@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/TestQuerySQLResolver.test.ts

@@ -0,0 +1,274 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi } from 'vitest';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+        Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+        createUnionType: () => class {},
+        AuthorizationError: class AuthorizationError extends Error {},
+        Float: class {}, Int: class {}, ID: class {},
+    };
+});
+
+vi.mock('../config.js', () => ({ configInfo: { databaseSettings: { requestTimeout: 120_000 } } }));
+
+import { UserInfo } from '@memberjunction/core';
+import type { DatabaseProviderBase } from '@memberjunction/core';
+import { TestQuerySQLResolver, TestQuerySQLInput } from '../resolvers/TestQuerySQLResolver.js';
+import type { AppContext } from '../types.js';
+
+interface EntityFixture {
+    Name: string;
+    SchemaName: string;
+    BaseView: string;
+    canRead?: boolean;
+    rowFilter?: string;
+    deniedFields?: string[];
+}
+
+function createReadOnlyProvider(entities: EntityFixture[]): DatabaseProviderBase {
+    return {
+        PlatformKey: 'sqlserver',
+        Entities: entities.map((e) => ({
+            Name: e.Name,
+            SchemaName: e.SchemaName,
+            BaseView: e.BaseView,
+            GetUserPermisions: () => ({ CanRead: e.canRead ?? true }),
+            GetEffectiveRowFilterWhereClause: () => e.rowFilter ?? '',
+            GetDeniedReadFields: () => new Set<string>(e.deniedFields ?? []),
+        })),
+    } as unknown as DatabaseProviderBase;
+}
+
+function createPlainUser(): UserInfo {
+    const u = new UserInfo();
+    u.ID = 'D1F1A0C4-0000-4000-8000-000000000001';
+    u.Email = 'user@example.com';
+    return u;
+}
+
+const RUBRIC_EVALUATIONS: EntityFixture = {
+    Name: 'MJ: Rubric Evaluations',
+    SchemaName: '__mj',
+    BaseView: 'vwRubricEvaluations',
+};
+
+const AI_MODELS: EntityFixture = {
+    Name: 'MJ: AI Models',
+    SchemaName: '__mj',
+    BaseView: 'vwAIModels',
+};
+
+describe('TestQuerySQLResolver scope-limited principal guard', () => {
+    const resolverSrc = readFileSync(resolve(__dirname, '../resolvers/TestQuerySQLResolver.ts'), 'utf8');
+
+    it('checks IsScopeLimitedPrincipal before acquiring the read-only provider or authorizing SQL', () => {
+        const scopeGuardIdx = resolverSrc.indexOf('IsScopeLimitedPrincipal(');
+        const providerIdx = resolverSrc.indexOf('GetReadOnlyProvider(');
+        const authorizeIdx = resolverSrc.indexOf('this.AuthorizeRenderedTestSQL(');
+
+        expect(scopeGuardIdx).toBeGreaterThan(-1);
+        expect(providerIdx).toBeGreaterThan(-1);
+        expect(authorizeIdx).toBeGreaterThan(-1);
+        expect(scopeGuardIdx).toBeLessThan(providerIdx);
+        expect(providerIdx).toBeLessThan(authorizeIdx);
+    });
+
+    it('refuses anonymous magic-link guests, resource-scoped sessions, and missing principals', async () => {
+        const resolver = new TestQuerySQLResolver();
+        const input: TestQuerySQLInput = { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' };
+
+        const anonGuest = createPlainUser();
+        anonGuest.IsMagicLinkAnonymous = true;
+
+        const scopedUser = createPlainUser();
+        scopedUser.MagicLinkScope = { ResourceID: 'A0000000-0000-4000-8000-000000000009' };
+
+        for (const userRecord of [anonGuest, scopedUser, undefined]) {
+            const context = {
+                userPayload: { userRecord, email: 'guest@example.com', sessionId: 'sess-1' },
+                providers: [],
+            } as unknown as AppContext;
+
+            const result = await resolver.TestQuerySQL(input, context);
+            expect(result.Success).toBe(false);
+            expect(result.RowCount).toBe(0);
+            expect(result.ErrorMessage).toBe('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+    });
+});
+
+describe('TestQuerySQLResolver.AuthorizeRenderedTestSQL', () => {
+    const resolver = new TestQuerySQLResolver();
+    const user = createPlainUser();
+
+    it('admits a read query referencing only unscoped readable entity base views', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS, AI_MODELS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT r.ID, m.Name FROM [__mj].[vwRubricEvaluations] r INNER JOIN [__mj].[vwAIModels] m ON r.ID = m.ID' },
+            provider,
+            user,
+        );
+        expect(refusal).toBeNull();
+    });
+
+    it('allows a table-free query that reads niladic user functions (CURRENT_USER, SESSION_USER, SYSTEM_USER)', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT CURRENT_USER AS UserName, SESSION_USER AS SessionUser, SYSTEM_USER AS SystemUser' },
+            provider,
+            user,
+        );
+        expect(refusal).toBeNull();
+    });
+
+    it('refuses a query that reads a base table instead of an entity base view', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT * FROM [__mj].[User]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/entity base view/);
+    });
+
+    it('refuses a query that reads an entity the caller does not have CanRead permission for', () => {
+        const provider = createReadOnlyProvider([{ ...RUBRIC_EVALUATIONS, canRead: false }]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/not permitted to read|permission/i);
+    });
+
+    it('refuses a query that reads a row-level-security filtered entity', () => {
+        const provider = createReadOnlyProvider([
+            { ...RUBRIC_EVALUATIONS, rowFilter: "EvaluatorUserID = 'user-1'" },
+        ]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/row-level-security filtered/);
+    });
+
+    it('refuses a query that reads an entity with denied read fields for the caller', () => {
+        const provider = createReadOnlyProvider([
+            { ...RUBRIC_EVALUATIONS, deniedFields: ['SecretScore'] },
+        ]);
+        const refusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(refusal).toMatch(/fields you are not permitted to read/);
+    });
+
+    it('refuses write statements and stacked SQL batches at render time', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+
+        const deleteRefusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'DELETE FROM [__mj].[vwRubricEvaluations]' },
+            provider,
+            user,
+        );
+        expect(deleteRefusal).toMatch(/single read query/i);
+
+        const stackedRefusal = resolver.AuthorizeRenderedTestSQL(
+            { SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]; SELECT * FROM [__mj].[User]' },
+            provider,
+            user,
+        );
+        expect(stackedRefusal).toMatch(/single read query/i);
+    });
+
+    it('screens the rendered SQL after Nunjucks template expansion', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS]);
+
+        // Safe parameter substitution on an allowed view passes
+        const safeRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations] WHERE Name = {{ targetName | sqlString }}',
+                UsesTemplate: true,
+                Parameters: { targetName: 'Q1 Eval' },
+            },
+            provider,
+            user,
+        );
+        expect(safeRefusal).toBeNull();
+
+        // Template expansion that introduces a base table reference is refused
+        const injectedTableRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT * FROM {{ targetTable }}',
+                UsesTemplate: true,
+                Parameters: { targetTable: '[__mj].[User]' },
+            },
+            provider,
+            user,
+        );
+        expect(injectedTableRefusal).toMatch(/entity base view/);
+    });
+
+    it('screens the rendered SQL after inline Dependencies ({{query:"..."}}) composition', () => {
+        const provider = createReadOnlyProvider([RUBRIC_EVALUATIONS, AI_MODELS]);
+
+        // Inline dependency reading an unscoped readable entity base view is admitted
+        const allowedDepRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT sub.ID FROM {{query:"Analytics/Evals/Base"}} sub',
+                Dependencies: [
+                    {
+                        Name: 'Base',
+                        CategoryPath: '/Analytics/Evals/',
+                        SQL: 'SELECT ID FROM [__mj].[vwRubricEvaluations]',
+                    },
+                ],
+            },
+            provider,
+            user,
+        );
+        expect(allowedDepRefusal).toBeNull();
+
+        // Inline dependency reading a base table is refused when composed into the outer query
+        const forbiddenDepRefusal = resolver.AuthorizeRenderedTestSQL(
+            {
+                SQL: 'SELECT sub.ID FROM {{query:"Analytics/Evals/LeakedUsers"}} sub',
+                Dependencies: [
+                    {
+                        Name: 'LeakedUsers',
+                        CategoryPath: '/Analytics/Evals/',
+                        SQL: 'SELECT ID FROM [__mj].[User]',
+                    },
+                ],
+            },
+            provider,
+            user,
+        );
+        expect(forbiddenDepRefusal).toMatch(/entity base view/);
+    });
+});
+
+describe('IntegrationDiscoveryResolver webhook SSRF guard', () => {
+    const discoverySrc = readFileSync(resolve(__dirname, '../resolvers/IntegrationDiscoveryResolver.ts'), 'utf8');
+
+    it('routes sendWebhook through SafeFetch from @memberjunction/network-utils instead of bare fetch', () => {
+        expect(discoverySrc).toMatch(/import\s*\{[^}]*\bSafeFetch\b[^}]*\}\s*from\s*['"]@memberjunction\/network-utils['"]/);
+        const sendWebhookStart = discoverySrc.indexOf('private async sendWebhook(');
+        expect(sendWebhookStart).toBeGreaterThan(-1);
+        const sendWebhookBody = discoverySrc.slice(sendWebhookStart, sendWebhookStart + 800);
+        expect(sendWebhookBody).toContain('await SafeFetch(url,');
+        expect(sendWebhookBody).not.toMatch(/(?<![A-Za-z])fetch\s*\(/);
+    });
+});

package/src/__tests__/TransactionGroupResolver.fieldSecurity.test.ts

@@ -0,0 +1,199 @@
+/**
+ * Field-level security on the transaction-group transport.
+ *
+ * Output: every `ResultsJSON` entry is projected for the caller. The update entry is a DELTA,
+ * computed by comparing the post-save row with a pre-save snapshot. When the snapshot came from a
+ * load narrowed for the caller and the post-save row is full width, every non-null denied value
+ * differs from its (absent) snapshot and counts as "changed", so the delta itself carried the
+ * values the caller may not read. The entity objects here deliberately return full-width rows
+ * to stand in for any object not narrowed at its source.
+ *
+ * Input: a restricted caller's item payload, and the field a transaction variable names, are
+ * refused when they carry a key the caller may not read or a key that names no field, with the
+ * same message for both, so the refusal does not reveal which columns exist.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import { BaseEntityResult, EntityInfo, UserInfo } from '@memberjunction/core';
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return { ...actual, LogError: () => undefined };
+});
+
+import {
+    TransactionResolver,
+    TransactionInputType,
+    TransactionOperationType,
+    TransactionVariableType,
+} from '../resolvers/TransactionGroupResolver.js';
+import type { AppContext } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, HRUser, Intern, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+class FakeTransactionGroup {
+    public Enrolled = 0;
+    public AddTransaction(): void { this.Enrolled++; }
+    public AddVariable(): void { /* variables are not under test here */ }
+    public async Submit(): Promise<boolean> { return true; }
+}
+
+/**
+ * An entity object that is NOT narrowed at its source: its load returns `loaded`, and after the
+ * save it reports the full-width row, as a save's re-read does.
+ */
+class FullWidthEntity {
+    public TransactionGroup: FakeTransactionGroup | null = null;
+    public LatestResult: BaseEntityResult | null = null;
+    public PrimaryKeys = [{ Name: 'ID' }];
+    public SetManyCalls: Array<Record<string, unknown>> = [];
+    private values: Record<string, unknown>;
+    private saved = false;
+
+    constructor(public readonly EntityInfo: EntityInfo, private readonly loaded: Record<string, unknown>) {
+        this.values = { ...loaded };
+    }
+    public SetMany(values: Record<string, unknown>): void {
+        this.SetManyCalls.push(values);
+        this.values = { ...this.values, ...values };
+    }
+    public async InnerLoad(): Promise<boolean> { this.values = { ...this.loaded }; return true; }
+    public async GetDataObject(): Promise<Record<string, unknown>> {
+        return this.saved ? { ...FullWidthEmployeeRow(), ...this.values, Salary: SECRET_SALARY } : { ...this.values };
+    }
+    public async GetDataObjectJSON(): Promise<string> { return JSON.stringify(await this.GetDataObject()); }
+    public async Save(): Promise<boolean> { return this.write(); }
+    public async Delete(): Promise<boolean> { return this.write(); }
+    private write(): boolean {
+        this.TransactionGroup?.AddTransaction();
+        this.saved = true;
+        const result = new BaseEntityResult();
+        result.Success = true;
+        this.LatestResult = result;
+        return true;
+    }
+}
+
+/** What a load narrowed for an intern holds: no salary keys at all. */
+const NARROW_ROW = { ID: 'emp-1', Name: 'Ada', Notes: 'n' };
+
+function buildContext(entities: FullWidthEntity[], user: UserInfo): AppContext {
+    let next = 0;
+    const provider = {
+        CreateTransactionGroup: async () => new FakeTransactionGroup(),
+        GetEntityObject: async () => entities[next++],
+        Entities: [] as EntityInfo[],
+        EntityByID: () => undefined,
+    };
+    return {
+        providers: [{ type: 'Read-Write', provider }],
+        userPayload: { userRecord: user, email: user.Email },
+    } as unknown as AppContext;
+}
+
+function group(operation: TransactionOperationType, payload: Record<string, unknown>): TransactionInputType {
+    return { Items: [{ EntityName: 'Employees', EntityObjectJSON: JSON.stringify(payload), OperationType: operation }], Variables: [] };
+}
+
+describe('ExecuteTransactionGroup: output is projected for the caller', () => {
+    it('REGRESSION: the update delta never carries a denied value, though the post-save row is full width', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.Success).toBe(true);
+        const delta = JSON.parse(result.ResultsJSON[0]);
+        expect(delta).toMatchObject({ ID: 'emp-1', Notes: 'edited' });
+        expect(delta).not.toHaveProperty('Salary');
+        expect(delta).not.toHaveProperty('Base Salary');
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('REGRESSION: the create result never carries a denied value', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), {});
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Create, { ID: 'emp-1', Name: 'Ada' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+        expect(JSON.parse(result.ResultsJSON[0])).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('REGRESSION: the delete result never carries a denied value', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), FullWidthEmployeeRow());
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Delete, { ID: 'emp-1' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+        expect(JSON.parse(result.ResultsJSON[0])).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('a caller who may read the salary still gets it back', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), {});
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Create, { ID: 'emp-1', Name: 'Ada', Salary: 1 }),
+            buildContext([entity], HRUser())
+        );
+
+        expect(JSON.parse(result.ResultsJSON[0]).Salary).toBe(SECRET_SALARY);
+    });
+});
+
+describe('ExecuteTransactionGroup: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before anything is applied', async (_label, key) => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const run = new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited', [key]: 1 }),
+            buildContext([entity], Intern())
+        );
+
+        await expect(run).rejects.toThrow(RefusalFor(key));
+        expect(entity.SetManyCalls).toHaveLength(0);
+    });
+
+    it('REGRESSION: refuses a transaction variable that names a denied field (it would copy the value elsewhere)', async () => {
+        const source = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const target = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const input: TransactionInputType = {
+            Items: [
+                { EntityName: 'Employees', EntityObjectJSON: JSON.stringify({ ID: 'emp-1', Notes: 'a' }), OperationType: TransactionOperationType.Update },
+                { EntityName: 'Employees', EntityObjectJSON: JSON.stringify({ ID: 'emp-2', Notes: 'b' }), OperationType: TransactionOperationType.Update },
+            ],
+            Variables: [
+                { Name: 'leak', ItemIndex: 0, FieldName: 'Salary', Type: TransactionVariableType.Define },
+                { Name: 'leak', ItemIndex: 1, FieldName: 'Notes', Type: TransactionVariableType.Use },
+            ],
+        };
+
+        await expect(new TransactionResolver().ExecuteTransactionGroup(input, buildContext([source, target], Intern())))
+            .rejects.toThrow(RefusalFor('Salary'));
+    });
+
+    it('accepts the keys a well-behaved client sends, plus transport keys', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited', __typename: 'Employee_' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.Success).toBe(true);
+        expect(entity.SetManyCalls).toHaveLength(1);
+    });
+
+    it('does not gate a caller who is denied nothing', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), FullWidthEmployeeRow());
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Salary: 5 }),
+            buildContext([entity], HRUser())
+        );
+
+        expect(result.Success).toBe(true);
+    });
+});

package/src/__tests__/TransactionGroupResolver.refusals.test.ts

@@ -41,6 +41,7 @@ import {
     TransactionInputType,
     TransactionItemInputType,
     TransactionOperationType,
+    TransactionVariableType,
 } from '../resolvers/TransactionGroupResolver.js';
 import type { AppContext } from '../types.js';
 
@@ -57,7 +58,10 @@ class FakeTransactionGroup {
     public AddTransaction(label: string): void {
         this.Enrolled.push(label);
     }
-    public AddVariable(): void { /* no variables in these tests */ }
+    public Variables: unknown[] = [];
+    public AddVariable(variable: unknown): void {
+        this.Variables.push(variable);
+    }
     public async Submit(): Promise<boolean> {
         this.SubmitCalled = true;
         // TransactionGroupBase.Submit(): an empty group is "nothing to do" and returns true.
@@ -287,4 +291,97 @@ describe('ExecuteTransactionGroup — rows refused server-side (issue #4309)', (
         expect(result.Success).toBe(true);
         expect(group.Enrolled).toHaveLength(0);
     });
+
+    it("registers the group's variables before any row's Save(), so a server-side check can see them", async () => {
+        // A 'Use' variable sets its field at Submit(), after every Save()-time check has passed. A check
+        // that depends on a field's final value (who a conversation message is from) can refuse such a
+        // row only if the variable is already on the group when its Save() runs.
+        const variablesAtSave: number[] = [];
+        class RecordingEntity extends FakeEntity {
+            public override async Save(): Promise<boolean> {
+                variablesAtSave.push(this.TransactionGroup?.Variables.length ?? -1);
+                return super.Save();
+            }
+        }
+        const entities = [
+            new RecordingEntity('MJ: User Roles', { accepts: true }),
+            new RecordingEntity('MJ: User Roles', { accepts: true }),
+        ];
+        const { context } = buildContext(entities);
+        const input = buildGroupInput(2);
+        input.Variables = [
+            { Name: 'v', ItemIndex: 0, FieldName: 'ID', Type: TransactionVariableType.Define },
+            { Name: 'v', ItemIndex: 1, FieldName: 'UserID', Type: TransactionVariableType.Use },
+        ];
+
+        const result = await new TransactionResolver().ExecuteTransactionGroup(input, context);
+
+        expect(result.Success).toBe(true);
+        expect(variablesAtSave).toEqual([2, 2]);
+    });
+
+    it('returns delta-only ResultsJSON on Update (PK, client-sent fields, datestamps, and server-changed fields), omitting unchanged columns', async () => {
+        const preLoadedRow: Record<string, unknown> = {
+            ID: 'a0000000-0000-0000-0000-000000000099',
+            Name: 'Action One',
+            Description: 'Initial description',
+            DriverClass: 'OriginalDriver',
+            Category: 'Utilities',
+            __mj_CreatedAt: '2026-01-01T00:00:00.000Z',
+            __mj_UpdatedAt: '2026-02-01T00:00:00.000Z',
+        };
+        for (let i = 1; i <= 15; i++) {
+            preLoadedRow[`UnchangedField${i}`] = `Constant-${i}`;
+        }
+
+        class ServerMutatingEntity extends FakeEntity {
+            public override async Save(): Promise<boolean> {
+                const ok = await super.Save();
+                if (ok) {
+                    // Simulate server-side DB update refreshing __mj_UpdatedAt and a computed/trigger column
+                    this.SetMany({
+                        __mj_UpdatedAt: '2026-03-01T00:00:00.000Z',
+                        Category: 'Automation (Server Refreshed)',
+                    });
+                }
+                return ok;
+            }
+        }
+
+        const entity = new ServerMutatingEntity('MJ: Actions', {
+            accepts: true,
+            loadedValues: preLoadedRow,
+        });
+        const { context } = buildContext([entity]);
+        const input: TransactionInputType = {
+            Items: [
+                {
+                    EntityName: 'MJ: Actions',
+                    EntityObjectJSON: JSON.stringify({
+                        ID: 'a0000000-0000-0000-0000-000000000099',
+                        Description: 'Updated description',
+                    }),
+                    OperationType: TransactionOperationType.Update,
+                },
+            ],
+            Variables: [],
+        };
+
+        const result = await new TransactionResolver().ExecuteTransactionGroup(input, context);
+
+        expect(result.Success).toBe(true);
+        const returnedObj = JSON.parse(result.ResultsJSON[0]) as Record<string, unknown>;
+        expect(returnedObj).toEqual({
+            ID: 'a0000000-0000-0000-0000-000000000099',
+            Description: 'Updated description',
+            Category: 'Automation (Server Refreshed)',
+            __mj_CreatedAt: '2026-01-01T00:00:00.000Z',
+            __mj_UpdatedAt: '2026-03-01T00:00:00.000Z',
+        });
+        expect(returnedObj).not.toHaveProperty('Name');
+        expect(returnedObj).not.toHaveProperty('DriverClass');
+        for (let i = 1; i <= 15; i++) {
+            expect(returnedObj).not.toHaveProperty(`UnchangedField${i}`);
+        }
+    });
 });