@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/src/__tests__/BridgeHostInstance.test.ts

@@ -0,0 +1,232 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { hostname } from 'os';
+import type { IMetadataProvider, RunViewParams, UserInfo } from '@memberjunction/core';
+import type { IRealtimeSession, RealtimeInputFrame } from '@memberjunction/ai';
+import type { MJAIAgentSessionBridgeEntity, MJAIBridgeProviderEntity } from '@memberjunction/core-entities';
+import { AIBridgeEngine, LOOPBACK_BRIDGE_DRIVER_CLASS } from '@memberjunction/ai-bridge-server';
+import { BindBridgeEngineHostInstance, StartBridgeOrphanReconciliation } from '../agentSessions/BridgeHostInstance.js';
+import { GetBootID, GetCurrentHostInstance, HostInstanceIdentity, SetHostInstancePort } from '../agentSessions/HostInstance.js';
+
+/** The port this test process "serves" on, set the way `Serve` sets it, before anything reads the identity. */
+const OUR_PORT = 4000;
+/** The port of a second MJAPI on the same host. */
+const OTHER_PORT = 4100;
+SetHostInstancePort(OUR_PORT);
+
+const user = { ID: 'system-user', Email: 'system@example.com' } as unknown as UserInfo;
+
+/** A bridge row as the engine reads and writes it. */
+interface BridgeRow {
+    ID: string;
+    Status: MJAIAgentSessionBridgeEntity['Status'];
+    HostInstanceID: string | null;
+    AgentSessionID: string;
+    CloseReason?: MJAIAgentSessionBridgeEntity['CloseReason'];
+}
+
+/** A `LIKE` pattern as a regular expression: `%` any run of characters, `_` any one character. */
+function likePattern(pattern: string): RegExp {
+    const body = [...pattern]
+        .map((c) => (c === '%' ? '.*' : c === '_' ? '.' : c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('');
+    return new RegExp(`^${body}$`);
+}
+
+/**
+ * A provider over a bridge table, answering the engine the way the database would: the orphan reconcile's read
+ * returns the open rows whose `HostInstanceID` matches the filter's `LIKE` pattern and isn't the id it excludes, and a
+ * row the engine loads and saves is written back. `row(id)` reads a row's current state.
+ */
+function bridgeTable(rows: BridgeRow[]): {
+    provider: IMetadataProvider;
+    row: (id: string) => BridgeRow;
+    runView: ReturnType<typeof vi.fn>;
+} {
+    const table = new Map(rows.map((r) => [r.ID, { ...r }]));
+    const runView = vi.fn(async (params: RunViewParams) => {
+        if (params.EntityName !== 'MJ: AI Agent Session Bridges') {
+            return { Success: true, Results: [] };
+        }
+        const filter = typeof params.ExtraFilter === 'string' ? params.ExtraFilter : '';
+        const like = likePattern(/HostInstanceID LIKE '(.*?)'/.exec(filter)?.[1] ?? '');
+        const excluded = /HostInstanceID <> '(.*?)'/.exec(filter)?.[1];
+        const results = [...table.values()]
+            .filter((r) => r.Status === 'Connecting' || r.Status === 'Connected')
+            .filter((r) => r.HostInstanceID != null && like.test(r.HostInstanceID) && r.HostInstanceID !== excluded)
+            .map((r) => ({ ...r }));
+        return { Success: true, Results: results };
+    });
+    const provider = {
+        RunView: runView,
+        GetEntityObject: vi.fn(async () => {
+            const entity: BridgeRow & { LatestResult: { CompleteMessage: string }; Load: (id: string) => Promise<boolean>; Save: () => Promise<boolean> } = {
+                ID: '',
+                Status: 'Pending',
+                HostInstanceID: null,
+                AgentSessionID: '',
+                CloseReason: null,
+                LatestResult: { CompleteMessage: '' },
+                Load: async (id: string) => {
+                    const stored = table.get(id);
+                    if (!stored) {
+                        return false;
+                    }
+                    Object.assign(entity, stored);
+                    return true;
+                },
+                Save: async () => {
+                    const stored = table.get(entity.ID);
+                    if (stored) {
+                        stored.Status = entity.Status;
+                        stored.CloseReason = entity.CloseReason;
+                    }
+                    return true;
+                },
+            };
+            return entity;
+        }),
+    } as unknown as IMetadataProvider;
+    return { provider, row: (id: string) => table.get(id) as BridgeRow, runView };
+}
+
+/** A realtime model session that says nothing: a bridge only needs one to connect. */
+class SilentSession implements IRealtimeSession {
+    public SendInput(_frame: RealtimeInputFrame): void {}
+    public async RegisterTools(): Promise<void> {}
+    public OnOutput(): void {}
+    public OnTranscript(): void {}
+    public OnToolCall(): void {}
+    public async SendToolResult(): Promise<void> {}
+    public OnInterruption(): void {}
+    public OnError(): void {}
+    public OnUsage(): void {}
+    public async Close(): Promise<void> {}
+}
+
+/** The loopback bridge provider: a bridge with no platform behind it. */
+const loopbackProvider = {
+    ID: 'provider-loopback',
+    Name: 'Loopback',
+    DriverClass: LOOPBACK_BRIDGE_DRIVER_CLASS,
+    SupportedFeaturesObject: { AudioIn: true, AudioOut: true },
+} as unknown as MJAIBridgeProviderEntity;
+
+afterEach(() => {
+    AIBridgeEngine.Instance.StopOrphanReconciliation();
+    BindBridgeEngineHostInstance();
+});
+
+describe('BindBridgeEngineHostInstance', () => {
+    it("makes the engine stamp this MJAPI instance's identity (hostname:port:pid:bootId) on the bridges it creates", async () => {
+        BindBridgeEngineHostInstance();
+        const row = {
+            ID: 'bridge-new',
+            Status: 'Pending',
+            HostInstanceID: null as string | null,
+            NewRecord: vi.fn(),
+            Save: vi.fn(async () => true),
+            Load: vi.fn(async () => true),
+            LatestResult: { CompleteMessage: '' },
+        };
+        const provider = {
+            GetEntityObject: vi.fn(async () => row),
+            RunView: vi.fn(async () => ({ Success: true, Results: [] })),
+        } as unknown as IMetadataProvider;
+
+        const active = await AIBridgeEngine.Instance.StartBridgeSession({
+            AgentSessionID: 'session-1',
+            Provider: loopbackProvider,
+            RealtimeSession: new SilentSession(),
+            Address: 'loopback://room',
+            ContextUser: user,
+            MetadataProvider: provider,
+        });
+        try {
+            expect(row.HostInstanceID).toBe(GetCurrentHostInstance().GetHostInstanceID());
+            expect(row.HostInstanceID).toBe(`${hostname()}:${OUR_PORT}:${process.pid}:${GetBootID()}`);
+        } finally {
+            await AIBridgeEngine.Instance.StopBridgeSession(active.SessionBridgeID, 'Explicit', user, provider);
+        }
+    });
+});
+
+describe("the bridge engine's orphan reconcile with this MJAPI's identity (#5310)", () => {
+    const ours = GetCurrentHostInstance();
+    const theirs = new HostInstanceIdentity(ours.HostName, String(OTHER_PORT), 40404, 'boot-theirs');
+
+    /** Both MJAPIs' live bridges, and one each left by an earlier boot. */
+    function sharedTable(): BridgeRow[] {
+        return [
+            { ID: 'ours-live', Status: 'Connected', HostInstanceID: ours.GetHostInstanceID(), AgentSessionID: 'session-ours-live' },
+            { ID: 'ours-stale', Status: 'Connected', HostInstanceID: `${ours.GetInstancePrefix()}31337:boot-ours-before`, AgentSessionID: 'session-ours-stale' },
+            { ID: 'theirs-live', Status: 'Connected', HostInstanceID: theirs.GetHostInstanceID(), AgentSessionID: 'session-theirs-live' },
+            { ID: 'theirs-stale', Status: 'Connecting', HostInstanceID: `${theirs.GetInstancePrefix()}27182:boot-theirs-before`, AgentSessionID: 'session-theirs-stale' },
+        ];
+    }
+
+    it('closes the bridges an earlier boot of this instance left, and nothing else (one MJAPI, as before)', async () => {
+        BindBridgeEngineHostInstance();
+        const { provider, row } = bridgeTable([
+            { ID: 'before-restart', Status: 'Connected', HostInstanceID: `${ours.GetInstancePrefix()}31337:boot-before`, AgentSessionID: 'session-1' },
+            // The OS gave the restarted process the same pid; the boot id still differs.
+            { ID: 'before-restart-same-pid', Status: 'Connecting', HostInstanceID: `${ours.GetInstancePrefix()}${ours.ProcessID}:boot-before`, AgentSessionID: 'session-2' },
+            { ID: 'this-boot', Status: 'Connected', HostInstanceID: ours.GetHostInstanceID(), AgentSessionID: 'session-3' },
+            { ID: 'other-host', Status: 'Connected', HostInstanceID: `other-host:${OUR_PORT}:31337:boot-other`, AgentSessionID: 'session-4' },
+            // Stamped before MJServer gave the engine its identity; no instance owns it.
+            { ID: 'fallback-stamped', Status: 'Connected', HostInstanceID: `unknown-host:31337:boot-old`, AgentSessionID: 'session-5' },
+        ]);
+
+        const closed = await AIBridgeEngine.Instance.ReconcileOrphans(user, provider);
+
+        expect(closed).toBe(2);
+        expect(row('before-restart')).toMatchObject({ Status: 'Disconnected', CloseReason: 'Janitor' });
+        expect(row('before-restart-same-pid')).toMatchObject({ Status: 'Disconnected', CloseReason: 'Janitor' });
+        expect(row('this-boot').Status).toBe('Connected');
+        expect(row('other-host').Status).toBe('Connected');
+        expect(row('fallback-stamped').Status).toBe('Connected');
+    });
+
+    it("closes its own stale bridges and leaves the other MJAPI's live bridges open", async () => {
+        BindBridgeEngineHostInstance();
+        const { provider, row } = bridgeTable(sharedTable());
+
+        const closed = await AIBridgeEngine.Instance.ReconcileOrphans(user, provider);
+
+        expect(closed).toBe(1);
+        expect(row('ours-stale')).toMatchObject({ Status: 'Disconnected', CloseReason: 'Janitor' });
+        expect(row('ours-live').Status).toBe('Connected');
+        expect(row('theirs-live').Status).toBe('Connected');
+        expect(row('theirs-stale').Status).toBe('Connecting');
+    });
+
+    it("the other MJAPI's reconcile closes its stale bridges and leaves this one's live bridges open", async () => {
+        // What the other MJAPI's own BindBridgeEngineHostInstance gives its engine.
+        AIBridgeEngine.Instance.SetHostInstanceIdentity(theirs);
+        const { provider, row } = bridgeTable(sharedTable());
+
+        const closed = await AIBridgeEngine.Instance.ReconcileOrphans(user, provider);
+
+        expect(closed).toBe(1);
+        expect(row('theirs-stale')).toMatchObject({ Status: 'Disconnected', CloseReason: 'Janitor' });
+        expect(row('theirs-live').Status).toBe('Connected');
+        expect(row('ours-live').Status).toBe('Connected');
+        expect(row('ours-stale').Status).toBe('Connected');
+    });
+});
+
+describe('StartBridgeOrphanReconciliation', () => {
+    it("reconciles at once, with this instance's identity, as the given user", async () => {
+        BindBridgeEngineHostInstance();
+        const ours = GetCurrentHostInstance();
+        const { provider, row, runView } = bridgeTable([
+            { ID: 'ours-stale', Status: 'Connected', HostInstanceID: `${ours.GetInstancePrefix()}31337:boot-before`, AgentSessionID: 'session-1' },
+            { ID: 'theirs-live', Status: 'Connected', HostInstanceID: `${ours.HostName}:${OTHER_PORT}:40404:boot-theirs`, AgentSessionID: 'session-2' },
+        ]);
+
+        StartBridgeOrphanReconciliation(provider, user);
+
+        await vi.waitFor(() => expect(row('ours-stale').Status).toBe('Disconnected'));
+        expect(row('theirs-live').Status).toBe('Connected');
+        expect(runView.mock.calls[0][1]).toBe(user);
+    });
+});

package/src/__tests__/ClientToolRequestResolver.test.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ClientToolResponse } from '@memberjunction/ai-core-plus';
+
+/**
+ * RespondToClientToolRequest is the seam between a browser's tool answer and the waiting agent run:
+ * the resolver checks the media with the real ParseClientToolMedia and hands the answer to
+ * ClientToolRequestManager.ReceiveResponse, which this suite replaces to see what the run receives.
+ */
+const h = vi.hoisted(() => ({
+    receiveResponse: vi.fn((_response: ClientToolResponse): boolean => true),
+    logError: vi.fn(),
+}));
+
+// The resolver's GraphQL decorators read TypeScript type metadata that the test transform does not
+// emit, so they become no-ops; the suite calls the resolver method directly.
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    const decorators = [
+        'Resolver', 'Query', 'Mutation', 'Subscription', 'Arg', 'Args', 'ArgsType', 'Ctx', 'Root', 'Info', 'Field',
+        'FieldResolver', 'ObjectType', 'InputType', 'InterfaceType', 'Authorized', 'UseMiddleware', 'Extensions',
+        'Directive', 'PubSub',
+    ];
+    return {
+        ...Object.fromEntries(decorators.map((name) => [name, noopDecorator])),
+        Float: class {},
+        Int: class {},
+        ID: class {},
+        PubSubEngine: class {},
+        AuthorizationError: class AuthorizationError extends Error {},
+        registerEnumType: () => undefined,
+        createUnionType: () => class {},
+    };
+});
+
+// Replace the agent package so the resolver test does not load the @memberjunction/ai-agents graph.
+vi.mock('@memberjunction/ai-agents', () => ({
+    ClientToolRequestManager: { Instance: { ReceiveResponse: h.receiveResponse } },
+    CLIENT_TOOL_REQUEST_TOPIC: 'CLIENT_TOOL_REQUEST',
+}));
+
+// Keep the resolver's error log out of the test output, and observable.
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return { ...actual, LogError: h.logError, LogStatus: vi.fn() };
+});
+
+import { ClientToolRequestResolver } from '../resolvers/ClientToolRequestResolver.js';
+
+/** Base64 content of 3 bytes ("ABC"). */
+const SMALL_BASE64 = 'QUJD';
+/** Base64 content that decodes to 2,000,004 bytes, over the 2,000,000-byte limit. */
+const OVERSIZED_BASE64 = 'A'.repeat(2_666_672);
+
+/** Sends one answer through the mutation, as the browser does. */
+function respond(media: string | undefined, result: string | undefined = '{"ok":true}'): Promise<boolean> {
+    return new ClientToolRequestResolver().RespondToClientToolRequest('req-1', true, result, undefined, media);
+}
+
+/** The response the waiting run received. */
+function received(): ClientToolResponse {
+    expect(h.receiveResponse).toHaveBeenCalledTimes(1);
+    return h.receiveResponse.mock.calls[0][0];
+}
+
+beforeEach(() => {
+    h.receiveResponse.mockReset();
+    h.receiveResponse.mockReturnValue(true);
+    h.logError.mockReset();
+});
+
+describe('ClientToolRequestResolver.RespondToClientToolRequest', () => {
+    it('hands valid media to the waiting run with the result', async () => {
+        const media = JSON.stringify([{ MimeType: 'image/jpeg', Base64: SMALL_BASE64, Width: 1280, Height: 720 }]);
+
+        await expect(respond(media)).resolves.toBe(true);
+
+        expect(received()).toEqual({
+            RequestID: 'req-1',
+            Success: true,
+            Result: { ok: true },
+            ErrorMessage: undefined,
+            Media: [{ MimeType: 'image/jpeg', Base64: SMALL_BASE64, Width: 1280, Height: 720 }],
+        });
+    });
+
+    it('hands no Media to the run when the answer carries none', async () => {
+        await respond(undefined);
+
+        expect(received()).toEqual({ RequestID: 'req-1', Success: true, Result: { ok: true }, ErrorMessage: undefined, Media: undefined });
+    });
+
+    it.each([
+        ['a MIME type that is not allowed', JSON.stringify([{ MimeType: 'image/gif', Base64: SMALL_BASE64 }]), 'media MIME type "image/gif" is not allowed'],
+        ['an item over the size limit', JSON.stringify([{ MimeType: 'image/png', Base64: OVERSIZED_BASE64 }]), 'media item is 2000004 bytes; the limit is 2000000'],
+        [
+            'more than 4 items',
+            JSON.stringify(Array.from({ length: 5 }, () => ({ MimeType: 'image/jpeg', Base64: SMALL_BASE64 }))),
+            'media holds 5 items; the limit is 4',
+        ],
+    ])('gives the run a failed result for %s, without the result or the media', async (_case, media, reason) => {
+        await respond(media);
+
+        expect(received()).toEqual({ RequestID: 'req-1', Success: false, ErrorMessage: `Client tool media rejected: ${reason}` });
+    });
+
+    it('gives the run a failed result and returns false when the result is not valid JSON', async () => {
+        await expect(respond(undefined, '{not json')).resolves.toBe(false);
+
+        expect(received()).toEqual({
+            RequestID: 'req-1',
+            Success: false,
+            ErrorMessage: expect.stringMatching(/^Client tool response rejected: /),
+        });
+        expect(h.logError).toHaveBeenCalledWith(expect.stringContaining('RespondToClientToolRequest error:'));
+    });
+});

package/src/__tests__/EntityRecordNameResolver.fieldSecurity.test.ts

@@ -7,43 +7,22 @@ import type { DatabaseProviderBase, EntityInfo, UserInfo } from '@memberjunction
 import { EntityRecordNameResolver } from '../resolvers/EntityRecordNameResolver.js';
 
 /**
- * `GetEntityRecordName` must not hand back a name the caller cannot READ.
- *
- * This resolver predates field-level security and took no user context at all, which made it an
- * open side channel: the name never travelled through `MapFieldNamesToCodeNames`, the boundary
- * that strips denied fields, so a caller denied READ on an entity's name field could still obtain
- * that name from here.
- *
- * FLS turned the latent gap into a live bypass, and the shape of it is worth remembering: the
- * form-field FK control falls through to this query PRECISELY WHEN the joined display column is
- * denied. The fallback that exists to handle a denial was the thing that defeated it. Found in
- * manual Phase 5 testing — a Contract form showed its Client's name while the grid, correctly,
- * did not.
+ * `GetEntityRecordName` hands the acting user to the provider, which applies field- and row-level
+ * security for them, and reports a withheld name exactly as it reports a missing record. The
+ * field-level rule itself is covered by MJCore's DatabaseProviderBase record-name tests.
  */
 
-const DENIED_USER = { ID: 'u-1', Email: 'restricted@test' } as unknown as UserInfo;
+const ACTING_USER = { ID: 'u-1', Email: 'restricted@test' } as unknown as UserInfo;
 
-/** An entity whose name field is denied or allowed, per the flag. */
-function entityInfo(opts: { fls: boolean; deniedNames?: string[]; nameField?: string }): EntityInfo {
-    const nameFieldName = opts.nameField ?? 'Name';
-    return {
-        Name: 'Clients',
-        EnableFieldLevelSecurity: opts.fls,
-        Fields: [
-            { Name: 'ID', IsNameField: false },
-            { Name: nameFieldName, IsNameField: true },
-            { Name: 'Industry', IsNameField: false },
-        ],
-        GetDeniedReadFields: () => new Set(opts.deniedNames ?? []),
-    } as unknown as EntityInfo;
-}
+const ENTITY = { Name: 'Clients' } as unknown as EntityInfo;
 
-/** A provider that would happily return the name — the resolver must decide not to ask. */
-function providerWith(entity: EntityInfo, getName = vi.fn().mockResolvedValue('Acme Manufacturing')) {
+/** A provider whose lookup answers with `name` ('' when it withholds or finds nothing). */
+function providerAnswering(name: string) {
+    const getName = vi.fn().mockResolvedValue(name);
     return {
-        Entities: [entity],
-        GetEntityRecordName: getName,
-    } as unknown as DatabaseProviderBase & { GetEntityRecordName: typeof getName };
+        md: { Entities: [ENTITY], GetEntityRecordName: getName } as unknown as DatabaseProviderBase,
+        getName,
+    };
 }
 
 /** Exposes the inner method so the test does not need a GraphQL context. */
@@ -57,62 +36,38 @@ class Probe extends EntityRecordNameResolver {
 
 const KEY = new CompositeKey([{ FieldName: 'ID', Value: 'c-1' }]);
 
-describe('GetEntityRecordName — field-security gate', () => {
-    it('withholds the name when the name field is read-denied', async () => {
-        const getName = vi.fn().mockResolvedValue('Acme Manufacturing');
-        const md = providerWith(entityInfo({ fls: true, deniedNames: ['name'] }), getName);
+describe('GetEntityRecordName — security is applied for the acting user', () => {
+    it('passes the acting user to the provider lookup', async () => {
+        const { md, getName } = providerAnswering('Acme Manufacturing');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
-        expect(result.Success).toBe(false);
-        expect(result.RecordName).toBeUndefined();
-        // Not merely filtered after the fact — the lookup must not run at all. The provider's
-        // record-name cache is keyed by entity + primary key and NOT by user, so a name fetched
-        // here would be visible to any later caller.
-        expect(getName).not.toHaveBeenCalled();
+        expect(getName).toHaveBeenCalledWith('Clients', expect.anything(), ACTING_USER);
     });
 
-    it('returns the name when the user may read the name field', async () => {
-        const md = providerWith(entityInfo({ fls: true, deniedNames: ['industry'] }));
+    it('returns the name the provider allows', async () => {
+        const { md } = providerAnswering('Acme Manufacturing');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
         expect(result.Success).toBe(true);
         expect(result.RecordName).toBe('Acme Manufacturing');
     });
 
-    it('is inert when the entity has field security switched off', async () => {
-        // Nearly every entity. A denial set that would otherwise match must not apply.
-        const md = providerWith(entityInfo({ fls: false, deniedNames: ['name'] }));
+    it('reports a withheld name as unsuccessful, with no name', async () => {
+        const { md } = providerAnswering('');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
-
-        expect(result.Success).toBe(true);
-        expect(result.RecordName).toBe('Acme Manufacturing');
-    });
-
-    it('honours a designated name field that is not literally called "Name"', async () => {
-        const md = providerWith(entityInfo({ fls: true, nameField: 'Title', deniedNames: ['title'] }));
-
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
         expect(result.Success).toBe(false);
+        expect(result.RecordName).toBeUndefined();
     });
 
-    it('passes the acting user to the provider so row-level security has an identity', async () => {
-        const getName = vi.fn().mockResolvedValue('Acme Manufacturing');
-        const md = providerWith(entityInfo({ fls: true }), getName);
-
-        await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+    it('does not disclose which of "missing" or "restricted" applies', async () => {
+        const { md } = providerAnswering('');
 
-        expect(getName).toHaveBeenCalledWith('Clients', expect.anything(), DENIED_USER);
-    });
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
-    it('does not disclose which of "missing" or "restricted" applies', async () => {
-        // The denial status must read the same as a genuine not-found, so the query cannot be
-        // used to probe for which entities carry restricted name fields.
-        const denied = await new Probe().Inner(
-            providerWith(entityInfo({ fls: true, deniedNames: ['name'] })), 'Clients', KEY, DENIED_USER);
-        expect(denied.Status).not.toMatch(/denied|permission|restricted|field.security/i);
+        expect(result.Status).not.toMatch(/denied|permission|restricted|field.security|RLS/i);
     });
 });