@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/TestQuerySQLResolver.test.ts

@@ -0,0 +1,274 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi } from 'vitest';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+        Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+        createUnionType: () => class {},
+        AuthorizationError: class AuthorizationError extends Error {},
+        Float: class {}, Int: class {}, ID: class {},
+    };
+});
+
+vi.mock('../config.js', () => ({ configInfo: { databaseSettings: { requestTimeout: 120_000 } } }));
+
+import { UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase } from '@memberjunction/core';
+import { TestQuerySQLResolver, TestQuerySQLInput } from '../resolvers/TestQuerySQLResolver.js';
+import type { AppContext } from '../types.js';
+
+interface EntityFixture {
+    Name: string;
+    SchemaName: string;
+    BaseView: string;
+    canRead?: boolean;
+    rowFilter?: string;
+    deniedFields?: string[];
+}
+
+function createReadOnlyProvider(entities: EntityFixture[]): DatabaseProviderBase {
+    return {
+        PlatformKey: 'sqlserver',
+        Entities: entities.map((e) => ({
+            Name: e.Name,
+            SchemaName: e.SchemaName,
+            BaseView: e.BaseView,
+            GetUserPermisions: () => ({ CanRead: e.canRead ?? true }),
+            GetEffectiveRowFilterWhereClause: () => e.rowFilter ?? '',
+            GetDeniedReadFields: () => new Set<string>(e.deniedFields ?? []),
+        })),
+    } as unknown as DatabaseProviderBase;
+}
+
+function createPlainUser(): UserInfo {
+    const u = new UserInfo();
+    u.ID = 'D1F1A0C4-0000-4000-8000-000000000001';
+    u.Email = 'user@example.com';
+    return u;
+}
+
+const RUBRIC_EVALUATIONS: EntityFixture = {
+    Name: 'MJ: Rubric Evaluations',
+    SchemaName: '__mj',
+    BaseView: 'vwRubricEvaluations',
+};
+
+const AI_MODELS: EntityFixture = {
+    Name: 'MJ: AI Models',
+    SchemaName: '__mj',
+    BaseView: 'vwAIModels',
+};
+
+describe('TestQuerySQLResolver scope-limited principal guard', () => {
+    const resolverSrc = readFileSync(resolve(__dirname, '../resolvers/TestQuerySQLResolver.ts'), 'utf8');
+
+    it('checks IsScopeLimitedPrincipal before acquiring the read-only provider or authorizing SQL', () => {
+        const scopeGuardIdx = resolverSrc.indexOf('IsScopeLimitedPrincipal(');
+        const providerIdx = resolverSrc.indexOf('GetReadOnlyProvider(');
+        const authorizeIdx = resolverSrc.indexOf('this.AuthorizeRenderedTestSQL(');
+
+        expect(scopeGuardIdx).toBeGreaterThan(-1);
+        expect(providerIdx).toBeGreaterThan(-1);
+        expect(authorizeIdx).toBeGreaterThan(-1);
+        expect(scopeGuardIdx).toBeLessThan(providerIdx);
+        expect(providerIdx).toBeLessThan(authorizeIdx);
+    });
+
+    it('refuses anonymous magic-link guests, resource-scoped sessions, and missing principals', async () => {
+        const resolver = new TestQuerySQLResolver();
+        const input: TestQuerySQLInput = { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' };
+
+        const anonGuest = createPlainUser();
+        anonGuest.IsMagicLinkAnonymous = true;
+
+        const scopedUser = createPlainUser();
+        scopedUser.MagicLinkScope = { ResourceID: 'A0000000-0000-4000-8000-000000000009' };
+
+        for (const userRecord of [anonGuest, scopedUser, undefined]) {
+            const context = {
+                userPayload: { userRecord, email: 'guest@example.com', sessionId: 'sess-1' },
+                providers: [],
+            } as unknown as AppContext;
+
+            const result = await resolver.TestQuerySQL(input, context);
+            expect(result.Success).toBe(false);
+            expect(result.RowCount).toBe(0);
+            expect(result.ErrorMessage).toBe('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+    });
+});
+
+describe('TestQuerySQLResolver.AuthorizeRenderedTestSQL', () => {
+    const resolver = new TestQuerySQLResolver();
+    const user = createPlainUser();
+
+    it('admits a read query referencing only unscoped readable entity base views', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS, AI_MODELS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT r.ID, m.Name FROM [__mj].[vwRubricEvaluations] r INNER JOIN [__mj].[vwAIModels] m ON r.ID = m.ID' },
+            provider,
+            user,
+        );
+        expect(refusal).toBeNull();
+    });
+
+    it('allows a table-free query that reads niladic user functions (CURRENT_USER, SESSION_USER, SYSTEM_USER)', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT CURRENT_USER AS UserName, SESSION_USER AS SessionUser, SYSTEM_USER AS SystemUser' },
+            provider,
+            user,
+        );
+        expect(refusal).toBeNull();
+    });
+
+    it('refuses a query that reads a base table instead of an entity base view', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT * FROM [__mj].[User]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/entity base view/);
+    });
+
+    it('refuses a query that reads an entity the caller does not have CanRead permission for', () => {
+        const provider = createReadOnlyProvider([{ ...RUBRIC_EVALUATIONS, canRead: false }]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/not permitted to read|permission/i);
+    });
+
+    it('refuses a query that reads a row-level-security filtered entity', () => {
+        const provider = createReadOnlyProvider([
+            { ...RUBRIC_EVALUATIONS, rowFilter: "EvaluatorUserID = 'user-1'" },
+        ]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/row-level-security filtered/);
+    });
+
+    it('refuses a query that reads an entity with denied read fields for the caller', () => {
+        const provider = createReadOnlyProvider([
+            { ...RUBRIC_EVALUATIONS, deniedFields: ['SecretScore'] },
+        ]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/fields you are not permitted to read/);
+    });
+
+    it('refuses write statements and stacked SQL batches at render time', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+
+        const deleteRefusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'DELETE FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(deleteRefusal).toMatch(/single read query/i);
+
+        const stackedRefusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]; SELECT * FROM [__mj].[User]' },
+            provider,
+            user,
+        );
+        expect(stackedRefusal).toMatch(/single read query/i);
+    });
+
+    it('screens the rendered SQL after Nunjucks template expansion', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+
+        // Safe parameter substitution on an allowed view passes
+        const safeRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations] WHERE Name = {{ targetName | sqlString }}',
+                UsesTemplate: true,
+                Parameters: { targetName: 'Q1 Eval' },
+            },
+            provider,
+            user,
+        );
+        expect(safeRefusal).toBeNull();
+
+        // Template expansion that introduces a base table reference is refused
+        const injectedTableRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT * FROM {{ targetTable }}',
+                UsesTemplate: true,
+                Parameters: { targetTable: '[__mj].[User]' },
+            },
+            provider,
+            user,
+        );
+        expect(injectedTableRefusal).toMatch(/entity base view/);
+    });
+
+    it('screens the rendered SQL after inline Dependencies ({{query:"..."}}) composition', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS, AI_MODELS]);
+
+        // Inline dependency reading an unscoped readable entity base view is admitted
+        const allowedDepRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT sub.ID FROM {{query:"Analytics/Evals/Base"}} sub',
+                Dependencies: [
+                    {
+                        Name: 'Base',
+                        CategoryPath: '/Analytics/Evals/',
+                        SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]',
+                    },
+                ],
+            },
+            provider,
+            user,
+        );
+        expect(allowedDepRefusal).toBeNull();
+
+        // Inline dependency reading a base table is refused when composed into the outer query
+        const forbiddenDepRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT sub.ID FROM {{query:"Analytics/Evals/LeakedUsers"}} sub',
+                Dependencies: [
+                    {
+                        Name: 'LeakedUsers',
+                        CategoryPath: '/Analytics/Evals/',
+                        SQL: 'SELECT ID FROM [__mj].[User]',
+                    },
+                ],
+            },
+            provider,
+            user,
+        );
+        expect(forbiddenDepRefusal).toMatch(/entity base view/);
+    });
+});
+
+describe('IntegrationDiscoveryResolver webhook SSRF guard', () => {
+    const discoverySrc = readFileSync(resolve(__dirname, '../resolvers/IntegrationDiscoveryResolver.ts'), 'utf8');
+
+    it('routes sendWebhook through SafeFetch from @memberjunction/network-utils instead of bare fetch', () => {
+        expect(discoverySrc).toMatch(/import\s*\{[^}]*\bSafeFetch\b[^}]*\}\s*from\s*['"]@memberjunction\/network-utils['"]/);
+        const sendWebhookStart = discoverySrc.indexOf('private async sendWebhook(');
+        expect(sendWebhookStart).toBeGreaterThan(-1);
+        const sendWebhookBody = discoverySrc.slice(sendWebhookStart, sendWebhookStart + 800);
+        expect(sendWebhookBody).toContain('await SafeFetch(url,');
+        expect(sendWebhookBody).not.toMatch(/(?<![A-Za-z])fetch\s*\(/);
+    });
+});

package/src/__tests__/TransactionGroupResolver.refusals.test.ts

@@ -41,6 +41,7 @@ import {
     TransactionInputType,
     TransactionItemInputType,
     TransactionOperationType,
+    TransactionVariableType,
 } from '../resolvers/TransactionGroupResolver.js';
 import type { AppContext } from '../types.js';
 
@@ -57,7 +58,10 @@ class FakeTransactionGroup {
     public AddTransaction(label: string): void {
         this.Enrolled.push(label);
     }
-    public AddVariable(): void { /* no variables in these tests */ }
+    public Variables: unknown[] = [];
+    public AddVariable(variable: unknown): void {
+        this.Variables.push(variable);
+    }
     public async Submit(): Promise<boolean> {
         this.SubmitCalled = true;
         // TransactionGroupBase.Submit(): an empty group is "nothing to do" and returns true.
@@ -287,4 +291,97 @@ describe('ExecuteTransactionGroup — rows refused server-side (issue #4309)', (
         expect(result.Success).toBe(true);
         expect(group.Enrolled).toHaveLength(0);
     });
+
+    it("registers the group's variables before any row's Save(), so a server-side check can see them", async () => {
+        // A 'Use' variable sets its field at Submit(), after every Save()-time check has passed. A check
+        // that depends on a field's final value (who a conversation message is from) can refuse such a
+        // row only if the variable is already on the group when its Save() runs.
+        const variablesAtSave: number[] = [];
+        class RecordingEntity extends FakeEntity {
+            public override async Save(): Promise<boolean> {
+                variablesAtSave.push(this.TransactionGroup?.Variables.length ?? -1);
+                return super.Save();
+            }
+        }
+        const entities = [
+            new RecordingEntity('MJ: User Roles', { accepts: true }),
+            new RecordingEntity('MJ: User Roles', { accepts: true }),
+        ];
+        const { context } = buildContext(entities);
+        const input = buildGroupInput(2);
+        input.Variables = [
+            { Name: 'v', ItemIndex: 0, FieldName: 'ID', Type: TransactionVariableType.Define },
+            { Name: 'v', ItemIndex: 1, FieldName: 'UserID', Type: TransactionVariableType.Use },
+        ];
+
+        const result = await new TransactionResolver().ExecuteTransactionGroup(input, context);
+
+        expect(result.Success).toBe(true);
+        expect(variablesAtSave).toEqual([2, 2]);
+    });
+
+    it('returns delta-only ResultsJSON on Update (PK, client-sent fields, datestamps, and server-changed fields), omitting unchanged columns', async () => {
+        const preLoadedRow: Record<string, unknown> = {
+            ID: 'a0000000-0000-0000-0000-000000000099',
+            Name: 'Action One',
+            Description: 'Initial description',
+            DriverClass: 'OriginalDriver',
+            Category: 'Utilities',
+            __mj_CreatedAt: '2026-01-01T00:00:00.000Z',
+            __mj_UpdatedAt: '2026-02-01T00:00:00.000Z',
+        };
+        for (let i = 1; i <= 15; i++) {
+            preLoadedRow[`UnchangedField${i}`] = `Constant-${i}`;
+        }
+
+        class ServerMutatingEntity extends FakeEntity {
+            public override async Save(): Promise<boolean> {
+                const ok = await super.Save();
+                if (ok) {
+                    // Simulate server-side DB update refreshing __mj_UpdatedAt and a computed/trigger column
+                    this.SetMany({
+                        __mj_UpdatedAt: '2026-03-01T00:00:00.000Z',
+                        Category: 'Automation (Server Refreshed)',
+                    });
+                }
+                return ok;
+            }
+        }
+
+        const entity = new ServerMutatingEntity('MJ: Actions', {
+            accepts: true,
+            loadedValues: preLoadedRow,
+        });
+        const { context } = buildContext([entity]);
+        const input: TransactionInputType = {
+            Items: [
+                {
+                    EntityName: 'MJ: Actions',
+                    EntityObjectJSON: JSON.stringify({
+                        ID: 'a0000000-0000-0000-0000-000000000099',
+                        Description: 'Updated description',
+                    }),
+                    OperationType: TransactionOperationType.Update,
+                },
+            ],
+            Variables: [],
+        };
+
+        const result = await new TransactionResolver().ExecuteTransactionGroup(input, context);
+
+        expect(result.Success).toBe(true);
+        const returnedObj = JSON.parse(result.ResultsJSON[0]) as Record<string, unknown>;
+        expect(returnedObj).toEqual({
+            ID: 'a0000000-0000-0000-0000-000000000099',
+            Description: 'Updated description',
+            Category: 'Automation (Server Refreshed)',
+            __mj_CreatedAt: '2026-01-01T00:00:00.000Z',
+            __mj_UpdatedAt: '2026-03-01T00:00:00.000Z',
+        });
+        expect(returnedObj).not.toHaveProperty('Name');
+        expect(returnedObj).not.toHaveProperty('DriverClass');
+        for (let i = 1; i <= 15; i++) {
+            expect(returnedObj).not.toHaveProperty(`UnchangedField${i}`);
+        }
+    });
 });

package/src/__tests__/UpdateMJDataContextItem.oldValues.test.ts

@@ -0,0 +1,220 @@
+// type-graphql decorators in the resolver graph need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+/**
+ * `UpdateMJDataContextItem` goes through `ResolverBase.UpdateRecord`. `MJ: Data Context Items` does
+ * not track record changes, so without special handling a client that sends `OldValues___` decides
+ * the record's starting state. It could repeat its new SQL as the old value, so the SQL field does
+ * not look changed. Or it could leave `Type` and `SQL` out entirely, so they are never loaded and
+ * the stored procedure keeps the stored SQL item. The server entity class for the item must still
+ * refuse a non-Owner's save of a SQL item on every one of these paths.
+ *
+ * The resolver base and the entity class are real. The provider hands out real entity objects,
+ * loads a fixed stored row, and records each save instead of writing it.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { EntityInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import type { BaseEntity, DatabaseProviderBase, IEntityDataProvider, IMetadataProvider } from '@memberjunction/core';
+import { MJDataContextItemEntityServer } from '@memberjunction/core-entities-server';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+
+const ENTITY_ID = 'E0000000-0000-4000-8000-0000000000D2';
+const UI_ROLE_ID = 'E1000000-0000-4000-8000-000000000001';
+const DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000001';
+const OTHER_DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000002';
+const ITEM_ID = 'C0000000-0000-4000-8000-000000000001';
+const STORED_SQL = 'SELECT 1 AS One';
+const NEW_SQL = 'SELECT 2 AS Two';
+
+interface StoredRow {
+    ID: string;
+    DataContextID: string;
+    Type: string;
+    SQL: string | null;
+    DataJSON: string | null;
+    Description: string | null;
+}
+
+/** A SQL item in someone else's data context. */
+const STORED_SQL_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: STORED_SQL, DataJSON: null, Description: 'Revenue',
+};
+
+/** An item of another type, with no SQL. */
+const STORED_ENTITY_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'full_entity', SQL: null, DataJSON: null, Description: 'Notes',
+};
+
+/**
+ * `MJ: Data Context Items` as the database describes it: record changes and field-level security
+ * off, the API open, and the UI role holding every permission with no row-level filter.
+ */
+const ITEM_ENTITY = new EntityInfo({
+    ID: ENTITY_ID,
+    Name: 'MJ: Data Context Items',
+    SchemaName: '__mj',
+    BaseTable: 'DataContextItem',
+    BaseView: 'vwDataContextItems',
+    Status: 'Active',
+    IncludeInAPI: true,
+    AllowCreateAPI: true,
+    AllowUpdateAPI: true,
+    AllowDeleteAPI: true,
+    TrackRecordChanges: false,
+    EnableFieldLevelSecurity: false,
+    EntityPermissions: [{
+        ID: 'P0000000-0000-4000-8000-000000000001', EntityID: ENTITY_ID, RoleID: UI_ROLE_ID,
+        CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true,
+    }],
+    EntityFields: [
+        { Name: 'ID', Type: 'uniqueidentifier', AllowsNull: false, IsPrimaryKey: true },
+        { Name: 'DataContextID', Type: 'uniqueidentifier', AllowsNull: false },
+        { Name: 'Type', Type: 'nvarchar', AllowsNull: false },
+        { Name: 'SQL', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'DataJSON', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'Description', Type: 'nvarchar', AllowsNull: true },
+    ].map((c, i) => ({
+        ID: `F0000000-0000-4000-8000-00000000000${i}`,
+        EntityID: ENTITY_ID,
+        Sequence: i + 1,
+        Length: 0,
+        Precision: 0,
+        Scale: 0,
+        AllowUpdateAPI: true,
+        ...c,
+    })),
+});
+
+/** A UI-role user who is not an administrator. */
+const UI_USER = new UserInfo(null, {
+    ID: 'A0000000-0000-4000-8000-000000000002',
+    Email: 'ui-user@example.com',
+    Type: 'User',
+    UserRoles: [new UserRoleInfo({ UserID: 'A0000000-0000-4000-8000-000000000002', RoleID: UI_ROLE_ID })],
+});
+
+const PAYLOAD: UserPayload = { email: UI_USER.Email, userRecord: UI_USER, sessionId: 'test-session' };
+const PUB_SUB = { publish: async (): Promise<void> => undefined } as unknown as PubSubEngine;
+
+/** What one save would have written. */
+interface RecordedSave {
+    DataContextID: string;
+    SQL: string | null;
+    DataJSON: string | null;
+}
+
+/** A database provider whose load returns `stored`, and which records each save it receives. */
+function recordingDatabase(stored: StoredRow): { Saves: RecordedSave[]; Provider: DatabaseProviderBase } {
+    const saves: RecordedSave[] = [];
+    const entityData = {
+        async Load(): Promise<Record<string, unknown>> {
+            return { ...stored };
+        },
+        async Save(entity: BaseEntity): Promise<Record<string, unknown>> {
+            const item = entity as MJDataContextItemEntityServer;
+            saves.push({ DataContextID: item.DataContextID, SQL: item.SQL, DataJSON: item.DataJSON });
+            return entity.GetAll();
+        },
+    } as unknown as IEntityDataProvider;
+    const database = {
+        async GetEntityObject(_entityName: string, user: UserInfo): Promise<MJDataContextItemEntityServer> {
+            const item = new MJDataContextItemEntityServer(ITEM_ENTITY, entityData);
+            item.ContextCurrentUser = user;
+            return item;
+        },
+    } as unknown as DatabaseProviderBase;
+    return { Saves: saves, Provider: database };
+}
+
+/** Builds an `OldValues___` array from a plain object. */
+function oldValues(values: Record<string, string | null>): Array<{ Key: string; Value: string | null }> {
+    return Object.entries(values).map(([Key, Value]) => ({ Key, Value }));
+}
+
+/** Exposes ResolverBase's generic update path, which the generated `UpdateMJDataContextItem` mutation calls. */
+class UpdateHarness extends ResolverBase {
+    /** Runs the update and reports how it ended: 'saved', or the message it was refused with. */
+    public async Update(input: Record<string, unknown>, provider: DatabaseProviderBase): Promise<string> {
+        try {
+            await this.UpdateRecord('MJ: Data Context Items', input, provider, PAYLOAD, PUB_SUB);
+            return 'saved';
+        } catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+}
+
+const harness = new UpdateHarness();
+
+describe('UpdateMJDataContextItem — a non-Owner may not change a SQL item', () => {
+    it('refuses new SQL when the update loads the stored row (no OldValues___)', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+
+        const outcome = await harness.Update({ ...STORED_SQL_ITEM, SQL: NEW_SQL }, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses new SQL when OldValues___ repeats the new SQL, so the field does not look changed', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ...STORED_SQL_ITEM,
+            SQL: NEW_SQL,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: NEW_SQL, Description: 'Revenue' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses moving a SQL item to another data context when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataContextID: OTHER_DATA_CONTEXT_ID,
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses changing the cached DataJSON of a SQL item when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataJSON: '[{"One":2}]',
+            OldValues___: oldValues({ ID: ITEM_ID, DataJSON: null }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('still saves a non-Owner\'s change to an item of another type that sends OldValues___', async () => {
+        // The success path maps the saved row back through the process-wide metadata.
+        vi.spyOn(Metadata, 'Provider', 'get').mockReturnValue(
+            { Entities: [ITEM_ENTITY], EntityByName: () => ITEM_ENTITY } as unknown as IMetadataProvider,
+        );
+        const db = recordingDatabase(STORED_ENTITY_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, Description: 'Notes' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(outcome).toBe('saved');
+        expect(db.Saves).toEqual([{ DataContextID: DATA_CONTEXT_ID, SQL: null, DataJSON: null }]);
+    });
+});