@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/RunTemplateResolver.test.ts

@@ -0,0 +1,132 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+/**
+ * `RunTemplate` renders a stored template on demand. Its API-key scope check is a no-op for JWT,
+ * magic-link and widget sessions, so the resolver applies its own rule. These tests pin that it
+ * refuses scope-limited sessions and callers who cannot read templates before it loads anything.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// As in RunDecisionResolver.test.ts: vitest's esbuild transform does not apply
+// `emitDecoratorMetadata`, so the decorators are no-ops and the resolver runs as a plain class.
+vi.mock('type-graphql', () => {
+  const noopDecorator = () => () => undefined;
+  return {
+    Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+    ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+    Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+    Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+    createUnionType: () => class {},
+    AuthorizationError: class AuthorizationError extends Error {
+      constructor(message?: string) {
+        super(message);
+        this.name = 'AuthorizationError';
+      }
+    },
+    Float: class {}, Int: class {}, ID: class {},
+  };
+});
+
+import { EntityInfo, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { RunTemplateResolver } from '../resolvers/RunTemplateResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+const UI_ROLE_ID = '0b9b7b55-0000-4000-8000-0000000000a1';
+const TEMPLATE_ID = '0b9b7b55-0000-4000-8000-0000000000c1';
+
+/** An entity whose read permission is granted to the given roles. */
+function entityReadableBy(name: string, roleIds: string[]): EntityInfo {
+  const entityId = `entity-${name}`;
+  return new EntityInfo({
+    ID: entityId, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: `vw${name}`, IncludeInAPI: true,
+    EntityPermissions: roleIds.map((roleId, index) => ({
+      ID: `${entityId}-permission-${index}`, EntityID: entityId, RoleID: roleId,
+      CanCreate: false, CanRead: true, CanUpdate: false, CanDelete: false, Type: 'Allow',
+    })),
+  });
+}
+
+/**
+ * Metadata plus the one data call the resolver makes first. The data call fails on purpose, so a
+ * test can tell whether the resolver got past authorization without needing a database.
+ */
+class FakeProvider {
+  public readonly EntityObjectRequests: string[] = [];
+
+  constructor(private readonly entities: EntityInfo[]) {}
+
+  public EntityByName(name: string): EntityInfo | undefined {
+    return this.entities.find((e) => e.Name.trim().toLowerCase() === name.trim().toLowerCase());
+  }
+
+  public async GetEntityObject(entityName: string): Promise<never> {
+    this.EntityObjectRequests.push(entityName);
+    throw new Error(`reached data access for ${entityName}`);
+  }
+}
+
+function makeUser(roleIds: string[]): UserInfo {
+  const userId = '0b9b7b55-0000-4000-8000-0000000000b1';
+  return new UserInfo(null, {
+    ID: userId, Name: 'Template Runner', Email: 'runner@example.com',
+    UserRoles: roleIds.map((roleId) => new UserRoleInfo({ UserID: userId, RoleID: roleId })),
+  });
+}
+
+const readableEverywhere = () => [
+  entityReadableBy('MJ: Templates', [UI_ROLE_ID]),
+  entityReadableBy('MJ: Template Contents', [UI_ROLE_ID]),
+];
+
+/** A JWT-style session (no API key), so the API-key scope check is a no-op. */
+function contextFor(user: UserInfo, provider: FakeProvider): AppContext {
+  const userPayload: UserPayload = { email: user.Email, userRecord: user, sessionId: 'session-1' };
+  return { userPayload, providers: [{ type: 'Read-Write', provider }] } as unknown as AppContext;
+}
+
+const runTemplate = (user: UserInfo, provider: FakeProvider) =>
+  new RunTemplateResolver().RunTemplate(TEMPLATE_ID, contextFor(user, provider));
+
+describe('RunTemplate authorization', () => {
+  it('refuses an anonymous magic-link guest before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const guest = makeUser([UI_ROLE_ID]);
+    guest.IsMagicLinkAnonymous = true;
+
+    const result = await runTemplate(guest, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a resource-scoped magic-link session before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+    const scoped = makeUser([UI_ROLE_ID]);
+    scoped.MagicLinkScope = { ResourceID: '0b9b7b55-0000-4000-8000-0000000000d1', ResourceType: 'Dashboards' };
+
+    const result = await runTemplate(scoped, provider);
+
+    expect(result).toMatchObject({ success: false, error: 'Running templates is not permitted for scope-limited sessions' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('refuses a user without read permission on MJ: Templates before loading the template', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'You do not have permission to read MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual([]);
+  });
+
+  it('lets a user who can read templates and their content through to the template load', async () => {
+    const provider = new FakeProvider(readableEverywhere());
+
+    const result = await runTemplate(makeUser([UI_ROLE_ID]), provider);
+
+    expect(result).toMatchObject({ success: false, error: 'reached data access for MJ: Templates' });
+    expect(provider.EntityObjectRequests).toEqual(['MJ: Templates']);
+  });
+});

package/src/__tests__/RunViewResolver.cacheCheckForwarding.test.ts

@@ -0,0 +1,63 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * The cache-check transport's param forwarding, at the resolver.
+ *
+ * This map is the middle of three places a param has to be carried for the smart-cache-check
+ * transport to behave like the ordinary one, and it is where three separate fields have now been
+ * found missing: `Aggregates` (B40), `DataSource`, and `BypassCache`. Each omission was invisible
+ * locally — the schema accepted the field, the provider could act on it, the response could carry
+ * it, and only the request never asked. These pin the two that silently change what the database
+ * is asked, so a fourth omission fails here rather than in a consumer's UI.
+ */
+const runViewsWithCacheCheck = vi.fn(async () => ({ success: true, errorMessage: null, results: [] }));
+
+vi.mock('../util.js', () => ({
+    GetReadOnlyProvider: () => ({ RunViewsWithCacheCheck: runViewsWithCacheCheck }),
+    GetReadWriteProvider: () => ({ RunViewsWithCacheCheck: runViewsWithCacheCheck }),
+}));
+
+import { RunViewResolver } from '../generic/RunViewResolver.js';
+import type { AppContext } from '../types.js';
+
+/** Minimal context: the resolver only needs a provider (mocked above) and a user record. */
+function context(): AppContext {
+    return { providers: [], userPayload: { userRecord: { ID: 'u1', Name: 'Test' } } } as unknown as AppContext;
+}
+
+/** The params the resolver handed the provider for the single view in the batch. */
+async function forwardedParams(params: Record<string, unknown>): Promise<Record<string, unknown>> {
+    runViewsWithCacheCheck.mockClear();
+    const resolver = new RunViewResolver();
+    await resolver.RunViewsWithCacheCheck([{ params } as never], context());
+    expect(runViewsWithCacheCheck).toHaveBeenCalledTimes(1);
+    const call = runViewsWithCacheCheck.mock.calls[0] as unknown as [Array<{ params: Record<string, unknown> }>];
+    return call[0][0].params;
+}
+
+describe('RunViewsWithCacheCheck resolver — param forwarding', () => {
+    beforeEach(() => {
+        runViewsWithCacheCheck.mockClear();
+    });
+
+    it('forwards BypassCache, so a deliberate database read is not answered from the server cache', async () => {
+        const forwarded = await forwardedParams({ EntityName: 'Customers', BypassCache: true });
+        expect(forwarded.BypassCache).toBe(true);
+    });
+
+    it('leaves BypassCache undefined when the caller did not ask for it', async () => {
+        const forwarded = await forwardedParams({ EntityName: 'Customers' });
+        expect(forwarded.BypassCache).toBeUndefined();
+    });
+
+    it('still forwards DataSource and Aggregates — the two fields previously found missing here', async () => {
+        const forwarded = await forwardedParams({
+            EntityName: 'Customers',
+            DataSource: 'Materialized',
+            Aggregates: [{ expression: 'COUNT(*)', alias: 'total' }],
+        });
+        expect(forwarded.DataSource).toBe('Materialized');
+        expect(forwarded.Aggregates).toEqual([{ expression: 'COUNT(*)', alias: 'total' }]);
+    });
+});

package/src/__tests__/RunViewResolver.cacheCheckScreen.test.ts

@@ -0,0 +1,165 @@
+// ResolverBase pulls in type-graphql decorators, which need the Reflect.metadata polyfill first.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * `RunViewsWithCacheCheck` is the transport `RunViews` switches to when any view in the batch is
+ * `CacheLocal`, so it carries the same client-supplied clauses as `RunViews`. These tests pin that
+ * it applies the same GraphQL-boundary protections before the provider is called: the base-view
+ * AST screen on ExtraFilter / OrderBy / OverrideExcludeFilter, and the API-key scope check.
+ *
+ * Every payload here is harmless (stacked `SELECT`s); the point is only whether it reaches the
+ * provider. The provider's own keyword denylist accepts the bracket-identifier payload, because a
+ * quote inside `[a']` hides the rest of the text from its literal stripper.
+ */
+
+const { authorize } = vi.hoisted(() => ({ authorize: vi.fn() }));
+
+vi.mock('@memberjunction/api-keys', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/api-keys')>();
+    return { ...actual, GetAPIKeyEngine: () => ({ Authorize: authorize }) };
+});
+
+import type { DatabaseProviderBase, EntityInfo, RunViewWithCacheCheckParams, UserInfo } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { RunDynamicViewInput, RunViewResolver, RunViewWithCacheCheckInput } from '../generic/RunViewResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/** A stacked statement hidden from the keyword denylist by a quote inside a bracket identifier. */
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM __mj.vwUserViews WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Email: 'reader@example.com', Name: 'Reader' } as UserInfo;
+
+function entity(name: string, schema: string, baseView: string): EntityInfo {
+    return {
+        Name: name,
+        SchemaName: schema,
+        BaseView: baseView,
+        PrimaryKeys: [{ Name: 'ID' }],
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetEffectiveRowFilterWhereClause: () => '',
+        GetDeniedReadFields: () => new Set<string>(),
+    } as unknown as EntityInfo;
+}
+
+/** Provider double: the metadata the screen reads, and a cache-check method that records calls. */
+function fakeProvider() {
+    const calls: RunViewWithCacheCheckParams[][] = [];
+    const entities = [
+        entity('MJ: User Views', '__mj', 'vwUserViews'),
+        entity('MJ: Users', '__mj', 'vwUsers'),
+    ];
+    const provider = {
+        Entities: entities,
+        EntityByName: (name: string) => entities.find((e) => e.Name === name),
+        RunViewsWithCacheCheck: async (params: RunViewWithCacheCheckParams[]) => {
+            calls.push(params);
+            return { success: true, results: [] };
+        },
+    };
+    return { provider: provider as unknown as DatabaseProviderBase, calls };
+}
+
+function context(provider: DatabaseProviderBase, payload: Partial<UserPayload> = {}): AppContext {
+    const userPayload = { email: USER.Email, userRecord: USER, ...payload } as UserPayload;
+    return { providers: [{ type: 'Read-Only', provider }], userPayload } as unknown as AppContext;
+}
+
+function cacheCheckInput(params: Partial<RunDynamicViewInput>): RunViewWithCacheCheckInput[] {
+    const dynamic = Object.assign(new RunDynamicViewInput(), { EntityName: 'MJ: User Views', ...params });
+    return [Object.assign(new RunViewWithCacheCheckInput(), { params: dynamic })];
+}
+
+describe('RunViewsWithCacheCheck — GraphQL-boundary clause screen', () => {
+    it('refuses a stacked statement hidden behind a bracket identifier, before the provider runs', async () => {
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: BRACKET_STACKED }),
+            context(provider),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('refuses a subquery against a base table', async () => {
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')` }),
+            context(provider),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/entity base view/);
+    });
+
+    it('screens OrderBy and OverrideExcludeFilter too', async () => {
+        for (const params of [
+            { OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { OverrideExcludeFilter: BRACKET_STACKED },
+        ]) {
+            const { provider, calls } = fakeProvider();
+
+            const result = await new RunViewResolver().RunViewsWithCacheCheck(cacheCheckInput(params), context(provider));
+
+            expect(calls).toHaveLength(0);
+            expect(result.success).toBe(false);
+        }
+    });
+
+    it('passes a filter that only reads entity base views through to the provider', async () => {
+        const { provider, calls } = fakeProvider();
+        const filter = `UserID IN (SELECT ID FROM [__mj].[vwUsers] WHERE Email = 'o''brien@example.com')`;
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: filter, OrderBy: '[Name] DESC' }),
+            context(provider),
+        );
+
+        expect(result.success).toBe(true);
+        expect(calls).toHaveLength(1);
+        expect(calls[0][0].params.ExtraFilter).toBe(filter);
+    });
+});
+
+describe('RunViewsWithCacheCheck — API-key scope', () => {
+    beforeEach(() => {
+        authorize.mockReset();
+        vi.spyOn(UserCache.Instance, 'GetSystemUser').mockReturnValue({ ID: 'system', Email: 'system@example.com' } as UserInfo);
+    });
+
+    it('refuses an API key without the batch view scope, before the provider runs', async () => {
+        authorize.mockResolvedValue({ Allowed: false, Reason: 'scope not granted' });
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `Name = 'x'` }),
+            context(provider, { apiKeyHash: 'hash-of-a-narrow-key' }),
+        );
+
+        expect(calls).toHaveLength(0);
+        expect(result.success).toBe(false);
+        expect(result.errorMessage).toMatch(/'view:batch' scope/);
+    });
+
+    it('lets an API key holding the scope through', async () => {
+        authorize.mockImplementation(async (_hash: string, _app: string, scope: string) => ({
+            Allowed: scope === 'view:batch',
+            Reason: scope === 'view:batch' ? 'granted' : 'not full access',
+        }));
+        const { provider, calls } = fakeProvider();
+
+        const result = await new RunViewResolver().RunViewsWithCacheCheck(
+            cacheCheckInput({ ExtraFilter: `Name = 'x'` }),
+            context(provider, { apiKeyHash: 'hash-of-a-batch-key' }),
+        );
+
+        expect(result.success).toBe(true);
+        expect(calls).toHaveLength(1);
+    });
+});

package/src/__tests__/SearchKnowledgeStreamResolver.test.ts

@@ -0,0 +1,161 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * Tests for SearchKnowledgeStreamResolver's wire mapping: a `provider` event is progress only.
+ *
+ * A provider's hits arrive before the engine's permission pass — rows the caller's row filters would drop,
+ * external-index hits not yet verified against the entity they name, content whose origin the caller may not
+ * read. The engine no longer puts them on its `provider` events, and the resolver does not forward them either,
+ * whatever the event holds: the client gets ProviderName, DurationMs and ResultCount, and results only in
+ * `fused`/`final`.
+ */
+
+const { streamEvents, streamCalls, resolveEffectivePermission, logForbiddenSearch } = vi.hoisted(() => ({
+    streamEvents: { current: [] as unknown[] },
+    streamCalls: { count: 0 },
+    resolveEffectivePermission: vi.fn(),
+    logForbiddenSearch: vi.fn(),
+}));
+
+vi.mock('@memberjunction/search-engine', () => ({
+    SearchEngine: {
+        Instance: {
+            streamSearch: async function* () {
+                streamCalls.count++;
+                for (const ev of streamEvents.current) yield ev;
+            },
+            LogForbiddenSearch: logForbiddenSearch,
+        },
+    },
+    GetSearchScopePermissionResolver: () => ({ ResolveEffectivePermission: resolveEffectivePermission }),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return { ...actual, LogError: vi.fn(), LogStatus: vi.fn() };
+});
+
+// Mock type-graphql to avoid the reflect-metadata dependency (the SearchKnowledgeResolver tests do the same).
+vi.mock('type-graphql', () => {
+    const noop = () => () => undefined;
+    const passthrough = () => (target: unknown) => target;
+    return {
+        Resolver: passthrough, Mutation: noop, Query: noop, Subscription: noop, Arg: noop, Args: noop, Ctx: noop,
+        ObjectType: passthrough, InputType: passthrough, ArgsType: passthrough, Field: noop,
+        Float: Number, Int: Number, ID: String, Authorized: noop, PubSub: noop, Root: noop,
+    };
+});
+
+import type { PubSubEngine } from 'type-graphql';
+import type { UserInfo } from '@memberjunction/core';
+import { SearchKnowledgeStreamResolver, SearchStreamNotification } from '../resolvers/SearchKnowledgeStreamResolver.js';
+import type { UserPayload } from '../types.js';
+
+class TestStreamResolver extends SearchKnowledgeStreamResolver {
+    protected override GetUserFromPayload(_userPayload: UserPayload): UserInfo | undefined {
+        return { ID: 'test-user-id', Email: 'test@test.com', Name: 'Test User' } as UserInfo;
+    }
+}
+
+const hit = (recordID: string) => ({
+    ID: `r-${recordID}`, EntityName: 'Customers', RecordID: recordID, SourceType: 'fulltext', ResultType: 'entity-record',
+    Title: `title of ${recordID}`, Snippet: `snippet of ${recordID}`, Score: 0.5, ScoreBreakdown: {}, Tags: [],
+    MatchedAt: new Date(), RawMetadata: `{"secret":"${recordID}"}`, ProviderId: 'prov-azure',
+});
+
+/** Run a stream to completion and return what the resolver published, in order. */
+async function publishedFor(events: unknown[]): Promise<SearchStreamNotification[]> {
+    streamEvents.current = events;
+    const published: SearchStreamNotification[] = [];
+    const pubSub = { publish: vi.fn(async (_topic: string, payload: SearchStreamNotification) => { published.push(payload); }) };
+    const start = await new TestStreamResolver().StreamScopedSearch(
+        'budget', 20, undefined, undefined, undefined, undefined,
+        pubSub as unknown as PubSubEngine, { userPayload: {} } as never,
+    );
+    expect(start.Success).toBe(true);
+    await vi.waitFor(() => expect(published.some(p => p.Phase === 'final' || p.Phase === 'error')).toBe(true),
+        { timeout: 500, interval: 5 });
+    return published;
+}
+
+describe('SearchKnowledgeStreamResolver — provider events are progress only', () => {
+    beforeEach(() => { vi.clearAllMocks(); });
+
+    it('publishes the count and no result, even when a provider event carries hits', async () => {
+        // An engine that (wrongly) put hits on a provider event: the resolver still must not forward them.
+        const published = await publishedFor([
+            { phase: 'provider', providerName: 'FullText', results: [hit('row-filtered')], resultCount: 1, durationMs: 7 },
+            { phase: 'fused', results: [] },
+            { phase: 'final', results: [], sourceCounts: { Vector: 0, FullText: 1, Entity: 0, Storage: 0 }, elapsedMs: 9 },
+        ]);
+
+        const progress = published.find(p => p.Phase === 'provider');
+        expect(progress).toMatchObject({ Phase: 'provider', ProviderName: 'FullText', DurationMs: 7, ResultCount: 1, Results: [] });
+        expect(JSON.stringify(progress)).not.toContain('row-filtered');
+    });
+
+    it('carries results on final, mapped as the synchronous resolver maps them', async () => {
+        const published = await publishedFor([
+            { phase: 'provider', providerName: 'FullText', results: [], resultCount: 1, durationMs: 7 },
+            { phase: 'fused', results: [hit('readable')] },
+            { phase: 'final', results: [hit('readable')], sourceCounts: { Vector: 0, FullText: 1, Entity: 0, Storage: 0 }, elapsedMs: 9 },
+        ]);
+
+        const final = published.find(p => p.Phase === 'final');
+        expect(final?.Results?.map(r => r.RecordID)).toEqual(['readable']);
+        expect(final?.ResultCount).toBeUndefined();
+    });
+});
+
+describe('SearchKnowledgeStreamResolver — the scope permission gate runs before the stream starts', () => {
+    const verdict = (Allowed: boolean, Level: string) => ({ Allowed, Level, Source: 'NoGrant', Reason: 'judged in test' });
+
+    beforeEach(() => {
+        streamEvents.current = [{ phase: 'final', results: [], sourceCounts: { Vector: 0, FullText: 0, Entity: 0, Storage: 0 }, elapsedMs: 1 }];
+        streamCalls.count = 0;
+        resolveEffectivePermission.mockReset();
+        logForbiddenSearch.mockReset();
+    });
+
+    async function start(scopeIDs: string[]) {
+        const pubSub = { publish: vi.fn(async () => undefined) };
+        const result = await new TestStreamResolver().StreamScopedSearch(
+            'budget', 20, undefined, scopeIDs, undefined, undefined,
+            pubSub as unknown as PubSubEngine, { userPayload: {} } as never,
+        );
+        return { result, pubSub };
+    }
+
+    it('refuses a denied scope, logs it, and never starts the stream or publishes', async () => {
+        resolveEffectivePermission.mockResolvedValue(verdict(false, 'None'));
+
+        const { result, pubSub } = await start(['scope-a']);
+
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/^Forbidden: refused for this user on scope 'scope-a'/);
+        expect(logForbiddenSearch).toHaveBeenCalledTimes(1);
+        await new Promise((r) => setTimeout(r, 20));
+        expect(streamCalls.count).toBe(0);
+        expect(pubSub.publish).not.toHaveBeenCalled();
+    });
+
+    it('refuses a Read-level grant: Read is metadata only, not search', async () => {
+        resolveEffectivePermission.mockResolvedValue(verdict(true, 'Read'));
+
+        const { result } = await start(['scope-a']);
+
+        expect(result.Success).toBe(false);
+        await new Promise((r) => setTimeout(r, 20));
+        expect(streamCalls.count).toBe(0);
+    });
+
+    it('judges every requested scope and starts the stream when all may be searched', async () => {
+        resolveEffectivePermission.mockResolvedValue(verdict(true, 'Search'));
+
+        const { result } = await start(['scope-a', 'scope-b']);
+
+        expect(result.Success).toBe(true);
+        expect(resolveEffectivePermission).toHaveBeenCalledTimes(2);
+        await vi.waitFor(() => expect(streamCalls.count).toBe(1), { timeout: 500, interval: 5 });
+    });
+});