@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/src/__tests__/actionAuthorization.test.ts

@@ -0,0 +1,130 @@
+/**
+ * The policy that decides who may run an action through a public entry point. It reads the
+ * `MJ: Action Authorizations` rows for the action, the caller's roles, one provider's authorizations
+ * and role grants, and whether the action's class authorizes its caller itself. It fails closed: an
+ * action that no authorization grants, and whose class does not authorize its caller, runs for
+ * Owners only.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { AuthorizationInfo, AuthorizationRoleInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { EvaluateActionRunAuthorization, IsOwner, type AuthorizationMetadata } from '../auth/actionAuthorization.js';
+
+const ANALYST_ROLE = 'A11C0000-0000-4000-8000-0000000000F1';
+const AUDITOR_ROLE = 'A11C0000-0000-4000-8000-0000000000F2';
+const BLOCKED_ROLE = 'A11C0000-0000-4000-8000-0000000000F3';
+
+const DATA_TOOLS = new AuthorizationInfo({ ID: 'auth-data-tools', Name: 'Data Tools', IsActive: true });
+const RUN_QUERIES = new AuthorizationInfo({ ID: 'auth-run-queries', Name: 'Run Queries', IsActive: true, ParentID: DATA_TOOLS.ID });
+const RETIRED_TOOL = new AuthorizationInfo({ ID: 'auth-retired-tool', Name: 'Retired Tool', IsActive: false, ParentID: DATA_TOOLS.ID });
+const SWITCHED_OFF = new AuthorizationInfo({ ID: 'auth-switched-off', Name: 'Switched Off', IsActive: false });
+const AUTHORIZATIONS = [DATA_TOOLS, RUN_QUERIES, RETIRED_TOOL, SWITCHED_OFF];
+const AUTHORIZATION_ROLES = [
+    new AuthorizationRoleInfo({ ID: 'ar-1', AuthorizationID: RUN_QUERIES.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-2', AuthorizationID: DATA_TOOLS.ID, RoleID: AUDITOR_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-3', AuthorizationID: RUN_QUERIES.ID, RoleID: BLOCKED_ROLE, Type: 'Deny' }),
+    new AuthorizationRoleInfo({ ID: 'ar-4', AuthorizationID: SWITCHED_OFF.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+];
+/** The provider metadata the decision reads. */
+const METADATA: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: AUTHORIZATION_ROLES };
+
+const user = (type: string, roleIDs: string[]): UserInfo =>
+    new UserInfo(null, { ID: `user-${type}-${roleIDs.join('-')}`, Type: type, UserRoles: roleIDs.map((RoleID) => new UserRoleInfo({ RoleID })) });
+
+/** Decides for an action whose class does not authorize its caller. */
+const decide = (caller: UserInfo, linkedAuthorizationIDs: string[]) =>
+    EvaluateActionRunAuthorization(caller, linkedAuthorizationIDs, METADATA, false);
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    // The decision reads only the metadata it is given, so any read of the global provider fails the test.
+    vi.spyOn(Metadata, 'Provider', 'get').mockImplementation(() => {
+        throw new Error('The decision read the global metadata provider');
+    });
+});
+
+describe('IsOwner', () => {
+    it('recognises the Owner type, padded as the nchar column stores it', () => {
+        expect(IsOwner(user('Owner     ', []))).toBe(true);
+        expect(IsOwner(user('User', [ANALYST_ROLE]))).toBe(false);
+    });
+});
+
+describe('EvaluateActionRunAuthorization', () => {
+    describe('Owners', () => {
+        it('lets an Owner run any action, linked or not', () => {
+            expect(decide(user('Owner     ', []), []).Allowed).toBe(true);
+            expect(decide(user('Owner     ', []), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with no Action Authorization rows', () => {
+        it('is refused to any other user when its class does not authorize its caller', () => {
+            const decision = decide(user('User', [ANALYST_ROLE]), []);
+
+            expect(decision.Allowed).toBe(false);
+            expect(decision.Reason).toMatch(/no action authorization/i);
+        });
+
+        it('runs for any user when its class authorizes its caller, so the action\'s own check decides', () => {
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [], METADATA, true).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with Action Authorization rows', () => {
+        it('is decided by its links, even when its class authorizes its caller', () => {
+            expect(EvaluateActionRunAuthorization(user('User', ['some-other-role']), [RUN_QUERIES.ID], METADATA, true).Allowed).toBe(false);
+        });
+
+        it('runs for a user whose role holds a linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('runs for a user whose role holds an ancestor of a linked authorization', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('is refused to a user whose roles hold none of the linked authorizations', () => {
+            expect(decide(user('User', ['some-other-role']), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [SWITCHED_OFF.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive, even to a holder of its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RETIRED_TOOL.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when one of the user\'s roles is denied the linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when a role is denied the linked authorization, even if another role holds its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('ignores a linked authorization that no longer exists in metadata', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), ['auth-deleted']).Allowed).toBe(false);
+        });
+
+        it('matches authorization IDs regardless of case', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID.toUpperCase()]).Allowed).toBe(true);
+        });
+    });
+
+    describe('the metadata it reads', () => {
+        it('decides from the role grants it is given, never from the global provider', () => {
+            const sameTreeWithoutGrants: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: [] };
+
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID], sameTreeWithoutGrants, false).Allowed).toBe(false);
+        });
+
+        it('walks to the parent within the authorizations it is given', () => {
+            const treeWithoutParent: AuthorizationMetadata = { Authorizations: [RUN_QUERIES], AuthorizationRoles: AUTHORIZATION_ROLES };
+
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID], treeWithoutParent, false).Allowed).toBe(false);
+        });
+    });
+});

package/src/__tests__/adhocTimeoutClamp.test.ts

@@ -0,0 +1,26 @@
+/**
+ * An ad-hoc query's timeout never exceeds the server's requestTimeout, so a caller cannot hold a
+ * read-only connection longer than any other request may.
+ */
+import { describe, it, expect } from 'vitest';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout';
+
+describe('ClampAdhocTimeoutSeconds', () => {
+    it('caps a longer request at requestTimeout', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 30000)).toBe(30);
+    });
+
+    it('keeps a shorter request', () => {
+        expect(ClampAdhocTimeoutSeconds(5, 30000)).toBe(5);
+    });
+
+    it('uses 30 seconds when the caller names none, within the cap', () => {
+        expect(ClampAdhocTimeoutSeconds(undefined, 30000)).toBe(30);
+        expect(ClampAdhocTimeoutSeconds(undefined, 10000)).toBe(10);
+        expect(ClampAdhocTimeoutSeconds(0, 30000)).toBe(30);
+    });
+
+    it('leaves the request alone when the server sets no limit', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 0)).toBe(600);
+    });
+});

package/src/__tests__/agentVisionConsentAudit.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+
+const h = vi.hoisted(() => ({
+  systemUser: { ID: 'SYS', Name: 'System' } as { ID: string; Name: string } | undefined,
+  logError: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return { ...actual, LogError: h.logError };
+});
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { GetSystemUser: () => h.systemUser } },
+}));
+
+import { WriteAgentVisionConsentAudit, REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE } from '../resolvers/agentVisionConsentAudit';
+
+/** A fake `MJ: Audit Logs` row that records what is set on it. */
+class FakeAuditRow {
+  public UserID = '';
+  public AuditLogTypeID = '';
+  public Status = '';
+  public EntityID: string | null = null;
+  public RecordID: string | null = null;
+  public Description: string | null = null;
+  public Details: string | null = null;
+  public IsNew = false;
+  constructor(private readonly saveResult: boolean) {}
+  NewRecord() {
+    this.IsNew = true;
+  }
+  async Save() {
+    return this.saveResult;
+  }
+  get LatestResult() {
+    return { CompleteMessage: 'save failed' };
+  }
+}
+
+const user = { ID: 'U1', Name: 'Test User' } as unknown as UserInfo;
+
+/** A provider with the consent audit type seeded (unless told otherwise), handing out one fake row. */
+function fakeProvider(o: { seeded?: boolean; saveResult?: boolean; getThrows?: boolean } = {}) {
+  const row = new FakeAuditRow(o.saveResult ?? true);
+  const getEntityObject = vi.fn(async () => {
+    if (o.getThrows) {
+      throw new Error('database unavailable');
+    }
+    return row;
+  });
+  const provider = {
+    AuditLogTypes: o.seeded === false ? [] : [{ ID: 'TYPE-1', Name: REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE }],
+    EntityByName: (name: string) => (name === 'MJ: Users' ? { ID: 'USERS-ENTITY' } : undefined),
+    GetEntityObject: getEntityObject,
+  } as unknown as IMetadataProvider;
+  return { provider, row, getEntityObject };
+}
+
+describe('WriteAgentVisionConsentAudit', () => {
+  beforeEach(() => {
+    h.logError.mockClear();
+    h.systemUser = { ID: 'SYS', Name: 'System' };
+  });
+
+  it('records an applied choice, saved by the system user, about the person', async () => {
+    const { provider, row, getEntityObject } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    expect(getEntityObject).toHaveBeenCalledWith('MJ: Audit Logs', h.systemUser);
+    expect(row).toMatchObject({
+      IsNew: true,
+      UserID: 'U1',
+      AuditLogTypeID: 'TYPE-1',
+      Status: 'Success',
+      EntityID: 'USERS-ENTITY',
+      RecordID: 'U1',
+      Description: 'Let agents see their camera and shared screen in room room-1.',
+    });
+    expect(JSON.parse(row.Details ?? '')).toEqual({ roomName: 'room-1', allow: true, error: null });
+    expect(h.logError).not.toHaveBeenCalled();
+  });
+
+  it('records a refused change as Failed, with the reason', async () => {
+    const { provider, row } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: false, Applied: false, ErrorMessage: 'not in the room' }, provider);
+    expect(row.Status).toBe('Failed');
+    expect(row.Description).toBe('Stopped letting agents see their camera and shared screen in room room-1 (not applied).');
+    expect(JSON.parse(row.Details ?? '')).toEqual({ roomName: 'room-1', allow: false, error: 'not in the room' });
+  });
+
+  it('logs the choice instead when the audit log type is not seeded', async () => {
+    const { provider, getEntityObject } = fakeProvider({ seeded: false });
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    expect(getEntityObject).not.toHaveBeenCalled();
+    expect(h.logError).toHaveBeenCalledWith(expect.stringMatching(/is not seeded.*user U1: Let agents see their camera and shared screen in room room-1\./));
+  });
+
+  it('logs the choice instead when there is no system user or no provider', async () => {
+    h.systemUser = undefined;
+    const { provider, getEntityObject } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, null);
+    expect(getEntityObject).not.toHaveBeenCalled();
+    expect(h.logError.mock.calls.map((c) => String(c[0]).match(/\((.*?)\)/)?.[1])).toEqual(['no system user', 'no provider']);
+  });
+
+  it('logs a row that does not save, and never throws when the write fails', async () => {
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, fakeProvider({ saveResult: false }).provider);
+    await expect(
+      WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, fakeProvider({ getThrows: true }).provider),
+    ).resolves.toBeUndefined();
+    expect(h.logError.mock.calls.map((c) => String(c[0]))).toEqual([
+      'Agent vision consent audit row not saved for user U1: save failed',
+      'Agent vision consent audit write threw for user U1: database unavailable',
+    ]);
+  });
+});

package/src/__tests__/avatarInputValidation.test.ts

@@ -0,0 +1,160 @@
+import { describe, it, expect } from 'vitest';
+import {
+  ValidateAvatarInput,
+  AVATAR_MAX_IMAGE_BYTES,
+  AVATAR_MAX_URL_LENGTH,
+  AVATAR_MAX_ICON_CLASS_LENGTH,
+} from '../resolvers/avatarInputValidation.js';
+
+/** A valid base64 data URI whose payload decodes to exactly `bytes` bytes. */
+function dataUri(bytes: number, type = 'png'): string {
+  return `data:image/${type};base64,${Buffer.alloc(bytes, 7).toString('base64')}`;
+}
+
+function expectRefused(imageURL: string | null, iconClass: string | null = null): string {
+  const result = ValidateAvatarInput(imageURL, iconClass);
+  expect(result.Valid).toBe(false);
+  expect(result.ErrorMessage).toBeTruthy();
+  return result.ErrorMessage!;
+}
+
+describe('ValidateAvatarInput', () => {
+  describe('clearing', () => {
+    it('accepts both null as a revert to default', () => {
+      expect(ValidateAvatarInput(null, null)).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+    });
+
+    it('treats undefined and empty strings as clear', () => {
+      expect(ValidateAvatarInput(undefined, undefined)).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+      expect(ValidateAvatarInput('', '')).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+    });
+  });
+
+  describe('data URIs', () => {
+    it.each(['png', 'jpeg', 'jpg', 'gif', 'webp'])('accepts image/%s', (type) => {
+      const uri = dataUri(10, type);
+      expect(ValidateAvatarInput(uri, null)).toEqual({ Valid: true, ImageURL: uri, IconClass: null });
+    });
+
+    it('accepts every padding variant', () => {
+      for (const bytes of [3, 4, 5]) {
+        expect(ValidateAvatarInput(dataUri(bytes), null).Valid).toBe(true);
+      }
+    });
+
+    it('accepts a decoded payload of exactly the cap', () => {
+      expect(ValidateAvatarInput(dataUri(AVATAR_MAX_IMAGE_BYTES), null).Valid).toBe(true);
+    });
+
+    it('refuses a decoded payload one byte over the cap', () => {
+      expect(expectRefused(dataUri(AVATAR_MAX_IMAGE_BYTES + 1))).toContain('200KB');
+    });
+
+    it('refuses an oversized data URI on length alone, even one the pattern would reject anyway', () => {
+      const huge = `data:image/png;base64,${'A'.repeat(2 * 1024 * 1024)}!`;
+      expect(expectRefused(huge)).toContain('200KB');
+    });
+
+    it('accepts the longest prefix with a payload of exactly the cap', () => {
+      expect(ValidateAvatarInput(dataUri(AVATAR_MAX_IMAGE_BYTES, 'jpeg'), null).Valid).toBe(true);
+    });
+
+    it('refuses SVG, which can carry script', () => {
+      expectRefused(`data:image/svg+xml;base64,${Buffer.from('<svg onload="alert(1)"/>').toString('base64')}`);
+    });
+
+    it.each([
+      'data:text/html;base64,PHNjcmlwdD4=',
+      'data:application/octet-stream;base64,AAAA',
+      'data:image/png,rawdata',
+      'data:image/png;base64,',
+      'data:image/png;base64,AAA',
+      'data:image/png;base64,AA=A',
+      'data:image/png;base64,AA AA',
+      'data:image/png;base64,AA*A',
+      'data:image/PNG;base64,AAAA',
+      `${dataUri(10)}\n`,
+    ])('refuses %j', (value) => {
+      expectRefused(value);
+    });
+  });
+
+  describe('http(s) URLs', () => {
+    it.each(['https://example.com/me.png', 'http://example.com/a/b?c=d#e', 'HTTPS://EXAMPLE.COM/x.png'])('accepts %s', (url) => {
+      expect(ValidateAvatarInput(url, null)).toEqual({ Valid: true, ImageURL: url, IconClass: null });
+    });
+
+    it('accepts a URL of exactly the length cap', () => {
+      const base = 'https://example.com/';
+      const url = base + 'a'.repeat(AVATAR_MAX_URL_LENGTH - base.length);
+      expect(url).toHaveLength(AVATAR_MAX_URL_LENGTH);
+      expect(ValidateAvatarInput(url, null).Valid).toBe(true);
+    });
+
+    it('refuses a URL one character over the length cap', () => {
+      const base = 'https://example.com/';
+      expectRefused(base + 'a'.repeat(AVATAR_MAX_URL_LENGTH - base.length + 1));
+    });
+
+    it.each([
+      'javascript:alert(1)',
+      'JavaScript:alert(document.cookie)',
+      'vbscript:msgbox(1)',
+      'file:///etc/passwd',
+      'ftp://example.com/me.png',
+      'blob:https://example.com/abc',
+      '//example.com/me.png',
+      '/assets/user.png',
+      'me.png',
+      'https://exa mple.com/me.png',
+      ' https://example.com/me.png',
+      'https://example.com/me.png\t',
+      'https://',
+      'http:example.com',
+    ])('refuses %j', (value) => {
+      expectRefused(value);
+    });
+  });
+
+  describe('icon classes', () => {
+    it.each(['fa-solid fa-user', 'fa-regular fa-circle-user', 'fa-user', 'fa-solid fa-user-astronaut fa-2x'])('accepts %j', (icon) => {
+      expect(ValidateAvatarInput(null, icon)).toEqual({ Valid: true, ImageURL: null, IconClass: icon });
+    });
+
+    it('accepts an icon class of exactly the length cap', () => {
+      const icon = 'fa-' + 'a'.repeat(AVATAR_MAX_ICON_CLASS_LENGTH - 3);
+      expect(ValidateAvatarInput(null, icon).Valid).toBe(true);
+    });
+
+    it('refuses an icon class one character over the length cap', () => {
+      expectRefused(null, 'fa-' + 'a'.repeat(AVATAR_MAX_ICON_CLASS_LENGTH - 2));
+    });
+
+    it.each([
+      'solid user',
+      'fa-',
+      'fa-solid fa-User',
+      'FA-SOLID FA-USER',
+      'fa-solid fa-user" onmouseover="alert(1)',
+      'fa-solid fa-user<script>',
+      'fa-solid;fa-user',
+      'fa_solid fa_user',
+      'fa-solid\tfa-user',
+      'fa-solid\nfa-user',
+    ])('refuses %j', (icon) => {
+      expectRefused(null, icon);
+    });
+  });
+
+  describe('both values', () => {
+    it('accepts a valid image and a valid icon together', () => {
+      const uri = dataUri(10);
+      expect(ValidateAvatarInput(uri, 'fa-solid fa-user')).toEqual({ Valid: true, ImageURL: uri, IconClass: 'fa-solid fa-user' });
+    });
+
+    it('refuses the whole request when either value is bad, and returns no values to store', () => {
+      expect(ValidateAvatarInput('javascript:alert(1)', 'fa-solid fa-user')).toMatchObject({ Valid: false, ImageURL: null, IconClass: null });
+      expect(ValidateAvatarInput(dataUri(10), 'bad icon')).toMatchObject({ Valid: false, ImageURL: null, IconClass: null });
+    });
+  });
+});

package/src/__tests__/isolatedProviderTransactions.test.ts

@@ -0,0 +1,169 @@
+/**
+ * Transactions opened outside a GraphQL request run on their OWN provider, never the shared
+ * `Metadata.Provider`.
+ *
+ * A provider's ambient transaction is per INSTANCE, and the global provider is shared by every
+ * request, scheduled job and background service. A transaction opened there nests into any other
+ * caller's, and while it is open every global-provider write from anywhere lands inside it. One left
+ * open swallows them all until the process restarts (MJ#2140). These tests pin the two call sites
+ * that used to open their transaction on the global provider: magic-link provisioning and
+ * SyncData's delete-with-filter. New-user creation is pinned in newUsers.test.ts.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+const factory = vi.hoisted(() => ({ create: vi.fn() }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: factory.create }));
+
+import { Metadata, RunView, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { SyncDataResolver, type ActionItemOutputType } from '../resolvers/SyncDataResolver.js';
+
+/** A provider that records every call made on it. */
+function recordingProvider(calls: string[], saveSucceeds = true) {
+  return {
+    BeginTransaction: vi.fn(async () => { calls.push('BeginTransaction'); }),
+    CommitTransaction: vi.fn(async () => { calls.push('CommitTransaction'); }),
+    RollbackTransaction: vi.fn(async () => { calls.push('RollbackTransaction'); }),
+    GetEntityObject: vi.fn(async (entityName: string) => {
+      calls.push(`GetEntityObject:${entityName}`);
+      const entity: Record<string, unknown> = {
+        NewRecord: () => { entity.ID = `id-${entityName}`; },
+        Save: async () => saveSucceeds,
+        GetAll: () => ({ ID: entity.ID }),
+        LatestResult: { CompleteMessage: 'save failed' },
+      };
+      return entity;
+    }),
+  };
+}
+
+let globalCalls: string[];
+let isolatedCalls: string[];
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => undefined);
+  vi.spyOn(console, 'error').mockImplementation(() => undefined);
+  globalCalls = [];
+  isolatedCalls = [];
+  Metadata.Provider = recordingProvider(globalCalls) as unknown as IMetadataProvider;
+});
+
+afterEach(() => {
+  Metadata.Provider = null as unknown as IMetadataProvider;
+  vi.restoreAllMocks();
+  factory.create.mockReset();
+});
+
+describe('MagicLinkService.createScopedUser', () => {
+  const invite = { Email: 'guest@example.com', RoleID: 'role-1', ApplicationID: 'app-1' } as unknown as MJMagicLinkInviteEntity;
+  const role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const provision = () =>
+    new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig)['createScopedUser'](invite, role, contextUser);
+
+  it('provisions inside a transaction on its own provider', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+
+    expect((await provision()).success).toBe(true);
+    expect(isolatedCalls).toEqual([
+      'BeginTransaction',
+      'GetEntityObject:MJ: Users',
+      'GetEntityObject:MJ: User Roles',
+      'GetEntityObject:MJ: User Applications',
+      'CommitTransaction',
+    ]);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on its own provider when a save fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls, false));
+
+    expect((await provision()).success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'GetEntityObject:MJ: Users', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});
+
+describe('SyncDataResolver.SyncSingleItemDeleteWithFilter', () => {
+  const user = { ID: 'system' } as UserInfo;
+
+  /** Rows the filtered view returns; each records its Delete on the shared call log. */
+  function stubView(rows: number, deleteSucceeds = true) {
+    const fromProvider = vi.spyOn(RunView, 'FromMetadataProvider').mockImplementation(
+      () =>
+        ({
+          RunView: async () => ({
+            Success: true,
+            Results: Array.from({ length: rows }, (_, i) => ({
+              Delete: async () => { isolatedCalls.push(`Delete:${i}`); return deleteSucceeds; },
+              LatestResult: { CompleteMessage: 'delete failed' },
+            })),
+          }),
+        }) as unknown as RunView,
+    );
+    return fromProvider;
+  }
+
+  const deleteWithFilter = (providerOverride?: IMetadataProvider) => {
+    const result = { Success: false } as ActionItemOutputType;
+    const resolver = new SyncDataResolver() as unknown as {
+      SyncSingleItemDeleteWithFilter: (...args: unknown[]) => Promise<void>;
+    };
+    return resolver
+      .SyncSingleItemDeleteWithFilter('MJ: Things', "Name = 'x'", result, user, {}, providerOverride)
+      .then(() => result);
+  };
+
+  it('with no request provider, loads AND deletes on its own provider inside one transaction', async () => {
+    const isolated = recordingProvider(isolatedCalls);
+    factory.create.mockResolvedValue(isolated);
+    const fromProvider = stubView(2);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(true);
+    expect(fromProvider).toHaveBeenCalledWith(isolated);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'Delete:1', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('with a request provider, uses it for both the read and the transaction', async () => {
+    const requestProvider = recordingProvider(isolatedCalls);
+    const fromProvider = stubView(1);
+
+    const result = await deleteWithFilter(requestProvider as unknown as IMetadataProvider);
+
+    expect(result.Success).toBe(true);
+    expect(factory.create).not.toHaveBeenCalled();
+    expect(fromProvider).toHaveBeenCalledWith(requestProvider);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on the same provider when a delete fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+    stubView(2, false);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});

package/src/__tests__/magicLinkService.consume.test.ts

@@ -15,6 +15,12 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+// Provisioning is stubbed in this suite; keep the real provider stack out of the module graph.
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => {
+    throw new Error('provisioning is stubbed in this suite');
+  },
+}));
 
 import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -16,6 +16,10 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+const isolated = vi.hoisted(() => ({ provider: null as unknown }));
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => isolated.provider,
+}));
 
 import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
@@ -62,6 +66,7 @@ describe('MagicLinkService provisioning log policy', () => {
       RollbackTransaction: async () => undefined,
       GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
     };
+    isolated.provider = provider;
     Metadata.Provider = provider as unknown as IMetadataProvider;
 
     service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);