@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/src/__tests__/RunAIAgentResolver.stoppedPredecessor.test.ts

@@ -0,0 +1,166 @@
+/**
+ * @fileoverview Continuing from a user-stopped run on `RunAIAgentFromConversationDetail`.
+ *
+ * The chat client never sends `lastRunId`, so the turn after a Stop used to start a fresh,
+ * unchained run. The mutation now looks for a user-stopped newest root run for the agent in the
+ * conversation and, when it finds one, chains the new run to it by LastRunID and rolls its
+ * FinalPayload in when the caller supplied no payload. These tests pin that on both dispatch
+ * paths, that a caller-supplied lastRunId wins, and that no predecessor changes nothing.
+ * Harness as in `RunAIAgentResolver.historyFrom.test.ts`.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { PubSubEngine } from 'type-graphql';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = [
+        'Resolver', 'Query', 'Mutation', 'Subscription', 'Arg', 'Args', 'ArgsType', 'Ctx', 'Root',
+        'Info', 'Field', 'FieldResolver', 'ObjectType', 'InputType', 'InterfaceType', 'Authorized',
+        'UseMiddleware', 'Extensions', 'Directive', 'ID', 'Int', 'Float', 'GraphQLISODateTime',
+        'GraphQLTimestamp', 'registerEnumType', 'createMethodDecorator', 'createParamDecorator',
+        'buildSchema', 'buildSchemaSync', 'PubSub',
+    ];
+    return Object.fromEntries(exportNames.map((name) => [name, decoratorFactory]));
+});
+
+vi.mock('@memberjunction/ai-agents', () => ({
+    AgentRunner: class {
+        RunAgentInConversation() {
+            return Promise.resolve({ agentResult: { success: true } });
+        }
+    },
+    ArtifactToolManager: class {},
+}));
+
+vi.mock('../realtimeWidget/widgetGuestElevation.js', () => ({
+    ResolveWidgetGuestRunContext: vi.fn().mockResolvedValue(null),
+    ElevateUserPayload: vi.fn(),
+}));
+
+import { RunAIAgentResolver } from '../resolvers/RunAIAgentResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+const USER = { ID: 'user-1', Email: 'user@example.com' };
+const STOPPED_RUN = '16787b44-29f6-44a5-8bd4-fc1538e79275';
+
+type Fn = ReturnType<typeof vi.fn>;
+
+interface ResolverSeams {
+    CheckAPIKeyScopeAuthorization: Fn;
+    GetUserFromPayload: Fn;
+    loadConversationHistoryWithAttachments: Fn;
+    executeAIAgent: Fn;
+    executeAgentInBackground: Fn;
+    findUserStoppedPredecessorRunId: Fn;
+}
+
+/** Argument positions of lastRunId / autoPopulateLastRunPayload on the two dispatch seams. */
+const SYNC_LAST_RUN = 10, SYNC_AUTO = 11, BG_LAST_RUN = 9, BG_AUTO = 10;
+
+function makeResolver(): { resolver: RunAIAgentResolver; seams: ResolverSeams } {
+    const resolver = new RunAIAgentResolver();
+    const seams = resolver as unknown as ResolverSeams;
+    seams.CheckAPIKeyScopeAuthorization = vi.fn().mockResolvedValue(undefined);
+    seams.GetUserFromPayload = vi.fn().mockReturnValue(USER);
+    seams.loadConversationHistoryWithAttachments = vi.fn().mockResolvedValue([]);
+    seams.executeAIAgent = vi.fn().mockResolvedValue({ success: true, result: '{}' });
+    seams.executeAgentInBackground = vi.fn();
+    seams.findUserStoppedPredecessorRunId = vi.fn().mockResolvedValue(null);
+    return { resolver, seams };
+}
+
+function makeContext(branchId: string | null = null): AppContext {
+    const provider = {
+        GetEntityObject: vi.fn().mockResolvedValue({ ConversationID: 'conv-1', BranchID: branchId, Load: vi.fn().mockResolvedValue(true) }),
+    };
+    return {
+        userPayload: { sessionId: 'session-1', userRecord: USER } as unknown as UserPayload,
+        providers: [{ type: 'Read-Write', provider }],
+        dataSource: {},
+    } as unknown as AppContext;
+}
+
+const pubSub = { publish: vi.fn() } as unknown as PubSubEngine;
+
+async function runMutation(
+    resolver: RunAIAgentResolver,
+    options: { payload?: string; lastRunId?: string; autoPopulate?: boolean; fireAndForget?: boolean; branchId?: string | null }
+) {
+    return resolver.RunAIAgentFromConversationDetail(
+        'detail-1', 'agent-1', makeContext(options.branchId ?? null), 'session-1', pubSub,
+        undefined, undefined, options.payload, options.lastRunId, options.autoPopulate, undefined, undefined, undefined,
+        undefined, undefined, options.fireAndForget, undefined, undefined,
+        undefined
+    );
+}
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('RunAIAgentFromConversationDetail — continuing from a user-stopped run', () => {
+    let resolver: RunAIAgentResolver;
+    let seams: ResolverSeams;
+
+    beforeEach(() => {
+        ({ resolver, seams } = makeResolver());
+    });
+
+    it('chains the new run to the stopped predecessor and rolls its payload in when none was supplied', async () => {
+        seams.findUserStoppedPredecessorRunId.mockResolvedValue(STOPPED_RUN);
+
+        const result = await runMutation(resolver, {});
+
+        expect(result.success).toBe(true);
+        expect(seams.findUserStoppedPredecessorRunId).toHaveBeenCalledWith('conv-1', 'agent-1', null, USER, expect.anything());
+        const args = seams.executeAIAgent.mock.calls[0];
+        expect(args[SYNC_LAST_RUN]).toBe(STOPPED_RUN);
+        expect(args[SYNC_AUTO]).toBe(true);
+    });
+
+    it('keeps the caller\'s payload as the start when one was supplied (chains, but does not roll the old one in)', async () => {
+        seams.findUserStoppedPredecessorRunId.mockResolvedValue(STOPPED_RUN);
+
+        await runMutation(resolver, { payload: '{"fromArtifact":true}' });
+
+        const args = seams.executeAIAgent.mock.calls[0];
+        expect(args[SYNC_LAST_RUN]).toBe(STOPPED_RUN);
+        expect(args[SYNC_AUTO]).toBeUndefined();
+    });
+
+    it('hands the chain to a fire-and-forget run too', async () => {
+        seams.findUserStoppedPredecessorRunId.mockResolvedValue(STOPPED_RUN);
+
+        await runMutation(resolver, { fireAndForget: true });
+
+        expect(seams.executeAIAgent).not.toHaveBeenCalled();
+        const args = seams.executeAgentInBackground.mock.calls[0];
+        expect(args[BG_LAST_RUN]).toBe(STOPPED_RUN);
+        expect(args[BG_AUTO]).toBe(true);
+    });
+
+    it('looks up the predecessor on the branch the reply row was created on', async () => {
+        await runMutation(resolver, { branchId: 'B' });
+        expect(seams.findUserStoppedPredecessorRunId).toHaveBeenCalledWith('conv-1', 'agent-1', 'B', expect.anything(), expect.anything());
+        await runMutation(resolver, {});
+        expect(seams.findUserStoppedPredecessorRunId).toHaveBeenLastCalledWith('conv-1', 'agent-1', null, expect.anything(), expect.anything());
+    });
+
+    it('a caller-supplied lastRunId wins and the lookup is skipped', async () => {
+        await runMutation(resolver, { lastRunId: 'caller-run', autoPopulate: false });
+
+        expect(seams.findUserStoppedPredecessorRunId).not.toHaveBeenCalled();
+        const args = seams.executeAIAgent.mock.calls[0];
+        expect(args[SYNC_LAST_RUN]).toBe('caller-run');
+        expect(args[SYNC_AUTO]).toBe(false);
+    });
+
+    it('with no stopped predecessor the run is dispatched unchained, as before', async () => {
+        await runMutation(resolver, {});
+
+        const args = seams.executeAIAgent.mock.calls[0];
+        expect(args[SYNC_LAST_RUN]).toBeUndefined();
+        expect(args[SYNC_AUTO]).toBeUndefined();
+    });
+});

package/src/__tests__/RunTemplateResolver.test.ts

@@ -0,0 +1,132 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+/**
+ * `RunTemplate` renders a stored template on demand. Its API-key scope check is a no-op for JWT,
+ * magic-link and widget sessions, so the resolver applies its own rule. These tests pin that it
+ * refuses scope-limited sessions and callers who cannot read templates before it loads anything.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// As in RunDecisionResolver.test.ts: vitest's esbuild transform does not apply
+// `emitDecoratorMetadata`, so the decorators are no-ops and the resolver runs as a plain class.
+vi.mock('type-graphql', () => {
+  const noopDecorator = () => () => undefined;
+  return {
+    Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+    ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+    Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+    Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+    createUnionType: () => class {},
+    AuthorizationError: class AuthorizationError extends Error {
+      constructor(message?: string) {
+        super(message);
+        this.name = 'AuthorizationError';
+      }
+    },
+    Float: class {}, Int: class {}, ID: class {},
+  };
+});
+
+import { EntityInfo, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { RunTemplateResolver } from '../resolvers/RunTemplateResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+const UI_ROLE_ID = '0b9b7b55-0000-4000-8000-0000000000a1';
+const TEMPLATE_ID = '0b9b7b55-0000-4000-8000-0000000000c1';
+
+/** An entity whose read permission is granted to the given roles. */
+function entityReadableBy(name: string, roleIds: string[]): EntityInfo {
+  const entityId = `entity-${name}`;
+  return new EntityInfo({
+    ID: entityId, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: `vw${name}`, IncludeInAPI: true,
+    EntityPermissions: roleIds.map((roleId, index) => ({
+      ID: `${entityId}-permission-${index}`, EntityID: entityId, RoleID: roleId,
+      CanCreate: false, CanRead: true, CanUpdate: false, CanDelete: false, Type: 'Allow',
+    })),
+  });
+}
+
+/**
+ * Metadata plus the one data call the resolver makes first. The data call fails on purpose, so a
+ * test can tell whether the resolver got past authorization without needing a database.
+ */
+class FakeProvider {
+  public readonly EntityObjectRequests: string[] = [];
+
+  constructor(private readonly entities: EntityInfo[]) {}
+
+  public EntityByName(name: string): EntityInfo | undefined {
+    return this.entities.find((e) => e.Name.trim().toLowerCase() === name.trim().toLowerCase());
+  }
+
+  public async GetEntityObject(entityName: string): Promise<never> {
+    this.EntityObjectRequests.push(entityName);
+    throw new Error(`reached data access for ${entityName}`);
+  }
+}
+
+function makeUser(roleIds: string[]): UserInfo {
+  const userId = '0b9b7b55-0000-4000-8000-0000000000b1';
+  return new UserInfo(null, {
+    ID: userId, Name: 'Template Runner', Email: 'runner@example.com',
+    UserRoles: roleIds.map((roleId) => new UserRoleInfo({ UserID: userId, RoleID: roleId })),
+  });
+}
+
+const readableEverywhere = () => [
+  entityReadableBy('MJ: Templates', [UI_ROLE_ID]),
+  entityReadableBy('MJ: Template Contents', [UI_ROLE_ID]),
+];
+
+/** A JWT-style session (no API key), so the API-key scope check is a no-op. */
+function contextFor(user: UserInfo, provider: FakeProvider): AppContext {
+  const userPayload: UserPayload = { email: user.Email, userRecord: user, sessionId: 'session-1' };
+  return { userPayload, providers: [{ type: 'Read-Write', provider }] } as unknown as AppContext;
+}
+
+const runTemplate = (user: UserInfo, provider: FakeProvider) =>
+  new RunTemplateResolver().RunTemplate(TEMPLATE_ID, contextFor(user, provider));
+
+describe('RunTemplate authorization', () => {
+  it('refuses an anonymous magic-link guest before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const guest = makeUser([UI_ROLE_ID]);
+    guest.IsMagicLinkAnonymous = true;
+
+    const result = await runTemplate(guest, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a resource-scoped magic-link session before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const scoped = makeUser([UI_ROLE_ID]);
+    scoped.MagicLinkScope = { ResourceID: '0b9b7b55-0000-4000-8000-0000000000d1', ResourceType: 'Dashboards' };
+
+    const result = await runTemplate(scoped, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a user without read permission on MJ: Templates before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'You do not have permission to read MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('lets a user who can read templates and their content through to the template load', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([UI_ROLE_ID]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'reached data access for MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual(['MJ: Templates']);
+  });
+});

package/src/__tests__/RunViewResolver.cacheCheckForwarding.test.ts

@@ -0,0 +1,63 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * The cache-check transport's param forwarding, at the resolver.
+ *
+ * This map is the middle of three places a param has to be carried for the smart-cache-check
+ * transport to behave like the ordinary one, and it is where three separate fields have now been
+ * found missing: `Aggregates` (B40), `DataSource`, and `BypassCache`. Each omission was invisible
+ * locally — the schema accepted the field, the provider could act on it, the response could carry
+ * it, and only the request never asked. These pin the two that silently change what the database
+ * is asked, so a fourth omission fails here rather than in a consumer's UI.
+ */
+const runViewsWithCacheCheck = vi.fn(async () => ({ success: true, errorMessage: null, results: [] }));
+
+vi.mock('../util.js', () => ({
+    GetReadOnlyProvider: () => ({ RunViewsWithCacheCheck: runViewsWithCacheCheck }),
+    GetReadWriteProvider: () => ({ RunViewsWithCacheCheck: runViewsWithCacheCheck }),
+}));
+
+import { RunViewResolver } from '../generic/RunViewResolver.js';
+import type { AppContext } from '../types.js';
+
+/** Minimal context: the resolver only needs a provider (mocked above) and a user record. */
+function context(): AppContext {
+    return { providers: [], userPayload: { userRecord: { ID: 'u1', Name: 'Test' } } } as unknown as AppContext;
+}
+
+/** The params the resolver handed the provider for the single view in the batch. */
+async function forwardedParams(params: Record<string, unknown>): Promise<Record<string, unknown>> {
+    runViewsWithCacheCheck.mockClear();
+    const resolver = new RunViewResolver();
+    await resolver.RunViewsWithCacheCheck([{ params } as never], context());
+    expect(runViewsWithCacheCheck).toHaveBeenCalledTimes(1);
+    const call = runViewsWithCacheCheck.mock.calls[0] as unknown as [Array<{ params: Record<string, unknown> }>];
+    return call[0][0].params;
+}
+
+describe('RunViewsWithCacheCheck resolver — param forwarding', () => {
+    beforeEach(() => {
+        runViewsWithCacheCheck.mockClear();
+    });
+
+    it('forwards BypassCache, so a deliberate database read is not answered from the server cache', async () => {
+        const forwarded = await forwardedParams({ EntityName: 'Customers', BypassCache: true });
+        expect(forwarded.BypassCache).toBe(true);
+    });
+
+    it('leaves BypassCache undefined when the caller did not ask for it', async () => {
+        const forwarded = await forwardedParams({ EntityName: 'Customers' });
+        expect(forwarded.BypassCache).toBeUndefined();
+    });
+
+    it('still forwards DataSource and Aggregates — the two fields previously found missing here', async () => {
+        const forwarded = await forwardedParams({
+            EntityName: 'Customers',
+            DataSource: 'Materialized',
+            Aggregates: [{ expression: 'COUNT(*)', alias: 'total' }],
+        });
+        expect(forwarded.DataSource).toBe('Materialized');
+        expect(forwarded.Aggregates).toEqual([{ expression: 'COUNT(*)', alias: 'total' }]);
+    });
+});