@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/src/__tests__/agentVisionConsentAudit.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+
+const h = vi.hoisted(() => ({
+  systemUser: { ID: 'SYS', Name: 'System' } as { ID: string; Name: string } | undefined,
+  logError: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return { ...actual, LogError: h.logError };
+});
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { GetSystemUser: () => h.systemUser } },
+}));
+
+import { WriteAgentVisionConsentAudit, REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE } from '../resolvers/agentVisionConsentAudit';
+
+/** A fake `MJ: Audit Logs` row that records what is set on it. */
+class FakeAuditRow {
+  public UserID = '';
+  public AuditLogTypeID = '';
+  public Status = '';
+  public EntityID: string | null = null;
+  public RecordID: string | null = null;
+  public Description: string | null = null;
+  public Details: string | null = null;
+  public IsNew = false;
+  constructor(private readonly saveResult: boolean) {}
+  NewRecord() {
+    this.IsNew = true;
+  }
+  async Save() {
+    return this.saveResult;
+  }
+  get LatestResult() {
+    return { CompleteMessage: 'save failed' };
+  }
+}
+
+const user = { ID: 'U1', Name: 'Test User' } as unknown as UserInfo;
+
+/** A provider with the consent audit type seeded (unless told otherwise), handing out one fake row. */
+function fakeProvider(o: { seeded?: boolean; saveResult?: boolean; getThrows?: boolean } = {}) {
+  const row = new FakeAuditRow(o.saveResult ?? true);
+  const getEntityObject = vi.fn(async () => {
+    if (o.getThrows) {
+      throw new Error('database unavailable');
+    }
+    return row;
+  });
+  const provider = {
+    AuditLogTypes: o.seeded === false ? [] : [{ ID: 'TYPE-1', Name: REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE }],
+    EntityByName: (name: string) => (name === 'MJ: Users' ? { ID: 'USERS-ENTITY' } : undefined),
+    GetEntityObject: getEntityObject,
+  } as unknown as IMetadataProvider;
+  return { provider, row, getEntityObject };
+}
+
+describe('WriteAgentVisionConsentAudit', () => {
+  beforeEach(() => {
+    h.logError.mockClear();
+    h.systemUser = { ID: 'SYS', Name: 'System' };
+  });
+
+  it('records an applied choice, saved by the system user, about the person', async () => {
+    const { provider, row, getEntityObject } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    expect(getEntityObject).toHaveBeenCalledWith('MJ: Audit Logs', h.systemUser);
+    expect(row).toMatchObject({
+      IsNew: true,
+      UserID: 'U1',
+      AuditLogTypeID: 'TYPE-1',
+      Status: 'Success',
+      EntityID: 'USERS-ENTITY',
+      RecordID: 'U1',
+      Description: 'Let agents see their camera and shared screen in room room-1.',
+    });
+    expect(JSON.parse(row.Details ?? '')).toEqual({ roomName: 'room-1', allow: true, error: null });
+    expect(h.logError).not.toHaveBeenCalled();
+  });
+
+  it('records a refused change as Failed, with the reason', async () => {
+    const { provider, row } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: false, Applied: false, ErrorMessage: 'not in the room' }, provider);
+    expect(row.Status).toBe('Failed');
+    expect(row.Description).toBe('Stopped letting agents see their camera and shared screen in room room-1 (not applied).');
+    expect(JSON.parse(row.Details ?? '')).toEqual({ roomName: 'room-1', allow: false, error: 'not in the room' });
+  });
+
+  it('logs the choice instead when the audit log type is not seeded', async () => {
+    const { provider, getEntityObject } = fakeProvider({ seeded: false });
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    expect(getEntityObject).not.toHaveBeenCalled();
+    expect(h.logError).toHaveBeenCalledWith(expect.stringMatching(/is not seeded.*user U1: Let agents see their camera and shared screen in room room-1\./));
+  });
+
+  it('logs the choice instead when there is no system user or no provider', async () => {
+    h.systemUser = undefined;
+    const { provider, getEntityObject } = fakeProvider();
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, provider);
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, null);
+    expect(getEntityObject).not.toHaveBeenCalled();
+    expect(h.logError.mock.calls.map((c) => String(c[0]).match(/\((.*?)\)/)?.[1])).toEqual(['no system user', 'no provider']);
+  });
+
+  it('logs a row that does not save, and never throws when the write fails', async () => {
+    await WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, fakeProvider({ saveResult: false }).provider);
+    await expect(
+      WriteAgentVisionConsentAudit({ User: user, RoomName: 'room-1', Allow: true, Applied: true }, fakeProvider({ getThrows: true }).provider),
+    ).resolves.toBeUndefined();
+    expect(h.logError.mock.calls.map((c) => String(c[0]))).toEqual([
+      'Agent vision consent audit row not saved for user U1: save failed',
+      'Agent vision consent audit write threw for user U1: database unavailable',
+    ]);
+  });
+});

package/src/__tests__/avatarInputValidation.test.ts

@@ -0,0 +1,160 @@
+import { describe, it, expect } from 'vitest';
+import {
+  ValidateAvatarInput,
+  AVATAR_MAX_IMAGE_BYTES,
+  AVATAR_MAX_URL_LENGTH,
+  AVATAR_MAX_ICON_CLASS_LENGTH,
+} from '../resolvers/avatarInputValidation.js';
+
+/** A valid base64 data URI whose payload decodes to exactly `bytes` bytes. */
+function dataUri(bytes: number, type = 'png'): string {
+  return `data:image/${type};base64,${Buffer.alloc(bytes, 7).toString('base64')}`;
+}
+
+function expectRefused(imageURL: string | null, iconClass: string | null = null): string {
+  const result = ValidateAvatarInput(imageURL, iconClass);
+  expect(result.Valid).toBe(false);
+  expect(result.ErrorMessage).toBeTruthy();
+  return result.ErrorMessage!;
+}
+
+describe('ValidateAvatarInput', () => {
+  describe('clearing', () => {
+    it('accepts both null as a revert to default', () => {
+      expect(ValidateAvatarInput(null, null)).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+    });
+
+    it('treats undefined and empty strings as clear', () => {
+      expect(ValidateAvatarInput(undefined, undefined)).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+      expect(ValidateAvatarInput('', '')).toEqual({ Valid: true, ImageURL: null, IconClass: null });
+    });
+  });
+
+  describe('data URIs', () => {
+    it.each(['png', 'jpeg', 'jpg', 'gif', 'webp'])('accepts image/%s', (type) => {
+      const uri = dataUri(10, type);
+      expect(ValidateAvatarInput(uri, null)).toEqual({ Valid: true, ImageURL: uri, IconClass: null });
+    });
+
+    it('accepts every padding variant', () => {
+      for (const bytes of [3, 4, 5]) {
+        expect(ValidateAvatarInput(dataUri(bytes), null).Valid).toBe(true);
+      }
+    });
+
+    it('accepts a decoded payload of exactly the cap', () => {
+      expect(ValidateAvatarInput(dataUri(AVATAR_MAX_IMAGE_BYTES), null).Valid).toBe(true);
+    });
+
+    it('refuses a decoded payload one byte over the cap', () => {
+      expect(expectRefused(dataUri(AVATAR_MAX_IMAGE_BYTES + 1))).toContain('200KB');
+    });
+
+    it('refuses an oversized data URI on length alone, even one the pattern would reject anyway', () => {
+      const huge = `data:image/png;base64,${'A'.repeat(2 * 1024 * 1024)}!`;
+      expect(expectRefused(huge)).toContain('200KB');
+    });
+
+    it('accepts the longest prefix with a payload of exactly the cap', () => {
+      expect(ValidateAvatarInput(dataUri(AVATAR_MAX_IMAGE_BYTES, 'jpeg'), null).Valid).toBe(true);
+    });
+
+    it('refuses SVG, which can carry script', () => {
+      expectRefused(`data:image/svg+xml;base64,${Buffer.from('<svg onload="alert(1)"/>').toString('base64')}`);
+    });
+
+    it.each([
+      'data:text/html;base64,PHNjcmlwdD4=',
+      'data:application/octet-stream;base64,AAAA',
+      'data:image/png,rawdata',
+      'data:image/png;base64,',
+      'data:image/png;base64,AAA',
+      'data:image/png;base64,AA=A',
+      'data:image/png;base64,AA AA',
+      'data:image/png;base64,AA*A',
+      'data:image/PNG;base64,AAAA',
+      `${dataUri(10)}\n`,
+    ])('refuses %j', (value) => {
+      expectRefused(value);
+    });
+  });
+
+  describe('http(s) URLs', () => {
+    it.each(['https://example.com/me.png', 'http://example.com/a/b?c=d#e', 'HTTPS://EXAMPLE.COM/x.png'])('accepts %s', (url) => {
+      expect(ValidateAvatarInput(url, null)).toEqual({ Valid: true, ImageURL: url, IconClass: null });
+    });
+
+    it('accepts a URL of exactly the length cap', () => {
+      const base = 'https://example.com/';
+      const url = base + 'a'.repeat(AVATAR_MAX_URL_LENGTH - base.length);
+      expect(url).toHaveLength(AVATAR_MAX_URL_LENGTH);
+      expect(ValidateAvatarInput(url, null).Valid).toBe(true);
+    });
+
+    it('refuses a URL one character over the length cap', () => {
+      const base = 'https://example.com/';
+      expectRefused(base + 'a'.repeat(AVATAR_MAX_URL_LENGTH - base.length + 1));
+    });
+
+    it.each([
+      'javascript:alert(1)',
+      'JavaScript:alert(document.cookie)',
+      'vbscript:msgbox(1)',
+      'file:///etc/passwd',
+      'ftp://example.com/me.png',
+      'blob:https://example.com/abc',
+      '//example.com/me.png',
+      '/assets/user.png',
+      'me.png',
+      'https://exa mple.com/me.png',
+      ' https://example.com/me.png',
+      'https://example.com/me.png\t',
+      'https://',
+      'http:example.com',
+    ])('refuses %j', (value) => {
+      expectRefused(value);
+    });
+  });
+
+  describe('icon classes', () => {
+    it.each(['fa-solid fa-user', 'fa-regular fa-circle-user', 'fa-user', 'fa-solid fa-user-astronaut fa-2x'])('accepts %j', (icon) => {
+      expect(ValidateAvatarInput(null, icon)).toEqual({ Valid: true, ImageURL: null, IconClass: icon });
+    });
+
+    it('accepts an icon class of exactly the length cap', () => {
+      const icon = 'fa-' + 'a'.repeat(AVATAR_MAX_ICON_CLASS_LENGTH - 3);
+      expect(ValidateAvatarInput(null, icon).Valid).toBe(true);
+    });
+
+    it('refuses an icon class one character over the length cap', () => {
+      expectRefused(null, 'fa-' + 'a'.repeat(AVATAR_MAX_ICON_CLASS_LENGTH - 2));
+    });
+
+    it.each([
+      'solid user',
+      'fa-',
+      'fa-solid fa-User',
+      'FA-SOLID FA-USER',
+      'fa-solid fa-user" onmouseover="alert(1)',
+      'fa-solid fa-user<script>',
+      'fa-solid;fa-user',
+      'fa_solid fa_user',
+      'fa-solid\tfa-user',
+      'fa-solid\nfa-user',
+    ])('refuses %j', (icon) => {
+      expectRefused(null, icon);
+    });
+  });
+
+  describe('both values', () => {
+    it('accepts a valid image and a valid icon together', () => {
+      const uri = dataUri(10);
+      expect(ValidateAvatarInput(uri, 'fa-solid fa-user')).toEqual({ Valid: true, ImageURL: uri, IconClass: 'fa-solid fa-user' });
+    });
+
+    it('refuses the whole request when either value is bad, and returns no values to store', () => {
+      expect(ValidateAvatarInput('javascript:alert(1)', 'fa-solid fa-user')).toMatchObject({ Valid: false, ImageURL: null, IconClass: null });
+      expect(ValidateAvatarInput(dataUri(10), 'bad icon')).toMatchObject({ Valid: false, ImageURL: null, IconClass: null });
+    });
+  });
+});

package/src/__tests__/isolatedProviderTransactions.test.ts

@@ -0,0 +1,169 @@
+/**
+ * Transactions opened outside a GraphQL request run on their OWN provider, never the shared
+ * `Metadata.Provider`.
+ *
+ * A provider's ambient transaction is per INSTANCE, and the global provider is shared by every
+ * request, scheduled job and background service. A transaction opened there nests into any other
+ * caller's, and while it is open every global-provider write from anywhere lands inside it. One left
+ * open swallows them all until the process restarts (MJ#2140). These tests pin the two call sites
+ * that used to open their transaction on the global provider: magic-link provisioning and
+ * SyncData's delete-with-filter. New-user creation is pinned in newUsers.test.ts.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+const factory = vi.hoisted(() => ({ create: vi.fn() }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: factory.create }));
+
+import { Metadata, RunView, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { SyncDataResolver, type ActionItemOutputType } from '../resolvers/SyncDataResolver.js';
+
+/** A provider that records every call made on it. */
+function recordingProvider(calls: string[], saveSucceeds = true) {
+  return {
+    BeginTransaction: vi.fn(async () => { calls.push('BeginTransaction'); }),
+    CommitTransaction: vi.fn(async () => { calls.push('CommitTransaction'); }),
+    RollbackTransaction: vi.fn(async () => { calls.push('RollbackTransaction'); }),
+    GetEntityObject: vi.fn(async (entityName: string) => {
+      calls.push(`GetEntityObject:${entityName}`);
+      const entity: Record<string, unknown> = {
+        NewRecord: () => { entity.ID = `id-${entityName}`; },
+        Save: async () => saveSucceeds,
+        GetAll: () => ({ ID: entity.ID }),
+        LatestResult: { CompleteMessage: 'save failed' },
+      };
+      return entity;
+    }),
+  };
+}
+
+let globalCalls: string[];
+let isolatedCalls: string[];
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => undefined);
+  vi.spyOn(console, 'error').mockImplementation(() => undefined);
+  globalCalls = [];
+  isolatedCalls = [];
+  Metadata.Provider = recordingProvider(globalCalls) as unknown as IMetadataProvider;
+});
+
+afterEach(() => {
+  Metadata.Provider = null as unknown as IMetadataProvider;
+  vi.restoreAllMocks();
+  factory.create.mockReset();
+});
+
+describe('MagicLinkService.createScopedUser', () => {
+  const invite = { Email: 'guest@example.com', RoleID: 'role-1', ApplicationID: 'app-1' } as unknown as MJMagicLinkInviteEntity;
+  const role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const provision = () =>
+    new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig)['createScopedUser'](invite, role, contextUser);
+
+  it('provisions inside a transaction on its own provider', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+
+    expect((await provision()).success).toBe(true);
+    expect(isolatedCalls).toEqual([
+      'BeginTransaction',
+      'GetEntityObject:MJ: Users',
+      'GetEntityObject:MJ: User Roles',
+      'GetEntityObject:MJ: User Applications',
+      'CommitTransaction',
+    ]);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on its own provider when a save fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls, false));
+
+    expect((await provision()).success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'GetEntityObject:MJ: Users', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});
+
+describe('SyncDataResolver.SyncSingleItemDeleteWithFilter', () => {
+  const user = { ID: 'system' } as UserInfo;
+
+  /** Rows the filtered view returns; each records its Delete on the shared call log. */
+  function stubView(rows: number, deleteSucceeds = true) {
+    const fromProvider = vi.spyOn(RunView, 'FromMetadataProvider').mockImplementation(
+      () =>
+        ({
+          RunView: async () => ({
+            Success: true,
+            Results: Array.from({ length: rows }, (_, i) => ({
+              Delete: async () => { isolatedCalls.push(`Delete:${i}`); return deleteSucceeds; },
+              LatestResult: { CompleteMessage: 'delete failed' },
+            })),
+          }),
+        }) as unknown as RunView,
+    );
+    return fromProvider;
+  }
+
+  const deleteWithFilter = (providerOverride?: IMetadataProvider) => {
+    const result = { Success: false } as ActionItemOutputType;
+    const resolver = new SyncDataResolver() as unknown as {
+      SyncSingleItemDeleteWithFilter: (...args: unknown[]) => Promise<void>;
+    };
+    return resolver
+      .SyncSingleItemDeleteWithFilter('MJ: Things', "Name = 'x'", result, user, {}, providerOverride)
+      .then(() => result);
+  };
+
+  it('with no request provider, loads AND deletes on its own provider inside one transaction', async () => {
+    const isolated = recordingProvider(isolatedCalls);
+    factory.create.mockResolvedValue(isolated);
+    const fromProvider = stubView(2);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(true);
+    expect(fromProvider).toHaveBeenCalledWith(isolated);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'Delete:1', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('with a request provider, uses it for both the read and the transaction', async () => {
+    const requestProvider = recordingProvider(isolatedCalls);
+    const fromProvider = stubView(1);
+
+    const result = await deleteWithFilter(requestProvider as unknown as IMetadataProvider);
+
+    expect(result.Success).toBe(true);
+    expect(factory.create).not.toHaveBeenCalled();
+    expect(fromProvider).toHaveBeenCalledWith(requestProvider);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on the same provider when a delete fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+    stubView(2, false);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});

package/src/__tests__/magicLinkService.consume.test.ts

@@ -15,6 +15,12 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+// Provisioning is stubbed in this suite; keep the real provider stack out of the module graph.
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => {
+    throw new Error('provisioning is stubbed in this suite');
+  },
+}));
 
 import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -16,6 +16,10 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+const isolated = vi.hoisted(() => ({ provider: null as unknown }));
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => isolated.provider,
+}));
 
 import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
@@ -62,6 +66,7 @@ describe('MagicLinkService provisioning log policy', () => {
       RollbackTransaction: async () => undefined,
       GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
     };
+    isolated.provider = provider;
     Metadata.Provider = provider as unknown as IMetadataProvider;
 
     service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);

package/src/__tests__/newUsers.template.test.ts

@@ -0,0 +1,151 @@
+/**
+ * Tests for userHandling.newUserTemplate: NewUserBase.createNewUser builds the new user as a copy of a
+ * template user through the record-cloning engine, and falls back to a plain user whenever the template
+ * can't be used (missing, not flagged IsTemplate, or the copy fails), so sign-in never breaks.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const {
+    mockConfig,
+    mockClone,
+    mockRunView,
+    mockLogError,
+    mockProvider,
+    savedUsers,
+} = vi.hoisted(() => {
+    const savedUsers: Array<Record<string, unknown>> = [];
+    const makeUser = () => {
+        const user: Record<string, unknown> & { NewRecord: () => void; Load: (id: string) => Promise<boolean>; Save: () => Promise<boolean> } = {
+            NewRecord: vi.fn(() => {
+                user.ID = 'plain-user-id';
+                user.Created = 'plain';
+            }),
+            Load: vi.fn(async (id: string) => {
+                user.ID = id;
+                user.Created = 'template';
+                return true;
+            }),
+            Save: vi.fn(async () => {
+                savedUsers.push({ ...user });
+                return true;
+            }),
+            LatestResult: null,
+        };
+        return user;
+    };
+    return {
+        mockConfig: {
+            userHandling: {
+                newUserRoles: [] as string[],
+                CreateUserApplicationRecords: false,
+                UserApplications: [] as string[],
+                contextUserForNewUserCreation: '',
+                newUserTemplate: { email: 'demo@example.org', preset: 'template' } as { email: string; preset: string } | undefined,
+            },
+        },
+        mockClone: vi.fn(),
+        mockRunView: vi.fn(),
+        mockLogError: vi.fn(),
+        mockProvider: {
+            GetEntityObject: vi.fn(async () => makeUser()),
+            BeginTransaction: vi.fn(),
+            CommitTransaction: vi.fn(),
+            RollbackTransaction: vi.fn(),
+            Roles: [],
+            Applications: [],
+        },
+        savedUsers,
+    };
+});
+
+vi.mock('../config.js', () => ({ configInfo: mockConfig }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: vi.fn(async () => mockProvider) }));
+vi.mock('../auth/principals.js', () => ({ ResolveConfiguredPrincipal: vi.fn(() => ({ ID: 'system-id', Type: 'Owner' })) }));
+vi.mock('@memberjunction/record-cloning', () => ({
+    RecordCloneEngine: class {
+        Clone = mockClone;
+    },
+}));
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return {
+        ...actual,
+        RunView: { FromMetadataProvider: () => ({ RunView: mockRunView }) },
+        LogError: mockLogError,
+        LogStatus: vi.fn(),
+    };
+});
+vi.mock('@memberjunction/core-entities', () => ({ UserInfoEngine: { GetDefaultApplicationsForNewUser: () => [] } }));
+
+import { NewUserBase } from '../auth/newUsers.js';
+
+const templateRow = (isTemplate: boolean) => ({ Success: true, Results: [{ ID: 'tpl-id', IsTemplate: isTemplate }] });
+const cloned = { Success: true, ResultCode: 'SUCCESS', Warnings: [], RecordsCloned: 120, Roots: [{ EntityName: 'MJ: Users', SourceKey: { KeyValuePairs: [] }, TargetKey: { KeyValuePairs: [{ FieldName: 'ID', Value: 'new-user-id' }] } }] };
+
+describe('NewUserBase.createNewUser with newUserTemplate', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        savedUsers.length = 0;
+        mockConfig.userHandling.newUserTemplate = { email: 'demo@example.org', preset: 'template' };
+    });
+
+    it('creates the user as an active copy of the template', async () => {
+        mockRunView.mockResolvedValue(templateRow(true));
+        mockClone.mockResolvedValue(cloned);
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).toHaveBeenCalledWith(
+            expect.objectContaining({
+                EntityName: 'MJ: Users',
+                SourceRecordKey: expect.objectContaining({ KeyValuePairs: [expect.objectContaining({ FieldName: 'ID', Value: 'tpl-id' })] }),
+                Preset: 'template',
+                PromptedValues: { Email: 'jane@example.com', FirstName: 'Jane', LastName: 'Doe' },
+            }),
+            expect.objectContaining({ ID: 'system-id' })
+        );
+        expect(user?.ID).toBe('new-user-id');
+        expect(savedUsers).toEqual([expect.objectContaining({ ID: 'new-user-id', Created: 'template', IsActive: true, LinkedRecordType: 'None' })]);
+        expect(mockProvider.BeginTransaction).not.toHaveBeenCalled();
+    });
+
+    it('falls back to a plain user when the template user is not flagged IsTemplate', async () => {
+        mockRunView.mockResolvedValue(templateRow(false));
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(mockLogError.mock.calls.flat().join(' ')).toContain('not marked as a template user');
+        expect(user?.ID).toBe('plain-user-id');
+        expect(savedUsers[0]).toEqual(expect.objectContaining({ Created: 'plain', Email: 'jane@example.com', IsActive: true }));
+    });
+
+    it('falls back to a plain user when no user has the template email', async () => {
+        mockRunView.mockResolvedValue({ Success: true, Results: [] });
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(user?.ID).toBe('plain-user-id');
+    });
+
+    it('falls back to a plain user when the copy is blocked', async () => {
+        mockRunView.mockResolvedValue(templateRow(true));
+        mockClone.mockResolvedValue({ Success: false, ResultCode: 'BLOCKED', Warnings: [{ Severity: 'Error', Code: 'FORBIDDEN', Message: 'needs Clone Records' }] });
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockLogError.mock.calls.flat().join(' ')).toContain('needs Clone Records');
+        expect(user?.ID).toBe('plain-user-id');
+    });
+
+    it('creates a plain user, as before, when no template is configured', async () => {
+        mockConfig.userHandling.newUserTemplate = undefined;
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockRunView).not.toHaveBeenCalled();
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(user?.ID).toBe('plain-user-id');
+    });
+});