@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/MJStorageBlobStore.storageGate.test.ts

@@ -0,0 +1,63 @@
+/**
+ * MJStorageBlobStore (the conversation-attachment blob seam) goes from a file ID to bytes, a signed URL or a delete. The
+ * `MJ: Files` row names only a storage PROVIDER, so each path resolves through `FileStorageEngine.ResolveFileObject` —
+ * the storage gate (the caller's access on the account, and the tracked-file rule). These tests pin that download and
+ * URL ask for Read, delete asks for Write, and a refusal reads, signs and deletes nothing (the seam never throws).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { resolveFileObject, getObject, createUrl, deleteObject } = vi.hoisted(() => ({
+    resolveFileObject: vi.fn(),
+    getObject: vi.fn(async () => Buffer.from('bytes')),
+    createUrl: vi.fn(async () => 'https://signed.example/x'),
+    deleteObject: vi.fn(async () => true),
+}));
+
+vi.mock('@memberjunction/storage', () => ({
+    FileStorageEngine: { Instance: { ResolveFileObject: resolveFileObject } },
+    StorageAccessEvaluator: { Instance: { AssertTrackedObjectsReadable: vi.fn() } },
+    FileStorageBase: class {},
+}));
+
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { MJStorageBlobStore } from '../services/MJStorageBlobStore.js';
+
+const caller = { ID: 'user-1', UserRoles: [] } as unknown as UserInfo;
+const fileRow = {
+    ID: 'file-1', ProviderID: 'prov-1', ProviderKey: 'conversation-attachments/a.png', Name: 'a.png',
+    Load: async () => true, Delete: vi.fn(async () => true),
+};
+const provider = { GetEntityObject: async () => fileRow } as unknown as IMetadataProvider;
+const driver = { GetObject: getObject, CreatePreAuthDownloadUrl: createUrl, DeleteObject: deleteObject };
+
+describe('MJStorageBlobStore — every path goes through the storage gate', () => {
+    const store = new MJStorageBlobStore();
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        resolveFileObject.mockResolvedValue({ Account: { ID: 'acct-1' }, Driver: driver, ObjectKey: fileRow.ProviderKey });
+    });
+
+    it('Download and GetDownloadUrl ask for Read, as the caller', async () => {
+        expect(await store.Download('file-1', caller, provider)).toBe(Buffer.from('bytes').toString('base64'));
+        expect(await store.GetDownloadUrl('file-1', caller, provider)).toBe('https://signed.example/x');
+        expect(resolveFileObject.mock.calls.map(c => c[2])).toEqual(['Read', 'Read']);
+        expect(resolveFileObject.mock.calls.every(c => c[1] === caller)).toBe(true);
+    });
+
+    it('Delete asks for Write', async () => {
+        expect(await store.Delete('file-1', caller, provider)).toBe(true);
+        expect(resolveFileObject.mock.calls[0][2]).toBe('Write');
+    });
+
+    it('a refusal reads, signs and deletes nothing — and the seam still does not throw', async () => {
+        resolveFileObject.mockRejectedValue(new Error('You do not have access to this file or it does not exist.'));
+        expect(await store.Download('file-1', caller, provider)).toBeNull();
+        expect(await store.GetDownloadUrl('file-1', caller, provider)).toBeNull();
+        expect(await store.Delete('file-1', caller, provider)).toBe(false);
+        expect(getObject).not.toHaveBeenCalled();
+        expect(createUrl).not.toHaveBeenCalled();
+        expect(deleteObject).not.toHaveBeenCalled();
+        expect(fileRow.Delete).not.toHaveBeenCalled();
+    });
+});

package/src/__tests__/PipelineProgressResolver.filter.test.ts

@@ -0,0 +1,58 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator,
+        Mutation: noopDecorator,
+        Query: noopDecorator,
+        Subscription: noopDecorator,
+        ObjectType: noopDecorator,
+        InputType: noopDecorator,
+        Field: noopDecorator,
+        Arg: noopDecorator,
+        Args: noopDecorator,
+        Ctx: noopDecorator,
+        PubSub: noopDecorator,
+        Root: noopDecorator,
+        Float: class {},
+        Int: class {},
+        ID: class {},
+    };
+});
+
+import { PipelineProgressFilter, type PipelineProgressNotification } from '../resolvers/PipelineProgressResolver';
+
+const RUN_ID = 'AA11BB22-0000-4000-8000-000000000001';
+const OTHER_RUN_ID = 'CC33DD44-0000-4000-8000-000000000002';
+
+function makePayload(pipelineRunID: string): PipelineProgressNotification {
+    return {
+        PipelineRunID: pipelineRunID,
+        Stage: 'extract',
+        TotalItems: 100,
+        ProcessedItems: 25,
+        ElapsedMs: 500,
+        PercentComplete: 25,
+    };
+}
+
+describe('PipelineProgressFilter', () => {
+    it('delivers when PipelineRunID matches exactly', () => {
+        expect(PipelineProgressFilter({ payload: makePayload(RUN_ID), args: { pipelineRunID: RUN_ID } })).toBe(true);
+    });
+
+    it('delivers when PipelineRunID differs only in UUID casing (SQL Server uppercase vs client lowercase)', () => {
+        expect(
+            PipelineProgressFilter({
+                payload: makePayload(RUN_ID.toUpperCase()),
+                args: { pipelineRunID: RUN_ID.toLowerCase() },
+            })
+        ).toBe(true);
+    });
+
+    it('rejects notifications for a different pipeline run', () => {
+        expect(PipelineProgressFilter({ payload: makePayload(OTHER_RUN_ID), args: { pipelineRunID: RUN_ID } })).toBe(false);
+    });
+});

package/src/__tests__/QuerySystemUserResolver.fieldSecurity.test.ts

@@ -0,0 +1,49 @@
+/**
+ * The saved query that `CreateQueryExtended` / `UpdateQueryExtended` return is mapped for the
+ * CALLER. These mutations are reachable with the `query:create` / `query:update` API-key scopes,
+ * not only by the system user, and the record they return is the one just saved, whose re-read
+ * holds every column. Mapping it with no context user skipped the field-security projection
+ * altogether, so the caller received columns its roles may not read.
+ *
+ * The base resolver is stubbed with the real projection (`ProjectValuesForCaller`) standing in
+ * for its field mapping, so what is pinned is the identity the result is mapped for.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = ['Arg', 'Ctx', 'Field', 'InputType', 'Mutation', 'ObjectType', 'Resolver', 'PubSub', 'Int', 'Float'];
+    return { ...Object.fromEntries(exportNames.map((name) => [name, decoratorFactory])), registerEnumType: () => undefined };
+});
+vi.mock('@memberjunction/core-entities-server', () => ({ MJQueryEntityServer: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../generated/generated.js', async () => {
+    const { ProjectValuesForCaller } = await import('../generic/fieldSecurityTransport.js');
+    const { EmployeeEntity, NoRecordChangesMetadata } = await import('./fieldSecurityFixtures.js');
+    return {
+        MJQuery_: class {}, MJQueryField_: class {}, MJQueryParameter_: class {}, MJQueryEntity_: class {}, MJQueryPermission_: class {},
+        MJQueryResolver: class {
+            protected async MapFieldNamesToCodeNames(_entityName: string, values: Record<string, unknown>, contextUser?: unknown) {
+                return ProjectValuesForCaller(EmployeeEntity(), values, contextUser as never, NoRecordChangesMetadata);
+            }
+        },
+    };
+});
+
+import { MJQueryResolverExtended } from '../resolvers/QuerySystemUserResolver.js';
+import { FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+describe('QuerySystemUserResolver: the saved query is mapped for the caller', () => {
+    it('REGRESSION: buildSuccessResult never returns a column the caller may not read', async () => {
+        const build = (MJQueryResolverExtended.prototype as unknown as {
+            buildSuccessResult(entity: unknown, user: unknown, provider: unknown): Promise<{ Query: Record<string, unknown> }>;
+        }).buildSuccessResult;
+        const entity = { GetAll: () => FullWidthEmployeeRow(), QueryFields: [], QueryParameters: [], QueryEntities: [], QueryPermissions: [] };
+
+        const result = await build.call(new MJQueryResolverExtended(), entity, Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(result.Query)).not.toContain(String(SECRET_SALARY));
+        expect(result.Query).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});

package/src/__tests__/RESTEndpointHandler.test.ts

@@ -110,6 +110,7 @@ interface ReqShape {
     query?: Record<string, string>;
     body?: unknown;
     mjUser?: UserInfo;
+    timeZone?: string;
 }
 
 function makeReq(shape: ReqShape = {}): express.Request {
@@ -118,6 +119,7 @@ function makeReq(shape: ReqShape = {}): express.Request {
         query: shape.query ?? {},
         body: shape.body ?? {},
         mjUser: shape.mjUser ?? MJ_USER,
+        userPayload: { TimeZone: shape.timeZone },
     } as unknown as express.Request;
 }
 
@@ -540,6 +542,17 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual({ Success: true, Results: [{ ID: '1' }] });
         });
 
+        it('drops fields only server code may set, takes the time zone from the header, and keeps the route\'s entity over the body\'s', async () => {
+            mockOpsRunView.mockResolvedValue({ success: true, result: { Success: true, Results: [] } });
+            const handler = makeHandler();
+            const req = makeReq({ params: { entityName: 'Users' }, body: { EntityName: 'Secrets', TimeZone: 'Asia/Tokyo', MaxRows: 5 }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runView(req, res);
+
+            expect(mockOpsRunView).toHaveBeenCalledWith({ EntityName: 'Users', MaxRows: 5, TimeZone: 'Europe/Paris' }, MJ_USER);
+        });
+
         it('maps view-layer failures to 400', async () => {
             mockOpsRunView.mockResolvedValue({ success: false, error: 'does not have permission' });
             const handler = makeHandler();
@@ -591,6 +604,18 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual([{ Success: true, Results: [] }]);
         });
 
+        it('drops fields only server code may set from every batched view', async () => {
+            mockOpsRunViews.mockResolvedValue({ success: true, results: [{ Success: true, Results: [] }] });
+            const handler = makeHandler();
+            const req = makeReq({ body: { params: [{ EntityName: 'Users', TimeZone: 'Asia/Tokyo' }] }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runViews(req, res);
+
+            const [sent] = mockOpsRunViews.mock.calls[0] as [RunViewParams[], UserInfo];
+            expect(sent).toEqual([{ EntityName: 'Users', TimeZone: 'Europe/Paris' }]);
+        });
+
         it('maps view-layer batch failures to 400', async () => {
             mockOpsRunViews.mockResolvedValue({ success: false, error: 'batch failed' });
             const handler = makeHandler();

package/src/__tests__/RealtimeClientSessionResolver.configTamper.test.ts

@@ -122,7 +122,14 @@ function makeSession(config: Record<string, unknown>, overrides: Partial<FakeEnt
 }
 
 function makeDetail(): FakeEntity {
-    return { ID: 'c3c3c3c3-0000-4000-8000-0000000000d1', Save: vi.fn(async () => true), Load: vi.fn(async () => true), NewRecord: vi.fn() };
+    return {
+        ID: 'c3c3c3c3-0000-4000-8000-0000000000d1',
+        ExternalID: 'c3-shared-resource',
+        Save: vi.fn(async () => true),
+        Load: vi.fn(async () => true),
+        NewRecord: vi.fn(),
+        MarkServerAuthoredReply: vi.fn(),
+    };
 }
 
 /** A provider serving the session plus view rows per entity name; `runView` records every view run. */
@@ -167,9 +174,22 @@ function relayTool(resolver: RealtimeClientSessionResolver, toolName: string, ar
 }
 
 /** A scoped anonymous magic-link caller: the relay runs its work as the system user. */
-const SCOPED_ANONYMOUS = { ID: USER_ID, Email: 'guest@magic-link.local', IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'c3-scope' } };
+const SCOPED_ANONYMOUS = {
+    ID: USER_ID,
+    Email: 'guest@magic-link.local',
+    IsMagicLinkAnonymous: true,
+    AnonymousVisitorID: 'c3-redemption-sid',
+    // The session's conversation is stamped with the caller's resource scope (ResolveSessionScopeIdentity).
+    MagicLinkScope: { ResourceID: 'c3-shared-resource' },
+};
 /** A public web-widget guest: anonymous, but not elevated. */
-const WIDGET_GUEST = { ID: USER_ID, Email: 'guest@widget.local', IsMagicLinkAnonymous: true, WidgetGuestContext: { WidgetID: 'c3c3c3c3-0000-4000-8000-0000000000b1' } };
+const WIDGET_GUEST = {
+    ID: USER_ID,
+    Email: 'guest@widget.local',
+    IsMagicLinkAnonymous: true,
+    AnonymousVisitorID: 'c3-shared-resource',
+    WidgetGuestContext: { WidgetID: 'c3c3c3c3-0000-4000-8000-0000000000b1' },
+};
 /** A resource-scoped magic-link session: a normal role pinned to one shared resource. */
 const RESOURCE_SCOPED = { ID: USER_ID, Email: 'invitee@example.com', MagicLinkScope: { ResourceID: 'c3-shared-resource' } };
 const SYSTEM_USER = { ID: 'c3c3c3c3-0000-4000-8000-0000000000aa', Email: 'system@example.com' } as UserInfo;