@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -5,6 +5,8 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
   ConfigureRecordDataBroadcast,
   MayBroadcastRecordData,
+  ReadIsRowFiltered,
+  ShapeCacheInvalidationEvent,
 } from '../generic/CacheInvalidationResolver.js';
 
 /**
@@ -175,3 +177,65 @@ describe('cacheInvalidationFilter', () => {
     expect(filter({ payload: { ...event(''), entityName: '' } as never, context: session({ ID: 'u1' }) })).toBe(false);
   });
 });
+
+/**
+ * Row-level narrowing (MJ#5241): a subscriber who reads the entity only through a row-level security filter learns that a
+ * row changed, not which one; a subscriber with an unfiltered read keeps the key; a subscriber with no read is the entity-level
+ * filter's business and gets nothing here to shape.
+ */
+describe('ReadIsRowFiltered and ShapeCacheInvalidationEvent', () => {
+  const FILTERED_ROLE = 'role-participant';
+  const OPEN_ROLE = 'role-staff';
+  const entity = {
+    Permissions: [
+      { RoleID: FILTERED_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: 'filter-1' },
+      { RoleID: OPEN_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: null },
+      { RoleID: 'role-denied', CanRead: true, Type: 'Deny', ReadRLSFilterID: null },
+    ],
+  };
+  const payload = {
+    entityName: 'Spaces',
+    primaryKeyValues: 'ID|abc',
+    action: 'save',
+    sourceServerId: 'srv',
+    timestamp: new Date('2026-10-07T00:00:00Z'),
+    originSessionId: 'sess',
+    recordData: '{"Name":"x"}',
+  };
+
+  it('is row-filtered when every read the user holds carries a filter', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }] })).toBe(true);
+  });
+
+  it('is not row-filtered when any read the user holds is unfiltered, whichever role brings it', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: OPEN_ROLE }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }, { RoleID: OPEN_ROLE }] })).toBe(false);
+  });
+
+  it('is not row-filtered when the user holds no read at all (the entity-level filter owns that case), and a Deny row grants nothing', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-stranger' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-denied' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: null })).toBe(false);
+  });
+
+  it('matches role ids without regard to case or whitespace', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: ` ${FILTERED_ROLE.toUpperCase()} ` }] })).toBe(true);
+  });
+
+  it('withholds the key and the row from a row-filtered subscriber, and keeps the rest of the event', () => {
+    const shaped = ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, entity);
+    expect(shaped.PrimaryKeyValues).toBeUndefined();
+    expect(shaped.RecordData).toBeUndefined();
+    expect(shaped.EntityName).toBe('Spaces');
+    expect(shaped.Action).toBe('save');
+    expect(shaped.SourceServerID).toBe('srv');
+    expect(shaped.OriginSessionID).toBe('sess');
+  });
+
+  it('delivers the event whole to an unfiltered reader, and when the entity or the user is unknown', () => {
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).RecordData).toBe('{"Name":"x"}');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, null).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, undefined, entity).PrimaryKeyValues).toBe('ID|abc');
+  });
+});

package/src/__tests__/conversationRunEvents.test.ts

@@ -128,7 +128,7 @@ describe('TailConversationEvents', () => {
 
             const runCall = mockRunView.mock.calls.find((c) => c[0].EntityName === 'MJ: AI Agent Runs');
             expect(runCall?.[0].ResultType).toBe('simple');
-            expect([...(runCall?.[0].Fields ?? [])].sort()).toEqual(['ID', 'Result', 'Status']);
+            expect([...(runCall?.[0].Fields ?? [])].sort()).toEqual(['FinalPayload', 'ID', 'Result', 'Status']);
         });
 
         it('returns real dates when a plain row carries them as strings', async () => {
@@ -261,20 +261,20 @@ describe('TailConversationEvents', () => {
         it('marks a Running run in flight and withholds the payload', async () => {
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'In-Progress' },
-                run: { ID: RUN_ID, Status: 'Running', Result: '{"partial":true}' },
+                run: { ID: RUN_ID, Status: 'Running', FinalPayload: '{"partial":true}' },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
 
             expect(out.IsInFlight).toBe(true);
-            // A partial Result mid-run could be mistaken for the final answer.
+            // FinalPayload is filled during the run. A partial one could be mistaken for the final answer.
             expect(out.FinalPayload).toBeUndefined();
         });
 
         it('releases the payload once the run is terminal, so one call ends the wait', async () => {
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'Complete' },
-                run: { ID: RUN_ID, Status: 'Completed', Result: '{"answer":"done"}' },
+                run: { ID: RUN_ID, Status: 'Completed', FinalPayload: '{"answer":"done"}', Result: null },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
@@ -302,7 +302,7 @@ describe('TailConversationEvents', () => {
             // Reporting it as terminal would tell a client to complete a message mid-workflow.
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'In-Progress' },
-                run: { ID: RUN_ID, Status: 'Paused', Result: '{"started":"workflow"}' },
+                run: { ID: RUN_ID, Status: 'Paused', FinalPayload: '{"started":"workflow"}' },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
@@ -353,16 +353,19 @@ describe('TailConversationEvents', () => {
 });
 
 /**
- * REGRESSION, found in manual testing. `FinalPayload` read only `AIAgentRun.Result`, which is
- * agent-dependent — null on 16 of 40 completed runs in a real database, including every run of the
- * Loop-type agent used to reproduce #4222. A caller waiting on this field to decide a message was
- * finished would wait forever on those agents.
+ * `FinalPayload` comes from `AIAgentRun.FinalPayload`, then `Result` (some older rows have no
+ * `FinalPayload`), then the conversation detail's message.
+ *
+ * REGRESSION, found in manual testing: the run payload is agent-dependent — null on 16 of 40
+ * completed runs in a real database, including every run of the Loop-type agent used to reproduce
+ * #4222. Without the detail-message fallback, a caller waiting on this field to decide a message
+ * was finished would wait forever on those agents.
  */
 describe('TailConversationEvents FinalPayload sourcing', () => {
-    it('falls back to the conversation detail message when the run has no Result', async () => {
+    it('falls back to the conversation detail message when the run has no payload', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'the answer text' },
-            run: { ID: RUN_ID, Status: 'Completed', Result: null },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: null, Result: null },
             steps: [],
         });
 
@@ -372,10 +375,34 @@ describe('TailConversationEvents FinalPayload sourcing', () => {
         expect(result.FinalPayload).toBe('the answer text');
     });
 
-    it('prefers the run Result when the agent does write one', async () => {
+    it('prefers the run FinalPayload over the detail message', async () => {
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: 'run payload', Result: null },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.FinalPayload).toBe('run payload');
+    });
+
+    it('prefers FinalPayload over Result when a row has both', async () => {
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: 'run payload', Result: 'run result' },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.FinalPayload).toBe('run payload');
+    });
+
+    it('falls back to Result on an older row that has no FinalPayload', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
-            run: { ID: RUN_ID, Status: 'Completed', Result: 'run result' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: null, Result: 'run result' },
             steps: [],
         });
 
@@ -384,10 +411,25 @@ describe('TailConversationEvents FinalPayload sourcing', () => {
         expect(result.FinalPayload).toBe('run result');
     });
 
+    it('returns the partial FinalPayload a Cancelled run saved, with RunStatus telling the caller', async () => {
+        // Cancelling saves the run with no Result, but it keeps the FinalPayload saved during the run.
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Error', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Cancelled', FinalPayload: '{"partial":true}', Result: null },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.IsInFlight).toBe(false);
+        expect(result.RunStatus).toBe('Cancelled');
+        expect(result.FinalPayload).toBe('{"partial":true}');
+    });
+
     it('still withholds the payload while the run is in flight', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'In-Progress', Message: 'partial text' },
-            run: { ID: RUN_ID, Status: 'Running', Result: null },
+            run: { ID: RUN_ID, Status: 'Running', FinalPayload: '{"partial":true}', Result: null },
             steps: [],
         });
 

package/src/__tests__/globalCors.test.ts

@@ -0,0 +1,217 @@
+/**
+ * MJServer's global CORS middleware vs. server extensions that own their CORS policy.
+ *
+ * Reproduces the BizApps Voting ballot-edge failure: the global middleware ran ahead of the
+ * extension, reflected any origin onto the extension's refusals, and answered every preflight
+ * with 204 so the extension's own OPTIONS handler never ran. Runs a real Express app on an
+ * ephemeral port so the preflight is Express's and `cors`'s own behavior, not a mock.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import express, { type Application } from 'express';
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { readFileSync } from 'node:fs';
+import { GetCorsOwningServerExtensionRoots, type ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import cors from 'cors';
+import { CreateExtensionOwnedPreflightFallback, CreateGlobalCorsMiddleware } from '../globalCors.js';
+
+const ALLOWED_BALLOT_ORIGIN = 'https://vote.example.org';
+const OTHER_ORIGIN = 'https://evil.example.com';
+
+/** A ballot-style edge: its own per-resource origin policy and its own preflight answer. */
+function mountBallotExtension(app: Application): void {
+    const router = express.Router();
+    router.use((req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && origin !== ALLOWED_BALLOT_ORIGIN) {
+            res.status(403).json({ error: 'origin not allowed for this ballot' });
+            return;
+        }
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            res.setHeader('Access-Control-Allow-Methods', 'POST');
+            res.setHeader('X-Ballot-Preflight', 'extension');
+            res.status(200).end();
+            return;
+        }
+        next();
+    });
+    router.post('/cast', (_req, res) => { res.json({ ok: true }); });
+    app.use('/ballot', router);
+}
+
+let server: Server | undefined;
+
+afterEach(async () => {
+    if (server) {
+        await new Promise<void>((resolve) => server!.close(() => resolve()));
+        server = undefined;
+    }
+});
+
+async function startApp(extensions: ServerExtensionConfig[]): Promise<string> {
+    const app = express();
+    app.disable('x-powered-by');
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, GetCorsOwningServerExtensionRoots(extensions)));
+    mountBallotExtension(app);
+    app.get('/core', (_req, res) => { res.json({ ok: true }); });
+    server = app.listen(0);
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+const ballotConfig = (ownsCors: boolean | undefined): ServerExtensionConfig => ({
+    Enabled: true,
+    DriverClass: 'BallotEdge',
+    RootPath: '/ballot',
+    Phase: 'pre-auth',
+    ...(ownsCors === undefined ? {} : { OwnsCORS: ownsCors }),
+    Settings: {},
+});
+
+describe('CreateGlobalCorsMiddleware', () => {
+    it('without OwnsCORS, global CORS answers the preflight and the extension never sees it (the bug)', async () => {
+        const base = await startApp([ballotConfig(undefined)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('x-ballot-preflight')).toBeNull();
+    });
+
+    it('with OwnsCORS, the preflight reaches the extension, which refuses a foreign origin without CORS headers', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('with OwnsCORS, the extension answers its own preflight for its allowed origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: ALLOWED_BALLOT_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+        expect(res.headers.get('access-control-allow-origin')).toBe(ALLOWED_BALLOT_ORIGIN);
+        // The global policy's max-age would only be there if global CORS had run.
+        expect(res.headers.get('access-control-max-age')).toBeNull();
+    });
+
+    it('with OwnsCORS, a foreign-origin refusal on a normal request carries no reflected origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('keeps global CORS on every path the extension does not own', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/core`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'GET' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('access-control-max-age')).toBe('86400');
+    });
+
+    it('ignores OwnsCORS on a disabled extension', async () => {
+        const base = await startApp([{ ...ballotConfig(true), Enabled: false }]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+    });
+
+    it('never sends credentials under the wildcard, even when allowCredentials is true', async () => {
+        const app = express();
+        app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'], allowCredentials: true }));
+        app.get('/core', (_req, res) => { res.json({ ok: true }); });
+        server = app.listen(0);
+        await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+        const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+        const res = await fetch(`${base}/core`, { headers: { Origin: OTHER_ORIGIN } });
+        expect(res.headers.get('access-control-allow-credentials')).toBeNull();
+    });
+});
+
+/**
+ * The real mount order: global CORS → extensions → (fallback) → the GraphQL mount at `/`, whose own
+ * `cors()` approves every origin. The webhook extension owns its CORS but has no OPTIONS handler.
+ */
+async function startAppWithGraphQLMount(withFallback: boolean): Promise<string> {
+    const extensions: ServerExtensionConfig[] = [
+        ballotConfig(true),
+        { Enabled: true, DriverClass: 'Webhook', RootPath: '/webhook', Phase: 'pre-auth', OwnsCORS: true, Settings: {} },
+    ];
+    const ownedRoots = GetCorsOwningServerExtensionRoots(extensions);
+    const app = express();
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, ownedRoots));
+    mountBallotExtension(app);
+    app.post('/webhook/events', (_req, res) => { res.json({ received: true }); });
+    if (withFallback) {
+        app.use(CreateExtensionOwnedPreflightFallback(ownedRoots));
+    }
+    app.use('/', cors(), (_req, res) => { res.json({ graphql: true }); });
+    server = app.listen(0);
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+async function preflight(url: string, origin: string): Promise<Response> {
+    return fetch(url, { method: 'OPTIONS', headers: { Origin: origin, 'Access-Control-Request-Method': 'POST' } });
+}
+
+describe('CreateExtensionOwnedPreflightFallback', () => {
+    it('without it, an unanswered preflight under an owned root falls through to the GraphQL cors() and is approved for any origin (the bug)', async () => {
+        const base = await startAppWithGraphQLMount(false);
+        const res = await preflight(`${base}/webhook/events`, OTHER_ORIGIN);
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe('*');
+    });
+
+    it('refuses an unanswered preflight under an owned root with a bare 404', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        for (const path of ['/webhook/events', '/WEBHOOK/Events', '/webhook/', '/webhook/no-such-route']) {
+            const res = await preflight(`${base}${path}`, OTHER_ORIGIN);
+            expect(res.status, path).toBe(404);
+            expect(res.headers.get('access-control-allow-origin'), path).toBeNull();
+        }
+    });
+
+    it('leaves an extension that answers its own preflight in charge', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const res = await preflight(`${base}/ballot/cast`, ALLOWED_BALLOT_ORIGIN);
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+    });
+
+    it('touches neither non-preflight requests under an owned root nor preflights elsewhere', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const post = await fetch(`${base}/webhook/events`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(post.status).toBe(200);
+        const sibling = await preflight(`${base}/webhookx/events`, OTHER_ORIGIN);
+        expect(sibling.status).toBe(204);
+        expect(sibling.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+    });
+});
+
+describe('X-Powered-By', () => {
+    it('CreateApp and Serve() both disable X-Powered-By', () => {
+        // Read as text so this test never loads config.ts / the full server graph.
+        const src = readFileSync(new URL('../index.ts', import.meta.url), 'utf8');
+        // Both the default app factory and Serve() (for host-supplied apps) disable the header.
+        expect(src.match(/app\.disable\('x-powered-by'\)/g)?.length ?? 0).toBeGreaterThanOrEqual(2);
+    });
+});

package/src/__tests__/isolatedProviderTransactions.test.ts

@@ -0,0 +1,169 @@
+/**
+ * Transactions opened outside a GraphQL request run on their OWN provider, never the shared
+ * `Metadata.Provider`.
+ *
+ * A provider's ambient transaction is per INSTANCE, and the global provider is shared by every
+ * request, scheduled job and background service. A transaction opened there nests into any other
+ * caller's, and while it is open every global-provider write from anywhere lands inside it. One left
+ * open swallows them all until the process restarts (MJ#2140). These tests pin the two call sites
+ * that used to open their transaction on the global provider: magic-link provisioning and
+ * SyncData's delete-with-filter. New-user creation is pinned in newUsers.test.ts.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+const factory = vi.hoisted(() => ({ create: vi.fn() }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: factory.create }));
+
+import { Metadata, RunView, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { SyncDataResolver, type ActionItemOutputType } from '../resolvers/SyncDataResolver.js';
+
+/** A provider that records every call made on it. */
+function recordingProvider(calls: string[], saveSucceeds = true) {
+  return {
+    BeginTransaction: vi.fn(async () => { calls.push('BeginTransaction'); }),
+    CommitTransaction: vi.fn(async () => { calls.push('CommitTransaction'); }),
+    RollbackTransaction: vi.fn(async () => { calls.push('RollbackTransaction'); }),
+    GetEntityObject: vi.fn(async (entityName: string) => {
+      calls.push(`GetEntityObject:${entityName}`);
+      const entity: Record<string, unknown> = {
+        NewRecord: () => { entity.ID = `id-${entityName}`; },
+        Save: async () => saveSucceeds,
+        GetAll: () => ({ ID: entity.ID }),
+        LatestResult: { CompleteMessage: 'save failed' },
+      };
+      return entity;
+    }),
+  };
+}
+
+let globalCalls: string[];
+let isolatedCalls: string[];
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => undefined);
+  vi.spyOn(console, 'error').mockImplementation(() => undefined);
+  globalCalls = [];
+  isolatedCalls = [];
+  Metadata.Provider = recordingProvider(globalCalls) as unknown as IMetadataProvider;
+});
+
+afterEach(() => {
+  Metadata.Provider = null as unknown as IMetadataProvider;
+  vi.restoreAllMocks();
+  factory.create.mockReset();
+});
+
+describe('MagicLinkService.createScopedUser', () => {
+  const invite = { Email: 'guest@example.com', RoleID: 'role-1', ApplicationID: 'app-1' } as unknown as MJMagicLinkInviteEntity;
+  const role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const provision = () =>
+    new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig)['createScopedUser'](invite, role, contextUser);
+
+  it('provisions inside a transaction on its own provider', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+
+    expect((await provision()).success).toBe(true);
+    expect(isolatedCalls).toEqual([
+      'BeginTransaction',
+      'GetEntityObject:MJ: Users',
+      'GetEntityObject:MJ: User Roles',
+      'GetEntityObject:MJ: User Applications',
+      'CommitTransaction',
+    ]);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on its own provider when a save fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls, false));
+
+    expect((await provision()).success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'GetEntityObject:MJ: Users', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});
+
+describe('SyncDataResolver.SyncSingleItemDeleteWithFilter', () => {
+  const user = { ID: 'system' } as UserInfo;
+
+  /** Rows the filtered view returns; each records its Delete on the shared call log. */
+  function stubView(rows: number, deleteSucceeds = true) {
+    const fromProvider = vi.spyOn(RunView, 'FromMetadataProvider').mockImplementation(
+      () =>
+        ({
+          RunView: async () => ({
+            Success: true,
+            Results: Array.from({ length: rows }, (_, i) => ({
+              Delete: async () => { isolatedCalls.push(`Delete:${i}`); return deleteSucceeds; },
+              LatestResult: { CompleteMessage: 'delete failed' },
+            })),
+          }),
+        }) as unknown as RunView,
+    );
+    return fromProvider;
+  }
+
+  const deleteWithFilter = (providerOverride?: IMetadataProvider) => {
+    const result = { Success: false } as ActionItemOutputType;
+    const resolver = new SyncDataResolver() as unknown as {
+      SyncSingleItemDeleteWithFilter: (...args: unknown[]) => Promise<void>;
+    };
+    return resolver
+      .SyncSingleItemDeleteWithFilter('MJ: Things', "Name = 'x'", result, user, {}, providerOverride)
+      .then(() => result);
+  };
+
+  it('with no request provider, loads AND deletes on its own provider inside one transaction', async () => {
+    const isolated = recordingProvider(isolatedCalls);
+    factory.create.mockResolvedValue(isolated);
+    const fromProvider = stubView(2);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(true);
+    expect(fromProvider).toHaveBeenCalledWith(isolated);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'Delete:1', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('with a request provider, uses it for both the read and the transaction', async () => {
+    const requestProvider = recordingProvider(isolatedCalls);
+    const fromProvider = stubView(1);
+
+    const result = await deleteWithFilter(requestProvider as unknown as IMetadataProvider);
+
+    expect(result.Success).toBe(true);
+    expect(factory.create).not.toHaveBeenCalled();
+    expect(fromProvider).toHaveBeenCalledWith(requestProvider);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on the same provider when a delete fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+    stubView(2, false);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});

package/src/__tests__/magicLinkService.consume.test.ts

@@ -15,6 +15,12 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+// Provisioning is stubbed in this suite; keep the real provider stack out of the module graph.
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => {
+    throw new Error('provisioning is stubbed in this suite');
+  },
+}));
 
 import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -16,6 +16,10 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+const isolated = vi.hoisted(() => ({ provider: null as unknown }));
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => isolated.provider,
+}));
 
 import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
@@ -62,6 +66,7 @@ describe('MagicLinkService provisioning log policy', () => {
       RollbackTransaction: async () => undefined,
       GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
     };
+    isolated.provider = provider;
     Metadata.Provider = provider as unknown as IMetadataProvider;
 
     service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);