@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/ResolverBase.clauseUnscopedRead.test.ts

@@ -0,0 +1,127 @@
+// ResolverBase pulls in type-graphql decorators, which need the Reflect.metadata polyfill first.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * `RunDynamicView` is the GraphQL entry point for a client RunView over one entity. A subquery in
+ * its ExtraFilter reads an entity's base view directly, so RunView applies neither that entity's
+ * row-level security nor its denied-field projection to the subquery. These tests pin that the
+ * boundary screen refuses such a subquery when the caller's read of that entity is narrowed (the
+ * rule the ad-hoc SQL screen applies) and still passes it when the read is not. Inputs are harmless.
+ */
+
+/** How the caller's read of an entity is narrowed: a row filter, denied fields, or neither. */
+interface ReadScope {
+    RowFilter?: string;
+    DeniedFields?: string[];
+}
+
+/** What the resolver handed to RunView; null when the request never got there. */
+type Captured = { params: RunViewParams | null };
+
+const USER = { ID: 'U1', Email: 'reader@example.com' } as UserInfo;
+const OWN_ROWS = "(OwnerID = 'U1')";
+const ORDERS_SUBQUERY = `ID IN (SELECT AccountID FROM [crm].[vwOrders] WHERE [Total] > 100)`;
+
+/** Provider double: two entities the caller can read, each under `scopes[Name]`, and a RunView that records its params. */
+function fakeProvider(captured: Captured, scopes: Record<string, ReadScope> = {}): DatabaseProviderBase {
+    const entity = (id: string, name: string, baseView: string) => ({
+        ID: id,
+        Name: name,
+        SchemaName: 'crm',
+        BaseView: baseView,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetEffectiveRowFilterWhereClause: () => scopes[name]?.RowFilter ?? '',
+        GetDeniedReadFields: () => new Set(scopes[name]?.DeniedFields ?? []),
+    });
+    return {
+        Entities: [entity('E1', 'Accounts', 'vwAccounts'), entity('E2', 'Orders', 'vwOrders')],
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as unknown as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+/** Runs `RunDynamicViewGeneric` over Accounts as USER. */
+class Probe extends ResolverBase {
+    public RunDynamic(input: Partial<RunDynamicViewInput>, provider: DatabaseProviderBase) {
+        const payload = { email: USER.Email, userRecord: USER } as UserPayload;
+        const view = { EntityName: 'Accounts', ...input } as RunDynamicViewInput;
+        return this.RunDynamicViewGeneric(view, provider, payload, undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('RunDynamicViewGeneric — a client subquery reads an entity only when the caller may read it unscoped', () => {
+    it('refuses a subquery over an entity that is row-level-security filtered for the caller, before RunView', async () => {
+        const captured: Captured = { params: null };
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: ORDERS_SUBQUERY }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('refuses a subquery over an entity with a field the caller may not read, before RunView', async () => {
+        const captured: Captured = { params: null };
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: ORDERS_SUBQUERY }, fakeProvider(captured, { Orders: { DeniedFields: ['total'] } })),
+        ).rejects.toThrow(/'Orders' has fields you are not permitted to read/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('passes the same subquery through when the caller reads that entity unscoped', async () => {
+        const captured: Captured = { params: null };
+
+        await new Probe().RunDynamic({ ExtraFilter: ORDERS_SUBQUERY }, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe(ORDERS_SUBQUERY);
+    });
+
+    it("refuses a subquery over the queried entity's own base view when the caller's read of it is row-filtered", async () => {
+        const captured: Captured = { params: null };
+        const ownView = `ID IN (SELECT ID FROM [crm].[vwAccounts] WHERE [Name] LIKE 'A%')`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: ownView }, fakeProvider(captured, { Accounts: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Accounts' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('refuses a CASE-WHEN subquery over a row-filtered entity, before RunView', async () => {
+        const captured: Captured = { params: null };
+        const caseWhen = `CASE WHEN (SELECT COUNT(*) FROM [crm].[vwOrders] WHERE [Total] > 100) > 0 THEN 1 ELSE 0 END = 1`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: caseWhen }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it("refuses a subquery over a row-filtered entity in a window's ORDER BY, before RunView", async () => {
+        const captured: Captured = { params: null };
+        const window = `ID IN (SELECT ID FROM (SELECT ID, ROW_NUMBER() OVER (ORDER BY (SELECT COUNT(*) FROM [crm].[vwOrders])) AS rn FROM [crm].[vwAccounts]) x)`;
+
+        await expect(
+            new Probe().RunDynamic({ ExtraFilter: window }, fakeProvider(captured, { Orders: { RowFilter: OWN_ROWS } })),
+        ).rejects.toThrow(/'Orders' is row-level-security filtered for you/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('still passes an ordinary filter and sort on an entity the caller reads under a row filter', async () => {
+        const captured: Captured = { params: null };
+
+        await new Probe().RunDynamic(
+            { ExtraFilter: `[Name] = 'Acme'`, OrderBy: '[Name] DESC' },
+            fakeProvider(captured, { Accounts: { RowFilter: OWN_ROWS } }),
+        );
+
+        expect(captured.params?.ExtraFilter).toBe(`[Name] = 'Acme'`);
+    });
+});

package/src/__tests__/ResolverBase.clientOldValues.test.ts

@@ -1,7 +1,7 @@
 // Reflect.metadata polyfill at import time.
 import 'reflect-metadata';
-import { describe, it, expect } from 'vitest';
-import { EntityFieldTSType, EntityInfo, UserInfo, type EntityFieldInfo } from '@memberjunction/core';
+import { describe, it, expect, vi } from 'vitest';
+import { BaseEntity, EntityFieldTSType, EntityInfo, UserInfo, type EntityFieldInfo, type IMetadataProvider } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
 /**
@@ -13,11 +13,42 @@ class Probe extends ResolverBase {
     public Convert(field: Partial<EntityFieldInfo>, raw: unknown) {
         return this.ClientOldValueToFieldValue(field as EntityFieldInfo, raw);
     }
-    public MustLoad(entity: Record<string, unknown>, oldValues: boolean) {
+    public MustLoad(
+        entity: Record<string, unknown>,
+        oldValues: boolean | Array<{ Key: string; Value: unknown }>,
+        entityFields: Array<Record<string, unknown>> = []
+    ) {
         // A real entity with no permission rows and a user with no roles: no row filter applies.
         // The Update RLS term itself is covered in resolverBase.fls.test.ts.
         const user = new UserInfo(null, { ID: 'u-1', Name: 'Probe', Email: 'probe@example.test', IsActive: true, UserRoles: [] });
-        return this.MustLoadTruthFromDatabase(new EntityInfo({ Fields: [], ...entity }), { OldValues___: oldValues ? [{ Key: 'Comments', Value: null }] : undefined }, false, false, user);
+        const resolvedOldValues = Array.isArray(oldValues)
+            ? oldValues
+            : oldValues
+              ? [{ Key: 'Comments', Value: null }]
+              : undefined;
+        return this.MustLoadTruthFromDatabase(
+            new EntityInfo({ EntityFields: entityFields, ...entity }),
+            { OldValues___: resolvedOldValues },
+            false,
+            false,
+            user
+        );
+    }
+    public HasComplete(entityInfo: EntityInfo, oldValues?: Array<{ Key: string; Value: unknown }> | null): boolean {
+        return this.hasCompleteOldValues(entityInfo, oldValues);
+    }
+    public async TestAndSet(
+        entityObject: BaseEntity,
+        input: { OldValues___?: Array<{ Key: string; Value: unknown }> } & Record<string, unknown>,
+        contextUser: UserInfo
+    ): Promise<void> {
+        const clientNewValues: Record<string, unknown> = {};
+        for (const [k, v] of Object.entries(input)) {
+            if (k !== 'OldValues___') {
+                clientNewValues[k] = v;
+            }
+        }
+        await this.TestAndSetClientOldValuesToDBValues(input, clientNewValues, entityObject, contextUser);
     }
 }
 const probe = new Probe();
@@ -44,12 +75,217 @@ describe('ResolverBase.ClientOldValueToFieldValue', () => {
     });
 });
 
-describe('ResolverBase.MustLoadTruthFromDatabase', () => {
+function buildTagEntityFields(): Array<Record<string, unknown>> {
+    const entityId = 'E0000000-0000-4000-8000-000000000001';
+    return [
+        { ID: 'F-1', EntityID: entityId, Name: 'ID', Type: 'uniqueidentifier', IsPrimaryKey: true, AllowsNull: false, AllowUpdateAPI: false, IsVirtual: false, Sequence: 1, Status: 'Active' },
+        { ID: 'F-2', EntityID: entityId, Name: 'Name', Type: 'nvarchar', IsPrimaryKey: false, AllowsNull: false, AllowUpdateAPI: true, IsVirtual: false, Sequence: 2, Status: 'Active' },
+        { ID: 'F-3', EntityID: entityId, Name: 'Display Name', Type: 'nvarchar', IsPrimaryKey: false, AllowsNull: false, AllowUpdateAPI: true, IsVirtual: false, Sequence: 3, Status: 'Active' },
+        { ID: 'F-4', EntityID: entityId, Name: 'Description', Type: 'nvarchar', IsPrimaryKey: false, AllowsNull: true, AllowUpdateAPI: true, IsVirtual: false, Sequence: 4, Status: 'Active' },
+        { ID: 'F-5', EntityID: entityId, Name: '__mj_UpdatedAt', Type: 'datetimeoffset', IsPrimaryKey: false, AllowsNull: false, AllowUpdateAPI: false, IsVirtual: false, Sequence: 5, Status: 'Active' },
+        { ID: 'F-6', EntityID: entityId, Name: 'ParentName', Type: 'nvarchar', IsPrimaryKey: false, AllowsNull: true, AllowUpdateAPI: false, IsVirtual: true, Sequence: 6, Status: 'Active' },
+    ];
+}
+
+describe('ResolverBase.MustLoadTruthFromDatabase & hasCompleteOldValues', () => {
     it('always loads a Record Change from the database, so client OldValues cannot pin forged audit columns', () => {
         expect(probe.MustLoad({ Name: 'MJ: Record Changes', TrackRecordChanges: false }, true)).toBe(true);
     });
 
-    it('still trusts OldValues on other untracked entities without field security', () => {
-        expect(probe.MustLoad({ Name: 'MJ: Tags', TrackRecordChanges: false, EnableFieldLevelSecurity: false }, true)).toBe(false);
+    it("always loads a conversation message, so client OldValues cannot claim a message's author or role", () => {
+        expect(probe.MustLoad({ Name: 'MJ: Conversation Details', TrackRecordChanges: false }, true)).toBe(true);
+        expect(probe.MustLoad({ Name: ' mj: conversation details ', TrackRecordChanges: false }, true)).toBe(true);
+    });
+
+    it("always loads a conversation and an agent session, so client OldValues cannot hide a change to the anonymous ownership key (#4931)", () => {
+        expect(probe.MustLoad({ Name: 'MJ: Conversations', TrackRecordChanges: false }, true)).toBe(true);
+        expect(probe.MustLoad({ Name: 'MJ: AI Agent Sessions', TrackRecordChanges: false }, true)).toBe(true);
+    });
+
+    it('still trusts OldValues on other untracked entities without field security when OldValues___ covers all writable fields', () => {
+        const fields = buildTagEntityFields();
+        const completeOldValues = [
+            { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+            { Key: 'Name', Value: 'Original' },
+            { Key: 'Display_Name', Value: 'Original Display' },
+            { Key: 'Description', Value: 'Desc' },
+        ];
+        expect(
+            probe.MustLoad(
+                { ID: 'E0000000-0000-4000-8000-000000000001', Name: 'MJ: Tags', TrackRecordChanges: false, EnableFieldLevelSecurity: false },
+                completeOldValues,
+                fields
+            )
+        ).toBe(false);
+    });
+
+    it('requires loading truth from the database when OldValues___ is a partial delta (even when TrackRecordChanges === false)', () => {
+        const fields = buildTagEntityFields();
+        const deltaOldValues = [
+            { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+            { Key: 'Name', Value: 'Original' },
+            // Display_Name and Description omitted because they were not dirty on the client
+        ];
+        expect(
+            probe.MustLoad(
+                { ID: 'E0000000-0000-4000-8000-000000000001', Name: 'MJ: Tags', TrackRecordChanges: false, EnableFieldLevelSecurity: false },
+                deltaOldValues,
+                fields
+            )
+        ).toBe(true);
+    });
+
+    it('requires loading truth from the database when OldValues___ is empty or undefined', () => {
+        const fields = buildTagEntityFields();
+        const entityMeta = { ID: 'E0000000-0000-4000-8000-000000000001', Name: 'MJ: Tags', TrackRecordChanges: false, EnableFieldLevelSecurity: false };
+        expect(probe.MustLoad(entityMeta, [], fields)).toBe(true);
+        expect(probe.MustLoad(entityMeta, false, fields)).toBe(true);
+    });
+});
+
+describe('ResolverBase.TestAndSetClientOldValuesToDBValues — partial delta Update', () => {
+    const tagEntityInfo = new EntityInfo({
+        ID: 'E0000000-0000-4000-8000-000000000001',
+        Name: 'MJ: Tags',
+        BaseTable: 'Tag',
+        BaseView: 'vwTags',
+        SchemaName: '__mj',
+        Status: 'Active',
+        EntityFields: buildTagEntityFields(),
+    });
+
+    function createLoadedTagEntity(errorLogSaves: Array<Record<string, unknown>> = [], failSaveWith?: string): { entity: BaseEntity; user: UserInfo } {
+        const fakeProvider = {
+            Entities: [tagEntityInfo],
+            GetEntityObject: async () => {
+                const errEntity: Record<string, unknown> = {
+                    Save: async () => {
+                        errorLogSaves.push({ ...errEntity });
+                        return failSaveWith === undefined;
+                    },
+                    LatestResult: failSaveWith === undefined ? null : { CompleteMessage: failSaveWith },
+                };
+                return errEntity;
+            },
+        } as unknown as IMetadataProvider;
+
+        const entity = new BaseEntity(tagEntityInfo, fakeProvider);
+        entity.LoadFromData({
+            ID: '11111111-2222-3333-4444-555555555555',
+            Name: 'OriginalTag',
+            'Display Name': 'Original Display',
+            Description: 'Untouched DB Description',
+            __mj_UpdatedAt: new Date('2026-03-01T00:00:00.000Z'),
+            ParentName: 'RootTag',
+        });
+        const user = new UserInfo(null, { ID: 'u-1', Name: 'Probe', Email: 'probe@example.test', IsActive: true, UserRoles: [] });
+        return { entity, user };
+    }
+
+    it('preserves untouched DB fields and applies only the dirty field from a partial delta', async () => {
+        const errorLogSaves: Array<Record<string, unknown>> = [];
+        const { entity, user } = createLoadedTagEntity(errorLogSaves);
+
+        await probe.TestAndSet(
+            entity,
+            {
+                ID: '11111111-2222-3333-4444-555555555555',
+                Display_Name: 'Updated Display',
+                OldValues___: [
+                    { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+                    { Key: 'Display_Name', Value: 'Original Display' },
+                ],
+            },
+            user
+        );
+
+        // Updated field is applied
+        expect(entity.Get('Display Name')).toBe('Updated Display');
+        // Untouched DB fields remain intact (never overwritten with null/defaults)
+        expect(entity.Get('Name')).toBe('OriginalTag');
+        expect(entity.Get('Description')).toBe('Untouched DB Description');
+        // No concurrency conflict warning logged
+        expect(errorLogSaves).toHaveLength(0);
+    });
+
+    it('detects a concurrent modification when the dirty field DB value differs from OldValues___', async () => {
+        const errorLogSaves: Array<Record<string, unknown>> = [];
+        const { entity, user } = createLoadedTagEntity(errorLogSaves);
+
+        // Client thinks Display_Name was 'Stale Client Display', but DB currently has 'Original Display'
+        await probe.TestAndSet(
+            entity,
+            {
+                ID: '11111111-2222-3333-4444-555555555555',
+                Display_Name: 'Client New Display',
+                OldValues___: [
+                    { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+                    { Key: 'Display_Name', Value: 'Stale Client Display' },
+                ],
+            },
+            user
+        );
+
+        // Warning is logged to ErrorLog, and save still applies the new value
+        expect(errorLogSaves).toHaveLength(1);
+        expect(errorLogSaves[0].Code).toBe('SAVE_INCONSISTENCY');
+        // ErrorLog.Code is NCHAR(20)
+        expect(String(errorLogSaves[0].Code).length).toBeLessThanOrEqual(20);
+        expect(String(errorLogSaves[0].Message)).toContain('Display_Name');
+        expect(entity.Get('Display Name')).toBe('Client New Display');
+        expect(entity.Get('Description')).toBe('Untouched DB Description');
+    });
+
+    it('reports the entity name and the reason when the ErrorLog save fails', async () => {
+        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const { entity, user } = createLoadedTagEntity([], 'value too long for Code');
+        try {
+            await probe.TestAndSet(
+                entity,
+                {
+                    ID: '11111111-2222-3333-4444-555555555555',
+                    Display_Name: 'Client New Display',
+                    OldValues___: [
+                        { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+                        { Key: 'Display_Name', Value: 'Stale Client Display' },
+                    ],
+                },
+                user
+            );
+            const message = errorSpy.mock.calls.map((c) => String(c[0])).join('\n');
+            expect(message).toContain('Failed to save ErrorLog record');
+            expect(message).toContain('value too long for Code');
+            expect(message).toContain(entity.EntityInfo.Name);
+        } finally {
+            errorSpy.mockRestore();
+        }
+    });
+
+    it('does not false-positive when a non-overlapping field differs in the DB', async () => {
+        const errorLogSaves: Array<Record<string, unknown>> = [];
+        const { entity, user } = createLoadedTagEntity(errorLogSaves);
+
+        // Suppose client sent full OldValues___ (e.g. IgnoreDirtyState: true) where Description
+        // changed in DB ('Untouched DB Description' vs 'Old Desc'), while the client only changed Name
+        await probe.TestAndSet(
+            entity,
+            {
+                ID: '11111111-2222-3333-4444-555555555555',
+                Name: 'RenamedTag',
+                Description: 'Old Desc',
+                OldValues___: [
+                    { Key: 'ID', Value: '11111111-2222-3333-4444-555555555555' },
+                    { Key: 'Name', Value: 'OriginalTag' },
+                    { Key: 'Description', Value: 'Old Desc' },
+                ],
+            },
+            user
+        );
+
+        // Description had a DB difference ('Untouched DB Description' !== 'Old Desc'),
+        // but client was NOT changing Description ('Old Desc' === 'Old Desc'), so overlap is empty!
+        expect(errorLogSaves).toHaveLength(0);
+        expect(entity.Get('Name')).toBe('RenamedTag');
     });
 });
+

package/src/__tests__/ResolverBase.deleteReturnProjection.test.ts

@@ -0,0 +1,52 @@
+/**
+ * The GraphQL delete returns the record's last state. It is projected for the caller, so an
+ * entity object that holds a full-width row (loaded as another user, or not narrowed at its
+ * source) never hands the caller a value they are denied.
+ */
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { UserInfo } from '@memberjunction/core';
+import { EmployeeEntity, FullWidthEmployeeRow, HRUser, Intern, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+/** Drives the real `ResolverBase.DeleteRecord` with its unrelated collaborators stubbed on the instance. */
+async function deleteAs(user: UserInfo): Promise<Record<string, unknown>> {
+    const { ResolverBase } = await import('../generic/ResolverBase.js');
+    const entityObject = {
+        EntityInfo: EmployeeEntity(true),
+        InnerLoad: async () => true,
+        GetAll: () => FullWidthEmployeeRow(),
+        Delete: async () => true,
+        LatestResult: { Message: '' },
+    };
+    const provider = { GetEntityObject: async () => entityObject, Entities: [] };
+    const resolver = Object.create(ResolverBase.prototype) as Record<string, unknown> & {
+        DeleteRecord: (...args: unknown[]) => Promise<Record<string, unknown>>;
+    };
+    resolver.CheckAPIKeyScopeAuthorization = async () => undefined;
+    resolver.BeforeDelete = async () => true;
+    resolver.AfterDelete = async () => undefined;
+    resolver.ListenForEntityMessages = () => undefined;
+    resolver.GetUserFromPayload = () => user;
+    return resolver.DeleteRecord(
+        'Employees',
+        { KeyValuePairs: [{ FieldName: 'ID', Value: 'emp-1' }] },
+        {},
+        provider,
+        { email: 'x@example.test', userRecord: user },
+        { publish: async () => undefined },
+    );
+}
+
+describe('ResolverBase.DeleteRecord: the returned last state is projected for the caller', () => {
+    it('REGRESSION: returns no denied value even when the entity object holds the full row', async () => {
+        const returned = await deleteAs(Intern());
+        expect(returned).not.toHaveProperty('Salary');
+        expect(JSON.stringify(returned)).not.toContain(String(SECRET_SALARY));
+        expect(returned.ID).toBe('emp-1');
+    });
+
+    it('returns every value to a caller who is denied nothing', async () => {
+        const returned = await deleteAs(HRUser());
+        expect(returned.Salary).toBe(SECRET_SALARY);
+    });
+});

package/src/__tests__/ResolverBase.entityMessageRelay.test.ts

@@ -0,0 +1,176 @@
+/**
+ * The entity-message relay in `ResolverBase.ListenForEntityMessages`.
+ *
+ * There is one listener per entity name per process, and it relays to the session that created
+ * it. So it must relay only events raised by an object that belongs to that session's user, and
+ * never the record values a payload can carry: a delete's payload is the whole deleted row.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { statusUpdates } = vi.hoisted(() => ({
+    statusUpdates: [] as Array<{ sessionId: string; ownerUserId: string; message: string | undefined }>,
+}));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({ SQLServerDataProvider: class {} }));
+vi.mock('@memberjunction/generic-database-provider', () => ({ UserCache: { Users: [] } }));
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {},
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+vi.mock('type-graphql', () => {
+    const noop = () => () => undefined;
+    return {
+        Resolver: noop, Mutation: noop, Query: noop, Subscription: noop, Ctx: noop, Arg: noop, PubSub: noop,
+        Root: noop, ObjectType: noop, InputType: noop, Field: noop, FieldResolver: noop,
+        Int: undefined, Float: undefined, registerEnumType: () => undefined,
+    };
+});
+vi.mock('graphql', () => ({ GraphQLError: class extends Error {} }));
+vi.mock('mssql', () => ({}));
+vi.mock('@memberjunction/api-keys', () => ({ GetAPIKeyEngine: vi.fn() }));
+vi.mock('@memberjunction/encryption', () => ({ EncryptionEngine: { Instance: {} } }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFieldName(n: string) { return n; } ReverseMapFieldName(n: string) { return n; } } }));
+vi.mock('../generic/PubSubManager.js', () => ({ PubSubManager: { Instance: { Publish: () => undefined } } }));
+vi.mock('../generic/PushStatusResolver.js', () => ({
+    PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic',
+    PublishStatusUpdate: (_pubSub: unknown, update: { sessionId: string; ownerUserId: string; message: string | undefined }) => {
+        statusUpdates.push(update);
+    },
+    // Mirrors the real StatusUpdateOwnerKey/StatusUpdateOwnerID (#4931): the elevated principal's
+    // key when the payload stands in for one, else the request user's. Anonymous visitors key on
+    // `id|scope`; these relay cases are all named users, so the ID is the whole key.
+    StatusUpdateOwnerKey: (user: { ID?: string } | null | undefined) => user?.ID ?? '',
+    StatusUpdateOwnerID: (payload: { ElevatedFrom?: { ID?: string }; userRecord?: { ID?: string } } | undefined) =>
+        payload?.ElevatedFrom?.ID ?? payload?.userRecord?.ID ?? '',
+}));
+vi.mock('../generic/RunViewResolver.js', () => ({ RunViewByIDInput: class {}, RunViewByNameInput: class {}, RunDynamicViewInput: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../types.js', () => ({ RunViewGenericParams: class {} }));
+vi.mock('@memberjunction/core-entities', () => ({}));
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return { ...actual, LogError: vi.fn(), LogStatus: vi.fn(), LogDebug: vi.fn() };
+});
+
+import { BaseEntity, BaseEntityEvent, EntityInfo, UserInfo } from '@memberjunction/core';
+import { MJEventType, MJGlobal } from '@memberjunction/global';
+import type { PubSubEngine } from 'type-graphql';
+import { Subscription } from 'rxjs';
+import { ResolverBase } from '../generic/ResolverBase';
+import type { UserPayload } from '../types.js';
+import { BuildUser, EmployeeEntity, FullWidthEmployeeRow, HR_ROLE_ID, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+const SUBSCRIPTIONS_KEY = '___MJServer___ResolverBase___EventSubscriptions';
+
+/** An entity object of `entityInfo` loaded by `owner`, holding the full row. */
+function entityOwnedBy(entityInfo: EntityInfo, owner: UserInfo) {
+    const row = FullWidthEmployeeRow();
+    return {
+        EntityInfo: entityInfo,
+        ContextCurrentUser: owner,
+        GetAll: () => ({ ...row }),
+        PrimaryKey: { KeyValuePairs: [{ FieldName: 'ID', Value: row.ID }] },
+        Fields: entityInfo.Fields.map(f => ({ Name: f.Name, Dirty: false })),
+        Get: (name: string) => (row as Record<string, unknown>)[name],
+        GetDirtyFieldNames: (): string[] => [],
+    };
+}
+type OwnedEntity = ReturnType<typeof entityOwnedBy>;
+
+class TestResolver extends ResolverBase {
+    public Listen(entity: OwnedEntity, sessionUser: UserInfo) {
+        this.ListenForEntityMessages(entity as unknown as BaseEntity, {} as PubSubEngine, { sessionId: 'session-a', userRecord: sessionUser } as UserPayload);
+    }
+}
+
+function raise(entity: OwnedEntity, type: BaseEntityEvent['type'], payload: unknown): void {
+    const args = new BaseEntityEvent();
+    args.type = type;
+    args.payload = payload;
+    args.baseEntity = entity as unknown as BaseEntity;
+    MJGlobal.Instance.RaiseEvent({ component: null, event: MJEventType.ComponentEvent, eventCode: BaseEntity.BaseEventCode, args });
+}
+
+/** Lets the async listener run for every event raised so far. */
+async function settle(): Promise<void> {
+    await new Promise(resolve => setTimeout(resolve, 10));
+}
+
+function resetListeners(): void {
+    const store = MJGlobal.Instance.GetGlobalObjectStore();
+    const subscriptions = store[SUBSCRIPTIONS_KEY] as Map<string, Subscription> | undefined;
+    subscriptions?.forEach(s => s.unsubscribe());
+    subscriptions?.clear();
+}
+
+let userA: UserInfo;
+let userB: UserInfo;
+
+beforeEach(() => {
+    statusUpdates.length = 0;
+    resetListeners();
+    userA = BuildUser([HR_ROLE_ID], 'user-a');
+    userB = BuildUser([HR_ROLE_ID], 'user-b');
+});
+
+describe('ResolverBase.ListenForEntityMessages: relay to the listening session', () => {
+    it("REGRESSION: never relays another user's delete to the session that created the listener", async () => {
+        const entityInfo = EmployeeEntity(false);
+        new TestResolver().Listen(entityOwnedBy(entityInfo, userA), userA);
+
+        raise(entityOwnedBy(entityInfo, userB), 'delete', { OldValues: FullWidthEmployeeRow() });
+        await settle();
+
+        expect(statusUpdates).toHaveLength(0);
+    });
+
+    it('REGRESSION: relays the session user\'s own delete with the key and type, never the deleted row', async () => {
+        const entityInfo = EmployeeEntity(false);
+        new TestResolver().Listen(entityOwnedBy(entityInfo, userA), userA);
+
+        raise(entityOwnedBy(entityInfo, userA), 'delete', { OldValues: FullWidthEmployeeRow() });
+        await settle();
+
+        expect(statusUpdates).toHaveLength(1);
+        const message = JSON.parse(statusUpdates[0].message!) as Record<string, unknown>;
+        expect(message.entityName).toBe('Employees');
+        expect(message.eventType).toBe('delete');
+        expect(message.message).toBeUndefined();
+        expect(statusUpdates[0].message).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('REGRESSION: an entity under field security never relays a payload, even to its own user', async () => {
+        const entityInfo = EmployeeEntity(true);
+        new TestResolver().Listen(entityOwnedBy(entityInfo, userA), userA);
+
+        raise(entityOwnedBy(entityInfo, userA), 'other', { Salary: SECRET_SALARY });
+        await settle();
+
+        expect(statusUpdates).toHaveLength(1);
+        expect(JSON.parse(statusUpdates[0].message!).message).toBeUndefined();
+    });
+
+    it('REGRESSION: MJ: Record Changes never relays a payload', async () => {
+        const recordChanges = new EntityInfo({ ID: 'rc', Name: 'MJ: Record Changes', SchemaName: '__mj', BaseTable: 'RecordChange', BaseView: 'vwRecordChanges', Fields: [] });
+        new TestResolver().Listen(entityOwnedBy(recordChanges, userA), userA);
+
+        raise(entityOwnedBy(recordChanges, userA), 'other', { ChangesJSON: `{"Salary":${SECRET_SALARY}}` });
+        await settle();
+
+        expect(statusUpdates).toHaveLength(1);
+        expect(statusUpdates[0].message).not.toContain(String(SECRET_SALARY));
+    });
+
+    it("still relays a progress message from the session user's own object", async () => {
+        const entityInfo = EmployeeEntity(false);
+        new TestResolver().Listen(entityOwnedBy(entityInfo, userA), userA);
+
+        raise(entityOwnedBy(entityInfo, userA), 'other', 'step 2 of 5');
+        await settle();
+
+        expect(statusUpdates).toHaveLength(1);
+        expect(JSON.parse(statusUpdates[0].message!).message).toBe('step 2 of 5');
+        expect(statusUpdates[0].ownerUserId).toBe('user-a');
+    });
+});

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -36,9 +36,12 @@ type Captured = { params: RunViewParams | null };
 function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = [], unreadableEntities: string[] = []): DatabaseProviderBase {
     const withPerms = (e: Record<string, unknown>) => ({
         ...e,
-        // Real EntityInfo aggregates per-user permissions; the boundary screen now consults
-        // CanRead for every subquery target, so the mock must answer it.
+        // Real EntityInfo aggregates per-user permissions; the boundary screen consults CanRead,
+        // the row filter and the denied fields for every subquery target, so the mock answers
+        // them (an unscoped read).
         GetUserPermisions: () => ({ CanRead: !unreadableEntities.includes(e.Name as string) }),
+        GetEffectiveRowFilterWhereClause: () => '',
+        GetDeniedReadFields: () => new Set<string>(),
     });
     return {
         Entities: [