@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/UserAvatarResolver.test.ts

@@ -0,0 +1,255 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * Tests for UserAvatarResolver.UpdateMyAvatar.
+ *
+ * The decorators are stubbed to no-ops (see TagGovernanceResolver.test.ts for the same shape),
+ * and the provider hands back a small fake `MJ: Users` entity that tracks dirty state the way
+ * BaseEntity does, so the tests can assert what the row looks like AT THE MOMENT OF SAVE.
+ */
+
+const SYSTEM_USER = { ID: 'system-user-id', Email: 'system@example.com', Type: 'Owner' };
+const CALLER = { ID: 'caller-id', Email: 'caller@example.com', Type: 'User' };
+
+/** The stored row the fake entity loads. */
+const STORED_ROW: Record<string, string | null> = {
+  ID: CALLER.ID,
+  Name: 'caller@example.com',
+  Email: 'caller@example.com',
+  FirstName: 'Alice',
+  Type: 'User',
+  UserImageURL: 'https://example.com/old.png',
+  UserImageIconClass: null,
+};
+
+class FakeUserEntity {
+  public ContextUser: unknown;
+  public LoadedID: string | undefined;
+  public SavedSnapshot: Record<string, string | null> | undefined;
+  public SavedDirtyFields: string[] = [];
+  public LoadResult = true;
+  public SaveResult = true;
+  public SaveThrows: Error | undefined;
+  public DirtyOnLoad: Record<string, string> = {};
+  public LatestResult = { CompleteMessage: 'spUpdateUser failed: boom' };
+  private oldValues: Record<string, string | null> = {};
+  private values: Record<string, string | null> = {};
+
+  constructor(contextUser: unknown) {
+    this.ContextUser = contextUser;
+  }
+
+  async Load(id: string): Promise<boolean> {
+    this.LoadedID = id;
+    if (!this.LoadResult) {
+      return false;
+    }
+    this.oldValues = { ...STORED_ROW };
+    // Simulate state left dirty by something other than this resolver (a subclass hook, say).
+    this.values = { ...STORED_ROW, ...this.DirtyOnLoad };
+    return true;
+  }
+
+  Revert(): boolean {
+    this.values = { ...this.oldValues };
+    return true;
+  }
+
+  get UserImageURL(): string | null { return this.values.UserImageURL; }
+  set UserImageURL(v: string | null) { this.values.UserImageURL = v; }
+  get UserImageIconClass(): string | null { return this.values.UserImageIconClass; }
+  set UserImageIconClass(v: string | null) { this.values.UserImageIconClass = v; }
+
+  async Save(): Promise<boolean> {
+    if (this.SaveThrows) {
+      throw this.SaveThrows;
+    }
+    this.SavedSnapshot = { ...this.values };
+    this.SavedDirtyFields = Object.keys(this.values).filter((k) => this.values[k] !== this.oldValues[k]);
+    return this.SaveResult;
+  }
+}
+
+const { state, logStatus, logError, scopeCheck } = vi.hoisted(() => ({
+  state: {
+    entity: undefined as FakeUserEntity | undefined,
+    entityName: undefined as string | undefined,
+    configure: undefined as ((e: FakeUserEntity) => void) | undefined,
+    systemUserThrows: false,
+  },
+  logStatus: vi.fn(),
+  logError: vi.fn(),
+  scopeCheck: vi.fn(async () => undefined),
+}));
+
+vi.mock('type-graphql', () => ({
+  Resolver: () => () => undefined,
+  Mutation: () => () => undefined,
+  Ctx: () => () => undefined,
+  Arg: () => () => undefined,
+  ObjectType: () => () => undefined,
+  Field: () => () => undefined,
+}));
+
+vi.mock('@memberjunction/core', () => ({ LogStatus: logStatus, LogError: logError }));
+
+vi.mock('../generic/ResolverBase.js', () => ({
+  ResolverBase: class {
+    CheckAPIKeyScopeAuthorization = scopeCheck;
+  },
+}));
+
+vi.mock('../auth/index.js', () => ({
+  GetSystemUser: async () => {
+    if (state.systemUserThrows) {
+      throw new Error('System user not found');
+    }
+    return SYSTEM_USER;
+  },
+}));
+
+vi.mock('../util.js', () => ({
+  GetReadWriteProvider: () => ({
+    GetEntityObject: async (entityName: string, contextUser: unknown) => {
+      state.entityName = entityName;
+      state.entity = new FakeUserEntity(contextUser);
+      state.configure?.(state.entity);
+      return state.entity;
+    },
+  }),
+}));
+
+import { UserAvatarResolver } from '../resolvers/UserAvatarResolver.js';
+import type { AppContext } from '../types.js';
+
+function ctxFor(userRecord: unknown): AppContext {
+  return { userPayload: { email: 'caller@example.com', userRecord, sessionId: 's-1' }, providers: [] } as unknown as AppContext;
+}
+
+const PNG = `data:image/png;base64,${Buffer.alloc(16, 1).toString('base64')}`;
+
+describe('UserAvatarResolver.UpdateMyAvatar', () => {
+  let resolver: UserAvatarResolver;
+
+  beforeEach(() => {
+    state.entity = undefined;
+    state.entityName = undefined;
+    state.configure = undefined;
+    state.systemUserThrows = false;
+    logStatus.mockClear();
+    logError.mockClear();
+    scopeCheck.mockReset();
+    scopeCheck.mockImplementation(async () => undefined);
+    resolver = new UserAvatarResolver();
+  });
+
+  it('refuses an unauthenticated request without touching the database', async () => {
+    await expect(resolver.UpdateMyAvatar(ctxFor(undefined), PNG, null)).rejects.toThrow('not authenticated');
+    expect(state.entity).toBeUndefined();
+  });
+
+  it.each([
+    ['an anonymous magic-link guest (the shared Anonymous principal)', { ...CALLER, IsMagicLinkAnonymous: true }],
+    ['a resource-scoped magic-link session', { ...CALLER, MagicLinkScope: { ResourceID: 'r-1', ResourceType: 'Conversation' } }],
+  ])('refuses %s without touching the database', async (_label, caller) => {
+    const result = await resolver.UpdateMyAvatar(ctxFor(caller), PNG, null);
+    expect(result.Success).toBe(false);
+    expect(result.ErrorMessage).toContain('scope-limited');
+    expect(state.entity).toBeUndefined();
+  });
+
+  it('runs the API key scope check as entity:update on MJ: Users, and stops if it throws', async () => {
+    scopeCheck.mockImplementation(async () => {
+      throw new Error('scope denied');
+    });
+    const ctx = ctxFor(CALLER);
+    await expect(resolver.UpdateMyAvatar(ctx, PNG, null)).rejects.toThrow('scope denied');
+    expect(scopeCheck).toHaveBeenCalledWith('entity:update', 'MJ: Users', ctx.userPayload);
+    expect(state.entity).toBeUndefined();
+  });
+
+  it('refuses invalid input before loading anything', async () => {
+    const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), 'javascript:alert(1)', null);
+    expect(result.Success).toBe(false);
+    expect(result.ErrorMessage).toContain('http or https');
+    expect(state.entity).toBeUndefined();
+  });
+
+  it("loads the CALLER's own row, taken from the request context", async () => {
+    const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+    expect(result).toEqual({ Success: true });
+    expect(state.entityName).toBe('MJ: Users');
+    expect(state.entity?.LoadedID).toBe(CALLER.ID);
+  });
+
+  it('makes the write as the system user, and logs which user asked', async () => {
+    await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+    expect(state.entity?.ContextUser).toBe(SYSTEM_USER);
+    expect(logStatus).toHaveBeenCalledWith(expect.stringContaining(CALLER.ID));
+  });
+
+  it('writes the two avatar columns', async () => {
+    await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+    expect(state.entity?.SavedSnapshot).toMatchObject({ UserImageURL: PNG, UserImageIconClass: null });
+  });
+
+  it('writes ONLY the two avatar columns, even when the loaded entity carried other dirty state', async () => {
+    state.configure = (e) => {
+      e.DirtyOnLoad = { Email: 'someone-else@example.com', FirstName: 'Mallory', Type: 'Owner' };
+    };
+    const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), null, 'fa-solid fa-user');
+    expect(result.Success).toBe(true);
+    expect(state.entity?.SavedDirtyFields.sort()).toEqual(['UserImageIconClass', 'UserImageURL']);
+    expect(state.entity?.SavedSnapshot).toEqual({ ...STORED_ROW, UserImageURL: null, UserImageIconClass: 'fa-solid fa-user' });
+  });
+
+  it('clears both columns when both are null (revert to default)', async () => {
+    const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), null, null);
+    expect(result.Success).toBe(true);
+    expect(state.entity?.SavedSnapshot).toMatchObject({ UserImageURL: null, UserImageIconClass: null });
+  });
+
+  describe('failure paths', () => {
+    it('returns a failure when the row cannot be loaded', async () => {
+      state.configure = (e) => {
+        e.LoadResult = false;
+      };
+      const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+      expect(result).toEqual({ Success: false, ErrorMessage: 'Could not load your user record.' });
+      expect(state.entity?.SavedSnapshot).toBeUndefined();
+      expect(logError).toHaveBeenCalledWith(expect.stringContaining(CALLER.ID));
+    });
+
+    it("logs the save's CompleteMessage but returns only a generic message when Save() returns false", async () => {
+      state.configure = (e) => {
+        e.SaveResult = false;
+      };
+      const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('Could not save your avatar');
+      expect(result.ErrorMessage).not.toContain('spUpdateUser');
+      expect(logError).toHaveBeenCalledWith(expect.stringContaining('spUpdateUser failed: boom'));
+      expect(logError).toHaveBeenCalledWith(expect.stringContaining(CALLER.ID));
+    });
+
+    it('returns a failure (does not throw) when Save() throws', async () => {
+      state.configure = (e) => {
+        e.SaveThrows = new Error('connection reset');
+      };
+      const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('Could not save your avatar');
+      expect(result.ErrorMessage).not.toContain('connection reset');
+      expect(logError).toHaveBeenCalledWith(expect.stringContaining('connection reset'));
+    });
+
+    it('returns a failure when the system user cannot be resolved', async () => {
+      state.systemUserThrows = true;
+      const result = await resolver.UpdateMyAvatar(ctxFor(CALLER), PNG, null);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).not.toContain('System user');
+      expect(logError).toHaveBeenCalledWith(expect.stringContaining('System user not found'));
+      expect(state.entity).toBeUndefined();
+    });
+  });
+});

package/src/__tests__/UserResolver.currentUser.test.ts

@@ -1,10 +1,11 @@
 import { describe, it, expect, vi, afterEach } from 'vitest';
-import { LogError } from '@memberjunction/core';
+import { LogError, UserInfo } from '@memberjunction/core';
 import {
   AssertRoleLoadSucceeded,
   RequireContextUser,
   RequireLoadedUser,
   RequireRoleProvider,
+  SessionUserFields,
   UserIdExtraFilter,
 } from '../resolvers/currentUserRoles.js';
 
@@ -85,3 +86,17 @@ describe('CurrentUser role-load guards', () => {
     });
   });
 });
+
+describe('SessionUserFields', () => {
+  it('returns every UserInfo field the client asks CurrentUser for', () => {
+    // GraphQLDataProvider requests each UserInfo key that doesn't start with a single underscore.
+    const requested = Object.keys(new UserInfo(null, null)).filter((k) => k.startsWith('__mj_') || !k.startsWith('_'));
+    const returned = Object.keys(SessionUserFields(new UserInfo(null, { ID: 'u-1' })));
+    expect(requested.filter((k) => !returned.includes(k))).toEqual([]);
+  });
+
+  it('carries IsTemplate, which the template-user banner reads', () => {
+    const user = new UserInfo(null, { ID: 'u-1', Email: 'demo@example.org', IsTemplate: true });
+    expect(SessionUserFields(user)).toMatchObject({ ID: 'u-1', Email: 'demo@example.org', IsTemplate: true });
+  });
+});

package/src/__tests__/ViewOperationsHandler.clauseScreen.test.ts

@@ -0,0 +1,157 @@
+/**
+ * The REST view routes (`POST /views/:entityName`, `POST /views/batch`, `GET /entities/:entityName`)
+ * hand client `ExtraFilter` / `OrderBy` / `OverrideExcludeFilter` text to `RunView` through
+ * `ViewOperationsHandler`. These tests pin that the text passes the same base-view AST screen as
+ * the GraphQL RunView resolvers before any view runs. Payloads are harmless (stacked `SELECT`s);
+ * the point is only whether they reach `RunView`.
+ *
+ * `@memberjunction/core`'s `Metadata` and `RunView` are replaced at the module boundary, as in
+ * ViewOperationsHandler.test.ts; the screen itself runs unmodified.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockRunViewFn, mockRunViewsFn, mockEntityList } = vi.hoisted(() => ({
+    mockRunViewFn: vi.fn(),
+    mockRunViewsFn: vi.fn(),
+    mockEntityList: [] as Array<{
+        Name: string;
+        SchemaName: string;
+        BaseView: string;
+        GetUserPermisions: (u: unknown) => { CanRead: boolean };
+        GetEffectiveRowFilterWhereClause: () => string;
+        GetDeniedReadFields: () => Set<string>;
+    }>,
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public get Entities() {
+            return mockEntityList;
+        }
+    }
+    class MockRunView {
+        public RunView(params: unknown, contextUser?: unknown): Promise<unknown> {
+            return mockRunViewFn(params, contextUser);
+        }
+        public RunViews(params: unknown[], contextUser?: unknown): Promise<unknown> {
+            return mockRunViewsFn(params, contextUser);
+        }
+    }
+    return { ...actual, Metadata: MockMetadata, RunView: MockRunView, LogError: vi.fn() };
+});
+
+import type { BaseEntity, PlatformSQL, RunViewParams, UserInfo } from '@memberjunction/core';
+import { ViewOperationsHandler } from '../rest/ViewOperationsHandler.js';
+
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM sales.vwCustomers WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Name: 'Reader' } as unknown as UserInfo;
+const OK_RESULT = { Success: true, Results: [{ ID: '1' }] };
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockEntityList.length = 0;
+    const unscoped = { GetEffectiveRowFilterWhereClause: () => '', GetDeniedReadFields: () => new Set<string>() };
+    mockEntityList.push(
+        { Name: 'Customers', SchemaName: 'sales', BaseView: 'vwCustomers', GetUserPermisions: () => ({ CanRead: true }), ...unscoped },
+        { Name: 'Ledger', SchemaName: 'sales', BaseView: 'vwLedger', GetUserPermisions: () => ({ CanRead: false }), ...unscoped },
+        {
+            Name: 'Orders',
+            SchemaName: 'sales',
+            BaseView: 'vwOrders',
+            GetUserPermisions: () => ({ CanRead: true }),
+            GetEffectiveRowFilterWhereClause: () => "(OwnerID = 'user-1')",
+            GetDeniedReadFields: () => new Set<string>(),
+        },
+    );
+    mockRunViewFn.mockResolvedValue(OK_RESULT);
+    mockRunViewsFn.mockResolvedValue([OK_RESULT]);
+});
+
+describe('ViewOperationsHandler — REST clause screen', () => {
+    it('RunView refuses a stacked statement hidden behind a bracket identifier, before RunView', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('RunView screens OrderBy and OverrideExcludeFilter too', async () => {
+        const cases: RunViewParams[] = [
+            { EntityName: 'Customers', OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { EntityName: 'Customers', OverrideExcludeFilter: BRACKET_STACKED },
+        ];
+        for (const params of cases) {
+            const outcome = await ViewOperationsHandler.RunView(params, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery against a base table or an entity the caller cannot read', async () => {
+        for (const filter of [
+            `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')`,
+            `ID IN (SELECT CustomerID FROM sales.vwLedger)`,
+        ]) {
+            const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery over an entity that is row-level-security filtered for the caller', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: `ID IN (SELECT CustomerID FROM sales.vwOrders)` }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/'Orders' is row-level-security filtered for you/);
+    });
+
+    it('RunView screens every variant of a platform-specific filter', async () => {
+        const filter: PlatformSQL = { default: `Name = 'x'`, sqlserver: BRACKET_STACKED };
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('RunViews refuses the whole batch when one entry carries a payload', async () => {
+        const outcome = await ViewOperationsHandler.RunViews(
+            [{ EntityName: 'Customers' }, { EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }],
+            USER,
+        );
+
+        expect(mockRunViewsFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('ListEntities refuses a payload in the query-string filter', async () => {
+        await expect(
+            ViewOperationsHandler.ListEntities({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER),
+        ).rejects.toThrow(/multiple statements/);
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('refuses a ViewEntity that was not loaded as an entity (its ID would be spliced into SQL)', async () => {
+        const forged = { ID: '0) ; SELECT 1 AS [x] ; SELECT 1 WHERE (1=1', EntityID: 'any' } as unknown as BaseEntity;
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ViewEntity: forged, ExcludeDataFromAllPriorViewRuns: true }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/ViewEntity is not accepted over REST/);
+    });
+
+    it('passes a filter that only reads entity base views through to RunView', async () => {
+        const filter = `Name = 'O''Brien' AND ID IN (SELECT ID FROM sales.vwCustomers WHERE Region = 'West')`;
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter, OrderBy: '[Name] DESC' }, USER);
+
+        expect(outcome.success).toBe(true);
+        expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ExtraFilter).toBe(filter);
+    });
+});

package/src/__tests__/actionAuthorization.test.ts

@@ -0,0 +1,130 @@
+/**
+ * The policy that decides who may run an action through a public entry point. It reads the
+ * `MJ: Action Authorizations` rows for the action, the caller's roles, one provider's authorizations
+ * and role grants, and whether the action's class authorizes its caller itself. It fails closed: an
+ * action that no authorization grants, and whose class does not authorize its caller, runs for
+ * Owners only.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { AuthorizationInfo, AuthorizationRoleInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { EvaluateActionRunAuthorization, IsOwner, type AuthorizationMetadata } from '../auth/actionAuthorization.js';
+
+const ANALYST_ROLE = 'A11C0000-0000-4000-8000-0000000000F1';
+const AUDITOR_ROLE = 'A11C0000-0000-4000-8000-0000000000F2';
+const BLOCKED_ROLE = 'A11C0000-0000-4000-8000-0000000000F3';
+
+const DATA_TOOLS = new AuthorizationInfo({ ID: 'auth-data-tools', Name: 'Data Tools', IsActive: true });
+const RUN_QUERIES = new AuthorizationInfo({ ID: 'auth-run-queries', Name: 'Run Queries', IsActive: true, ParentID: DATA_TOOLS.ID });
+const RETIRED_TOOL = new AuthorizationInfo({ ID: 'auth-retired-tool', Name: 'Retired Tool', IsActive: false, ParentID: DATA_TOOLS.ID });
+const SWITCHED_OFF = new AuthorizationInfo({ ID: 'auth-switched-off', Name: 'Switched Off', IsActive: false });
+const AUTHORIZATIONS = [DATA_TOOLS, RUN_QUERIES, RETIRED_TOOL, SWITCHED_OFF];
+const AUTHORIZATION_ROLES = [
+    new AuthorizationRoleInfo({ ID: 'ar-1', AuthorizationID: RUN_QUERIES.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-2', AuthorizationID: DATA_TOOLS.ID, RoleID: AUDITOR_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-3', AuthorizationID: RUN_QUERIES.ID, RoleID: BLOCKED_ROLE, Type: 'Deny' }),
+    new AuthorizationRoleInfo({ ID: 'ar-4', AuthorizationID: SWITCHED_OFF.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+];
+/** The provider metadata the decision reads. */
+const METADATA: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: AUTHORIZATION_ROLES };
+
+const user = (type: string, roleIDs: string[]): UserInfo =>
+    new UserInfo(null, { ID: `user-${type}-${roleIDs.join('-')}`, Type: type, UserRoles: roleIDs.map((RoleID) => new UserRoleInfo({ RoleID })) });
+
+/** Decides for an action whose class does not authorize its caller. */
+const decide = (caller: UserInfo, linkedAuthorizationIDs: string[]) =>
+    EvaluateActionRunAuthorization(caller, linkedAuthorizationIDs, METADATA, false);
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    // The decision reads only the metadata it is given, so any read of the global provider fails the test.
+    vi.spyOn(Metadata, 'Provider', 'get').mockImplementation(() => {
+        throw new Error('The decision read the global metadata provider');
+    });
+});
+
+describe('IsOwner', () => {
+    it('recognises the Owner type, padded as the nchar column stores it', () => {
+        expect(IsOwner(user('Owner     ', []))).toBe(true);
+        expect(IsOwner(user('User', [ANALYST_ROLE]))).toBe(false);
+    });
+});
+
+describe('EvaluateActionRunAuthorization', () => {
+    describe('Owners', () => {
+        it('lets an Owner run any action, linked or not', () => {
+            expect(decide(user('Owner     ', []), []).Allowed).toBe(true);
+            expect(decide(user('Owner     ', []), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with no Action Authorization rows', () => {
+        it('is refused to any other user when its class does not authorize its caller', () => {
+            const decision = decide(user('User', [ANALYST_ROLE]), []);
+
+            expect(decision.Allowed).toBe(false);
+            expect(decision.Reason).toMatch(/no action authorization/i);
+        });
+
+        it('runs for any user when its class authorizes its caller, so the action\'s own check decides', () => {
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [], METADATA, true).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with Action Authorization rows', () => {
+        it('is decided by its links, even when its class authorizes its caller', () => {
+            expect(EvaluateActionRunAuthorization(user('User', ['some-other-role']), [RUN_QUERIES.ID], METADATA, true).Allowed).toBe(false);
+        });
+
+        it('runs for a user whose role holds a linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('runs for a user whose role holds an ancestor of a linked authorization', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('is refused to a user whose roles hold none of the linked authorizations', () => {
+            expect(decide(user('User', ['some-other-role']), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [SWITCHED_OFF.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive, even to a holder of its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RETIRED_TOOL.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when one of the user\'s roles is denied the linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when a role is denied the linked authorization, even if another role holds its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('ignores a linked authorization that no longer exists in metadata', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), ['auth-deleted']).Allowed).toBe(false);
+        });
+
+        it('matches authorization IDs regardless of case', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID.toUpperCase()]).Allowed).toBe(true);
+        });
+    });
+
+    describe('the metadata it reads', () => {
+        it('decides from the role grants it is given, never from the global provider', () => {
+            const sameTreeWithoutGrants: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: [] };
+
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID], sameTreeWithoutGrants, false).Allowed).toBe(false);
+        });
+
+        it('walks to the parent within the authorizations it is given', () => {
+            const treeWithoutParent: AuthorizationMetadata = { Authorizations: [RUN_QUERIES], AuthorizationRoles: AUTHORIZATION_ROLES };
+
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID], treeWithoutParent, false).Allowed).toBe(false);
+        });
+    });
+});