@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/multiTenancy.postgresRewrite.test.ts

@@ -0,0 +1,181 @@
+/**
+ * The tenant PreRunView hook checks the caller's ExtraFilter and builds
+ * `(<ExtraFilter>) AND (<tenant predicate>)`. On PostgreSQL the provider then rewrites the whole
+ * filter (identifier quoting, T-SQL date functions, boolean literals), and that rewrite can change
+ * the caller's part after the hook checked it. These tests run the real hook, the real PostgreSQL
+ * rewrite and the real view query builder, with only ExecuteSQL recorded, and pin that the tenant
+ * predicate stays a separate AND term whatever the rewrite does to the caller's term. The last
+ * block runs the same path with no hook and pins that the per-term rewrite keeps a SQL Server
+ * bracket name whole.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+    ClearAllDataHooks,
+    Metadata,
+    RegisterDataHook,
+    UserInfo,
+    type EntityInfo,
+    type IMetadataProvider,
+} from '@memberjunction/core';
+import { PostgreSQLDataProvider } from '@memberjunction/postgresql-dataprovider';
+import type { SQLParserDialect } from '@memberjunction/sql-dialect';
+import { IsBalancedSQLFragment, SplitTopLevelAndTerms } from '@memberjunction/sql-parser';
+import { CreateTenantPreRunViewHook } from '../multiTenancy/index.js';
+import type { MultiTenancyConfig } from '../config.js';
+
+const TENANT_TERM = `(("OrganizationID" = 't1'))`;
+
+/** The real PostgreSQL provider over one entity fixture, with every executed statement recorded. */
+class RecordingPostgreSQLProvider extends PostgreSQLDataProvider {
+    public readonly ExecutedSQL: string[] = [];
+
+    constructor(private readonly testEntities: EntityInfo[]) {
+        super();
+    }
+
+    public override get Entities(): EntityInfo[] {
+        return this.testEntities;
+    }
+
+    public override async ExecuteSQL<T>(sql: string): Promise<T[]> {
+        this.ExecutedSQL.push(sql);
+        return [];
+    }
+}
+
+/** A tenant-scoped entity with a boolean field, which the PostgreSQL rewrite coerces. */
+function customersEntity(): EntityInfo {
+    const field = (name: string, tsType: string) => ({ Name: name, CodeName: name, TSType: tsType, IsVirtual: false });
+    const fields = [field('ID', 'string'), field('Name', 'string'), field('OrganizationID', 'string'), field('IsActive', 'boolean')];
+    return {
+        ID: 'ENT-CUSTOMERS',
+        Name: 'Customers',
+        SchemaName: 'app',
+        BaseView: 'vwCustomers',
+        Fields: fields,
+        PrimaryKeys: [fields[0]],
+        FirstPrimaryKey: fields[0],
+        FieldByName: (n: string) => fields.find((f) => f.Name.toLowerCase() === n.trim().toLowerCase()),
+        DatetimeFields: [],
+        ExternalDataSourceID: null,
+        UserViewMaxRows: 0,
+        EnableFieldLevelSecurity: false,
+        AuditViewRuns: false,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetEffectiveRowFilterWhereClause: () => '',
+    } as unknown as EntityInfo;
+}
+
+function tenantConfig(): MultiTenancyConfig {
+    return {
+        enabled: true,
+        contextSource: 'header',
+        tenantHeader: 'x-tenant-id',
+        scopingStrategy: 'allowlist',
+        scopedEntities: ['Customers'],
+        autoExcludeCoreEntities: true,
+        defaultTenantColumn: 'OrganizationID',
+        entityColumnMappings: {},
+        adminRoles: ['Admin'],
+        writeProtection: 'strict',
+    };
+}
+
+/** The WHERE clause of the one statement the provider ran. */
+function whereOf(provider: RecordingPostgreSQLProvider): string {
+    expect(provider.ExecutedSQL).toHaveLength(1);
+    const sql = provider.ExecutedSQL[0];
+    return sql.substring(sql.indexOf(' WHERE ') + ' WHERE '.length);
+}
+
+/**
+ * Whether `term` is one of the top-level AND terms inside the one pair of parentheses around
+ * `where`. Only then does it narrow every row the query returns.
+ */
+function isTopLevelAndTerm(where: string, term: string, dialect: SQLParserDialect): boolean {
+    const inner = where.slice(1, -1);
+    const wrapped = where.startsWith('(') && where.endsWith(')') && IsBalancedSQLFragment(inner, dialect).IsBalanced;
+    return wrapped && (SplitTopLevelAndTerms(inner, dialect) ?? []).some((t) => t.trim() === term);
+}
+
+describe('Multi-tenancy on PostgreSQL — the provider rewrite cannot reach the tenant predicate', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+    let user: UserInfo;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+        RegisterDataHook('PreRunView', CreateTenantPreRunViewHook(tenantConfig()));
+        user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+        user.TenantContext = { TenantID: 't1', Source: 'header' };
+    });
+
+    afterEach(() => {
+        ClearAllDataHooks();
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps the tenant predicate a separate AND term when the rewrite changes the caller term', async () => {
+        // The rewrite turns the caller's quoted text into boolean literals and changes where its
+        // parentheses close. Each term is rewritten and wrapped on its own, so that change stays
+        // inside the caller's term.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE) AND ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('keeps the tenant predicate its own AND term after a quote the boolean rewrite drops, followed by a top-level OR', async () => {
+        // The rewrite drops the quote, so text the hook read inside a string literal becomes code
+        // with a top-level OR. The tenant predicate must still narrow every row.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) OR (1=1) OR ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        const where = whereOf(provider);
+        expect(isTopLevelAndTerm(where, TENANT_TERM, provider.Dialect), `tenant predicate is not a top-level AND term of ${where}`).toBe(true);
+        expect(where).toBe(`((("IsActive" = TRUE) OR (1=1) OR ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('refuses a caller term that the rewrite leaves unbalanced, and runs no SQL', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND (1 = 1'` }, user);
+
+        expect(provider.ExecutedSQL).toEqual([]);
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+    });
+
+    it('leaves an ordinary filter and the tenant predicate as written, each in its own term', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = 1 OR "Name" = 'a'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE OR "Name" = 'a')) AND ${TENANT_TERM})`);
+    });
+});
+
+describe('PostgreSQL ExtraFilter rewrite with no PreRunView hook', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps a SQL Server bracket name that contains AND whole when it rewrites each AND term', async () => {
+        const user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: '[Profit and Loss] > 0 AND [IsActive] = 1' }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe('(("Profit and Loss" > 0) AND ("IsActive" = TRUE))');
+    });
+});

package/src/__tests__/multiTenancy.security.test.ts

@@ -518,6 +518,57 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
   });
 
+  // ─── Client ExtraFilter containment ───────────────────────────────────
+
+  describe('client ExtraFilter must stay inside its parentheses', () => {
+    // The hook builds `(<ExtraFilter>) AND (<tenant>)`. A filter that closes a parenthesis it did
+    // not open turns that into `(1=1) OR (1=1) AND (<tenant>)`: AND binds tighter than OR, so the
+    // tenant predicate would narrow only one side of an OR the caller controls.
+    const escapes = [
+      '1=1) OR (1=1',
+      "Name = 'a') OR (Name = 'b'",
+      '1=1)) OR ((1=1',
+    ];
+
+    it.each(escapes)('refuses the ExtraFilter %j instead of ANDing the tenant predicate onto it', (extraFilter) => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: extraFilter } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/parenthesis/);
+    });
+
+    it('refuses an ExtraFilter that ends inside an unterminated string literal', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/unterminated/);
+    });
+
+    it('refuses an ExtraFilter that contains a comment', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a' -- note\n" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/comment/);
+    });
+
+    it('applies the PostgreSQL rules too when the provider dialect is unknown', () => {
+      // The mocked Metadata.Provider here is not a database provider, so the hook reads the filter
+      // with every supported dialect.
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: 'Name = $$x$$' } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/dollar/);
+    });
+
+    it('keeps a balanced ExtraFilter and the tenant predicate as separate parenthesized terms', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a) OR (b' OR Name = 'c'" } as RunViewParams;
+
+      const result = hook(params, makeUser('tenant-abc')) as RunViewParams;
+      expect(result.ExtraFilter).toBe("(Name = 'a) OR (b' OR Name = 'c') AND ([OrganizationID] = 'tenant-abc')");
+    });
+  });
+
   // ─── PreSave security edge cases ──────────────────────────────────────
 
   describe('PreSave security', () => {

package/src/__tests__/multiTenancy.test.ts

@@ -87,7 +87,7 @@ describe('Multi-Tenancy Hooks', () => {
 
       const result = hook(params, user);
       expect((result as RunViewParams).ExtraFilter).toBe(
-        "(Status = 'Active') AND [OrganizationID] = 'tenant-abc'"
+        "(Status = 'Active') AND ([OrganizationID] = 'tenant-abc')"
       );
     });
 

package/src/__tests__/newUsers.template.test.ts

@@ -0,0 +1,151 @@
+/**
+ * Tests for userHandling.newUserTemplate: NewUserBase.createNewUser builds the new user as a copy of a
+ * template user through the record-cloning engine, and falls back to a plain user whenever the template
+ * can't be used (missing, not flagged IsTemplate, or the copy fails), so sign-in never breaks.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const {
+    mockConfig,
+    mockClone,
+    mockRunView,
+    mockLogError,
+    mockProvider,
+    savedUsers,
+} = vi.hoisted(() => {
+    const savedUsers: Array<Record<string, unknown>> = [];
+    const makeUser = () => {
+        const user: Record<string, unknown> & { NewRecord: () => void; Load: (id: string) => Promise<boolean>; Save: () => Promise<boolean> } = {
+            NewRecord: vi.fn(() => {
+                user.ID = 'plain-user-id';
+                user.Created = 'plain';
+            }),
+            Load: vi.fn(async (id: string) => {
+                user.ID = id;
+                user.Created = 'template';
+                return true;
+            }),
+            Save: vi.fn(async () => {
+                savedUsers.push({ ...user });
+                return true;
+            }),
+            LatestResult: null,
+        };
+        return user;
+    };
+    return {
+        mockConfig: {
+            userHandling: {
+                newUserRoles: [] as string[],
+                CreateUserApplicationRecords: false,
+                UserApplications: [] as string[],
+                contextUserForNewUserCreation: '',
+                newUserTemplate: { email: 'demo@example.org', preset: 'template' } as { email: string; preset: string } | undefined,
+            },
+        },
+        mockClone: vi.fn(),
+        mockRunView: vi.fn(),
+        mockLogError: vi.fn(),
+        mockProvider: {
+            GetEntityObject: vi.fn(async () => makeUser()),
+            BeginTransaction: vi.fn(),
+            CommitTransaction: vi.fn(),
+            RollbackTransaction: vi.fn(),
+            Roles: [],
+            Applications: [],
+        },
+        savedUsers,
+    };
+});
+
+vi.mock('../config.js', () => ({ configInfo: mockConfig }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: vi.fn(async () => mockProvider) }));
+vi.mock('../auth/principals.js', () => ({ ResolveConfiguredPrincipal: vi.fn(() => ({ ID: 'system-id', Type: 'Owner' })) }));
+vi.mock('@memberjunction/record-cloning', () => ({
+    RecordCloneEngine: class {
+        Clone = mockClone;
+    },
+}));
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return {
+        ...actual,
+        RunView: { FromMetadataProvider: () => ({ RunView: mockRunView }) },
+        LogError: mockLogError,
+        LogStatus: vi.fn(),
+    };
+});
+vi.mock('@memberjunction/core-entities', () => ({ UserInfoEngine: { GetDefaultApplicationsForNewUser: () => [] } }));
+
+import { NewUserBase } from '../auth/newUsers.js';
+
+const templateRow = (isTemplate: boolean) => ({ Success: true, Results: [{ ID: 'tpl-id', IsTemplate: isTemplate }] });
+const cloned = { Success: true, ResultCode: 'SUCCESS', Warnings: [], RecordsCloned: 120, Roots: [{ EntityName: 'MJ: Users', SourceKey: { KeyValuePairs: [] }, TargetKey: { KeyValuePairs: [{ FieldName: 'ID', Value: 'new-user-id' }] } }] };
+
+describe('NewUserBase.createNewUser with newUserTemplate', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        savedUsers.length = 0;
+        mockConfig.userHandling.newUserTemplate = { email: 'demo@example.org', preset: 'template' };
+    });
+
+    it('creates the user as an active copy of the template', async () => {
+        mockRunView.mockResolvedValue(templateRow(true));
+        mockClone.mockResolvedValue(cloned);
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).toHaveBeenCalledWith(
+            expect.objectContaining({
+                EntityName: 'MJ: Users',
+                SourceRecordKey: expect.objectContaining({ KeyValuePairs: [expect.objectContaining({ FieldName: 'ID', Value: 'tpl-id' })] }),
+                Preset: 'template',
+                PromptedValues: { Email: 'jane@example.com', FirstName: 'Jane', LastName: 'Doe' },
+            }),
+            expect.objectContaining({ ID: 'system-id' })
+        );
+        expect(user?.ID).toBe('new-user-id');
+        expect(savedUsers).toEqual([expect.objectContaining({ ID: 'new-user-id', Created: 'template', IsActive: true, LinkedRecordType: 'None' })]);
+        expect(mockProvider.BeginTransaction).not.toHaveBeenCalled();
+    });
+
+    it('falls back to a plain user when the template user is not flagged IsTemplate', async () => {
+        mockRunView.mockResolvedValue(templateRow(false));
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(mockLogError.mock.calls.flat().join(' ')).toContain('not marked as a template user');
+        expect(user?.ID).toBe('plain-user-id');
+        expect(savedUsers[0]).toEqual(expect.objectContaining({ Created: 'plain', Email: 'jane@example.com', IsActive: true }));
+    });
+
+    it('falls back to a plain user when no user has the template email', async () => {
+        mockRunView.mockResolvedValue({ Success: true, Results: [] });
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(user?.ID).toBe('plain-user-id');
+    });
+
+    it('falls back to a plain user when the copy is blocked', async () => {
+        mockRunView.mockResolvedValue(templateRow(true));
+        mockClone.mockResolvedValue({ Success: false, ResultCode: 'BLOCKED', Warnings: [{ Severity: 'Error', Code: 'FORBIDDEN', Message: 'needs Clone Records' }] });
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockLogError.mock.calls.flat().join(' ')).toContain('needs Clone Records');
+        expect(user?.ID).toBe('plain-user-id');
+    });
+
+    it('creates a plain user, as before, when no template is configured', async () => {
+        mockConfig.userHandling.newUserTemplate = undefined;
+
+        const user = await new NewUserBase().createNewUser('Jane', 'Doe', 'jane@example.com');
+
+        expect(mockRunView).not.toHaveBeenCalled();
+        expect(mockClone).not.toHaveBeenCalled();
+        expect(user?.ID).toBe('plain-user-id');
+    });
+});

package/src/__tests__/newUsers.test.ts

@@ -30,6 +30,8 @@ const {
     mockBeginTransaction,
     mockCommitTransaction,
     mockRollbackTransaction,
+    mockGlobalProviderCalls,
+    mockCreateIsolatedProvider,
     mockGetDefaultApplicationsForNewUser,
     mockRolesArray,
     mockApplicationsArray,
@@ -69,6 +71,10 @@ const {
         mockBeginTransaction: vi.fn(),
         mockCommitTransaction: vi.fn(),
         mockRollbackTransaction: vi.fn(),
+        // Every call new-user creation makes on the SHARED Metadata.Provider. Must stay empty: a
+        // transaction there nests into every concurrent request's (see CreateIsolatedProvider).
+        mockGlobalProviderCalls: [] as string[],
+        mockCreateIsolatedProvider: vi.fn(),
         mockGetDefaultApplicationsForNewUser: vi.fn(),
         mockRolesArray: [] as Array<{ ID: string; Name: string }>,
         mockApplicationsArray: [] as Array<{ ID: string; Name: string }>,
@@ -79,6 +85,9 @@ const {
 
 vi.mock('../config.js', () => ({ configInfo: mockConfig }));
 
+// The provider new-user creation must use: its own instance, so its transaction is its own.
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: mockCreateIsolatedProvider }));
+
 vi.mock('@memberjunction/generic-database-provider', () => {
     const instance = {
         get Users() {
@@ -89,6 +98,18 @@ vi.mock('@memberjunction/generic-database-provider', () => {
         },
         Refresh: mockRefresh,
         GetSystemUser: vi.fn(),
+        /**
+         * The real cache falls back to a database read on a miss. The stub answers from
+         * the same array `Users` exposes, so these tests still describe the cache's behaviour.
+         */
+        FindUser: vi.fn(async ({ Email }: { Email?: string }) =>
+            mockCacheUsers.find((u: UserInfo) => {
+                if (!u.Email || u.Email.trim() === '') {
+                    console.error(`SYSTEM METADATA ISSUE: User ${u.ID} has no email address`);
+                    return false;
+                }
+                return u.Email.toLowerCase().trim() === (Email ?? '').toLowerCase().trim();
+            })),
     };
     return {
         UserCache: class MockUserCache {
@@ -104,10 +125,11 @@ vi.mock('@memberjunction/generic-database-provider', () => {
 
 vi.mock('@memberjunction/core', async (importOriginal) => {
     const actual = await importOriginal<typeof import('@memberjunction/core')>();
-    const provider = {
-        BeginTransaction: mockBeginTransaction,
-        CommitTransaction: mockCommitTransaction,
-        RollbackTransaction: mockRollbackTransaction,
+    // The shared global provider: records any use instead of doing anything.
+    const globalProvider = {
+        BeginTransaction: async () => { mockGlobalProviderCalls.push('BeginTransaction'); },
+        CommitTransaction: async () => { mockGlobalProviderCalls.push('CommitTransaction'); },
+        RollbackTransaction: async () => { mockGlobalProviderCalls.push('RollbackTransaction'); },
         Dialect: { BooleanLiteral: (value: boolean) => (value ? '1' : '0') },
     };
     class MockMetadata {
@@ -118,9 +140,10 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
             return mockApplicationsArray;
         }
         public GetEntityObject(entityName: string, contextUser?: UserInfo): Promise<unknown> {
+            mockGlobalProviderCalls.push(`GetEntityObject:${entityName}`);
             return mockGetEntityObject(entityName, contextUser);
         }
-        static Provider = provider;
+        static Provider = globalProvider;
     }
     class MockUserInfo {
         constructor(_provider: unknown, initData: Record<string, unknown>) {
@@ -128,6 +151,9 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
         }
     }
     class MockRunView {
+        public static FromMetadataProvider(_provider: unknown): MockRunView {
+            return new MockRunView();
+        }
         public RunView(params: unknown, contextUser?: UserInfo): Promise<unknown> {
             return mockRunViewFn(params, contextUser);
         }
@@ -295,6 +321,21 @@ beforeEach(() => {
     });
     mockRunViewFn.mockResolvedValue({ Success: true, Results: [] });
     mockGetDefaultApplicationsForNewUser.mockReturnValue([]);
+
+    mockGlobalProviderCalls.length = 0;
+    mockCreateIsolatedProvider.mockImplementation(async () => ({
+        BeginTransaction: mockBeginTransaction,
+        CommitTransaction: mockCommitTransaction,
+        RollbackTransaction: mockRollbackTransaction,
+        Dialect: { BooleanLiteral: (value: boolean) => (value ? '1' : '0') },
+        get Roles() {
+            return mockRolesArray;
+        },
+        get Applications() {
+            return mockApplicationsArray;
+        },
+        GetEntityObject: (entityName: string, contextUser?: UserInfo) => mockGetEntityObject(entityName, contextUser),
+    }));
 });
 
 // ─── NewUserBase.createNewUser ──────────────────────────────────────────────
@@ -303,6 +344,34 @@ describe('NewUserBase.createNewUser', () => {
     const create = (first = 'Ada', last = 'Lovelace', email = 'ada@example.com') =>
         new NewUserBase().createNewUser(first, last, email);
 
+    describe('provider isolation', () => {
+        it('runs the whole provisioning on its own provider, never the shared Metadata.Provider', async () => {
+            mockConfig.userHandling.CreateUserApplicationRecords = true;
+            mockConfig.userHandling.UserApplications = ['CRM'];
+            mockRunViewFn.mockResolvedValue({ Success: true, Results: [{ EntityID: 'ent-1', Entity: 'Accounts' }] });
+
+            const user = await create();
+
+            expect(user).toBeTruthy();
+            expect(mockCreateIsolatedProvider).toHaveBeenCalledTimes(1);
+            expect(mockBeginTransaction).toHaveBeenCalledTimes(1);
+            expect(mockCommitTransaction).toHaveBeenCalledTimes(1);
+            // User, role, application and application-entity records all came from the isolated one.
+            expect(getEntityObjectCalls.map((c) => c.entityName)).toEqual([
+                'MJ: Users', 'MJ: User Roles', 'MJ: User Applications', 'MJ: User Application Entities',
+            ]);
+            expect(mockGlobalProviderCalls).toEqual([]);
+        });
+
+        it('rolls back on the isolated provider too, never the shared one', async () => {
+            saveBehavior['MJ: Users'] = () => false;
+
+            expect(await create()).toBeNull();
+            expect(mockRollbackTransaction).toHaveBeenCalledTimes(1);
+            expect(mockGlobalProviderCalls).toEqual([]);
+        });
+    });
+
     describe('context-user resolution', () => {
         it('uses the configured contextUserForNewUserCreation for every entity it creates', async () => {
             const user = await create();

package/src/__tests__/orphanedConversationDetailReconciler.test.ts

@@ -20,8 +20,10 @@ const { mockGetEntityObject, writableStore } = vi.hoisted(() => ({
     writableStore: { last: null as Record<string, unknown> | null },
 }));
 
-vi.mock('@memberjunction/global', () => ({
-    UUIDsEqual: (a: string, b: string) => String(a).toLowerCase() === String(b).toLowerCase(),
+// The real UUID helpers: the reconciler indexes users with IndexByUUID, so a stub that only
+// provides UUIDsEqual would make the owner lookup throw (and the pass silently do nothing).
+vi.mock('@memberjunction/global', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('@memberjunction/global')>()),
 }));
 
 vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
@@ -230,6 +232,19 @@ describe('ReconcileOrphanedConversationDetails', () => {
         );
     });
 
+    it('resolves the owner when the conversation spells the user ID in a different case', async () => {
+        // The cached user is 'OWNER-1'; SQL Server and PostgreSQL disagree on UUID case, so the
+        // conversation row may carry it lower-cased. The owner lookup must still find the user.
+        script([detail()], [{ ConversationDetailID: DETAIL_ID, Status: 'Failed', CompletedAt: longAgo() }], 'owner-1');
+
+        await ReconcileOrphanedConversationDetails(PROVIDER, USER);
+
+        expect(mockGetEntityObject).toHaveBeenCalledWith(
+            'MJ: Conversation Details',
+            expect.objectContaining({ ID: 'OWNER-1' })
+        );
+    });
+
     it('leaves the detail alone when no owner can be resolved', async () => {
         script([detail()], [{ ConversationDetailID: DETAIL_ID, Status: 'Failed', CompletedAt: longAgo() }], null);
 

package/src/__tests__/ownedRealtimeSession.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import {
+    LoadOwnedRealtimeSession, RealtimeSessionNotFoundError, RealtimeSessionOwnershipError,
+} from '../realtimeSessions/ownedRealtimeSession.js';
+
+const SESSION = '11111111-1111-4111-8111-111111111111';
+const OWNER = { ID: 'AAAAAAAA-0000-4000-8000-000000000001' } as unknown as UserInfo;
+const STRANGER = { ID: 'BBBBBBBB-0000-4000-8000-000000000002' } as unknown as UserInfo;
+
+function providerWith(row: { UserID: string } | null): IMetadataProvider {
+    return {
+        GetEntityObject: vi.fn(async () => ({
+            UserID: row?.UserID ?? '',
+            Load: vi.fn(async () => row !== null),
+        })),
+    } as unknown as IMetadataProvider;
+}
+
+describe('LoadOwnedRealtimeSession', () => {
+    it('returns the session when the caller owns it (UUIDs compared case-insensitively)', async () => {
+        const session = await LoadOwnedRealtimeSession(SESSION, OWNER, providerWith({ UserID: OWNER.ID.toLowerCase() }));
+        expect(session.UserID).toBe(OWNER.ID.toLowerCase());
+    });
+
+    it('throws RealtimeSessionNotFoundError when the row does not load', async () => {
+        await expect(LoadOwnedRealtimeSession(SESSION, OWNER, providerWith(null)))
+            .rejects.toBeInstanceOf(RealtimeSessionNotFoundError);
+        await expect(LoadOwnedRealtimeSession(SESSION, OWNER, providerWith(null)))
+            .rejects.toThrow(`Realtime session ${SESSION} not found`);
+    });
+
+    it('throws RealtimeSessionOwnershipError for another user', async () => {
+        await expect(LoadOwnedRealtimeSession(SESSION, STRANGER, providerWith({ UserID: OWNER.ID })))
+            .rejects.toBeInstanceOf(RealtimeSessionOwnershipError);
+        await expect(LoadOwnedRealtimeSession(SESSION, STRANGER, providerWith({ UserID: OWNER.ID })))
+            .rejects.toThrow('Not authorized: you do not own this realtime session');
+    });
+});

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -53,4 +53,11 @@ describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
   it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
     expect(StatusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
   });
+
+  it('delivers server-originated wildcard sessionId ("*") pushes ONLY when ownerUserId matches the connection user', () => {
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+  });
 });
+