@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.5

package/src/__tests__/conversationRunEvents.test.ts

@@ -128,7 +128,7 @@ describe('TailConversationEvents', () => {
 
             const runCall = mockRunView.mock.calls.find((c) => c[0].EntityName === 'MJ: AI Agent Runs');
             expect(runCall?.[0].ResultType).toBe('simple');
-            expect([...(runCall?.[0].Fields ?? [])].sort()).toEqual(['ID', 'Result', 'Status']);
+            expect([...(runCall?.[0].Fields ?? [])].sort()).toEqual(['FinalPayload', 'ID', 'Result', 'Status']);
         });
 
         it('returns real dates when a plain row carries them as strings', async () => {
@@ -261,20 +261,20 @@ describe('TailConversationEvents', () => {
         it('marks a Running run in flight and withholds the payload', async () => {
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'In-Progress' },
-                run: { ID: RUN_ID, Status: 'Running', Result: '{"partial":true}' },
+                run: { ID: RUN_ID, Status: 'Running', FinalPayload: '{"partial":true}' },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
 
             expect(out.IsInFlight).toBe(true);
-            // A partial Result mid-run could be mistaken for the final answer.
+            // FinalPayload is filled during the run. A partial one could be mistaken for the final answer.
             expect(out.FinalPayload).toBeUndefined();
         });
 
         it('releases the payload once the run is terminal, so one call ends the wait', async () => {
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'Complete' },
-                run: { ID: RUN_ID, Status: 'Completed', Result: '{"answer":"done"}' },
+                run: { ID: RUN_ID, Status: 'Completed', FinalPayload: '{"answer":"done"}', Result: null },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
@@ -302,7 +302,7 @@ describe('TailConversationEvents', () => {
             // Reporting it as terminal would tell a client to complete a message mid-workflow.
             scriptRunView({
                 detail: { ID: DETAIL_ID, Status: 'In-Progress' },
-                run: { ID: RUN_ID, Status: 'Paused', Result: '{"started":"workflow"}' },
+                run: { ID: RUN_ID, Status: 'Paused', FinalPayload: '{"started":"workflow"}' },
                 steps: [step(1)],
             });
             const out = await resolver.TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
@@ -353,16 +353,19 @@ describe('TailConversationEvents', () => {
 });
 
 /**
- * REGRESSION, found in manual testing. `FinalPayload` read only `AIAgentRun.Result`, which is
- * agent-dependent — null on 16 of 40 completed runs in a real database, including every run of the
- * Loop-type agent used to reproduce #4222. A caller waiting on this field to decide a message was
- * finished would wait forever on those agents.
+ * `FinalPayload` comes from `AIAgentRun.FinalPayload`, then `Result` (some older rows have no
+ * `FinalPayload`), then the conversation detail's message.
+ *
+ * REGRESSION, found in manual testing: the run payload is agent-dependent — null on 16 of 40
+ * completed runs in a real database, including every run of the Loop-type agent used to reproduce
+ * #4222. Without the detail-message fallback, a caller waiting on this field to decide a message
+ * was finished would wait forever on those agents.
  */
 describe('TailConversationEvents FinalPayload sourcing', () => {
-    it('falls back to the conversation detail message when the run has no Result', async () => {
+    it('falls back to the conversation detail message when the run has no payload', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'the answer text' },
-            run: { ID: RUN_ID, Status: 'Completed', Result: null },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: null, Result: null },
             steps: [],
         });
 
@@ -372,10 +375,34 @@ describe('TailConversationEvents FinalPayload sourcing', () => {
         expect(result.FinalPayload).toBe('the answer text');
     });
 
-    it('prefers the run Result when the agent does write one', async () => {
+    it('prefers the run FinalPayload over the detail message', async () => {
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: 'run payload', Result: null },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.FinalPayload).toBe('run payload');
+    });
+
+    it('prefers FinalPayload over Result when a row has both', async () => {
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: 'run payload', Result: 'run result' },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.FinalPayload).toBe('run payload');
+    });
+
+    it('falls back to Result on an older row that has no FinalPayload', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'Complete', Message: 'detail message' },
-            run: { ID: RUN_ID, Status: 'Completed', Result: 'run result' },
+            run: { ID: RUN_ID, Status: 'Completed', FinalPayload: null, Result: 'run result' },
             steps: [],
         });
 
@@ -384,10 +411,25 @@ describe('TailConversationEvents FinalPayload sourcing', () => {
         expect(result.FinalPayload).toBe('run result');
     });
 
+    it('returns the partial FinalPayload a Cancelled run saved, with RunStatus telling the caller', async () => {
+        // Cancelling saves the run with no Result, but it keeps the FinalPayload saved during the run.
+        scriptRunView({
+            detail: { ID: DETAIL_ID, Status: 'Error', Message: 'detail message' },
+            run: { ID: RUN_ID, Status: 'Cancelled', FinalPayload: '{"partial":true}', Result: null },
+            steps: [],
+        });
+
+        const result = await new ConversationRunEventsResolver().TailConversationEvents(DETAIL_ID, ctxFor(USER), 0);
+
+        expect(result.IsInFlight).toBe(false);
+        expect(result.RunStatus).toBe('Cancelled');
+        expect(result.FinalPayload).toBe('{"partial":true}');
+    });
+
     it('still withholds the payload while the run is in flight', async () => {
         scriptRunView({
             detail: { ID: DETAIL_ID, Status: 'In-Progress', Message: 'partial text' },
-            run: { ID: RUN_ID, Status: 'Running', Result: null },
+            run: { ID: RUN_ID, Status: 'Running', FinalPayload: '{"partial":true}', Result: null },
             steps: [],
         });
 

package/src/__tests__/globalCors.test.ts

@@ -0,0 +1,217 @@
+/**
+ * MJServer's global CORS middleware vs. server extensions that own their CORS policy.
+ *
+ * Reproduces the BizApps Voting ballot-edge failure: the global middleware ran ahead of the
+ * extension, reflected any origin onto the extension's refusals, and answered every preflight
+ * with 204 so the extension's own OPTIONS handler never ran. Runs a real Express app on an
+ * ephemeral port so the preflight is Express's and `cors`'s own behavior, not a mock.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import express, { type Application } from 'express';
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { readFileSync } from 'node:fs';
+import { GetCorsOwningServerExtensionRoots, type ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import cors from 'cors';
+import { CreateExtensionOwnedPreflightFallback, CreateGlobalCorsMiddleware } from '../globalCors.js';
+
+const ALLOWED_BALLOT_ORIGIN = 'https://vote.example.org';
+const OTHER_ORIGIN = 'https://evil.example.com';
+
+/** A ballot-style edge: its own per-resource origin policy and its own preflight answer. */
+function mountBallotExtension(app: Application): void {
+    const router = express.Router();
+    router.use((req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && origin !== ALLOWED_BALLOT_ORIGIN) {
+            res.status(403).json({ error: 'origin not allowed for this ballot' });
+            return;
+        }
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            res.setHeader('Access-Control-Allow-Methods', 'POST');
+            res.setHeader('X-Ballot-Preflight', 'extension');
+            res.status(200).end();
+            return;
+        }
+        next();
+    });
+    router.post('/cast', (_req, res) => { res.json({ ok: true }); });
+    app.use('/ballot', router);
+}
+
+let server: Server | undefined;
+
+afterEach(async () => {
+    if (server) {
+        await new Promise<void>((resolve) => server!.close(() => resolve()));
+        server = undefined;
+    }
+});
+
+async function startApp(extensions: ServerExtensionConfig[]): Promise<string> {
+    const app = express();
+    app.disable('x-powered-by');
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, GetCorsOwningServerExtensionRoots(extensions)));
+    mountBallotExtension(app);
+    app.get('/core', (_req, res) => { res.json({ ok: true }); });
+    server = app.listen(0);
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+const ballotConfig = (ownsCors: boolean | undefined): ServerExtensionConfig => ({
+    Enabled: true,
+    DriverClass: 'BallotEdge',
+    RootPath: '/ballot',
+    Phase: 'pre-auth',
+    ...(ownsCors === undefined ? {} : { OwnsCORS: ownsCors }),
+    Settings: {},
+});
+
+describe('CreateGlobalCorsMiddleware', () => {
+    it('without OwnsCORS, global CORS answers the preflight and the extension never sees it (the bug)', async () => {
+        const base = await startApp([ballotConfig(undefined)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('x-ballot-preflight')).toBeNull();
+    });
+
+    it('with OwnsCORS, the preflight reaches the extension, which refuses a foreign origin without CORS headers', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('with OwnsCORS, the extension answers its own preflight for its allowed origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: ALLOWED_BALLOT_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+        expect(res.headers.get('access-control-allow-origin')).toBe(ALLOWED_BALLOT_ORIGIN);
+        // The global policy's max-age would only be there if global CORS had run.
+        expect(res.headers.get('access-control-max-age')).toBeNull();
+    });
+
+    it('with OwnsCORS, a foreign-origin refusal on a normal request carries no reflected origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('keeps global CORS on every path the extension does not own', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/core`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'GET' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('access-control-max-age')).toBe('86400');
+    });
+
+    it('ignores OwnsCORS on a disabled extension', async () => {
+        const base = await startApp([{ ...ballotConfig(true), Enabled: false }]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+    });
+
+    it('never sends credentials under the wildcard, even when allowCredentials is true', async () => {
+        const app = express();
+        app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'], allowCredentials: true }));
+        app.get('/core', (_req, res) => { res.json({ ok: true }); });
+        server = app.listen(0);
+        await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+        const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+        const res = await fetch(`${base}/core`, { headers: { Origin: OTHER_ORIGIN } });
+        expect(res.headers.get('access-control-allow-credentials')).toBeNull();
+    });
+});
+
+/**
+ * The real mount order: global CORS → extensions → (fallback) → the GraphQL mount at `/`, whose own
+ * `cors()` approves every origin. The webhook extension owns its CORS but has no OPTIONS handler.
+ */
+async function startAppWithGraphQLMount(withFallback: boolean): Promise<string> {
+    const extensions: ServerExtensionConfig[] = [
+        ballotConfig(true),
+        { Enabled: true, DriverClass: 'Webhook', RootPath: '/webhook', Phase: 'pre-auth', OwnsCORS: true, Settings: {} },
+    ];
+    const ownedRoots = GetCorsOwningServerExtensionRoots(extensions);
+    const app = express();
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, ownedRoots));
+    mountBallotExtension(app);
+    app.post('/webhook/events', (_req, res) => { res.json({ received: true }); });
+    if (withFallback) {
+        app.use(CreateExtensionOwnedPreflightFallback(ownedRoots));
+    }
+    app.use('/', cors(), (_req, res) => { res.json({ graphql: true }); });
+    server = app.listen(0);
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+async function preflight(url: string, origin: string): Promise<Response> {
+    return fetch(url, { method: 'OPTIONS', headers: { Origin: origin, 'Access-Control-Request-Method': 'POST' } });
+}
+
+describe('CreateExtensionOwnedPreflightFallback', () => {
+    it('without it, an unanswered preflight under an owned root falls through to the GraphQL cors() and is approved for any origin (the bug)', async () => {
+        const base = await startAppWithGraphQLMount(false);
+        const res = await preflight(`${base}/webhook/events`, OTHER_ORIGIN);
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe('*');
+    });
+
+    it('refuses an unanswered preflight under an owned root with a bare 404', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        for (const path of ['/webhook/events', '/WEBHOOK/Events', '/webhook/', '/webhook/no-such-route']) {
+            const res = await preflight(`${base}${path}`, OTHER_ORIGIN);
+            expect(res.status, path).toBe(404);
+            expect(res.headers.get('access-control-allow-origin'), path).toBeNull();
+        }
+    });
+
+    it('leaves an extension that answers its own preflight in charge', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const res = await preflight(`${base}/ballot/cast`, ALLOWED_BALLOT_ORIGIN);
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+    });
+
+    it('touches neither non-preflight requests under an owned root nor preflights elsewhere', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const post = await fetch(`${base}/webhook/events`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(post.status).toBe(200);
+        const sibling = await preflight(`${base}/webhookx/events`, OTHER_ORIGIN);
+        expect(sibling.status).toBe(204);
+        expect(sibling.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+    });
+});
+
+describe('X-Powered-By', () => {
+    it('CreateApp and Serve() both disable X-Powered-By', () => {
+        // Read as text so this test never loads config.ts / the full server graph.
+        const src = readFileSync(new URL('../index.ts', import.meta.url), 'utf8');
+        // Both the default app factory and Serve() (for host-supplied apps) disable the header.
+        expect(src.match(/app\.disable\('x-powered-by'\)/g)?.length ?? 0).toBeGreaterThanOrEqual(2);
+    });
+});

package/src/__tests__/multiTenancy.postgresRewrite.test.ts

@@ -0,0 +1,181 @@
+/**
+ * The tenant PreRunView hook checks the caller's ExtraFilter and builds
+ * `(<ExtraFilter>) AND (<tenant predicate>)`. On PostgreSQL the provider then rewrites the whole
+ * filter (identifier quoting, T-SQL date functions, boolean literals), and that rewrite can change
+ * the caller's part after the hook checked it. These tests run the real hook, the real PostgreSQL
+ * rewrite and the real view query builder, with only ExecuteSQL recorded, and pin that the tenant
+ * predicate stays a separate AND term whatever the rewrite does to the caller's term. The last
+ * block runs the same path with no hook and pins that the per-term rewrite keeps a SQL Server
+ * bracket name whole.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+    ClearAllDataHooks,
+    Metadata,
+    RegisterDataHook,
+    UserInfo,
+    type EntityInfo,
+    type IMetadataProvider,
+} from '@memberjunction/core';
+import { PostgreSQLDataProvider } from '@memberjunction/postgresql-dataprovider';
+import type { SQLParserDialect } from '@memberjunction/sql-dialect';
+import { IsBalancedSQLFragment, SplitTopLevelAndTerms } from '@memberjunction/sql-parser';
+import { CreateTenantPreRunViewHook } from '../multiTenancy/index.js';
+import type { MultiTenancyConfig } from '../config.js';
+
+const TENANT_TERM = `(("OrganizationID" = 't1'))`;
+
+/** The real PostgreSQL provider over one entity fixture, with every executed statement recorded. */
+class RecordingPostgreSQLProvider extends PostgreSQLDataProvider {
+    public readonly ExecutedSQL: string[] = [];
+
+    constructor(private readonly testEntities: EntityInfo[]) {
+        super();
+    }
+
+    public override get Entities(): EntityInfo[] {
+        return this.testEntities;
+    }
+
+    public override async ExecuteSQL<T>(sql: string): Promise<T[]> {
+        this.ExecutedSQL.push(sql);
+        return [];
+    }
+}
+
+/** A tenant-scoped entity with a boolean field, which the PostgreSQL rewrite coerces. */
+function customersEntity(): EntityInfo {
+    const field = (name: string, tsType: string) => ({ Name: name, CodeName: name, TSType: tsType, IsVirtual: false });
+    const fields = [field('ID', 'string'), field('Name', 'string'), field('OrganizationID', 'string'), field('IsActive', 'boolean')];
+    return {
+        ID: 'ENT-CUSTOMERS',
+        Name: 'Customers',
+        SchemaName: 'app',
+        BaseView: 'vwCustomers',
+        Fields: fields,
+        PrimaryKeys: [fields[0]],
+        FirstPrimaryKey: fields[0],
+        FieldByName: (n: string) => fields.find((f) => f.Name.toLowerCase() === n.trim().toLowerCase()),
+        DatetimeFields: [],
+        ExternalDataSourceID: null,
+        UserViewMaxRows: 0,
+        EnableFieldLevelSecurity: false,
+        AuditViewRuns: false,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetEffectiveRowFilterWhereClause: () => '',
+    } as unknown as EntityInfo;
+}
+
+function tenantConfig(): MultiTenancyConfig {
+    return {
+        enabled: true,
+        contextSource: 'header',
+        tenantHeader: 'x-tenant-id',
+        scopingStrategy: 'allowlist',
+        scopedEntities: ['Customers'],
+        autoExcludeCoreEntities: true,
+        defaultTenantColumn: 'OrganizationID',
+        entityColumnMappings: {},
+        adminRoles: ['Admin'],
+        writeProtection: 'strict',
+    };
+}
+
+/** The WHERE clause of the one statement the provider ran. */
+function whereOf(provider: RecordingPostgreSQLProvider): string {
+    expect(provider.ExecutedSQL).toHaveLength(1);
+    const sql = provider.ExecutedSQL[0];
+    return sql.substring(sql.indexOf(' WHERE ') + ' WHERE '.length);
+}
+
+/**
+ * Whether `term` is one of the top-level AND terms inside the one pair of parentheses around
+ * `where`. Only then does it narrow every row the query returns.
+ */
+function isTopLevelAndTerm(where: string, term: string, dialect: SQLParserDialect): boolean {
+    const inner = where.slice(1, -1);
+    const wrapped = where.startsWith('(') && where.endsWith(')') && IsBalancedSQLFragment(inner, dialect).IsBalanced;
+    return wrapped && (SplitTopLevelAndTerms(inner, dialect) ?? []).some((t) => t.trim() === term);
+}
+
+describe('Multi-tenancy on PostgreSQL — the provider rewrite cannot reach the tenant predicate', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+    let user: UserInfo;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+        RegisterDataHook('PreRunView', CreateTenantPreRunViewHook(tenantConfig()));
+        user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+        user.TenantContext = { TenantID: 't1', Source: 'header' };
+    });
+
+    afterEach(() => {
+        ClearAllDataHooks();
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps the tenant predicate a separate AND term when the rewrite changes the caller term', async () => {
+        // The rewrite turns the caller's quoted text into boolean literals and changes where its
+        // parentheses close. Each term is rewritten and wrapped on its own, so that change stays
+        // inside the caller's term.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE) AND ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('keeps the tenant predicate its own AND term after a quote the boolean rewrite drops, followed by a top-level OR', async () => {
+        // The rewrite drops the quote, so text the hook read inside a string literal becomes code
+        // with a top-level OR. The tenant predicate must still narrow every row.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) OR (1=1) OR ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        const where = whereOf(provider);
+        expect(isTopLevelAndTerm(where, TENANT_TERM, provider.Dialect), `tenant predicate is not a top-level AND term of ${where}`).toBe(true);
+        expect(where).toBe(`((("IsActive" = TRUE) OR (1=1) OR ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('refuses a caller term that the rewrite leaves unbalanced, and runs no SQL', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND (1 = 1'` }, user);
+
+        expect(provider.ExecutedSQL).toEqual([]);
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+    });
+
+    it('leaves an ordinary filter and the tenant predicate as written, each in its own term', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = 1 OR "Name" = 'a'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE OR "Name" = 'a')) AND ${TENANT_TERM})`);
+    });
+});
+
+describe('PostgreSQL ExtraFilter rewrite with no PreRunView hook', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps a SQL Server bracket name that contains AND whole when it rewrites each AND term', async () => {
+        const user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: '[Profit and Loss] > 0 AND [IsActive] = 1' }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe('(("Profit and Loss" > 0) AND ("IsActive" = TRUE))');
+    });
+});

package/src/__tests__/multiTenancy.security.test.ts

@@ -518,6 +518,57 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
   });
 
+  // ─── Client ExtraFilter containment ───────────────────────────────────
+
+  describe('client ExtraFilter must stay inside its parentheses', () => {
+    // The hook builds `(<ExtraFilter>) AND (<tenant>)`. A filter that closes a parenthesis it did
+    // not open turns that into `(1=1) OR (1=1) AND (<tenant>)`: AND binds tighter than OR, so the
+    // tenant predicate would narrow only one side of an OR the caller controls.
+    const escapes = [
+      '1=1) OR (1=1',
+      "Name = 'a') OR (Name = 'b'",
+      '1=1)) OR ((1=1',
+    ];
+
+    it.each(escapes)('refuses the ExtraFilter %j instead of ANDing the tenant predicate onto it', (extraFilter) => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: extraFilter } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/parenthesis/);
+    });
+
+    it('refuses an ExtraFilter that ends inside an unterminated string literal', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/unterminated/);
+    });
+
+    it('refuses an ExtraFilter that contains a comment', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a' -- note\n" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/comment/);
+    });
+
+    it('applies the PostgreSQL rules too when the provider dialect is unknown', () => {
+      // The mocked Metadata.Provider here is not a database provider, so the hook reads the filter
+      // with every supported dialect.
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: 'Name = $$x$$' } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/dollar/);
+    });
+
+    it('keeps a balanced ExtraFilter and the tenant predicate as separate parenthesized terms', () => {
+      const hook = CreateTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a) OR (b' OR Name = 'c'" } as RunViewParams;
+
+      const result = hook(params, makeUser('tenant-abc')) as RunViewParams;
+      expect(result.ExtraFilter).toBe("(Name = 'a) OR (b' OR Name = 'c') AND ([OrganizationID] = 'tenant-abc')");
+    });
+  });
+
   // ─── PreSave security edge cases ──────────────────────────────────────
 
   describe('PreSave security', () => {

package/src/__tests__/multiTenancy.test.ts

@@ -87,7 +87,7 @@ describe('Multi-Tenancy Hooks', () => {
 
       const result = hook(params, user);
       expect((result as RunViewParams).ExtraFilter).toBe(
-        "(Status = 'Active') AND [OrganizationID] = 'tenant-abc'"
+        "(Status = 'Active') AND ([OrganizationID] = 'tenant-abc')"
       );
     });
 

package/src/__tests__/ownedRealtimeSession.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import {
+    LoadOwnedRealtimeSession, RealtimeSessionNotFoundError, RealtimeSessionOwnershipError,
+} from '../realtimeSessions/ownedRealtimeSession.js';
+
+const SESSION = '11111111-1111-4111-8111-111111111111';
+const OWNER = { ID: 'AAAAAAAA-0000-4000-8000-000000000001' } as unknown as UserInfo;
+const STRANGER = { ID: 'BBBBBBBB-0000-4000-8000-000000000002' } as unknown as UserInfo;
+
+function providerWith(row: { UserID: string } | null): IMetadataProvider {
+    return {
+        GetEntityObject: vi.fn(async () => ({
+            UserID: row?.UserID ?? '',
+            Load: vi.fn(async () => row !== null),
+        })),
+    } as unknown as IMetadataProvider;
+}
+
+describe('LoadOwnedRealtimeSession', () => {
+    it('returns the session when the caller owns it (UUIDs compared case-insensitively)', async () => {
+        const session = await LoadOwnedRealtimeSession(SESSION, OWNER, providerWith({ UserID: OWNER.ID.toLowerCase() }));
+        expect(session.UserID).toBe(OWNER.ID.toLowerCase());
+    });
+
+    it('throws RealtimeSessionNotFoundError when the row does not load', async () => {
+        await expect(LoadOwnedRealtimeSession(SESSION, OWNER, providerWith(null)))
+            .rejects.toBeInstanceOf(RealtimeSessionNotFoundError);
+        await expect(LoadOwnedRealtimeSession(SESSION, OWNER, providerWith(null)))
+            .rejects.toThrow(`Realtime session ${SESSION} not found`);
+    });
+
+    it('throws RealtimeSessionOwnershipError for another user', async () => {
+        await expect(LoadOwnedRealtimeSession(SESSION, STRANGER, providerWith({ UserID: OWNER.ID })))
+            .rejects.toBeInstanceOf(RealtimeSessionOwnershipError);
+        await expect(LoadOwnedRealtimeSession(SESSION, STRANGER, providerWith({ UserID: OWNER.ID })))
+            .rejects.toThrow('Not authorized: you do not own this realtime session');
+    });
+});

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -53,4 +53,11 @@ describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
   it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
     expect(StatusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
   });
+
+  it('delivers server-originated wildcard sessionId ("*") pushes ONLY when ownerUserId matches the connection user', () => {
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push({ sessionId: '*', ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+  });
 });
+