@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/restTransport.fieldSecurity.test.ts

@@ -0,0 +1,148 @@
+/**
+ * Field-level security on the REST transport (rest/EntityCRUDHandler.ts, rest/ViewOperationsHandler.ts).
+ *
+ * Output: every record and every view row is projected for the caller. The entity objects and
+ * view results here are deliberately FULL WIDTH, standing in for any value not narrowed at its
+ * source; the response must still omit what the caller may not read.
+ *
+ * Input: a restricted caller's create or update body is refused when it names a field the caller
+ * may not read, or a key that names no field, with the same message for both.
+ *
+ * Views: callers may not ask for `entity_object` results, whose serialization would send an
+ * entity object's internal state rather than its projected fields.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockGetEntityObject, mockRunViewFn, mockRunViewsFn, mockEntityList } = vi.hoisted(() => ({
+    mockGetEntityObject: vi.fn(),
+    mockRunViewFn: vi.fn(),
+    mockRunViewsFn: vi.fn(),
+    mockEntityList: [] as unknown[],
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public get Entities() { return mockEntityList; }
+        public EntityByID() { return undefined; }
+        public GetEntityObject(entityName: string, contextUser?: unknown): Promise<unknown> {
+            return mockGetEntityObject(entityName, contextUser);
+        }
+    }
+    class MockRunView {
+        public RunView(params: unknown, contextUser?: unknown): Promise<unknown> { return mockRunViewFn(params, contextUser); }
+        public RunViews(params: unknown[], contextUser?: unknown): Promise<unknown> { return mockRunViewsFn(params, contextUser); }
+    }
+    return { ...actual, Metadata: MockMetadata, RunView: MockRunView, LogError: vi.fn() };
+});
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+    ClientClauseScreen: { ScreenViewClauses: vi.fn(), DialectFor: vi.fn() },
+}));
+
+import { EntityInfo, RunViewParams } from '@memberjunction/core';
+import { EntityCRUDHandler } from '../rest/EntityCRUDHandler.js';
+import { ViewOperationsHandler } from '../rest/ViewOperationsHandler.js';
+import { EmployeeEntity, FullWidthEmployeeRow, HRUser, Intern, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+function fullWidthEntity(entityInfo: EntityInfo) {
+    return {
+        EntityInfo: entityInfo,
+        Dirty: true,
+        LatestResult: null,
+        CheckPermissions: vi.fn(() => true),
+        NewRecord: vi.fn(),
+        Set: vi.fn(),
+        Validate: vi.fn(() => ({ Success: true, Errors: [] })),
+        Save: vi.fn(async () => true),
+        InnerLoad: vi.fn(async () => true),
+        GetDataObject: vi.fn(async () => FullWidthEmployeeRow()),
+    };
+}
+
+let entity: ReturnType<typeof fullWidthEntity>;
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    entity = fullWidthEntity(EmployeeEntity());
+    mockGetEntityObject.mockImplementation(async () => entity);
+    mockEntityList.length = 0;
+    mockEntityList.push(EmployeeEntity());
+    mockRunViewFn.mockResolvedValue({ Success: true, Results: [FullWidthEmployeeRow()] });
+    mockRunViewsFn.mockResolvedValue([{ Success: true, Results: [FullWidthEmployeeRow()] }]);
+});
+
+describe('REST entity CRUD: responses are projected for the caller', () => {
+    it('REGRESSION: GetEntity omits a denied field from a full-width record', async () => {
+        const result = await EntityCRUDHandler.GetEntity('Employees', 'emp-1', null, Intern());
+        expect(result.entity).toEqual({ ID: 'emp-1', Name: 'Ada', Notes: 'n' });
+    });
+
+    it('REGRESSION: CreateEntity and UpdateEntity omit a denied field from the saved record', async () => {
+        const created = await EntityCRUDHandler.CreateEntity('Employees', { Name: 'Ada' }, Intern());
+        const updated = await EntityCRUDHandler.UpdateEntity('Employees', 'emp-1', { Notes: 'x' }, Intern());
+        expect(JSON.stringify([created, updated])).not.toContain(String(SECRET_SALARY));
+        expect(created.entity).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('a caller who may read the field still receives it', async () => {
+        const result = await EntityCRUDHandler.GetEntity('Employees', 'emp-1', null, HRUser());
+        expect(result.entity).toMatchObject({ Salary: SECRET_SALARY });
+    });
+});
+
+describe('REST entity CRUD: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: CreateEntity refuses %s with the same message, before anything is set', async (_label, key) => {
+        const result = await EntityCRUDHandler.CreateEntity('Employees', { Name: 'Ada', [key]: 1 }, Intern());
+        expect(result).toMatchObject({ success: false, error: RefusalFor(key) });
+        expect(entity.Set).not.toHaveBeenCalled();
+        expect(entity.Save).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: UpdateEntity refuses %s with the same message, before anything is set', async (_label, key) => {
+        const result = await EntityCRUDHandler.UpdateEntity('Employees', 'emp-1', { Notes: 'x', [key]: 1 }, Intern());
+        expect(result).toMatchObject({ success: false, error: RefusalFor(key) });
+        expect(entity.Set).not.toHaveBeenCalled();
+    });
+
+    it('accepts the save-options key and readable fields', async () => {
+        const result = await EntityCRUDHandler.UpdateEntity('Employees', 'emp-1', { Notes: 'x', options: { SkipEntityActions: true } }, Intern());
+        expect(result.success).toBe(true);
+        expect(entity.Set).toHaveBeenCalledWith('Notes', 'x');
+    });
+});
+
+describe('REST views: rows are projected and entity objects never cross the wire', () => {
+    it('REGRESSION: RunView omits a denied field from full-width rows', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Employees' }, Intern());
+        expect(outcome.result?.Results).toEqual([{ ID: 'emp-1', Name: 'Ada', Notes: 'n' }]);
+    });
+
+    it('REGRESSION: RunViews omits a denied field from every result set', async () => {
+        const outcome = await ViewOperationsHandler.RunViews([{ EntityName: 'Employees' }], Intern());
+        expect(JSON.stringify(outcome.results)).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('REGRESSION: ListEntities omits a denied field from full-width rows', async () => {
+        const result = await ViewOperationsHandler.ListEntities({ EntityName: 'Employees' }, Intern());
+        expect(JSON.stringify(result)).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('REGRESSION: a caller-chosen entity_object ResultType is forced to simple, singly and in a batch', async () => {
+        await ViewOperationsHandler.RunView({ EntityName: 'Employees', ResultType: 'entity_object' }, Intern());
+        await ViewOperationsHandler.RunViews([{ EntityName: 'Employees', ResultType: 'entity_object' }], Intern());
+        expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ResultType).toBe('simple');
+        expect((mockRunViewsFn.mock.calls[0][0] as RunViewParams[])[0].ResultType).toBe('simple');
+    });
+
+    it('a caller who may read the field still receives it', async () => {
+        const outcome = await ViewOperationsHandler.RunView({ EntityName: 'Employees' }, HRUser());
+        expect(outcome.result?.Results[0]).toMatchObject({ Salary: SECRET_SALARY });
+    });
+});

package/src/__tests__/runParamsTimeZone.test.ts

@@ -0,0 +1,179 @@
+// ResolverBase / RunViewResolver / RunQueryResolver pull in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+// QueryResolver's GraphQL types lean on emitted decorator metadata, which vitest's transform does not
+// produce. The decorators are irrelevant to what the resolvers pass on, so they become no-ops.
+vi.mock('type-graphql', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    const noopDecorator = () => () => undefined;
+    return {
+        ...actual,
+        Resolver: noopDecorator, Query: noopDecorator, Mutation: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, Root: noopDecorator, PubSub: noopDecorator,
+    };
+});
+import type {
+    DatabaseProviderBase,
+    RunQueryParams,
+    RunQueryResult,
+    RunQueryWithCacheCheckParams,
+    RunQueriesWithCacheCheckResponse,
+    RunViewParams,
+    RunViewResult,
+    RunViewWithCacheCheckParams,
+    RunViewsWithCacheCheckResponse,
+    UserInfo,
+} from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import {
+    RunViewResolver,
+    type RunDynamicViewInput,
+    type RunViewByIDInput,
+    type RunViewByNameInput,
+    type RunViewWithCacheCheckInput,
+} from '../generic/RunViewResolver.js';
+import { RunQueryResolver, type RunQueryInput, type RunQueryWithCacheCheckInput } from '../resolvers/QueryResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * The view and query resolvers pass the caller's time zone (UserPayload.TimeZone, read from the
+ * x-mj-timezone header) on to the provider as RunViewParams.TimeZone / RunQueryParams.TimeZone,
+ * and leave it unset when the request carried none.
+ */
+
+const ENTITY_NAME = 'MJ: Things';
+
+function payload(timeZone?: string): UserPayload {
+    const p = { email: 'tester@example.com', userRecord: { Email: 'tester@example.com' } as UserInfo } as UserPayload;
+    if (timeZone) p.TimeZone = timeZone;
+    return p;
+}
+
+function entityStub() {
+    return { ID: 'ent-1', Name: ENTITY_NAME, BaseView: 'vwThings', PrimaryKeys: [{ Name: 'ID' }], Fields: [{ Name: 'ID', CodeName: 'ID' }], EncryptedFields: [] };
+}
+
+const okView = (): RunViewResult => ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult);
+const okQuery = (): RunQueryResult => ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ExecutionTime: 0, ErrorMessage: '' } as RunQueryResult);
+
+/** Provider that records the run params every resolver path hands it. */
+function recordingProvider() {
+    const views: RunViewParams[] = [];
+    const queries: RunQueryParams[] = [];
+    const provider = {
+        Entities: [entityStub()],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? entityStub() : undefined),
+        RunView: async (params: RunViewParams) => { views.push(params); return okView(); },
+        RunViews: async (params: RunViewParams[]) => { views.push(...params); return params.map(okView); },
+        RunViewsWithCacheCheck: async (params: RunViewWithCacheCheckParams[]) => {
+            views.push(...params.map((p) => p.params));
+            return { success: true, results: [] } as RunViewsWithCacheCheckResponse;
+        },
+        RunQuery: async (params: RunQueryParams) => { queries.push(params); return okQuery(); },
+        RunQueries: async (params: RunQueryParams[]) => { queries.push(...params); return params.map(okQuery); },
+        RunQueriesWithCacheCheck: async (params: RunQueryWithCacheCheckParams[]) => {
+            queries.push(...params.map((p) => p.params));
+            return { success: true, results: [] } as RunQueriesWithCacheCheckResponse;
+        },
+    } as unknown as DatabaseProviderBase;
+    return { provider, views, queries };
+}
+
+function appContext(provider: DatabaseProviderBase, userPayload: UserPayload): AppContext {
+    return { providers: [{ provider, type: 'Read-Write' }], userPayload } as unknown as AppContext;
+}
+
+/** Skips the encrypted-field filter (it needs live Metadata) — irrelevant here. */
+class Probe extends ResolverBase {
+    protected override async ArrayFilterEncryptedFieldsForAPI(_entityName: string, rows: Record<string, unknown>[]): Promise<Record<string, unknown>[]> {
+        return rows;
+    }
+}
+
+describe('RunViewParams.TimeZone from the request', () => {
+    const dynamic = { EntityName: ENTITY_NAME, ExtraFilter: '', OrderBy: '' } as RunDynamicViewInput;
+
+    it('a single view run carries the caller zone', async () => {
+        const { provider, views } = recordingProvider();
+        await new Probe().RunDynamicViewGeneric(dynamic, provider, payload('Europe/Paris'), undefined as never);
+        expect(views[0].TimeZone).toBe('Europe/Paris');
+    });
+
+    it('a single view run without the header leaves it unset (UTC)', async () => {
+        const { provider, views } = recordingProvider();
+        await new Probe().RunDynamicViewGeneric(dynamic, provider, payload(), undefined as never);
+        expect(views[0].TimeZone).toBeUndefined();
+    });
+
+    it('a batch carries it on every view', async () => {
+        const { provider, views } = recordingProvider();
+        const inputs = [dynamic, dynamic] as (RunViewByNameInput & RunViewByIDInput & RunDynamicViewInput)[];
+        await new Probe().RunViewsGeneric(inputs, provider, payload('Asia/Tokyo'));
+        expect(views.map((v) => v.TimeZone)).toEqual(['Asia/Tokyo', 'Asia/Tokyo']);
+    });
+
+    it('the cache-check batch carries it', async () => {
+        const { provider, views } = recordingProvider();
+        const input = [{ params: { EntityName: ENTITY_NAME } }] as unknown as RunViewWithCacheCheckInput[];
+        await new RunViewResolver().RunViewsWithCacheCheck(input, appContext(provider, payload('America/Chicago')));
+        expect(views[0].TimeZone).toBe('America/Chicago');
+    });
+});
+
+describe('RunQueryParams.TimeZone from the request', () => {
+    it('a single query run carries the caller zone, or none', async () => {
+        const withZone = recordingProvider();
+        await new RunQueryResolver().GetQueryDataByName('Active Members', appContext(withZone.provider, payload('Europe/Paris')));
+        expect(withZone.queries[0].TimeZone).toBe('Europe/Paris');
+
+        const without = recordingProvider();
+        await new RunQueryResolver().GetQueryDataByName('Active Members', appContext(without.provider, payload()));
+        expect(without.queries[0].TimeZone).toBeUndefined();
+    });
+
+    it('a batch carries it on every query', async () => {
+        const { provider, queries } = recordingProvider();
+        const input = [{ QueryName: 'A' }, { QueryName: 'B' }] as RunQueryInput[];
+        await new RunQueryResolver().RunQueries(input, appContext(provider, payload('Asia/Tokyo')));
+        expect(queries.map((q) => q.TimeZone)).toEqual(['Asia/Tokyo', 'Asia/Tokyo']);
+    });
+
+    it('the cache-check batch carries it', async () => {
+        const { provider, queries } = recordingProvider();
+        const input = [{ params: { QueryName: 'A' } }] as unknown as RunQueryWithCacheCheckInput[];
+        await new RunQueryResolver().RunQueriesWithCacheCheck(input, appContext(provider, payload('America/Chicago')));
+        expect(queries[0].TimeZone).toBe('America/Chicago');
+    });
+});
+
+/**
+ * #4789 A17: ServerParameters (values for server-set query parameters) and RequireApproved are
+ * server-only. No GraphQL run input declares them, and the RunQuery* resolvers build the run params
+ * field by field, so a value a client smuggles into an input object never reaches the provider. A
+ * client's only channel for a value is `Parameters`, where a server-set parameter is refused.
+ */
+describe('RunQueryParams.ServerParameters and RequireApproved never come from a request', () => {
+    const smuggled = { ServerParameters: { ChapterID: 'someone-elses-chapter' }, RequireApproved: false, TimeZone: 'Pacific/Fiji' };
+
+    it('a batch drops them from each input', async () => {
+        const { provider, queries } = recordingProvider();
+        const input = [{ QueryName: 'A', Parameters: { Region: 'West' }, ...smuggled }] as unknown as RunQueryInput[];
+        await new RunQueryResolver().RunQueries(input, appContext(provider, payload('Asia/Tokyo')));
+        expect(queries[0].ServerParameters).toBeUndefined();
+        expect(queries[0].RequireApproved).toBeUndefined();
+        expect(queries[0].TimeZone).toBe('Asia/Tokyo'); // from the header, not the input
+        expect(queries[0].Parameters).toEqual({ Region: 'West' });
+    });
+
+    it('the cache-check batch drops them too', async () => {
+        const { provider, queries } = recordingProvider();
+        const input = [{ params: { QueryName: 'A', ...smuggled } }] as unknown as RunQueryWithCacheCheckInput[];
+        await new RunQueryResolver().RunQueriesWithCacheCheck(input, appContext(provider, payload()));
+        expect(queries[0].ServerParameters).toBeUndefined();
+        expect(queries[0].RequireApproved).toBeUndefined();
+        expect(queries[0].TimeZone).toBeUndefined();
+    });
+});

package/src/__tests__/runStreams.fieldSecurity.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Field-level security on the agent-run and test-run streams.
+ *
+ * Each of these publishes an entity object's `GetAll()` to the caller's session: the agent run on
+ * every progress and streaming message and in the final result, the test run on every progress
+ * message. The objects come from long-running engines and can have been built for another
+ * identity, so the transport projects them for the recipient. The objects here are FULL WIDTH,
+ * and the recipient may not read `Salary`.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import type { PubSubEngine } from 'type-graphql';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = [
+        'Resolver', 'Query', 'Mutation', 'Subscription', 'Arg', 'Args', 'ArgsType', 'Ctx', 'Root',
+        'Info', 'Field', 'FieldResolver', 'ObjectType', 'InputType', 'InterfaceType', 'Authorized',
+        'UseMiddleware', 'Extensions', 'Directive', 'ID', 'Int', 'Float', 'GraphQLISODateTime',
+        'GraphQLTimestamp', 'registerEnumType', 'createMethodDecorator', 'createParamDecorator',
+        'buildSchema', 'buildSchemaSync', 'PubSub',
+    ];
+    return Object.fromEntries(exportNames.map((name) => [name, decoratorFactory]));
+});
+
+vi.mock('@memberjunction/ai-agents', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('@memberjunction/ai-agents')>()),
+    AgentRunner: class {},
+}));
+
+import type { ExecuteAgentResult } from '@memberjunction/ai-core-plus';
+import { AgentRunStatusPublisher } from '../resolvers/AgentRunStatusPublisher.js';
+import { RunAIAgentResolver } from '../resolvers/RunAIAgentResolver.js';
+import { RunTestResolver } from '../resolvers/RunTestResolver.js';
+import type { UserPayload } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+/** A run object holding every column, as one built for another identity would. */
+function fullWidthRun() {
+    return {
+        ID: 'emp-1',
+        ConversationDetailID: 'detail-1',
+        Steps: [{ StepName: 'Answer' }],
+        EntityInfo: EmployeeEntity(),
+        GetAll: () => FullWidthEmployeeRow(),
+    };
+}
+
+function capture() {
+    const publish = vi.fn().mockResolvedValue(undefined);
+    const pubSub = { publish } as unknown as PubSubEngine;
+    const userPayload = { sessionId: 'session-1', userRecord: Intern() } as unknown as UserPayload;
+    const messages = () => publish.mock.calls.map((call) => String((call[1] as { message: string }).message));
+    return { pubSub, userPayload, messages };
+}
+
+describe('AgentRunStatusPublisher: the run is projected for the recipient', () => {
+    it('REGRESSION: progress and streaming messages never carry a denied value', () => {
+        const { pubSub, userPayload, messages } = capture();
+        const publisher = new AgentRunStatusPublisher(pubSub, userPayload);
+        publisher.OnProgress({ step: 'prompt_execution', percentage: 10, message: 'm', metadata: { agentRun: fullWidthRun() } } as never);
+        publisher.OnStreaming({ content: 'hi', isComplete: false } as never);
+
+        expect(messages()).toHaveLength(2);
+        for (const message of messages()) {
+            expect(message).not.toContain(String(SECRET_SALARY));
+            expect(message).toContain('"Name":"Ada"');
+        }
+    });
+});
+
+describe('RunAIAgentResolver: the final result is projected for the recipient', () => {
+    it('REGRESSION: the sanitized result never carries a denied value of the run', () => {
+        const sanitize = (RunAIAgentResolver.prototype as unknown as {
+            sanitizeAgentResult(result: ExecuteAgentResult, user?: unknown): Record<string, unknown>;
+        }).sanitizeAgentResult;
+        const result = { success: true, agentRun: fullWidthRun() } as unknown as ExecuteAgentResult;
+
+        const sanitized = sanitize.call(new RunAIAgentResolver(), result, Intern());
+
+        expect(JSON.stringify(sanitized)).not.toContain(String(SECRET_SALARY));
+        expect(sanitized.agentRun).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});
+
+describe('RunTestResolver: progress is projected for the recipient', () => {
+    it('REGRESSION: a progress message never carries a denied value of the test run', () => {
+        const { pubSub, userPayload, messages } = capture();
+        const create = (RunTestResolver.prototype as unknown as {
+            createProgressCallback(pubSub: PubSubEngine, userPayload: UserPayload, testId: string): (progress: unknown) => void;
+        }).createProgressCallback;
+        const onProgress = create.call(new RunTestResolver(), pubSub, userPayload, 'test-1');
+
+        onProgress({ step: 'running', percentage: 50, message: 'm', metadata: { testRun: fullWidthRun() } });
+
+        expect(messages()).toHaveLength(1);
+        expect(messages()[0]).not.toContain(String(SECRET_SALARY));
+        expect(messages()[0]).toContain('Ada');
+    });
+});

package/src/__tests__/runViewProperties.test.ts

@@ -0,0 +1,114 @@
+// ResolverBase / RunViewResolver pull in type-graphql decorators, which need the Reflect.metadata
+// polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+// The decorators are irrelevant to what the resolvers pass on, so they become no-ops.
+vi.mock('type-graphql', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    const noopDecorator = () => () => undefined;
+    return {
+        ...actual,
+        Resolver: noopDecorator, Query: noopDecorator, Mutation: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, Root: noopDecorator, PubSub: noopDecorator,
+    };
+});
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { RunViewResolver, type RunDynamicViewInput, type RunViewByIDInput, type RunViewByNameInput } from '../generic/RunViewResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * The GraphQL view resolvers pass a client's `Properties` on to the provider and never
+ * `ServerProperties`, whatever the input object carries; and a refusal the provider returns
+ * reaches the client with its message.
+ */
+
+const ENTITY_NAME = 'MJ: Things';
+const VIEW_ID = '33333333-3333-4333-8333-333333333333';
+const CHAPTER = '11111111-1111-4111-8111-111111111111';
+const REFUSAL = 'View property "Chapter" is set by the server; a client value for it is refused.';
+
+function payload(): UserPayload {
+    return { email: 'tester@example.com', userRecord: { Email: 'tester@example.com' } as UserInfo } as UserPayload;
+}
+
+function entityStub() {
+    return { ID: 'ent-1', Name: ENTITY_NAME, BaseView: 'vwThings', PrimaryKeys: [{ Name: 'ID' }], Fields: [{ Name: 'ID', CodeName: 'ID', NeedsQuotes: true }], EncryptedFields: [] };
+}
+
+function userViewsEntityStub() {
+    return { ...entityStub(), ID: 'ent-views', Name: 'MJ: User Views' };
+}
+
+const viewRow = { ID: VIEW_ID, Name: 'Chapter Things', Entity: ENTITY_NAME, EntityID: 'ent-1' };
+
+/** Records the run params each resolver hands the provider; a run carrying Properties is refused like the provider would. */
+function recordingProvider() {
+    const views: RunViewParams[] = [];
+    const answer = (p: RunViewParams): RunViewResult => {
+        if (p.EntityName === 'MJ: User Views') {
+            return { Success: true, Results: [viewRow], RowCount: 1, TotalRowCount: 1, ErrorMessage: '' } as RunViewResult;
+        }
+        views.push(p);
+        return p.Properties
+            ? ({ Success: false, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: REFUSAL } as RunViewResult)
+            : ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult);
+    };
+    const provider = {
+        Entities: [entityStub(), userViewsEntityStub()],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? entityStub() : undefined),
+        EntityByID: () => entityStub(),
+        GetEntityObject: async () => ({ ...viewRow, Load: async () => true }),
+        RunView: async (params: RunViewParams) => answer(params),
+        RunViews: async (params: RunViewParams[]) => params.map(answer),
+    } as unknown as DatabaseProviderBase;
+    return { provider, views };
+}
+
+function appContext(provider: DatabaseProviderBase): AppContext {
+    return { providers: [{ provider, type: 'Read-Write' }], userPayload: payload() } as unknown as AppContext;
+}
+
+class Probe extends ResolverBase {
+    protected override async ArrayFilterEncryptedFieldsForAPI(_entityName: string, rows: Record<string, unknown>[]): Promise<Record<string, unknown>[]> {
+        return rows;
+    }
+}
+
+/** An input as a client might shape it, with a ServerProperties field smuggled in. */
+function smuggled<T>(input: T): T {
+    return { ...input, Properties: { Chapter: CHAPTER }, ServerProperties: { Chapter: 'forged' } } as T;
+}
+
+describe('GraphQL view resolvers and view properties', () => {
+    it('RunViewByID and RunViewByName pass Properties on, never ServerProperties', async () => {
+        const { provider, views } = recordingProvider();
+        await new Probe().RunViewByIDGeneric(smuggled({ ViewID: VIEW_ID } as RunViewByIDInput), provider, payload(), undefined as never);
+        await new Probe().RunViewByNameGeneric(smuggled({ ViewName: viewRow.Name } as RunViewByNameInput), provider, payload(), undefined as never);
+        expect(views.map((v) => v.Properties)).toEqual([{ Chapter: CHAPTER }, { Chapter: CHAPTER }]);
+        expect(views.map((v) => v.ServerProperties)).toEqual([undefined, undefined]);
+        expect(views[0].ViewID).toBe(VIEW_ID);
+    });
+
+    it('RunViews passes Properties on for each view, never ServerProperties', async () => {
+        const { provider, views } = recordingProvider();
+        const inputs = [smuggled({ ViewID: VIEW_ID }), { EntityName: ENTITY_NAME }] as (RunViewByNameInput & RunViewByIDInput & RunDynamicViewInput)[];
+        await new Probe().RunViewsGeneric(inputs, provider, payload());
+        expect(views.map((v) => v.Properties)).toEqual([{ Chapter: CHAPTER }, undefined]);
+        expect(views.every((v) => v.ServerProperties === undefined)).toBe(true);
+    });
+
+    it('a run without Properties carries none', async () => {
+        const { provider, views } = recordingProvider();
+        await new Probe().RunViewByIDGeneric({ ViewID: VIEW_ID } as RunViewByIDInput, provider, payload(), undefined as never);
+        expect(views[0].Properties).toBeUndefined();
+    });
+
+    it('RunViewByID returns the provider refusal, naming the property', async () => {
+        const { provider } = recordingProvider();
+        const result = await new RunViewResolver().RunViewByID(smuggled({ ViewID: VIEW_ID } as RunViewByIDInput), appContext(provider), undefined as never);
+        expect(result).toMatchObject({ Success: false, ErrorMessage: REFUSAL });
+    });
+});