@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/LoginScreenEngine.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi } from 'vitest';
+import { DefaultLoginDesign } from '@memberjunction/theme-engine';
+
+/**
+ * `GetPublicLoginScreen` feeds an UNAUTHENTICATED endpoint: these assert what may not escape it (the
+ * draft, an unsafe value) and the empty answer that keeps the stock login screen. The sanitizing itself
+ * is tested in theme-engine; here, that the engine wires it up.
+ */
+
+vi.mock('@memberjunction/core-entities', () => ({}));
+
+vi.mock('@memberjunction/core', () => ({
+  BaseEngine: class {
+    public LoadedConfigs: unknown[] = [];
+    protected async Load(configs: unknown[]): Promise<void> {
+      this.LoadedConfigs = configs;
+    }
+    protected GetConfigData<T>(propertyName: string): T[] {
+      return (this as unknown as Record<string, T[]>)[propertyName] ?? [];
+    }
+    public static getInstance<T>(this: new () => T): T {
+      return new this();
+    }
+  },
+  RegisterForStartup: () => (target: unknown) => target,
+}));
+
+import { LoginScreenEngine } from '../auth/LoginScreenEngine.js';
+
+/** Minimal stand-in for a generated MJThemeEntity row. */
+type Row = {
+  Name: string;
+  Seeds: string;
+  LoginScreen: string | null;
+  LoginScreenDraft: string | null;
+  LightMarkURL: string | null;
+  DarkMarkURL: string | null;
+  WordmarkURL: string | null;
+  MonochromeURL: string | null;
+};
+
+function engineWith(rows: Partial<Row>[]): LoginScreenEngine {
+  const engine = new (LoginScreenEngine as unknown as new () => LoginScreenEngine)();
+  const full: Row[] = rows.map((r) => ({
+    Name: 'Acme', Seeds: '{"primary":"#0076b6"}', LoginScreen: null, LoginScreenDraft: null,
+    LightMarkURL: null, DarkMarkURL: null, WordmarkURL: null, MonochromeURL: null, ...r,
+  }));
+  (engine as unknown as Record<string, Row[]>)['_defaultThemes'] = full;
+  return engine;
+}
+
+describe('LoginScreenEngine', () => {
+  it('loads the default Active theme, most recently changed first', async () => {
+    const engine = engineWith([]);
+    await engine.Config();
+    expect((engine as unknown as { LoadedConfigs: unknown[] }).LoadedConfigs).toEqual([
+      expect.objectContaining({ EntityName: 'MJ: Themes', Filter: `IsDefault = 1 AND Status = 'Active'`, OrderBy: '__mj_UpdatedAt DESC' }),
+    ]);
+  });
+
+  it('serves the published design, logos and seeds, and never the draft', () => {
+    const design = DefaultLoginDesign();
+    const draft = JSON.stringify({ ...DefaultLoginDesign(), Heading: 'Secret launch page' });
+    const result = engineWith([{ LoginScreen: JSON.stringify(design), LoginScreenDraft: draft, LightMarkURL: 'https://cdn.example.org/m.svg' }])
+      .GetPublicLoginScreen();
+    expect(result).toEqual({ ThemeName: 'Acme', Design: design, Seeds: { primary: '#0076b6' }, Logos: { lightMarkURL: 'https://cdn.example.org/m.svg' } });
+    expect(JSON.stringify(result)).not.toContain('Secret launch page');
+  });
+
+  it('drops an unsafe design, seed and logo from a row edited outside the entity layer', () => {
+    const tampered = DefaultLoginDesign();
+    tampered.Regions.PanelBottom = [{ ID: 'b-x', Type: 'links', Links: [{ Label: 'Help', Href: 'javascript:alert(1)' }], Width: 'full', HideWhenStacked: false }];
+    const result = engineWith([{
+      LoginScreen: JSON.stringify(tampered),
+      Seeds: JSON.stringify({ primary: '#0076b6', fontFamily: 'x;} body{background:url(https://evil/t)} a{' }),
+      LightMarkURL: 'javascript:alert(1)',
+    }]).GetPublicLoginScreen();
+    expect(result.Design).toBeNull();
+    expect(result.Seeds).toEqual({ primary: '#0076b6' });
+    expect(result.Logos).toEqual({});
+  });
+
+  it('answers empty when there is no default theme', () => {
+    expect(engineWith([]).GetPublicLoginScreen()).toEqual({ ThemeName: null, Design: null, Seeds: null, Logos: {} });
+  });
+});

package/src/__tests__/MJStorageBlobStore.storageGate.test.ts

@@ -0,0 +1,63 @@
+/**
+ * MJStorageBlobStore (the conversation-attachment blob seam) goes from a file ID to bytes, a signed URL or a delete. The
+ * `MJ: Files` row names only a storage PROVIDER, so each path resolves through `FileStorageEngine.ResolveFileObject` —
+ * the storage gate (the caller's access on the account, and the tracked-file rule). These tests pin that download and
+ * URL ask for Read, delete asks for Write, and a refusal reads, signs and deletes nothing (the seam never throws).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { resolveFileObject, getObject, createUrl, deleteObject } = vi.hoisted(() => ({
+    resolveFileObject: vi.fn(),
+    getObject: vi.fn(async () => Buffer.from('bytes')),
+    createUrl: vi.fn(async () => 'https://signed.example/x'),
+    deleteObject: vi.fn(async () => true),
+}));
+
+vi.mock('@memberjunction/storage', () => ({
+    FileStorageEngine: { Instance: { ResolveFileObject: resolveFileObject } },
+    StorageAccessEvaluator: { Instance: { AssertTrackedObjectsReadable: vi.fn() } },
+    FileStorageBase: class {},
+}));
+
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { MJStorageBlobStore } from '../services/MJStorageBlobStore.js';
+
+const caller = { ID: 'user-1', UserRoles: [] } as unknown as UserInfo;
+const fileRow = {
+    ID: 'file-1', ProviderID: 'prov-1', ProviderKey: 'conversation-attachments/a.png', Name: 'a.png',
+    Load: async () => true, Delete: vi.fn(async () => true),
+};
+const provider = { GetEntityObject: async () => fileRow } as unknown as IMetadataProvider;
+const driver = { GetObject: getObject, CreatePreAuthDownloadUrl: createUrl, DeleteObject: deleteObject };
+
+describe('MJStorageBlobStore — every path goes through the storage gate', () => {
+    const store = new MJStorageBlobStore();
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        resolveFileObject.mockResolvedValue({ Account: { ID: 'acct-1' }, Driver: driver, ObjectKey: fileRow.ProviderKey });
+    });
+
+    it('Download and GetDownloadUrl ask for Read, as the caller', async () => {
+        expect(await store.Download('file-1', caller, provider)).toBe(Buffer.from('bytes').toString('base64'));
+        expect(await store.GetDownloadUrl('file-1', caller, provider)).toBe('https://signed.example/x');
+        expect(resolveFileObject.mock.calls.map(c => c[2])).toEqual(['Read', 'Read']);
+        expect(resolveFileObject.mock.calls.every(c => c[1] === caller)).toBe(true);
+    });
+
+    it('Delete asks for Write', async () => {
+        expect(await store.Delete('file-1', caller, provider)).toBe(true);
+        expect(resolveFileObject.mock.calls[0][2]).toBe('Write');
+    });
+
+    it('a refusal reads, signs and deletes nothing — and the seam still does not throw', async () => {
+        resolveFileObject.mockRejectedValue(new Error('You do not have access to this file or it does not exist.'));
+        expect(await store.Download('file-1', caller, provider)).toBeNull();
+        expect(await store.GetDownloadUrl('file-1', caller, provider)).toBeNull();
+        expect(await store.Delete('file-1', caller, provider)).toBe(false);
+        expect(getObject).not.toHaveBeenCalled();
+        expect(createUrl).not.toHaveBeenCalled();
+        expect(deleteObject).not.toHaveBeenCalled();
+        expect(fileRow.Delete).not.toHaveBeenCalled();
+    });
+});

package/src/__tests__/MeetingResolver.test.ts

@@ -3,12 +3,14 @@ import 'reflect-metadata';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
 import type {
+  MJAIAgentSessionEntity,
   MJMeetingEntity,
   MJMeetingParticipantEntity,
   MJPhoneNumberEntity,
   MJInteractionEntity,
   MJInteractionEventEntity,
 } from '@memberjunction/core-entities';
+import type { StartAgentRoomSessionParams } from '@memberjunction/livekit-room-server';
 
 const mocks = vi.hoisted(() => ({
   mintClientToken: vi.fn(async (roomName: string, identity: string, name?: string) => ({
@@ -16,7 +18,7 @@ const mocks = vi.hoisted(() => ({
     Identity: identity,
     ServerUrl: 'wss://livekit.example.com',
   })),
-  startAgentRoomSession: vi.fn(async () => ({
+  startAgentRoomSession: vi.fn(async (_params: StartAgentRoomSessionParams) => ({
     SessionBridgeID: 'bridge-123',
     RoomName: 'room-123',
   })),
@@ -69,6 +71,7 @@ import {
   type RSVPMeetingInput,
 } from '../resolvers/MeetingResolver.js';
 import type { AppContext } from '../types.js';
+import type { SessionManager } from '../agentSessions/SessionManager.js';
 
 class MockEntityBase {
   public ID: string = `mock-${Date.now()}-${Math.random()}`;
@@ -362,6 +365,77 @@ describe('MeetingResolver', () => {
       expect(m.EndedAt).toBeDefined();
       expect(mocks.stopAllAgentsInRoom).toHaveBeenCalledWith('mj-mtg-standup-1', 'Explicit', resolver.user, mockProvider);
     });
+
+    it("closes an agent participant's session when its agent leaves the room (#5356)", async () => {
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-live-2';
+      m.HostUserID = 'user-host-1';
+      m.RoomName = 'mj-mtg-standup-2';
+      m.Status = 'Scheduled';
+      resolver.mockMeetings.push(m);
+
+      // The resolver's protected seams this test stands in for.
+      const seams = resolver as unknown as {
+        loadMeetingEntity: () => Promise<MockMeetingEntity>;
+        isUserHostOrCoHost: () => Promise<boolean>;
+        loadParticipants: () => Promise<object[]>;
+        sessionManager: SessionManager;
+      };
+      vi.spyOn(seams, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(seams, 'isUserHostOrCoHost').mockResolvedValue(true);
+      vi.spyOn(seams, 'loadParticipants').mockResolvedValue([
+        { ID: 'p-1', MeetingID: m.ID, Role: 'Agent', AgentID: 'agent-co-1', InviteStatus: 'Accepted' },
+      ]);
+      vi.spyOn(seams.sessionManager, 'CreateSession').mockResolvedValue({ ID: 'agent-session-789' } as unknown as MJAIAgentSessionEntity);
+      const closeSession = vi.spyOn(seams.sessionManager, 'CloseSession').mockResolvedValue(true);
+
+      await resolver.StartMeeting(m.ID, ctx);
+      const started = mocks.startAgentRoomSession.mock.calls[0][0];
+      expect(started.AgentSessionID).toBe('agent-session-789');
+      expect(closeSession).not.toHaveBeenCalled();
+
+      // The agent leaves (the meeting was ended, or everyone left): the coordinator runs the hook once its bridge has ended.
+      await started.Host?.OnSessionEnded?.('Explicit');
+
+      expect(closeSession).toHaveBeenCalledWith('agent-session-789', resolver.user, mockProvider, 'Explicit');
+    });
+
+    it("closes an agent participant's session at once, as Error, when its agent fails to start (#5308)", async () => {
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-live-3';
+      m.HostUserID = 'user-host-1';
+      m.RoomName = 'mj-mtg-standup-3';
+      m.Status = 'Scheduled';
+      resolver.mockMeetings.push(m);
+
+      // The resolver's protected seams this test stands in for.
+      const seams = resolver as unknown as {
+        loadMeetingEntity: () => Promise<MockMeetingEntity>;
+        isUserHostOrCoHost: () => Promise<boolean>;
+        loadParticipants: () => Promise<object[]>;
+        sessionManager: SessionManager;
+      };
+      vi.spyOn(seams, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(seams, 'isUserHostOrCoHost').mockResolvedValue(true);
+      vi.spyOn(seams, 'loadParticipants').mockResolvedValue([
+        { ID: 'p-1', MeetingID: m.ID, Role: 'Agent', AgentID: 'agent-fails', InviteStatus: 'Accepted' },
+        { ID: 'p-2', MeetingID: m.ID, Role: 'Agent', AgentID: 'agent-joins', InviteStatus: 'Accepted' },
+      ]);
+      vi.spyOn(seams.sessionManager, 'CreateSession')
+        .mockResolvedValueOnce({ ID: 'agent-session-fails' } as unknown as MJAIAgentSessionEntity)
+        .mockResolvedValueOnce({ ID: 'agent-session-joins' } as unknown as MJAIAgentSessionEntity);
+      const closeSession = vi.spyOn(seams.sessionManager, 'CloseSession').mockResolvedValue(true);
+      // The first agent's bridge can't start (the coordinator has closed its model session by the time this throws).
+      mocks.startAgentRoomSession.mockRejectedValueOnce(new Error('Failed to create AIAgentSessionBridge: permission denied'));
+
+      const result = await resolver.StartMeeting(m.ID, ctx);
+
+      // The meeting still starts, with the agent that joined; only the failed agent's session is closed.
+      expect(result.Success).toBe(true);
+      expect(mocks.startAgentRoomSession).toHaveBeenCalledTimes(2);
+      expect(closeSession).toHaveBeenCalledTimes(1);
+      expect(closeSession).toHaveBeenCalledWith('agent-session-fails', resolver.user, mockProvider, 'Error');
+    });
   });
 
   describe('RSVPMeeting', () => {