@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/DatasetResolver.itemFilters.test.ts

@@ -0,0 +1,201 @@
+// The resolvers carry type-graphql decorators, which need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import {
+    DatabaseProviderBase,
+    DatasetItemFilterType,
+    DatasetResultType,
+    DatasetStatusResultType,
+    EntityInfo,
+    UserInfo,
+} from '@memberjunction/core';
+import { ENCRYPTED_SENTINEL } from '@memberjunction/global';
+import { DatasetResolverExtended, DatasetStatusResolver } from '../resolvers/DatasetResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+// The encrypted-field policy configures the encryption engine before it inspects a value; there is
+// no key store in a unit test.
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: {
+        Instance: {
+            Config: async () => undefined,
+            GetKeyByID: () => ({ Marker: '$ENC$' }),
+            Encrypt: async (value: string) => `$ENC$${value}`,
+        },
+    },
+}));
+
+/**
+ * The GraphQL dataset queries are the network edge of security finding C6.
+ *
+ * `GetDatasetByName` / `GetDatasetStatusByName` took `ItemFilters[].Filter` from any authenticated
+ * principal and handed it to the provider unscreened, and passed no context user, so the provider
+ * could neither refuse an unreadable item nor apply row-level security. These tests pin that the
+ * resolvers screen every ItemFilter with the same AST screen as ExtraFilter before the provider is
+ * reached, pass the session user down, and apply the API encryption policy to the rows they return.
+ */
+
+const ROLE_ID = 'R0000000-0000-0000-0000-00000000000A';
+const OTHER_ROLE_ID = 'R0000000-0000-0000-0000-00000000000C';
+
+function entity(name: string, baseView: string, fields: Record<string, unknown>[] = []): EntityInfo {
+    const id = `E-${name}`;
+    return new EntityInfo({
+        ID: id, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: baseView,
+        Permissions: [{ ID: `p-${name}`, EntityID: id, RoleID: ROLE_ID, CanRead: true, Type: 'Allow' }],
+        Fields: fields.map((f, i) => ({ ID: `${id}-f${i}`, EntityID: id, Entity: name, Sequence: i + 1, Type: 'nvarchar', ...f })),
+    });
+}
+
+const THINGS = entity('Things', 'vwThings', [{ Name: 'ID', IsPrimaryKey: true }, { Name: 'Name' }]);
+const SECRETS = entity('Secrets', 'vwSecrets', [
+    { Name: 'ID', IsPrimaryKey: true },
+    { Name: 'Token', Encrypt: true, EncryptionKeyID: 'K1', AllowDecryptInAPI: false, SendEncryptedValue: false },
+]);
+
+const USER = new UserInfo(undefined, {
+    ID: 'U1', Name: 'Reader', Email: 'reader@example.com', IsActive: true,
+    UserRoles: [{ UserID: 'U1', RoleID: ROLE_ID, Role: 'Reader' }],
+});
+
+type ProviderCall = {
+    Method: 'GetDatasetByName' | 'GetDatasetStatusByName';
+    DatasetName: string;
+    ItemFilters: DatasetItemFilterType[] | undefined;
+    ContextUser: UserInfo | undefined;
+};
+
+/** A provider double that records what reached it and answers with fixed rows. */
+function fakeProvider(itemEntity: EntityInfo = THINGS, rows: Record<string, unknown>[] = []) {
+    const calls: ProviderCall[] = [];
+    const provider = {
+        Entities: [THINGS, SECRETS],
+        EntityByName: (name: string) => [THINGS, SECRETS].find(e => e.Name.toLowerCase() === name?.trim().toLowerCase()),
+        GetDatasetByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetResultType> => {
+            calls.push({ Method: 'GetDatasetByName', DatasetName, ItemFilters, ContextUser });
+            return {
+                DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0),
+                Results: [{ Code: itemEntity.Name, EntityName: itemEntity.Name, EntityID: itemEntity.ID, Results: rows, Success: true }],
+            };
+        },
+        GetDatasetStatusByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetStatusResultType> => {
+            calls.push({ Method: 'GetDatasetStatusByName', DatasetName, ItemFilters, ContextUser });
+            return { DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0), EntityUpdateDates: [] };
+        },
+    };
+    return { provider: provider as unknown as DatabaseProviderBase, calls };
+}
+
+function context(provider: DatabaseProviderBase, userPayload: Partial<UserPayload> = { email: USER.Email, userRecord: USER }): AppContext {
+    return {
+        providers: [{ provider, type: 'Read-Write' }],
+        userPayload: { sessionId: 'S1', ...userPayload } as UserPayload,
+    } as AppContext;
+}
+
+const STACKED = [{ ItemCode: 'Things', Filter: '1=0; SELECT 1' }];
+// A quote inside a bracket identifier opens a fake literal for the string-literal stripper that
+// guards the provider denylist; the AST screen tokenizes brackets and still sees the second statement.
+const STACKED_BEHIND_BRACKET = [{ ItemCode: 'Things', Filter: "[a'] = 1; SELECT 1 --'" }];
+
+describe('GetDatasetByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses a stacked statement hidden behind a bracket identifier', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED_BEHIND_BRACKET))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses an ItemFilter whose subquery reads a table that is not an entity base view', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.[User])' }];
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), filters))
+            .rejects.toThrow(/entity base view/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider, with the screened filters', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: "Name = 'x'" }];
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider), filters);
+
+        expect(result.Success).toBe(true);
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+        expect(calls[0].ItemFilters).toEqual(filters);
+    });
+
+    it('refuses a session that resolves to no user rather than reading as nobody', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider, { email: '', userRecord: null })))
+            .rejects.toThrow(/no user/i);
+        expect(calls).toEqual([]);
+    });
+
+    it('masks an encrypted field the entity does not allow decrypted over the API, without touching the provider rows', async () => {
+        // A context user makes the provider decrypt; the API policy decides what leaves the server.
+        const providerRow = Object.freeze({ ID: 'S1', Token: 'plain-secret' });
+        const { provider } = fakeProvider(SECRETS, [providerRow]);
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Secrets_Dataset', context(provider));
+
+        const items = JSON.parse(result.Results) as DatasetResultType['Results'];
+        expect(items[0].Results[0].Token).toBe(ENCRYPTED_SENTINEL);
+        expect(result.Results).not.toContain('plain-secret');
+        expect(providerRow.Token).toBe('plain-secret');
+    });
+});
+
+describe('GetDatasetStatusByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider), [{ ItemCode: 'Things', Filter: "Name = 'x'" }]);
+
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+    });
+
+    it('refuses an ItemFilter that reads an entity the user has no read permission on', async () => {
+        const { provider, calls } = fakeProvider();
+        const outsider = new UserInfo(undefined, {
+            ID: 'U2', Name: 'Outsider', Email: 'outsider@example.com', IsActive: true,
+            UserRoles: [{ UserID: 'U2', RoleID: OTHER_ROLE_ID, Role: 'Other' }],
+        });
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.vwSecrets)' }];
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider, { email: outsider.Email, userRecord: outsider }), filters))
+            .rejects.toThrow(/read permission/);
+        expect(calls).toEqual([]);
+    });
+});
+
+describe('GetMultipleDatasetStatusByName', () => {
+    it('passes the session user to the provider for every dataset', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetMultipleDatasetStatusByName(['A', 'B'], context(provider));
+
+        expect(calls.map(c => c.ContextUser)).toEqual([USER, USER]);
+    });
+});

package/src/__tests__/EntityCommunicationsResolver.actingUser.test.ts

@@ -0,0 +1,151 @@
+// The resolver module pulls in type-graphql decorators, which need the Reflect.metadata polyfill.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import type { EntityCommunicationParams } from '@memberjunction/entity-communications-base';
+
+/**
+ * `RunEntityCommunicationByViewID` with `previewOnly` + `includeProcessedMessages` returns the rows
+ * it read. It must hand the engine the authenticated caller as the acting user, and screen the
+ * view's client-supplied clauses the way a RunView request is screened, because this entry point
+ * does not pass through the RunView resolvers.
+ */
+
+const { captured } = vi.hoisted(() => ({ captured: { params: [] as EntityCommunicationParams[] } }));
+
+// The resolver's input types declare fields without explicit GraphQL types; the test runner emits no
+// decorator metadata, so the decorators are stubbed out.
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+        Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+        createUnionType: () => class {},
+        AuthorizationError: class AuthorizationError extends Error {},
+        Float: class {}, Int: class {}, ID: class {},
+    };
+});
+
+vi.mock('@memberjunction/entity-communications-server', () => ({
+    EntityCommunicationsEngine: {
+        Instance: {
+            Config: vi.fn(),
+            RunEntityCommunication: vi.fn(async (params: EntityCommunicationParams) => {
+                captured.params.push(params);
+                return { Success: true, Results: [] };
+            }),
+        },
+    },
+}));
+
+vi.mock('@memberjunction/templates', () => ({
+    TemplateEngineServer: { Instance: { Config: vi.fn(), FindTemplate: vi.fn() } },
+}));
+
+import { ReportResolver } from '../resolvers/EntityCommunicationsResolver.js';
+import type { AppContext } from '../types.js';
+import type { RunViewByIDInput } from '../generic/RunViewResolver.js';
+import type { CommunicationMessageInput } from '../resolvers/EntityCommunicationsResolver.js';
+
+const SENDER = { ID: 'sender', Email: 'sender@example.com' } as UserInfo;
+
+/** Entity metadata the clause screen reads: one entity the sender can read, one it cannot. */
+function fakeProvider(): DatabaseProviderBase {
+    const entity = (name: string, view: string, canRead: boolean) => ({
+        ID: name,
+        Name: name,
+        SchemaName: '__mj',
+        BaseView: view,
+        BaseTable: view.replace(/^vw/, ''),
+        Fields: [{ Name: 'ID', NeedsQuotes: true }, { Name: 'Email', NeedsQuotes: true }],
+        GetUserPermisions: () => ({ CanRead: canRead }),
+        GetEffectiveRowFilterWhereClause: () => '',
+        GetDeniedReadFields: () => new Set<string>(),
+    });
+    return {
+        Entities: [entity('Customers', 'vwCustomers', true), entity('Salaries', 'vwSalaries', false)],
+        GetEntityObject: async () => fakeView(),
+    } as unknown as DatabaseProviderBase;
+}
+
+/** Saved views by ID, as the caller can load them: `view-1` is a Customers view, `view-salaries` is not. */
+const VIEWS: Record<string, { ID: string; EntityID: string }> = {
+    'view-1': { ID: 'view-1', EntityID: 'Customers' },
+    'view-salaries': { ID: 'view-salaries', EntityID: 'Salaries' },
+};
+
+function fakeView() {
+    const view = {
+        ID: undefined as string | undefined,
+        EntityID: undefined as string | undefined,
+        async Load(id: string) {
+            const found = VIEWS[id];
+            if (!found) return false;
+            Object.assign(view, found);
+            return true;
+        },
+    };
+    return view;
+}
+
+function context(): AppContext {
+    return {
+        userPayload: { email: SENDER.Email, userRecord: SENDER },
+        providers: [{ provider: fakeProvider(), type: 'Read-Write' }],
+    } as unknown as AppContext;
+}
+
+function run(extraFilter?: string, viewID = 'view-1') {
+    const viewInput = { ViewID: viewID, ExtraFilter: extraFilter } as RunViewByIDInput;
+    const message = { MessageType: {}, From: 'a@example.com', To: '' } as unknown as CommunicationMessageInput;
+    return new ReportResolver().RunEntityCommunicationByViewID('Customers', viewInput, 'SendGrid', 'Email', message, true, true, context());
+}
+
+describe('RunEntityCommunicationByViewID — runs as the caller', () => {
+    beforeEach(() => {
+        captured.params = [];
+    });
+
+    it('passes the authenticated caller to the engine as the acting user', async () => {
+        const result = await run();
+        expect(result.Success).toBe(true);
+        expect(captured.params).toHaveLength(1);
+        expect(captured.params[0].ContextUser).toBe(SENDER);
+    });
+
+    it('refuses an ExtraFilter whose subquery reads an entity the caller cannot read, before the engine runs', async () => {
+        const result = await run("ID IN (SELECT ID FROM __mj.vwSalaries WHERE Amount > 100000)");
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+        expect(captured.params).toHaveLength(0);
+    });
+
+    it('refuses an ExtraFilter that carries a second statement', async () => {
+        const result = await run("1=1; SELECT 1");
+        expect(result.Success).toBe(false);
+        expect(captured.params).toHaveLength(0);
+    });
+});
+
+describe('RunEntityCommunicationByViewID — the view must belong to the entity', () => {
+    beforeEach(() => {
+        captured.params = [];
+    });
+
+    it('refuses a view of a different entity, before the engine runs', async () => {
+        const result = await run(undefined, 'view-salaries');
+        expect(result.Success).toBe(false);
+        expect(captured.params).toHaveLength(0);
+    });
+
+    it('gives the same error for a view of another entity as for a view that does not exist', async () => {
+        const mismatched = await run(undefined, 'view-salaries');
+        const missing = await run(undefined, 'view-missing');
+        expect(missing.Success).toBe(false);
+        expect(mismatched.ErrorMessage).toBe(missing.ErrorMessage);
+        expect(mismatched.ErrorMessage).toMatch(/does not exist or you do not have access/);
+        expect(captured.params).toHaveLength(0);
+    });
+});

package/src/__tests__/EntityRecordNameResolver.rowSecurity.test.ts

@@ -0,0 +1,152 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { CompositeKey, DatabaseProviderBase, EntityInfo, EntityPermissionType, Metadata, RowLevelSecurityFilterInfo, UserInfo } from '@memberjunction/core';
+import type { DeleteSQLResult, IMetadataProvider, QueryExecutionSpec, RunQueryResult, SaveSQLResult } from '@memberjunction/core';
+import { EntityRecordNameResolver } from '../resolvers/EntityRecordNameResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * The record-name queries against a real provider whose database only records what it is sent.
+ * The lookup the resolver causes carries the acting user's read row filter, binds the key value,
+ * refuses a key that is not the entity's primary key, and never runs without an acting user.
+ */
+
+const CLIENTS_ID = 'E0000000-0000-0000-0000-0000000000C1';
+const ACCOUNT_MANAGER_ROLE_ID = 'B0000000-0000-0000-0000-0000000000C1';
+const OWN_CLIENTS_FILTER_ID = 'F0000000-0000-0000-0000-0000000000C1';
+const MANAGER_ID = 'C0000000-0000-0000-0000-0000000000C1';
+const CLIENT_ID_VALUE = '33333333-3333-3333-3333-333333333333';
+
+const ROW_FILTERS: RowLevelSecurityFilterInfo[] = [
+    new RowLevelSecurityFilterInfo({ ID: OWN_CLIENTS_FILTER_ID, Name: 'Own clients', FilterText: "AccountManagerID = '{{UserID}}'" }),
+];
+
+/** `Clients`: account managers read only the clients they manage. */
+function clientsEntity(): EntityInfo {
+    return new EntityInfo({
+        ID: CLIENTS_ID, Name: 'Clients', SchemaName: 'dbo', BaseTable: 'Client', BaseView: 'vwClients',
+        Permissions: [
+            { ID: 'perm-manager', EntityID: CLIENTS_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, CanRead: true, ReadRLSFilterID: OWN_CLIENTS_FILTER_ID, Type: 'Allow' },
+        ],
+        Fields: [
+            { ID: 'cl-id', EntityID: CLIENTS_ID, Sequence: 1, Name: 'ID', Type: 'uniqueidentifier', IsPrimaryKey: true, NeedsQuotes: true },
+            { ID: 'cl-name', EntityID: CLIENTS_ID, Sequence: 2, Name: 'Name', Type: 'nvarchar', IsNameField: true, NeedsQuotes: true },
+            { ID: 'cl-tier', EntityID: CLIENTS_ID, Sequence: 3, Name: 'Tier', Type: 'int', NeedsQuotes: false },
+            { ID: 'cl-manager', EntityID: CLIENTS_ID, Sequence: 4, Name: 'AccountManagerID', Type: 'uniqueidentifier', NeedsQuotes: true },
+        ],
+    });
+}
+
+interface SentQuery {
+    SQL: string;
+    Parameters: unknown[] | undefined;
+}
+
+/** A SQL Server-shaped provider over `Clients`, whose database answers every query with one row. */
+class RecordingProvider extends DatabaseProviderBase {
+    public Sent: SentQuery[] = [];
+    private readonly entities = [clientsEntity()];
+
+    public override get Entities(): EntityInfo[] {
+        return this.entities;
+    }
+
+    public override get RowLevelSecurityFilters(): RowLevelSecurityFilterInfo[] {
+        return ROW_FILTERS;
+    }
+
+    async ExecuteSQL<T>(sql: string, parameters?: unknown[]): Promise<Array<T>> {
+        this.Sent.push({ SQL: sql, Parameters: parameters });
+        return [{ Name: 'Acme Manufacturing' }] as T[];
+    }
+
+    public override BuildParameterPlaceholder(index: number): string { return `@p${index}`; }
+    protected get UUIDFunctionPattern(): RegExp { return /^newid\(\)$/i; }
+    protected get DBDefaultFunctionPattern(): RegExp { return /^getdate\(\)$/i; }
+    public QuoteIdentifier(name: string): string { return `[${name}]`; }
+    public QuoteSchemaAndView(schema: string, obj: string): string { return `[${schema}].[${obj}]`; }
+    protected BuildChildDiscoverySQL(): string { return ''; }
+    protected BuildHardLinkDependencySQL(): string { return ''; }
+    protected BuildSoftLinkDependencySQL(): string { return ''; }
+    protected async GenerateSaveSQL(): Promise<SaveSQLResult> { return { fullSQL: '' }; }
+    protected GenerateDeleteSQL(): DeleteSQLResult { return { fullSQL: '' }; }
+    protected BuildRecordChangeSQL(): { sql: string; parameters?: unknown[] } | null { return null; }
+    protected BuildSiblingRecordChangeSQL(): string { return ''; }
+    async BeginTransaction(): Promise<void> {}
+    async CommitTransaction(): Promise<void> {}
+    async RollbackTransaction(): Promise<void> {}
+    protected async InternalExecuteQueryFromSpec(_spec: QueryExecutionSpec): Promise<RunQueryResult> {
+        throw new Error('Not supported.');
+    }
+}
+
+const MANAGER = new UserInfo(null, {
+    ID: MANAGER_ID, Name: 'Morgan', Email: 'morgan@example.com', IsActive: true,
+    UserRoles: [{ UserID: MANAGER_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, Role: 'Account Managers' }],
+});
+
+function key(fieldName: string, value: string): CompositeKey {
+    return new CompositeKey([{ FieldName: fieldName, Value: value }]);
+}
+
+describe('EntityRecordNameResolver lookups under row-level security', () => {
+    let provider: RecordingProvider;
+    let savedProvider: IMetadataProvider;
+    let context: AppContext;
+    const resolver = new EntityRecordNameResolver();
+
+    beforeEach(() => {
+        provider = new RecordingProvider();
+        // Row filters resolve through the global provider.
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        const userPayload: UserPayload = { email: MANAGER.Email, userRecord: MANAGER, sessionId: 'session-1' };
+        context = { dataSource: undefined, dataSources: [], providers: [{ provider, type: 'Read-Only' }], userPayload };
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    function managerRowFilter(): string {
+        return provider.EntityByName('Clients').GetEffectiveRowFilterWhereClause(MANAGER, EntityPermissionType.Read, '');
+    }
+
+    it("looks the name up under the acting user's read row filter, with the key value bound", async () => {
+        const rowFilter = managerRowFilter();
+        expect(rowFilter).toContain(MANAGER_ID);
+
+        const result = await resolver.GetEntityRecordName('Clients', key('ID', CLIENT_ID_VALUE), context);
+
+        expect(result.Success).toBe(true);
+        expect(provider.Sent).toEqual([
+            { SQL: `SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`, Parameters: [CLIENT_ID_VALUE] },
+        ]);
+    });
+
+    it('applies the row filter to each item of a batch', async () => {
+        const rowFilter = managerRowFilter();
+
+        const results = await resolver.GetEntityRecordNames([{ EntityName: 'Clients', CompositeKey: key('ID', CLIENT_ID_VALUE) }], context);
+
+        expect(results.map(r => r.Success)).toEqual([true]);
+        expect(provider.Sent.map(q => q.SQL)).toEqual([`SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`]);
+    });
+
+    it('refuses a key field that is not a primary key, without querying', async () => {
+        const result = await resolver.GetEntityRecordName('Clients', key('Tier', '1'), context);
+
+        expect(result.Success).toBe(false);
+        expect(result.RecordName).toBeUndefined();
+        expect(provider.Sent).toHaveLength(0);
+    });
+
+    it('looks no name up when there is no acting user', async () => {
+        const result = await resolver.InnerGetEntityRecordName(provider, 'Clients', key('ID', CLIENT_ID_VALUE));
+
+        expect(result.Success).toBe(false);
+        expect(provider.Sent).toHaveLength(0);
+    });
+});

package/src/__tests__/EvolutionActsOnWhatItDetects.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Two ways the schema-evolution path stopped short of acting on what it already knew.
+ *
+ *  - MJ-RUN-37: the persist layer has always recorded an `IncrementalWatermarkField` change and
+ *    nothing consumed the record. `changedObjects` — the sole input to `ResetPullWatermarks` — was
+ *    built from a physical column diff and a field-map add/disable, and a cursor swap produces
+ *    neither. The stale Pull watermark then became a lower bound on a DIFFERENT column, and where
+ *    the new column sorts later, every row below it was filtered out at the source, permanently and
+ *    invisibly (an incremental's fetched-vs-expected check agrees, because the source counts
+ *    against the filter it was handed).
+ *
+ *  - MJ-APPLY-6 residual: `RunPipelineBatchWithRetry` existed and two of the six pipeline call
+ *    sites used it. `SchemaBuilder.RunSchemaPipeline` states the reason plainly — the middle steps
+ *    fail transiently and "the callers simply never used it".
+ *
+ * The evolution mutation needs a provider, a connector, a SchemaBuilder and an RSU pipeline to
+ * invoke, and the properties here are wiring, not behaviour worth standing all that up to observe.
+ * Read from source, the convention this directory already uses for this method. The DECISION the
+ * wiring feeds is unit-tested for real in the integration-engine package
+ * (WatermarkFieldChangeIsAChange.test.ts) — these pin that the resolver calls it, feeds it the
+ * right input, and does so before the watermark reset.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC = readFileSync(join(__dirname, '..', 'resolvers', 'IntegrationDiscoveryResolver.ts'), 'utf-8');
+const PROMOTER = readFileSync(join(__dirname, '..', 'integration', 'CustomColumnPromoter.ts'), 'utf-8');
+const RSU_RESOLVER = readFileSync(join(__dirname, '..', 'resolvers', 'RSUResolver.ts'), 'utf-8');
+
+/** The body of a named resolver method, up to the next @Query/@Mutation at the same indent. */
+function methodBody(src: string, name: string): string {
+  const start = src.indexOf(`async ${name}(`);
+  expect(start, `${name} not found`).toBeGreaterThan(-1);
+  const rest = src.slice(start);
+  const end = rest.search(/\n    @(Query|Mutation)\(/);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+describe('MJ-RUN-37 — a watermark-field change reaches ResetPullWatermarks', () => {
+  const body = () => methodBody(SRC, 'IntegrationSchemaEvolution');
+
+  it('consumes the persist layer\'s detection rather than re-deriving it', () => {
+    // The whole defect was that this signal existed and had no consumer. It must come from the
+    // refresh's OWN PersistResult — re-reading the catalog afterwards cannot tell a changed
+    // watermark field from one that was always that way.
+    expect(body()).toMatch(/ObjectsWithWatermarkFieldChange\(\s*refresh\.PersistResult\?\.ObjectMergeLog \?\? \[\]/);
+  });
+
+  it('imports it from the engine that produces it', () => {
+    expect(SRC).toMatch(/ObjectsWithWatermarkFieldChange[\s\S]{0,200}?from "@memberjunction\/integration-engine"/);
+  });
+
+  it('scopes it to the CONTINUING maps, so it cannot report what nothing can reset', () => {
+    expect(body()).toMatch(/continuingMaps\.map\(m => m\.ExternalObjectName \?\? ''\)/);
+  });
+
+  it('folds the result into changedObjects — the only input ResetPullWatermarks has', () => {
+    const b = body();
+    const push = b.search(/if \(!changedObjects\.some\(n => n\.toLowerCase\(\) === name\.toLowerCase\(\)\)\) changedObjects\.push\(name\)/);
+    const reset = b.indexOf('ResetPullWatermarks(');
+    expect(push, 'the watermark-changed names are never pushed onto changedObjects').toBeGreaterThan(-1);
+    expect(reset).toBeGreaterThan(-1);
+    expect(push, 'the push must happen BEFORE the reset, or it changes nothing').toBeLessThan(reset);
+  });
+
+  it('does not push unconditionally — an unchanged run must not re-full-sync the connection', () => {
+    // The guard is the expensive half. `changedObjects` drives ResetPullWatermarks AND HasChanges,
+    // so a rule that fires when no cursor moved turns every refresh into a full re-fetch of
+    // everything. The emptiness of the detection is what has to carry that, never a bare loop.
+    const b = body();
+    const i = b.indexOf('ObjectsWithWatermarkFieldChange(');
+    const after = b.slice(i, i + 600);
+    expect(after).toMatch(/for \(const name of watermarkFieldChanged\)/);
+    expect(after).not.toMatch(/changedObjects\.push\(\.\.\./);
+  });
+});
+
+describe('MJ-APPLY-6 residual — the bare pipeline calls that should retry', () => {
+  it('IntegrationApplySchemaBatch retries, matching its single-connector sibling', () => {
+    // IntegrationApplySchema retries via SchemaBuilder.RunSchemaPipeline. Same install path, same
+    // generated DDL, same four transient steps — the batch simply never used the wrapper.
+    const b = methodBody(SRC, 'IntegrationApplySchemaBatch');
+    expect(b).toMatch(/rsm\.RunPipelineBatchWithRetry\(pipelineInputs\)/);
+    expect(b).not.toMatch(/rsm\.RunPipelineBatch\(/);
+  });
+
+  it('IntegrationSchemaEvolution retries', () => {
+    const b = methodBody(SRC, 'IntegrationSchemaEvolution');
+    expect(b).toMatch(/rsm\.RunPipelineBatchWithRetry\(/);
+    expect(b).not.toMatch(/rsm\.RunPipelineBatch\(/);
+  });
+
+  it('the custom-column promoter retries — it runs unattended, mid-sync', () => {
+    expect(PROMOTER).toMatch(/RuntimeSchemaManager\.Instance\.RunPipelineBatchWithRetry\(batchInputs\)/);
+    expect(PROMOTER).not.toMatch(/RuntimeSchemaManager\.Instance\.RunPipelineBatch\(/);
+  });
+
+  it('no bare RunPipelineBatch survives in the integration resolver', () => {
+    // A regression here is invisible at runtime: the pipeline still works, it just stops
+    // absorbing the hiccup it was wrapped to absorb.
+    expect(SRC).not.toMatch(/RunPipelineBatch\((?!\w)/);
+  });
+
+  it('RunRuntimeSchemaUpdateBatch deliberately does NOT retry, and says why', () => {
+    // The one exception, kept explicit so it reads as a decision rather than an oversight: this
+    // mutation replays CALLER-AUTHORED SQL, and executeMigration is not transactional.
+    const b = methodBody(RSU_RESOLVER, 'RunRuntimeSchemaUpdateBatch');
+    expect(b).toMatch(/rsm\.RunPipelineBatch\(pipelineInputs\)/);
+    expect(b).toMatch(/deliberately the BARE call/);
+    expect(b).toMatch(/NOT transactional/);
+  });
+});