@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/UpdateMJDataContextItem.oldValues.test.ts

@@ -0,0 +1,220 @@
+// type-graphql decorators in the resolver graph need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+/**
+ * `UpdateMJDataContextItem` goes through `ResolverBase.UpdateRecord`. `MJ: Data Context Items` does
+ * not track record changes, so without special handling a client that sends `OldValues___` decides
+ * the record's starting state. It could repeat its new SQL as the old value, so the SQL field does
+ * not look changed. Or it could leave `Type` and `SQL` out entirely, so they are never loaded and
+ * the stored procedure keeps the stored SQL item. The server entity class for the item must still
+ * refuse a non-Owner's save of a SQL item on every one of these paths.
+ *
+ * The resolver base and the entity class are real. The provider hands out real entity objects,
+ * loads a fixed stored row, and records each save instead of writing it.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { EntityInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import type { BaseEntity, DatabaseProviderBase, IEntityDataProvider, IMetadataProvider } from '@memberjunction/core';
+import { MJDataContextItemEntityServer } from '@memberjunction/core-entities-server';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+
+const ENTITY_ID = 'E0000000-0000-4000-8000-0000000000D2';
+const UI_ROLE_ID = 'E1000000-0000-4000-8000-000000000001';
+const DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000001';
+const OTHER_DATA_CONTEXT_ID = 'B0000000-0000-4000-8000-000000000002';
+const ITEM_ID = 'C0000000-0000-4000-8000-000000000001';
+const STORED_SQL = 'SELECT 1 AS One';
+const NEW_SQL = 'SELECT 2 AS Two';
+
+interface StoredRow {
+    ID: string;
+    DataContextID: string;
+    Type: string;
+    SQL: string | null;
+    DataJSON: string | null;
+    Description: string | null;
+}
+
+/** A SQL item in someone else's data context. */
+const STORED_SQL_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: STORED_SQL, DataJSON: null, Description: 'Revenue',
+};
+
+/** An item of another type, with no SQL. */
+const STORED_ENTITY_ITEM: StoredRow = {
+    ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'full_entity', SQL: null, DataJSON: null, Description: 'Notes',
+};
+
+/**
+ * `MJ: Data Context Items` as the database describes it: record changes and field-level security
+ * off, the API open, and the UI role holding every permission with no row-level filter.
+ */
+const ITEM_ENTITY = new EntityInfo({
+    ID: ENTITY_ID,
+    Name: 'MJ: Data Context Items',
+    SchemaName: '__mj',
+    BaseTable: 'DataContextItem',
+    BaseView: 'vwDataContextItems',
+    Status: 'Active',
+    IncludeInAPI: true,
+    AllowCreateAPI: true,
+    AllowUpdateAPI: true,
+    AllowDeleteAPI: true,
+    TrackRecordChanges: false,
+    EnableFieldLevelSecurity: false,
+    EntityPermissions: [{
+        ID: 'P0000000-0000-4000-8000-000000000001', EntityID: ENTITY_ID, RoleID: UI_ROLE_ID,
+        CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true,
+    }],
+    EntityFields: [
+        { Name: 'ID', Type: 'uniqueidentifier', AllowsNull: false, IsPrimaryKey: true },
+        { Name: 'DataContextID', Type: 'uniqueidentifier', AllowsNull: false },
+        { Name: 'Type', Type: 'nvarchar', AllowsNull: false },
+        { Name: 'SQL', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'DataJSON', Type: 'nvarchar', AllowsNull: true },
+        { Name: 'Description', Type: 'nvarchar', AllowsNull: true },
+    ].map((c, i) => ({
+        ID: `F0000000-0000-4000-8000-00000000000${i}`,
+        EntityID: ENTITY_ID,
+        Sequence: i + 1,
+        Length: 0,
+        Precision: 0,
+        Scale: 0,
+        AllowUpdateAPI: true,
+        ...c,
+    })),
+});
+
+/** A UI-role user who is not an administrator. */
+const UI_USER = new UserInfo(null, {
+    ID: 'A0000000-0000-4000-8000-000000000002',
+    Email: 'ui-user@example.com',
+    Type: 'User',
+    UserRoles: [new UserRoleInfo({ UserID: 'A0000000-0000-4000-8000-000000000002', RoleID: UI_ROLE_ID })],
+});
+
+const PAYLOAD: UserPayload = { email: UI_USER.Email, userRecord: UI_USER, sessionId: 'test-session' };
+const PUB_SUB = { publish: async (): Promise<void> => undefined } as unknown as PubSubEngine;
+
+/** What one save would have written. */
+interface RecordedSave {
+    DataContextID: string;
+    SQL: string | null;
+    DataJSON: string | null;
+}
+
+/** A database provider whose load returns `stored`, and which records each save it receives. */
+function recordingDatabase(stored: StoredRow): { Saves: RecordedSave[]; Provider: DatabaseProviderBase } {
+    const saves: RecordedSave[] = [];
+    const entityData = {
+        async Load(): Promise<Record<string, unknown>> {
+            return { ...stored };
+        },
+        async Save(entity: BaseEntity): Promise<Record<string, unknown>> {
+            const item = entity as MJDataContextItemEntityServer;
+            saves.push({ DataContextID: item.DataContextID, SQL: item.SQL, DataJSON: item.DataJSON });
+            return entity.GetAll();
+        },
+    } as unknown as IEntityDataProvider;
+    const database = {
+        async GetEntityObject(_entityName: string, user: UserInfo): Promise<MJDataContextItemEntityServer> {
+            const item = new MJDataContextItemEntityServer(ITEM_ENTITY, entityData);
+            item.ContextCurrentUser = user;
+            return item;
+        },
+    } as unknown as DatabaseProviderBase;
+    return { Saves: saves, Provider: database };
+}
+
+/** Builds an `OldValues___` array from a plain object. */
+function oldValues(values: Record<string, string | null>): Array<{ Key: string; Value: string | null }> {
+    return Object.entries(values).map(([Key, Value]) => ({ Key, Value }));
+}
+
+/** Exposes ResolverBase's generic update path, which the generated `UpdateMJDataContextItem` mutation calls. */
+class UpdateHarness extends ResolverBase {
+    /** Runs the update and reports how it ended: 'saved', or the message it was refused with. */
+    public async Update(input: Record<string, unknown>, provider: DatabaseProviderBase): Promise<string> {
+        try {
+            await this.UpdateRecord('MJ: Data Context Items', input, provider, PAYLOAD, PUB_SUB);
+            return 'saved';
+        } catch (e) {
+            return e instanceof Error ? e.message : String(e);
+        }
+    }
+}
+
+const harness = new UpdateHarness();
+
+describe('UpdateMJDataContextItem — a non-Owner may not change a SQL item', () => {
+    it('refuses new SQL when the update loads the stored row (no OldValues___)', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+
+        const outcome = await harness.Update({ ...STORED_SQL_ITEM, SQL: NEW_SQL }, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses new SQL when OldValues___ repeats the new SQL, so the field does not look changed', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ...STORED_SQL_ITEM,
+            SQL: NEW_SQL,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID, Type: 'sql', SQL: NEW_SQL, Description: 'Revenue' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses moving a SQL item to another data context when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataContextID: OTHER_DATA_CONTEXT_ID,
+            OldValues___: oldValues({ ID: ITEM_ID, DataContextID: DATA_CONTEXT_ID }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('refuses changing the cached DataJSON of a SQL item when Type and SQL are left out of the input and OldValues___', async () => {
+        const db = recordingDatabase(STORED_SQL_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            DataJSON: '[{"One":2}]',
+            OldValues___: oldValues({ ID: ITEM_ID, DataJSON: null }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(db.Saves).toEqual([]);
+        expect(outcome).toMatch(/Owner-type/);
+    });
+
+    it('still saves a non-Owner\'s change to an item of another type that sends OldValues___', async () => {
+        // The success path maps the saved row back through the process-wide metadata.
+        vi.spyOn(Metadata, 'Provider', 'get').mockReturnValue(
+            { Entities: [ITEM_ENTITY], EntityByName: () => ITEM_ENTITY } as unknown as IMetadataProvider,
+        );
+        const db = recordingDatabase(STORED_ENTITY_ITEM);
+        const input = {
+            ID: ITEM_ID,
+            Description: 'Renamed',
+            OldValues___: oldValues({ ID: ITEM_ID, Description: 'Notes' }),
+        };
+
+        const outcome = await harness.Update(input, db.Provider);
+
+        expect(outcome).toBe('saved');
+        expect(db.Saves).toEqual([{ DataContextID: DATA_CONTEXT_ID, SQL: null, DataJSON: null }]);
+    });
+});

package/src/__tests__/UserViewResolver.updateWhereClause.test.ts

@@ -35,6 +35,7 @@ vi.mock('../resolvers/UserResolver.js', () => ({ UserResolver: class {} }));
 
 import { UserViewResolver } from '../resolvers/UserViewResolver.js';
 import type { AppContext, ProviderInfo, UserPayload } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, SECRET_SALARY } from './fieldSecurityFixtures.js';
 
 const VIEW_ID = '0F8FAD5B-D9CB-469F-A165-70867728950E';
 const USER = { ID: 'user-1', Email: 'dev@example.com' } as unknown as UserInfo;
@@ -111,4 +112,18 @@ describe('UserViewResolver.UpdateWhereClause', () => {
         const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
         await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/Failed to update where clause/);
     });
+
+    it('REGRESSION: returns the saved view projected for the caller, never a denied value', async () => {
+        const { view } = makeView({ loadOk: true });
+        const fullWidth = view as FakeView & { EntityInfo?: unknown };
+        fullWidth.EntityInfo = EmployeeEntity();
+        fullWidth.GetAll = vi.fn(() => FullWidthEmployeeRow());
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        (ctx.userPayload as { userRecord: unknown }).userRecord = Intern();
+
+        const result = await new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx);
+
+        expect(JSON.stringify(result)).not.toContain(String(SECRET_SALARY));
+        expect(result).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
 });

package/src/__tests__/ViewOperationsHandler.clauseScreen.test.ts

@@ -0,0 +1,157 @@
+/**
+ * The REST view routes (`POST /views/:entityName`, `POST /views/batch`, `GET /entities/:entityName`)
+ * hand client `ExtraFilter` / `OrderBy` / `OverrideExcludeFilter` text to `RunView` through
+ * `ViewOperationsHandler`. These tests pin that the text passes the same base-view AST screen as
+ * the GraphQL RunView resolvers before any view runs. Payloads are harmless (stacked `SELECT`s);
+ * the point is only whether they reach `RunView`.
+ *
+ * `@memberjunction/core`'s `Metadata` and `RunView` are replaced at the module boundary, as in
+ * ViewOperationsHandler.test.ts; the screen itself runs unmodified.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockRunViewFn, mockRunViewsFn, mockEntityList } = vi.hoisted(() => ({
+    mockRunViewFn: vi.fn(),
+    mockRunViewsFn: vi.fn(),
+    mockEntityList: [] as Array<{
+        Name: string;
+        SchemaName: string;
+        BaseView: string;
+        GetUserPermisions: (u: unknown) => { CanRead: boolean };
+        GetEffectiveRowFilterWhereClause: () => string;
+        GetDeniedReadFields: () => Set<string>;
+    }>,
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public get Entities() {
+            return mockEntityList;
+        }
+    }
+    class MockRunView {
+        public RunView(params: unknown, contextUser?: unknown): Promise<unknown> {
+            return mockRunViewFn(params, contextUser);
+        }
+        public RunViews(params: unknown[], contextUser?: unknown): Promise<unknown> {
+            return mockRunViewsFn(params, contextUser);
+        }
+    }
+    return { ...actual, Metadata: MockMetadata, RunView: MockRunView, LogError: vi.fn() };
+});
+
+import type { BaseEntity, PlatformSQL, RunViewParams, UserInfo } from '@memberjunction/core';
+import { ViewOperationsHandler } from '../rest/ViewOperationsHandler.js';
+
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM sales.vwCustomers WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Name: 'Reader' } as unknown as UserInfo;
+const OK_RESULT = { Success: true, Results: [{ ID: '1' }] };
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockEntityList.length = 0;
+    const unscoped = { GetEffectiveRowFilterWhereClause: () => '', GetDeniedReadFields: () => new Set<string>() };
+    mockEntityList.push(
+        { Name: 'Customers', SchemaName: 'sales', BaseView: 'vwCustomers', GetUserPermisions: () => ({ CanRead: true }), ...unscoped },
+        { Name: 'Ledger', SchemaName: 'sales', BaseView: 'vwLedger', GetUserPermisions: () => ({ CanRead: false }), ...unscoped },
+        {
+            Name: 'Orders',
+            SchemaName: 'sales',
+            BaseView: 'vwOrders',
+            GetUserPermisions: () => ({ CanRead: true }),
+            GetEffectiveRowFilterWhereClause: () => "(OwnerID = 'user-1')",
+            GetDeniedReadFields: () => new Set<string>(),
+        },
+    );
+    mockRunViewFn.mockResolvedValue(OK_RESULT);
+    mockRunViewsFn.mockResolvedValue([OK_RESULT]);
+});
+
+describe('ViewOperationsHandler — REST clause screen', () => {
+    it('RunView refuses a stacked statement hidden behind a bracket identifier, before RunView', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('RunView screens OrderBy and OverrideExcludeFilter too', async () => {
+        const cases: RunViewParams[] = [
+            { EntityName: 'Customers', OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { EntityName: 'Customers', OverrideExcludeFilter: BRACKET_STACKED },
+        ];
+        for (const params of cases) {
+            const outcome = await ViewOperationsHandler.RunView(params, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery against a base table or an entity the caller cannot read', async () => {
+        for (const filter of [
+            `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')`,
+            `ID IN (SELECT CustomerID FROM sales.vwLedger)`,
+        ]) {
+            const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery over an entity that is row-level-security filtered for the caller', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: `ID IN (SELECT CustomerID FROM sales.vwOrders)` }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/'Orders' is row-level-security filtered for you/);
+    });
+
+    it('RunView screens every variant of a platform-specific filter', async () => {
+        const filter: PlatformSQL = { default: `Name = 'x'`, sqlserver: BRACKET_STACKED };
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('RunViews refuses the whole batch when one entry carries a payload', async () => {
+        const outcome = await ViewOperationsHandler.RunViews(
+            [{ EntityName: 'Customers' }, { EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }],
+            USER,
+        );
+
+        expect(mockRunViewsFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('ListEntities refuses a payload in the query-string filter', async () => {
+        await expect(
+            ViewOperationsHandler.ListEntities({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER),
+        ).rejects.toThrow(/multiple statements/);
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('refuses a ViewEntity that was not loaded as an entity (its ID would be spliced into SQL)', async () => {
+        const forged = { ID: '0) ; SELECT 1 AS [x] ; SELECT 1 WHERE (1=1', EntityID: 'any' } as unknown as BaseEntity;
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ViewEntity: forged, ExcludeDataFromAllPriorViewRuns: true }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/ViewEntity is not accepted over REST/);
+    });
+
+    it('passes a filter that only reads entity base views through to RunView', async () => {
+        const filter = `Name = 'O''Brien' AND ID IN (SELECT ID FROM sales.vwCustomers WHERE Region = 'West')`;
+
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Customers', ExtraFilter: filter, OrderBy: '[Name] DESC' }, USER);
+
+        expect(outcome.success).toBe(true);
+        expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ExtraFilter).toBe(filter);
+    });
+});

package/src/__tests__/ViewOperationsHandler.test.ts

@@ -107,14 +107,19 @@ describe('ViewOperationsHandler.runView', () => {
     });
 
     describe('parameter sanitization', () => {
-        it('defaults ResultType to "simple" when unset and preserves an explicit one', async () => {
+        it('defaults ResultType to "simple" when unset, forces "simple" over "entity_object", and keeps "count_only"', async () => {
             const defaulted: RunViewParams = { EntityName: 'Customers' };
             await ViewOperationsHandler.runView(defaulted, makeUser());
             expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ResultType).toBe('simple');
 
+            // Entity objects cannot cross the wire: serializing one sends its internal state, not its fields.
             const explicit: RunViewParams = { EntityName: 'Customers', ResultType: 'entity_object' };
             await ViewOperationsHandler.runView(explicit, makeUser());
-            expect((mockRunViewFn.mock.calls[1][0] as RunViewParams).ResultType).toBe('entity_object');
+            expect((mockRunViewFn.mock.calls[1][0] as RunViewParams).ResultType).toBe('simple');
+
+            const countOnly: RunViewParams = { EntityName: 'Customers', ResultType: 'count_only' };
+            await ViewOperationsHandler.runView(countOnly, makeUser());
+            expect((mockRunViewFn.mock.calls[2][0] as RunViewParams).ResultType).toBe('count_only');
         });
 
         it('splits comma-separated Fields strings and coerces numeric strings for MaxRows/StartRow', async () => {