@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/resolvers/__tests__/GetDataResolver.validation.test.ts

@@ -0,0 +1,95 @@
+// type-graphql decorators on the resolver class need the reflect-metadata polyfill.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { MockInstance } from 'vitest';
+import { SQLExpressionValidator } from '@memberjunction/global';
+
+const { executedSQL } = vi.hoisted(() => ({ executedSQL: [] as string[] }));
+
+// GetData's server bootstrap, provider, auth and driver imports are replaced so the resolver runs
+// offline. The fake driver records every text it is asked to run.
+vi.mock('../../index.js', () => ({ GetDbType: () => 'sqlserver' }));
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  QueryCompositionEngine: class {
+    HasCompositionTokens(): boolean {
+      return false;
+    }
+  },
+}));
+vi.mock('../../util.js', () => ({ GetReadOnlyDataSource: () => ({}), GetReadOnlyProvider: () => null }));
+vi.mock('../../auth/index.js', () => ({ GetSystemUser: async () => ({}) }));
+vi.mock('mssql', () => ({
+  default: {
+    Request: class {
+      async query(text: string): Promise<{ recordset: Array<Record<string, unknown>> }> {
+        executedSQL.push(text);
+        return { recordset: [] };
+      }
+    },
+  },
+}));
+
+import { GetDataResolver, GetDataInputType, GetDataOutputType, RegisterAccessToken } from '../GetDataResolver.js';
+import type { AppContext } from '../../types.js';
+
+const CONTEXT = { dataSources: [] } as unknown as AppContext;
+
+let tokenSeq = 0;
+
+/** Calls GetData with a fresh valid token. */
+async function runGetData(queries: string[]): Promise<GetDataOutputType> {
+  const token = `getdata-validation-${Date.now()}-${++tokenSeq}`;
+  RegisterAccessToken(token, 60_000);
+  const input = Object.assign(new GetDataInputType(), { Token: token, Queries: queries });
+  return new GetDataResolver().GetData(input, CONTEXT);
+}
+
+/** The text of every call to the validator's `validate` method. */
+function validatedTexts(spy: MockInstance<SQLExpressionValidator['validate']>): string[] {
+  return spy.mock.calls.map(([text]) => text);
+}
+
+describe('GetData runs exactly the SQL it validated', () => {
+  beforeEach(() => {
+    executedSQL.length = 0;
+  });
+
+  it('validates and runs the same text when the query contains backslash sequences', async () => {
+    const query = String.raw`SELECT Name FROM __mj.vwFiles WHERE Path = 'C:\new\temp'`;
+    const validateSpy = vi.spyOn(SQLExpressionValidator.Instance, 'validate');
+
+    const output = await runGetData([query]);
+
+    expect(output.ErrorMessages).toEqual([null]);
+    expect(executedSQL).toEqual(validatedTexts(validateSpy));
+    expect(executedSQL).toEqual([query]);
+    expect(validateSpy).toHaveBeenCalledWith(query, { context: 'full_query', Dialect: 'sqlserver' });
+  });
+
+  it('runs the trimmed text that the validator reads', async () => {
+    const validateSpy = vi.spyOn(SQLExpressionValidator.Instance, 'validate');
+
+    const output = await runGetData(['\n  SELECT 1 AS One  \n']);
+
+    expect(output.ErrorMessages).toEqual([null]);
+    expect(executedSQL).toEqual(['SELECT 1 AS One']);
+    expect(validatedTexts(validateSpy)).toEqual(executedSQL);
+  });
+
+  it('refuses a query whose text, as written, does not open with SELECT or WITH', async () => {
+    const output = await runGetData(["-- note\\n SELECT 1\nPRINT 'hello'"]);
+
+    expect(executedSQL).toEqual([]);
+    expect(output.Success).toBe(false);
+    expect(output.ErrorMessages[0]).toMatch(/must start with SELECT or WITH/);
+  });
+
+  it('does not run a refused query and still runs the others', async () => {
+    const output = await runGetData(['SELECT 1; SELECT 2', 'SELECT 1 AS One']);
+
+    expect(executedSQL).toEqual(['SELECT 1 AS One']);
+    expect(output.ErrorMessages[0]).toMatch(/Semicolons are not allowed/);
+    expect(output.ErrorMessages[1]).toBeNull();
+  });
+});

package/src/resolvers/__tests__/MergeRecordsResolver.test.ts

@@ -90,4 +90,47 @@ describe('RecordDependencyResolver', () => {
     expect(result[0].IsSoftLink).toBeUndefined();
     expect(result[0].EntityIDFieldName).toBeUndefined();
   });
+
+  it('forwards contextUser and options to provider and maps FieldDisplayName', async () => {
+    const mockDep: RecordDependency = {
+      EntityName: 'Users',
+      RelatedEntityName: 'MJ: Task Links',
+      FieldName: 'RecordID',
+      FieldDisplayName: 'Linked Record',
+      PrimaryKey: new CompositeKey([new KeyValuePair('ID', 'TL-200')]),
+      IsSoftLink: true,
+      EntityIDFieldName: 'EntityID',
+    };
+
+    const getRecordDepsSpy = vi.fn().mockResolvedValue([mockDep]);
+    const mockProvider = {
+      GetRecordDependencies: getRecordDepsSpy,
+    } as unknown as IMetadataProvider;
+
+    vi.mocked(GetReadOnlyProvider).mockReturnValue(mockProvider as never);
+
+    const resolver = new RecordDependencyResolver();
+    const mockUser = { ID: 'u-1', Email: 'test@example.com' };
+    const mockContext = {
+      dataSource: {},
+      userPayload: { userRecord: mockUser },
+      providers: [],
+    } as unknown as AppContext;
+    const mockPubSub = {} as PubSubEngine;
+    const options = { LinkType: 'soft' as const, IncludeSystemEntities: false };
+
+    const result = await resolver.GetRecordDependencies(
+      'Users',
+      { KeyValuePairs: [{ FieldName: 'ID', Value: 'USER-1' }] },
+      mockContext,
+      mockPubSub,
+      options
+    );
+
+    expect(getRecordDepsSpy).toHaveBeenCalledTimes(1);
+    expect(getRecordDepsSpy.mock.calls[0][0]).toBe('Users');
+    expect(getRecordDepsSpy.mock.calls[0][2]).toBe(mockUser);
+    expect(getRecordDepsSpy.mock.calls[0][3]).toEqual(options);
+    expect(result[0].FieldDisplayName).toBe('Linked Record');
+  });
 });

package/src/resolvers/agent-run-data-guard.ts

@@ -0,0 +1,89 @@
+/**
+ * @fileoverview Decides which callers of the agent-run resolvers may set a run's scope or agent-type parameters
+ * through the free-form `data` argument.
+ *
+ * `BaseAgent` and `AgentRunner` read a few `ExecuteAgentParams.data` keys (`RESERVED_AGENT_RUN_DATA_KEYS` in
+ * `@memberjunction/ai-core-plus`) as fallbacks that change what a run is, not just what its prompt says:
+ *  - `PrimaryScopeEntityName`, `PrimaryScopeRecordID`, `SecondaryScopes` decide the run's scope: which
+ *    notes and examples memory is injected, the pre-execution RAG search context, the scoped prompt parts
+ *    and run settings, the scope columns written on the `MJ: AI Agent Runs` row, and what sub-agents
+ *    inherit. On a widget-guest run an explicit scope also beats the returning-visitor scope.
+ *  - `__agentTypePromptParams` is the highest-precedence agent-type parameter layer. It can turn on the
+ *    Loop type's `enableTaskGraphs` capability, and switch decisions on or off.
+ *
+ * The rule lives with the run, not here: `BaseAgent.Execute` drops those keys from every run's `data` unless the
+ * params set `ExecuteAgentParams.TrustReservedRunData`. The resolvers set that marker for the callers
+ * {@link IsTrustedAgentRunCaller} accepts — the system user, and an `mj_sk_*` API key that holds the
+ * {@link TRUSTED_RUN_DATA_SCOPE} scope — and never for a browser or a widget guest. Any user who may create API
+ * keys can mint one for themselves, so a key alone is not enough: an administrator grants the scope. Explorer never
+ * sends these keys. Everything else in `data` (template data, `conversationId`, `appContext`, `clientTools`, ...)
+ * reaches the run unchanged either way.
+ *
+ * @module @memberjunction/server/resolvers
+ */
+import { LogError } from '@memberjunction/core';
+import { GetAPIKeyEngine } from '@memberjunction/api-keys';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import type { UserPayload } from '../types.js';
+
+/**
+ * The API-key scope (`MJ: API Scopes.FullPath`) that makes an `mj_sk_*` key a trusted integration for reserved run
+ * data. Checked against the agent being run, so a key can be trusted for some agents only. `full_access` does not
+ * imply it: the key must hold this scope itself.
+ */
+export const TRUSTED_RUN_DATA_SCOPE = 'agent:trusted';
+
+/** Who sent a run's `data`, as far as {@link IsTrustedAgentRunCaller} needs to know. */
+export interface ClientAgentRunCaller {
+    /**
+     * The request's authenticated payload, BEFORE any widget-guest elevation. `isSystemUser` is set only by
+     * the system API key (and by widget elevation, which {@link IsWidgetGuestRun} overrides); `apiKeyHash`
+     * only by an `mj_sk_*` user API key.
+     */
+    UserPayload: Pick<UserPayload, 'email' | 'isSystemUser' | 'apiKeyHash'>;
+    /** True when the run executes under the widget-guest elevated principal. Such a run is never trusted. */
+    IsWidgetGuestRun: boolean;
+    /** The agent the caller asked to run: the resource the {@link TRUSTED_RUN_DATA_SCOPE} check is made against. */
+    AgentID: string;
+}
+
+/**
+ * Whether a caller may set the reserved run-data keys — the value the agent-run resolvers pass as
+ * `ExecuteAgentParams.TrustReservedRunData`: the system user, or an API key that holds
+ * {@link TRUSTED_RUN_DATA_SCOPE} for this agent, and never a widget-guest run, whatever principal it was elevated to.
+ * A key without the scope is treated like the browser session of the user it belongs to.
+ *
+ * @param caller - Who sent the run's `data`.
+ * @returns `true` when the run may read the reserved keys from `data`.
+ */
+export async function IsTrustedAgentRunCaller(caller: ClientAgentRunCaller): Promise<boolean> {
+    if (caller.IsWidgetGuestRun) {
+        return false;
+    }
+    if (caller.UserPayload.isSystemUser === true) {
+        return true;
+    }
+    const apiKeyHash = caller.UserPayload.apiKeyHash;
+    return apiKeyHash ? keyHoldsTrustedRunDataScope(apiKeyHash, caller.AgentID) : false;
+}
+
+/**
+ * Whether the key explicitly holds {@link TRUSTED_RUN_DATA_SCOPE} for the agent. A key-level rule must match: an
+ * allow that comes from scope enforcement being switched off, or from `defaultBehaviorNoScopes: 'allow'`, matches
+ * no rule and does not count. Any failure counts as not held.
+ */
+async function keyHoldsTrustedRunDataScope(apiKeyHash: string, agentID: string): Promise<boolean> {
+    try {
+        const systemUser = UserCache.Instance.GetSystemUser();
+        if (!systemUser) {
+            return false;
+        }
+        // A probe, not an access decision (the run goes ahead either way), so it is not written to the usage log.
+        const result = await GetAPIKeyEngine().Authorize(apiKeyHash, 'MJAPI', TRUSTED_RUN_DATA_SCOPE, agentID, systemUser,
+            { endpoint: '/graphql', method: 'POST' }, { skipLogging: true });
+        return result.Allowed && result.MatchedKeyRule != null;
+    } catch (e) {
+        LogError(`IsTrustedAgentRunCaller: the ${TRUSTED_RUN_DATA_SCOPE} check failed; the run is not trusted: ${e}`);
+        return false;
+    }
+}

package/src/rest/EntityCRUDHandler.ts

@@ -1,7 +1,8 @@
 import { 
-    BaseEntity, CompositeKey, EntityDeleteOptions, EntityPermissionType, 
+    AssertClientInputWritableForUser, BaseEntity, CompositeKey, EntityDeleteOptions, EntityPermissionType, 
     EntitySaveOptions, LogError, Metadata, UserInfo 
 } from '@memberjunction/core';
+import { ProjectValuesForCaller } from '../generic/fieldSecurityTransport.js';
 
 /**
  * Entity CRUD Implementation Functions for REST endpoints
@@ -42,6 +43,9 @@ export class EntityCRUDHandler {
                 delete data.options;
             }
             
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(entity.EntityInfo, data, user);
+
             // Set values on the entity
             for (const key in data) {
                 entity.Set(key, data[key]);
@@ -70,7 +74,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -114,7 +118,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -171,6 +175,9 @@ export class EntityCRUDHandler {
                 delete data.options;
             }
             
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(entity.EntityInfo, data, user);
+
             // Update entity with new values
             for (const key in data) {
                 entity.Set(key, data[key]);
@@ -179,7 +186,7 @@ export class EntityCRUDHandler {
             // Check if entity is dirty
             if (!entity.Dirty && !options.IgnoreDirtyState) {
                 // Nothing changed, return success
-                const entityData = await entity.GetDataObject();
+                const entityData = await this.responseData(entity, user, md);
                 return { success: true, entity: entityData };
             }
             
@@ -206,7 +213,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -273,6 +280,16 @@ export class EntityCRUDHandler {
         return this.DeleteEntity(entityName, id, options, user);
     }
     
+    /**
+     * The record's field values for the response, reduced to what `user` may READ. An entity
+     * object built for a restricted user holds no denied value already; this is the backstop for
+     * one that does.
+     */
+    private static async responseData(entity: BaseEntity, user: UserInfo, md: Metadata): Promise<Record<string, unknown>> {
+        // fls-guard: projected by ProjectValuesForCaller
+        return ProjectValuesForCaller(entity.EntityInfo, await entity.GetDataObject() as Record<string, unknown>, user, md);
+    }
+
     /**
      * Build the record key from the `:id` path segment. A single-column key (any column name) is
      * the bare value; a composite key is the URL-encoded `Field1|Value1||Field2|Value2` segment.

package/src/rest/RESTEndpointHandler.ts

@@ -2,7 +2,7 @@ import express from 'express';
 import {
     BaseEntity, CompositeKey, EntityDeleteOptions, EntityInfo,
     EntityPermissionType, EntitySaveOptions, LogError, Metadata,
-    RunView, RunViewParams, UserInfo
+    RunView, RunViewParams, StripServerOnlyRunViewParams, UserInfo
 } from '@memberjunction/core';
 import { EntityCRUDHandler } from './EntityCRUDHandler.js';
 import { ViewOperationsHandler } from './ViewOperationsHandler.js';
@@ -499,10 +499,11 @@ export class RESTEndpointHandler {
             
             const user = req['mjUser'];
             
-            // Create RunViewParams from the request body
+            // Create RunViewParams from the request body, without the fields only server code sets;
+            // the time zone comes from the x-mj-timezone header, as on the GraphQL path
             const params: RunViewParams = {
-                EntityName: entityName,
-                ...viewParams
+                ...StripServerOnlyRunViewParams({ ...viewParams, EntityName: entityName }),
+                TimeZone: req.userPayload?.TimeZone
             };
             
             const result = await ViewOperationsHandler.runView(params, user);
@@ -533,7 +534,9 @@ export class RESTEndpointHandler {
             
             // Filter out any views for entities that aren't allowed
             // using our enhanced entity filtering with wildcards and schema support
-            const filteredParams = params.filter(p => this.isEntityAllowed(p.EntityName));
+            const filteredParams = params
+                .filter(p => this.isEntityAllowed(p.EntityName))
+                .map(p => ({ ...StripServerOnlyRunViewParams(p), TimeZone: req.userPayload?.TimeZone }));
             
             // If all requested entities were filtered out, return an error
             if (filteredParams.length === 0 && params.length > 0) {