@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/FetchEntityVectorsResolver.test.ts

@@ -21,16 +21,26 @@ vi.mock('type-graphql', () => {
     return Object.fromEntries(exportNames.map((name) => [name, decoratorFactory]));
 });
 
-const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined }> = [];
+const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined; provider: unknown }> = [];
+/** Each RunViews call, as the list of entity names it batched. */
+const runViewsBatches: string[][] = [];
 let runViewHandler: RunViewHandler = () => ({ Success: true, Results: [] });
 
 vi.mock('@memberjunction/core', async (importOriginal) => {
     const actual = await importOriginal<typeof import('@memberjunction/core')>();
     class MockRunView {
+        constructor(private readonly provider?: unknown) {}
+        static FromMetadataProvider(provider: unknown): MockRunView {
+            return new MockRunView(provider);
+        }
         async RunView(params: RunViewParams, contextUser?: UserInfo): Promise<ViewResult> {
-            runViewCalls.push({ params, contextUser });
+            runViewCalls.push({ params, contextUser, provider: this.provider });
             return runViewHandler(params, contextUser);
         }
+        async RunViews(params: RunViewParams[], contextUser?: UserInfo): Promise<ViewResult[]> {
+            runViewsBatches.push(params.map((p) => p.EntityName ?? ''));
+            return Promise.all(params.map((p) => this.RunView(p, contextUser)));
+        }
     }
     return { ...actual, RunView: MockRunView, LogStatus: () => undefined, LogError: () => undefined };
 });
@@ -54,9 +64,13 @@ import type { AppContext } from '../types.js';
 const DOC_ID = 'DOC-1';
 const contextUser = new UserInfo();
 
+/** Entity read and field-level security the external-index path checks, per test. */
+const access = { canRead: true, deniedReadFields: new Set<string>() };
+
 const membersEntity = {
     Name: 'Members',
     PrimaryKeys: [{ Name: 'ID' }],
+    FirstPrimaryKey: { Name: 'ID' },
     Fields: [
         { Name: 'ID', IsNameField: false },
         { Name: 'FirstName', IsNameField: true },
@@ -64,11 +78,16 @@ const membersEntity = {
         { Name: 'Email', IsNameField: false },
     ],
     NameField: undefined,
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: (user: UserInfo) => (user === contextUser ? access.deniedReadFields : new Set<string>()),
 } as unknown as EntityInfo;
 
 const orderLinesEntity = {
     Name: 'Order Lines',
     PrimaryKeys: [{ Name: 'OrderID' }, { Name: 'LineNo' }],
+    FirstPrimaryKey: { Name: 'OrderID' },
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: () => new Set<string>(),
     Fields: [
         { Name: 'OrderID', IsNameField: false },
         { Name: 'LineNo', IsNameField: false },
@@ -123,6 +142,38 @@ const memberRows = [
     { ID: 'ccc', FirstName: 'Alan', LastName: null },
 ];
 
+/**
+ * A fake `MJ: Entity Record Documents` view over `rows`: returns only the requested `Fields`, and
+ * only the rows named by an `ID IN ('a','b')` filter when one is given.
+ */
+function erdView(rows: Array<Record<string, string>>) {
+    return (params: RunViewParams): ViewResult => {
+        const idList = /^ID IN \((.*)\)$/.exec(params.ExtraFilter ?? '');
+        const ids = idList ? new Set(idList[1].split(',').map((v) => v.trim().replace(/^'|'$/g, ''))) : undefined;
+        const picked = ids ? rows.filter((r) => ids.has(r.ID)) : rows;
+        const fields = params.Fields ?? Object.keys(rows[0] ?? {});
+        return { Success: true, Results: picked.map((r) => Object.fromEntries(fields.map((f) => [f, r[f]]))) };
+    };
+}
+
+/**
+ * A fake `Members` view of the rows the caller may read (row-level security already applied):
+ * returns the requested `Fields` of the rows named by an `ID IN ('a','b')` filter.
+ */
+function readableMembersView(readableIDs: string[]) {
+    return (params: RunViewParams): ViewResult => {
+        const idList = /^ID IN \((.*)\)$/.exec(params.ExtraFilter ?? '');
+        const requested = idList ? idList[1].split(',').map((v) => v.trim().replace(/^'|'$/g, '')) : [];
+        const rows = requested.filter((id) => readableIDs.includes(id)).map((id) => ({ ID: id }));
+        return { Success: true, Results: rows.map((r) => Object.fromEntries((params.Fields ?? ['ID']).map((f) => [f, r[f as 'ID']]))) };
+    };
+}
+
+/** The VectorJSON fetches: Entity Record Documents views filtered by ID. */
+function vectorFetches() {
+    return callsFor('MJ: Entity Record Documents').filter((c) => c.params.ExtraFilter?.startsWith('ID IN ('));
+}
+
 function callsFor(entityName: string) {
     return runViewCalls.filter((c) => c.params.EntityName === entityName);
 }
@@ -134,6 +185,9 @@ describe('FetchEntityVectorsResolver', () => {
 
     beforeEach(() => {
         runViewCalls.length = 0;
+        runViewsBatches.length = 0;
+        access.canRead = true;
+        access.deniedReadFields = new Set<string>();
     });
 
     afterEach(() => {
@@ -150,7 +204,7 @@ describe('FetchEntityVectorsResolver', () => {
         it('reads VectorJSON for the document with the context user instead of calling QueryIndex', async () => {
             const { queryIndex } = useVectorDB(true);
             routeViews('Members', {
-                'MJ: Entity Record Documents': () => ({ Success: true, Results: storedRows }),
+                'MJ: Entity Record Documents': erdView(storedRows),
                 Members: () => ({ Success: true, Results: memberRows }),
             });
 
@@ -163,18 +217,53 @@ describe('FetchEntityVectorsResolver', () => {
             expect(result.Results.map((r) => r.ID)).toEqual(['ERD-1', 'ERD-2', 'ERD-3']);
             expect(result.Results.map((r) => r.Values)).toEqual([[0.1, 0.2], [0.3, 0.4], [0.5, 0.6]]);
 
-            const [erdCall] = callsFor('MJ: Entity Record Documents');
-            expect(erdCall.contextUser).toBe(contextUser);
-            expect(erdCall.params.ExtraFilter).toBe(`EntityDocumentID='${DOC_ID}' AND VectorJSON IS NOT NULL`);
-            expect(erdCall.params.Fields).toEqual(['ID', 'RecordID', 'VectorJSON']);
-            expect(erdCall.params.ResultType).toBe('simple');
-            expect(erdCall.params.IgnoreMaxRows).toBe(true);
+            const [listCall, vectorCall] = callsFor('MJ: Entity Record Documents');
+            expect(listCall.contextUser).toBe(contextUser);
+            expect(listCall.params.ExtraFilter).toBe(`EntityDocumentID='${DOC_ID}' AND VectorJSON IS NOT NULL`);
+            expect(listCall.params.Fields).toEqual(['ID', 'RecordID']);
+            expect(listCall.params.ResultType).toBe('simple');
+            expect(listCall.params.IgnoreMaxRows).toBe(true);
+            expect(vectorCall.contextUser).toBe(contextUser);
+            expect(vectorCall.params.ExtraFilter).toBe("ID IN ('ERD-1','ERD-2','ERD-3')");
+            expect(vectorCall.params.Fields).toEqual(['ID', 'VectorJSON']);
+            expect(vectorCall.params.ResultType).toBe('simple');
+            expect(vectorCall.params.IgnoreMaxRows).toBe(true);
+        });
+
+        it("REGRESSION: runs every view on the request's provider", async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('MJ: Entity Record Documents')).toHaveLength(2);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
+        it('bypasses the server RunView cache for both Entity Record Documents views, so Fields is honoured', async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            const erdCalls = callsFor('MJ: Entity Record Documents');
+            expect(erdCalls).toHaveLength(2);
+            expect(erdCalls.map((c) => c.params.BypassCache)).toEqual([true, true]);
+            expect(callsFor('Members')[0].params.BypassCache).toBeUndefined();
         });
 
         it('labels each item with Entity, RecordID and the record name fields (RecordID matched case-insensitively)', async () => {
             useVectorDB(true);
             routeViews('Members', {
-                'MJ: Entity Record Documents': () => ({ Success: true, Results: storedRows }),
+                'MJ: Entity Record Documents': erdView(storedRows),
                 Members: () => ({ Success: true, Results: memberRows }),
             });
 
@@ -196,7 +285,7 @@ describe('FetchEntityVectorsResolver', () => {
             useVectorDB(true);
             const filter = "LastName = 'Hopper'";
             routeViews('Members', {
-                'MJ: Entity Record Documents': () => ({ Success: true, Results: storedRows }),
+                'MJ: Entity Record Documents': erdView(storedRows),
                 Members: (params) => ({
                     Success: true,
                     Results: params.ExtraFilter === filter ? memberRows.filter((r) => r.LastName === 'Hopper') : memberRows,
@@ -215,7 +304,7 @@ describe('FetchEntityVectorsResolver', () => {
         it('stops at maxRecords', async () => {
             useVectorDB(true);
             routeViews('Members', {
-                'MJ: Entity Record Documents': () => ({ Success: true, Results: storedRows }),
+                'MJ: Entity Record Documents': erdView(storedRows),
                 Members: () => ({ Success: true, Results: memberRows }),
             });
 
@@ -223,15 +312,74 @@ describe('FetchEntityVectorsResolver', () => {
 
             expect(result.Results.map((r) => r.ID)).toEqual(['ERD-1', 'ERD-2']);
             expect(result.TotalCount).toBe(2);
+            expect(vectorFetches().map((c) => c.params.ExtraFilter)).toEqual(["ID IN ('ERD-1','ERD-2')"]);
+        });
+
+        it('fetches VectorJSON only for vectors whose record passed the filter', async () => {
+            useVectorDB(true);
+            const filter = "LastName = 'Hopper'";
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows.filter((r) => r.LastName === 'Hopper') }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, filter, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.Values)).toEqual([[0.3, 0.4]]);
+            expect(vectorFetches().map((c) => c.params.ExtraFilter)).toEqual(["ID IN ('ERD-2')"]);
+        });
+
+        it('runs no VectorJSON fetch when no stored vector belongs to a readable record', async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: [] }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results).toEqual([]);
+            expect(vectorFetches()).toHaveLength(0);
+        });
+
+        it('splits a large VectorJSON fetch into ID lists of at most 1000, sent in one RunViews batch', async () => {
+            useVectorDB(true);
+            const ids = Array.from({ length: 1500 }, (_, i) => `id-${i}`);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(ids.map((id, i) => ({ ID: `ERD-${i}`, RecordID: id, VectorJSON: `[${i}]` }))),
+                Members: () => ({ Success: true, Results: ids.map((id) => ({ ID: id, FirstName: id, LastName: null })) }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 1500, undefined, appContext(membersEntity));
+
+            expect(result.TotalCount).toBe(1500);
+            expect(result.Results[1499]).toMatchObject({ ID: 'ERD-1499', Values: [1499] });
+            const fetchSizes = vectorFetches().map((c) => (c.params.ExtraFilter ?? '').split(',').length);
+            expect(fetchSizes).toEqual([1000, 500]);
+            expect(runViewsBatches[1]).toEqual(['MJ: Entity Record Documents', 'MJ: Entity Record Documents']);
+        });
+
+        it('returns an error result when the VectorJSON fetch fails', async () => {
+            useVectorDB(true);
+            const listing = erdView(storedRows);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': (params) =>
+                    params.ExtraFilter?.startsWith('ID IN (') ? { Success: false, Results: [], ErrorMessage: 'deadlock' } : listing(params),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.ErrorMessage).toBe('Failed to load vector values: deadlock');
         });
 
         it('matches composite-key records by the compact RecordID segment and falls back to NameField for labels', async () => {
             useVectorDB(true);
             routeViews('Order Lines', {
-                'MJ: Entity Record Documents': () => ({
-                    Success: true,
-                    Results: [{ ID: 'ERD-9', RecordID: 'OrderID|o-1||LineNo|2', VectorJSON: '[1,0]' }],
-                }),
+                'MJ: Entity Record Documents': erdView([{ ID: 'ERD-9', RecordID: 'OrderID|o-1||LineNo|2', VectorJSON: '[1,0]' }]),
                 'Order Lines': () => ({ Success: true, Results: [{ OrderID: 'o-1', LineNo: 2, Description: 'Brie wheel' }] }),
             });
 
@@ -250,7 +398,7 @@ describe('FetchEntityVectorsResolver', () => {
         it('returns an error result when the entity records cannot be loaded (e.g. an invalid filter)', async () => {
             useVectorDB(true);
             routeViews('Members', {
-                'MJ: Entity Record Documents': () => ({ Success: true, Results: storedRows }),
+                'MJ: Entity Record Documents': erdView(storedRows),
                 Members: () => ({ Success: false, Results: [], ErrorMessage: 'bad filter' }),
             });
 
@@ -260,12 +408,55 @@ describe('FetchEntityVectorsResolver', () => {
             expect(result.Results).toEqual([]);
             expect(result.ErrorMessage).toBe('Failed to load "Members" records: bad filter');
         });
+
+        it('returns an error result when the stored vectors cannot be loaded', async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': () => ({ Success: false, Results: [], ErrorMessage: 'timeout' }),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.TotalCount).toBe(0);
+            expect(result.ErrorMessage).toBe('Failed to load stored vectors: timeout');
+        });
+
+        it('returns an error result, and runs neither view, when the document names an entity missing from metadata', async () => {
+            const { queryIndex } = useVectorDB(true);
+            routeViews('Retired Entity', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.ErrorMessage).toBe('Entity "Retired Entity" not found in metadata');
+            expect(queryIndex).not.toHaveBeenCalled();
+            expect(callsFor('MJ: Entity Record Documents')).toHaveLength(0);
+            expect(runViewsBatches).toHaveLength(0);
+        });
+
+        it('lists the entity records and the stored vectors in one RunViews batch, then fetches the vector values', async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, appContext(membersEntity));
+
+            expect(runViewsBatches).toEqual([['Members', 'MJ: Entity Record Documents'], ['MJ: Entity Record Documents']]);
+        });
     });
 
     describe('index-keyed providers (Pinecone path, unchanged)', () => {
         it('queries the provider index by name and never reads Entity Record Documents', async () => {
             const { queryIndex } = useVectorDB(false);
-            routeViews('Members', {});
+            routeViews('Members', { Members: readableMembersView(['a']) });
 
             const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
 
@@ -279,7 +470,167 @@ describe('FetchEntityVectorsResolver', () => {
             expect(query.vector).toHaveLength(2);
             expect(result.Results).toEqual([{ ID: 'pc-1', Values: [0.5, 0.5], Metadata: JSON.stringify({ Entity: 'Members', RecordID: 'a' }) }]);
             expect(callsFor('MJ: Entity Record Documents')).toHaveLength(0);
+        });
+
+        it('removes metadata keys naming fields the caller may not read', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata: { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' } }] },
+            });
+            access.deniedReadFields = new Set(['email']);
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual({ Entity: 'Members', RecordID: 'a', FirstName: 'Ada' });
+        });
+
+        it('keeps every metadata key for a caller denied nothing', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const metadata = { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' };
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata }] } });
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual(metadata);
+        });
+
+        it('refuses, without querying the index, a caller who may not read the source entity', async () => {
+            const { queryIndex } = useVectorDB(false);
+            access.canRead = false;
+            routeViews('Members', {});
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.ErrorMessage).toBe('Entity "Members" does not exist or you do not have permission to read it');
+            expect(queryIndex).not.toHaveBeenCalled();
+        });
+    });
+
+    describe('index-keyed providers: rows the caller cannot read', () => {
+        function matchesFor(recordIDs: Array<string | undefined>) {
+            return recordIDs.map((recordID, i) => ({
+                id: `pc-${i}`,
+                values: [i, i],
+                score: 1 - i / 10,
+                metadata: recordID === undefined ? { Entity: 'Members' } : { Entity: 'Members', RecordID: recordID },
+            }));
+        }
+
+        it('drops matches whose record the caller cannot read, keeping the order of the rest', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'ID|bbb', 'ID|ccc']) } });
+            routeViews('Members', { Members: readableMembersView(['ccc', 'aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-2']);
+            expect(result.Results.map((r) => r.Values)).toEqual([[0, 0], [2, 2]]);
+            expect(result.TotalCount).toBe(2);
+        });
+
+        it("REGRESSION: runs every view, the key check included, on the request's provider", async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('Members')).toHaveLength(1);
+            expect(runViewCalls.length).toBeGreaterThan(1);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
+        it('checks the matched keys with a simple view of the primary key, as the caller', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'bbb']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa', 'bbb']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-1']);
+            const [check] = callsFor('Members');
+            expect(check.contextUser).toBe(contextUser);
+            expect(check.params.ExtraFilter).toBe("ID IN ('aaa','bbb')");
+            expect(check.params.Fields).toEqual(['ID']);
+            expect(check.params.ResultType).toBe('simple');
+            expect(check.params.IgnoreMaxRows).toBe(true);
+        });
+
+        it('drops a match with no record ID, or one naming a field that is not the primary key, without querying for it', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined, "Salary|1' OR 1=1 --", 'ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-2']);
+            expect(callsFor('Members').map((c) => c.params.ExtraFilter)).toEqual(["ID IN ('aaa')"]);
+        });
+
+        it('returns no matches and runs no check when none carries a usable record ID', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined]) } });
+            routeViews('Members', { Members: readableMembersView([]) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results).toEqual([]);
             expect(callsFor('Members')).toHaveLength(0);
         });
+
+        it('checks composite keys with one clause per record, using the real key columns', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [
+                    { id: 'pc-a', values: [1], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-1||LineNo|2' } },
+                    { id: 'pc-b', values: [2], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-2||LineNo|1' } },
+                ] },
+            });
+            routeViews('Order Lines', {
+                'Order Lines': () => ({ Success: true, Results: [{ OrderID: 'o-2', LineNo: 1 }] }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(orderLinesEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-b']);
+            const [check] = callsFor('Order Lines');
+            expect(check.params.ExtraFilter).toBe("(OrderID='o-1' AND LineNo='2') OR (OrderID='o-2' AND LineNo='1')");
+            expect(check.params.Fields).toEqual(['OrderID', 'LineNo']);
+        });
+
+        it('splits a large key check into lists of at most 1000, sent in one RunViews batch', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const ids = Array.from({ length: 1500 }, (_, i) => `id-${i}`);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(ids.map((id) => `ID|${id}`)) } });
+            routeViews('Members', { Members: readableMembersView(ids) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 1500, undefined, appContext(membersEntity));
+
+            expect(result.TotalCount).toBe(1500);
+            expect(callsFor('Members').map((c) => (c.params.ExtraFilter ?? '').split(',').length)).toEqual([1000, 500]);
+            expect(runViewsBatches).toEqual([['Members', 'Members']]);
+        });
+
+        it('returns an error result when the key check fails', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: () => ({ Success: false, Results: [], ErrorMessage: 'timeout' }) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+        });
     });
 });

package/src/__tests__/FileResolver.fieldSecurity.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Field-level security on FileResolver's own create path and responses.
+ *
+ * `CreateFile` applies its input with `NewRecord` rather than through the generated create
+ * resolver, so it gates the input itself: a restricted caller's key for a field it may not read,
+ * or a key that names no field, is refused with the same message, before any storage work. The
+ * `File` it returns (and `UploadStorageFile`'s) is the record just saved or reloaded, which is
+ * projected for the caller. The file entity here stands in with the fixture's restricted fields.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ createUploadUrl: vi.fn() }));
+
+vi.mock('@memberjunction/server', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Arg: noopDecorator, Ctx: noopDecorator, Field: noopDecorator, FieldResolver: noopDecorator, InputType: noopDecorator,
+        Mutation: noopDecorator, ObjectType: noopDecorator, PubSub: noopDecorator, Query: noopDecorator, Resolver: noopDecorator,
+        Root: noopDecorator, Int: {}, Float: {}, DeleteOptionsInput: class {},
+    };
+});
+vi.mock('../generated/generated.js', () => ({
+    CreateMJFileInput: class {},
+    UpdateMJFileInput: class {},
+    MJFile_: class {},
+    MJFileResolver: class {
+        protected GetUserFromPayload(userPayload: { userRecord?: object } | undefined) {
+            return userPayload?.userRecord;
+        }
+    },
+}));
+vi.mock('@memberjunction/ai-agents', () => ({ readRealtimeRecordingFile: vi.fn() }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFields(o: object) { return o; } } }));
+vi.mock('../config.js', () => ({ configInfo: {} }));
+vi.mock('../rest/MediaAccessKeys.js', () => ({ MediaAccessKeyManager: { Instance: {} } }));
+vi.mock('../rest/UploadTokenManager.js', () => ({ UploadTokenManager: { Instance: { Consume: vi.fn() } } }));
+vi.mock('@memberjunction/storage', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/storage')>('@memberjunction/storage');
+    return { ...actual, createUploadUrl: mocks.createUploadUrl };
+});
+
+import type { PubSubEngine } from '@memberjunction/server';
+import { FileResolver } from '../resolvers/FileResolver.js';
+import type { AppContext } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+function fileEntity() {
+    return { EntityInfo: EmployeeEntity(), CheckPermissions: vi.fn(), NewRecord: vi.fn(() => true), GetAll: () => FullWidthEmployeeRow() };
+}
+
+function contextFor(entity: ReturnType<typeof fileEntity>): AppContext {
+    const provider = { GetEntityObject: vi.fn(async () => entity), RunView: vi.fn(), RunViews: vi.fn() };
+    return { providers: [{ provider, type: 'Read-Write' }], userPayload: { userRecord: Intern() } } as unknown as AppContext;
+}
+
+describe('FileResolver.CreateFile: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before any storage work', async (_label, key) => {
+        const entity = fileEntity();
+        const input = { Name: 'new.pdf', [key]: 1 }; // keys of the stand-in entity
+        await expect(new FileResolver().CreateFile(input as never, contextFor(entity), {} as PubSubEngine))
+            .rejects.toThrow(RefusalFor(key));
+        expect(entity.NewRecord).not.toHaveBeenCalled();
+        expect(mocks.createUploadUrl).not.toHaveBeenCalled();
+    });
+});
+
+describe('FileResolver responses are projected for the caller', () => {
+    it('REGRESSION: the File returned never carries a denied value of a full-width record', () => {
+        const respond = (FileResolver.prototype as unknown as {
+            fileResponse(entity: ReturnType<typeof fileEntity>, user: unknown, provider: unknown): Record<string, unknown>;
+        }).fileResponse;
+
+        const file = respond.call(new FileResolver(), fileEntity(), Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(file)).not.toContain(String(SECRET_SALARY));
+        expect(file).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});