@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/src/__tests__/RemoteBrowserActionResolver.goalRunLink.test.ts

@@ -0,0 +1,129 @@
+/**
+ * `ExecuteRemoteBrowserGoal` attaches a "Browser goal" step to the realtime co-agent run named by the
+ * session's `coAgentRunID`. The session owner can edit `Config`, so the run must be a record of the
+ * session before a step is attached to it.
+ */
+// type-graphql decorators on the resolver need the reflect-metadata polyfill loaded first.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// As in RemoteBrowserActionRecovery.test.ts: the decorators become no-ops so the resolver's plain logic runs.
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator,
+        Mutation: noopDecorator,
+        Query: noopDecorator,
+        Subscription: noopDecorator,
+        ObjectType: noopDecorator,
+        InputType: noopDecorator,
+        Field: noopDecorator,
+        Arg: noopDecorator,
+        Args: noopDecorator,
+        Ctx: noopDecorator,
+        PubSub: noopDecorator,
+        Root: noopDecorator,
+        Float: class {},
+        Int: class {},
+        ID: class {},
+    };
+});
+
+const achieveGoalMock = vi.fn(async (_sessionID: string, _goal: string, _options: Record<string, unknown>) => ({ Success: true, Status: 'Done' }));
+vi.mock('@memberjunction/remote-browser-server', () => ({
+    NormalizeInstanceKey: (key?: string) => key,
+    RemoteBrowserEngine: {
+        Instance: {
+            AchieveGoal: (sessionID: string, goal: string, options: Record<string, unknown>) => achieveGoalMock(sessionID, goal, options),
+        },
+    },
+}));
+
+const beginStepMock = vi.fn(async (_provider: unknown, _user: unknown, _coAgentRunID: string | undefined, _goal: string) => null);
+vi.mock('../agentSessions/remoteBrowserGoalEngine.js', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('../agentSessions/remoteBrowserGoalEngine.js')>()),
+    BeginBrowserGoalStep: (provider: unknown, user: unknown, coAgentRunID: string | undefined, goal: string) =>
+        beginStepMock(provider, user, coAgentRunID, goal),
+    FinalizeBrowserGoalStep: vi.fn(async () => undefined),
+}));
+
+vi.mock('@memberjunction/aiengine', () => ({ AIEngine: { Instance: { Config: vi.fn(), Prompts: [] } } }));
+vi.mock('@memberjunction/ai-prompts', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('@memberjunction/ai-prompts')>()),
+    AIPromptRunner: class {},
+}));
+vi.mock('@memberjunction/ai-core-plus', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('@memberjunction/ai-core-plus')>()),
+    AIPromptParams: class {},
+}));
+
+import { RemoteBrowserActionResolver } from '../resolvers/RemoteBrowserActionResolver.js';
+import type { AppContext } from '../types.js';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { MJAIAgentSessionEntity } from '@memberjunction/core-entities';
+
+const SESSION_ID = 'c3c3c3c3-2000-4000-8000-000000000001';
+const CO_RUN_ID = 'c3c3c3c3-2000-4000-8000-000000000002';
+/** A run that exists, but belongs to someone else's session. */
+const FOREIGN_RUN_ID = 'c3c3c3c3-2000-4000-8000-0000000000f1';
+
+/** The runs the fake lookup reports as records of the session. */
+let sessionRunIDs: string[] = [];
+const runViewsMock = vi.fn(async (paramsList: Array<{ EntityName?: string }>) =>
+    paramsList.map((params) => ({
+        Success: true,
+        Results: params.EntityName === 'MJ: AI Agent Runs' ? sessionRunIDs.map((ID) => ({ ID })) : [],
+    })),
+);
+
+/** Bypasses the ownership/provider plumbing (covered elsewhere); the session carries `ConfigJson`. */
+class TestableResolver extends RemoteBrowserActionResolver {
+    public ConfigJson = '';
+    protected override requireUserAndProvider(): { contextUser: UserInfo; provider: IMetadataProvider } {
+        return {
+            contextUser: { ID: 'c3c3c3c3-2000-4000-8000-0000000000aa' } as unknown as UserInfo,
+            provider: { RunViews: runViewsMock } as unknown as IMetadataProvider,
+        };
+    }
+    protected override async loadOwnedSession(): Promise<MJAIAgentSessionEntity> {
+        return { ID: SESSION_ID, AgentID: 'agent-1', Config_: this.ConfigJson } as unknown as MJAIAgentSessionEntity;
+    }
+    protected override async resolveProviderName(): Promise<string | undefined> {
+        return 'Self-Hosted Chrome';
+    }
+}
+
+const ctx = { userPayload: { sessionId: 'push-sess-1' }, providers: [] } as unknown as AppContext;
+
+async function startGoal(config: Record<string, unknown>): Promise<void> {
+    const resolver = new TestableResolver();
+    resolver.ConfigJson = JSON.stringify(config);
+    await resolver.ExecuteRemoteBrowserGoal(SESSION_ID, 'open the docs', ctx);
+}
+
+beforeEach(() => {
+    sessionRunIDs = [];
+    runViewsMock.mockClear();
+    beginStepMock.mockClear();
+    achieveGoalMock.mockClear();
+});
+
+describe('RemoteBrowserActionResolver.ExecuteRemoteBrowserGoal — co-agent run from Config', () => {
+    it('does not attach the goal to a run that is not a record of the session', async () => {
+        await startGoal({ targetAgentID: 'target-1', coAgentRunID: FOREIGN_RUN_ID });
+
+        expect(beginStepMock).toHaveBeenCalledTimes(1);
+        expect(beginStepMock.mock.calls[0][2]).toBeUndefined();
+        expect(achieveGoalMock.mock.calls[0][2].AgentRunID).toBeUndefined();
+    });
+
+    it('attaches the goal to the session\'s co-agent run', async () => {
+        sessionRunIDs = [CO_RUN_ID];
+
+        await startGoal({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID });
+
+        expect(beginStepMock.mock.calls[0][2]).toBe(CO_RUN_ID);
+        expect(achieveGoalMock.mock.calls[0][2].AgentRunID).toBe(CO_RUN_ID);
+    });
+});

package/src/__tests__/ResolverBase.adhocReadScope.test.ts

@@ -0,0 +1,96 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+/**
+ * The ad-hoc SQL screen (`assertFullQueryUsesReadableEntityViews`) admits a table reference
+ * only when it resolves to an entity base view the caller can read UNSCOPED. These tests pin
+ * the three ways that resolution was looser than it looked (PR #4782 review):
+ *
+ * - a schema-qualified reference fell back to a bare-name match in another schema;
+ * - an unqualified name present in two schemas resolved to whichever loaded last;
+ * - entity CanRead was treated as unscoped read authority, though raw SQL applies neither the
+ *   row-level filter nor the denied-field projection RunView does.
+ */
+
+type EntityShape = {
+    Name: string;
+    SchemaName: string;
+    BaseView: string;
+    canRead?: boolean;
+    rowFilter?: string;
+    deniedFields?: string[];
+};
+
+function fakeProvider(entities: EntityShape[]): IMetadataProvider {
+    return {
+        Entities: entities.map((e) => ({
+            Name: e.Name,
+            SchemaName: e.SchemaName,
+            BaseView: e.BaseView,
+            GetUserPermisions: () => ({ CanRead: e.canRead ?? true }),
+            GetEffectiveRowFilterWhereClause: () => e.rowFilter ?? '',
+            GetDeniedReadFields: () => new Set(e.deniedFields ?? []),
+        })),
+    } as unknown as IMetadataProvider;
+}
+
+const USER = { ID: 'U1', Email: 'u@example.com' } as unknown as UserInfo;
+
+class Probe extends ResolverBase {
+    public Screen(sql: string, provider: IMetadataProvider, user: UserInfo | undefined = USER) {
+        return this.assertFullQueryUsesReadableEntityViews(sql, provider, user, 'ad-hoc SQL');
+    }
+}
+
+const PUBLIC_FOO: EntityShape = { Name: 'Public Foo', SchemaName: 'public', BaseView: 'vwFoo' };
+
+describe('assertFullQueryUsesReadableEntityViews', () => {
+    it('admits an unscoped readable base view', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM [public].[vwFoo]', fakeProvider([PUBLIC_FOO]))).not.toThrow();
+    });
+
+    it('does not resolve a schema-qualified reference through another schema', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM secret.vwFoo', fakeProvider([PUBLIC_FOO]))).toThrow(
+            /entity base view, not 'secret.vwFoo'/,
+        );
+    });
+
+    it('refuses an unqualified view name that exists in more than one schema', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Other Foo', SchemaName: 'other', BaseView: 'vwFoo' }]);
+        expect(() => new Probe().Screen('SELECT ID FROM vwFoo', provider)).toThrow(/more than one schema/);
+        expect(() => new Probe().Screen('SELECT ID FROM other.vwFoo', provider)).not.toThrow();
+    });
+
+    it('refuses an entity the caller cannot read', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM public.vwFoo', fakeProvider([{ ...PUBLIC_FOO, canRead: false }]))).toThrow(
+            /read permission/,
+        );
+    });
+
+    it('refuses an entity that is row-level-security filtered for the caller', () => {
+        const provider = fakeProvider([{ ...PUBLIC_FOO, rowFilter: "(UserID = 'U1')" }]);
+        expect(() => new Probe().Screen('SELECT ID, UserID FROM public.vwFoo', provider)).toThrow(/row-level-security/);
+    });
+
+    it('refuses an entity with a field the caller is denied', () => {
+        const provider = fakeProvider([{ ...PUBLIC_FOO, deniedFields: ['secret'] }]);
+        expect(() => new Probe().Screen('SELECT ID FROM public.vwFoo', provider)).toThrow(/not permitted to read/);
+    });
+
+    it('applies the scope check to every reference, including joins and subqueries', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Bar', SchemaName: 'public', BaseView: 'vwBar', rowFilter: '(1=0)' }]);
+        expect(() =>
+            new Probe().Screen('SELECT f.ID FROM public.vwFoo f WHERE f.ID IN (SELECT FooID FROM public.vwBar)', provider),
+        ).toThrow(/'Bar' is row-level-security filtered/);
+    });
+
+    it('exempts CTE names the statement defines', () => {
+        expect(() =>
+            new Probe().Screen('WITH x AS (SELECT ID FROM public.vwFoo) SELECT ID FROM x', fakeProvider([PUBLIC_FOO])),
+        ).not.toThrow();
+    });
+});

package/src/__tests__/ResolverBase.aggregateScreen.test.ts

@@ -0,0 +1,174 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { AggregateExpression, DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { RunViewResolver, type RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * `Aggregates[].expression` is spliced into `SELECT <expression> AS [Agg_0] FROM <view> WHERE …`.
+ * The GraphQL-boundary screen must treat it like the other client SQL fragments (ExtraFilter,
+ * OrderBy, OverrideExcludeFilter): one statement, no writes, and subqueries only against entity
+ * base views the caller can read.
+ *
+ * The payloads below are harmless (`SELECT 1`).
+ */
+
+const ENTITY_NAME = 'MJ: Users';
+
+/** An aggregate that carries a second statement. */
+const STACKED_AGGREGATE = "COUNT(*) AS [a'] ; SELECT 1 AS [b'], COUNT(*)";
+
+/** A subquery against a base table rather than an entity base view. */
+const BASE_TABLE_AGGREGATE = 'COUNT(*) + (SELECT COUNT(*) FROM __mj.[User])';
+
+type Captured = { params: RunViewParams | null };
+
+/** Entity metadata the screen reads, plus a `RunView` that records what reached it. */
+function fakeProvider(captured: Captured): DatabaseProviderBase {
+    return {
+        Entities: [
+            {
+                ID: 'E1',
+                Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwUsers',
+                BaseTable: 'User',
+                Fields: [
+                    { Name: 'ID', NeedsQuotes: true },
+                    { Name: 'Name', NeedsQuotes: true },
+                    { Name: 'Sequence', NeedsQuotes: false },
+                ],
+                PrimaryKeys: [{ Name: 'ID' }],
+                GetUserPermisions: () => ({ CanRead: true }),
+            },
+        ],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? { ID: 'E1', Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] } : undefined),
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult;
+        },
+        RunViews: async (params: RunViewParams[]): Promise<RunViewResult[]> => {
+            captured.params = params[0] ?? null;
+            return params.map(() => ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult));
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the boundary screen and the dynamic-view entry point. */
+class Probe extends ResolverBase {
+    public ScreenAll(
+        clauses: { extraFilter?: string | null; aggregates?: AggregateExpression[] | null },
+        provider: DatabaseProviderBase,
+    ) {
+        return this.screenClientViewClauses(clauses, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('ResolverBase.screenClientViewClauses — aggregate expressions', () => {
+    it('rejects an aggregate that carries a second statement', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: STACKED_AGGREGATE }] }, fakeProvider({ params: null })),
+        ).toThrow(/Invalid Aggregate: multiple statements/);
+    });
+
+    it('rejects an aggregate whose subquery reads a base table', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: BASE_TABLE_AGGREGATE }] }, fakeProvider({ params: null })),
+        ).toThrow(/Invalid Aggregate: subquery must use an entity base view/);
+    });
+
+    it('screens every aggregate in the list, not only the first', () => {
+        expect(() =>
+            new Probe().ScreenAll(
+                { aggregates: [{ expression: 'COUNT(*)' }, { expression: STACKED_AGGREGATE }] },
+                fakeProvider({ params: null }),
+            ),
+        ).toThrow(/Invalid Aggregate: multiple statements/);
+    });
+
+    it('leaves an aggregate the parser cannot read to the provider, which refuses it per aggregate', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: 'COUNT_BIG(*)' }] }, fakeProvider({ params: null })),
+        ).not.toThrow();
+    });
+
+    it('lets ordinary aggregate expressions through', () => {
+        const ordinary = [
+            'COUNT(*)',
+            'SUM(Sequence)',
+            'AVG(Sequence * 2)',
+            'COUNT(DISTINCT Name)',
+            "COUNT(CASE WHEN Name = 'x' THEN 1 END)",
+            'MIN([Name])',
+        ];
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: ordinary.map((expression) => ({ expression })) }, fakeProvider({ params: null })),
+        ).not.toThrow();
+    });
+});
+
+describe('ResolverBase RunView entry points — aggregate expressions', () => {
+    it('RunDynamicViewGeneric never reaches RunView with a stacked aggregate', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, Aggregates: [{ expression: STACKED_AGGREGATE }] } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(/Invalid Aggregate: multiple statements/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes ordinary aggregates through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const aggregates = [{ expression: 'COUNT(*)', alias: 'Total' }, { expression: 'SUM(Sequence)' }];
+        const input = { EntityName: ENTITY_NAME, Aggregates: aggregates } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.Aggregates).toEqual(aggregates);
+    });
+
+    it('RunViews returns a failure result, and never reaches the provider, for a stacked aggregate', async () => {
+        const captured: Captured = { params: null };
+        const provider = fakeProvider(captured);
+        const input = [{ EntityName: ENTITY_NAME, Aggregates: [{ expression: STACKED_AGGREGATE }] }] as Parameters<RunViewResolver['RunViews']>[0];
+
+        const results = await new RunViewResolver().RunViews(
+            input,
+            { providers: [{ type: 'Read-Only', provider }] as unknown as AppContext['providers'], userPayload: fakePayload() } as AppContext,
+            undefined as unknown as PubSubEngine,
+        );
+
+        expect(results).toHaveLength(1);
+        expect(results[0].Success).toBe(false);
+        expect(results[0].ErrorMessage).toMatch(/Invalid Aggregate: multiple statements/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunViews does not fail the batch because one aggregate cannot be parsed', async () => {
+        const captured: Captured = { params: null };
+        const provider = fakeProvider(captured);
+        const input = [
+            { EntityName: ENTITY_NAME, Aggregates: [{ expression: 'COUNT_BIG(*)' }] },
+            { EntityName: ENTITY_NAME },
+        ] as Parameters<RunViewResolver['RunViews']>[0];
+
+        const results = await new RunViewResolver().RunViews(
+            input,
+            { providers: [{ type: 'Read-Only', provider }] as unknown as AppContext['providers'], userPayload: fakePayload() } as AppContext,
+            undefined as unknown as PubSubEngine,
+        );
+
+        expect(results.map((r) => r.Success)).toEqual([true, true]);
+        expect(captured.params?.Aggregates).toEqual([{ expression: 'COUNT_BIG(*)' }]);
+    });
+});

package/src/__tests__/ResolverBase.clientOldValues.test.ts

@@ -1,7 +1,7 @@
 // Reflect.metadata polyfill at import time.
 import 'reflect-metadata';
 import { describe, it, expect } from 'vitest';
-import { EntityFieldTSType, type EntityFieldInfo, type EntityInfo } from '@memberjunction/core';
+import { EntityFieldTSType, EntityInfo, UserInfo, type EntityFieldInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
 /**
@@ -13,8 +13,11 @@ class Probe extends ResolverBase {
     public Convert(field: Partial<EntityFieldInfo>, raw: unknown) {
         return this.ClientOldValueToFieldValue(field as EntityFieldInfo, raw);
     }
-    public MustLoad(entity: Partial<EntityInfo>, oldValues: boolean) {
-        return this.MustLoadTruthFromDatabase(entity as EntityInfo, { OldValues___: oldValues ? [{ Key: 'Comments', Value: null }] : undefined }, false, false);
+    public MustLoad(entity: Record<string, unknown>, oldValues: boolean) {
+        // A real entity with no permission rows and a user with no roles: no row filter applies.
+        // The Update RLS term itself is covered in resolverBase.fls.test.ts.
+        const user = new UserInfo(null, { ID: 'u-1', Name: 'Probe', Email: 'probe@example.test', IsActive: true, UserRoles: [] });
+        return this.MustLoadTruthFromDatabase(new EntityInfo({ Fields: [], ...entity }), { OldValues___: oldValues ? [{ Key: 'Comments', Value: null }] : undefined }, false, false, user);
     }
 }
 const probe = new Probe();

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -33,7 +33,13 @@ type Captured = { params: RunViewParams | null };
  * its params. `Sequence` stands in for a numeric field (`NeedsQuotes` is false only for
  * Number and Boolean TS types).
  */
-function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []): DatabaseProviderBase {
+function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = [], unreadableEntities: string[] = []): DatabaseProviderBase {
+    const withPerms = (e: Record<string, unknown>) => ({
+        ...e,
+        // Real EntityInfo aggregates per-user permissions; the boundary screen now consults
+        // CanRead for every subquery target, so the mock must answer it.
+        GetUserPermisions: () => ({ CanRead: !unreadableEntities.includes(e.Name as string) }),
+    });
     return {
         Entities: [
             {
@@ -67,7 +73,7 @@ function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []):
             { Name: 'Committees: Motions', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMotions', BaseTable: 'Motion', Fields: [] },
             { Name: 'Committees: Memberships', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwMemberships', BaseTable: 'Membership', Fields: [] },
             { Name: 'Committees: Terms', SchemaName: '__mj_BizAppsCommittees', BaseView: 'vwTerms', BaseTable: 'Term', Fields: [] },
-        ],
+        ].map(withPerms),
         RunView: async (params: RunViewParams): Promise<RunViewResult> => {
             captured.params = params;
             return { Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult;
@@ -246,6 +252,19 @@ describe('ResolverBase — GraphQL-boundary ExtraFilter AST screen', () => {
         expect(captured.params?.ExtraFilter).toBe(`ID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'a@b.com')`);
     });
 
+    it('RunDynamicViewGeneric rejects a subquery into an entity the caller cannot read', async () => {
+        const captured: Captured = { params: null };
+        const input = {
+            EntityName: ENTITY_NAME,
+            ExtraFilter: `ID IN (SELECT TaskID FROM [__mj_BizAppsTasks].[vwTaskAssignments])`,
+        } as RunDynamicViewInput;
+
+        await expect(
+            new Probe().RunDynamic(input, fakeProvider(captured, [], ['MJ_BizApps_Tasks: Task Assignments']))
+        ).rejects.toThrow(/read permission/);
+        expect(captured.params).toBeNull();
+    });
+
     it('RunDynamicViewGeneric passes a benign ExtraFilter through to RunView', async () => {
         const captured: Captured = { params: null };
         const input = {