@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/__tests__/FetchEntityVectorsResolver.test.ts

@@ -21,7 +21,7 @@ vi.mock('type-graphql', () => {
     return Object.fromEntries(exportNames.map((name) => [name, decoratorFactory]));
 });
 
-const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined }> = [];
+const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined; provider: unknown }> = [];
 /** Each RunViews call, as the list of entity names it batched. */
 const runViewsBatches: string[][] = [];
 let runViewHandler: RunViewHandler = () => ({ Success: true, Results: [] });
@@ -29,8 +29,12 @@ let runViewHandler: RunViewHandler = () => ({ Success: true, Results: [] });
 vi.mock('@memberjunction/core', async (importOriginal) => {
     const actual = await importOriginal<typeof import('@memberjunction/core')>();
     class MockRunView {
+        constructor(private readonly provider?: unknown) {}
+        static FromMetadataProvider(provider: unknown): MockRunView {
+            return new MockRunView(provider);
+        }
         async RunView(params: RunViewParams, contextUser?: UserInfo): Promise<ViewResult> {
-            runViewCalls.push({ params, contextUser });
+            runViewCalls.push({ params, contextUser, provider: this.provider });
             return runViewHandler(params, contextUser);
         }
         async RunViews(params: RunViewParams[], contextUser?: UserInfo): Promise<ViewResult[]> {
@@ -60,9 +64,13 @@ import type { AppContext } from '../types.js';
 const DOC_ID = 'DOC-1';
 const contextUser = new UserInfo();
 
+/** Entity read and field-level security the external-index path checks, per test. */
+const access = { canRead: true, deniedReadFields: new Set<string>() };
+
 const membersEntity = {
     Name: 'Members',
     PrimaryKeys: [{ Name: 'ID' }],
+    FirstPrimaryKey: { Name: 'ID' },
     Fields: [
         { Name: 'ID', IsNameField: false },
         { Name: 'FirstName', IsNameField: true },
@@ -70,11 +78,16 @@ const membersEntity = {
         { Name: 'Email', IsNameField: false },
     ],
     NameField: undefined,
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: (user: UserInfo) => (user === contextUser ? access.deniedReadFields : new Set<string>()),
 } as unknown as EntityInfo;
 
 const orderLinesEntity = {
     Name: 'Order Lines',
     PrimaryKeys: [{ Name: 'OrderID' }, { Name: 'LineNo' }],
+    FirstPrimaryKey: { Name: 'OrderID' },
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: () => new Set<string>(),
     Fields: [
         { Name: 'OrderID', IsNameField: false },
         { Name: 'LineNo', IsNameField: false },
@@ -143,6 +156,19 @@ function erdView(rows: Array<Record<string, string>>) {
     };
 }
 
+/**
+ * A fake `Members` view of the rows the caller may read (row-level security already applied):
+ * returns the requested `Fields` of the rows named by an `ID IN ('a','b')` filter.
+ */
+function readableMembersView(readableIDs: string[]) {
+    return (params: RunViewParams): ViewResult => {
+        const idList = /^ID IN \((.*)\)$/.exec(params.ExtraFilter ?? '');
+        const requested = idList ? idList[1].split(',').map((v) => v.trim().replace(/^'|'$/g, '')) : [];
+        const rows = requested.filter((id) => readableIDs.includes(id)).map((id) => ({ ID: id }));
+        return { Success: true, Results: rows.map((r) => Object.fromEntries((params.Fields ?? ['ID']).map((f) => [f, r[f as 'ID']]))) };
+    };
+}
+
 /** The VectorJSON fetches: Entity Record Documents views filtered by ID. */
 function vectorFetches() {
     return callsFor('MJ: Entity Record Documents').filter((c) => c.params.ExtraFilter?.startsWith('ID IN ('));
@@ -160,6 +186,8 @@ describe('FetchEntityVectorsResolver', () => {
     beforeEach(() => {
         runViewCalls.length = 0;
         runViewsBatches.length = 0;
+        access.canRead = true;
+        access.deniedReadFields = new Set<string>();
     });
 
     afterEach(() => {
@@ -202,6 +230,21 @@ describe('FetchEntityVectorsResolver', () => {
             expect(vectorCall.params.IgnoreMaxRows).toBe(true);
         });
 
+        it("REGRESSION: runs every view on the request's provider", async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('MJ: Entity Record Documents')).toHaveLength(2);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
         it('bypasses the server RunView cache for both Entity Record Documents views, so Fields is honoured', async () => {
             useVectorDB(true);
             routeViews('Members', {
@@ -413,7 +456,7 @@ describe('FetchEntityVectorsResolver', () => {
     describe('index-keyed providers (Pinecone path, unchanged)', () => {
         it('queries the provider index by name and never reads Entity Record Documents', async () => {
             const { queryIndex } = useVectorDB(false);
-            routeViews('Members', {});
+            routeViews('Members', { Members: readableMembersView(['a']) });
 
             const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
 
@@ -427,7 +470,167 @@ describe('FetchEntityVectorsResolver', () => {
             expect(query.vector).toHaveLength(2);
             expect(result.Results).toEqual([{ ID: 'pc-1', Values: [0.5, 0.5], Metadata: JSON.stringify({ Entity: 'Members', RecordID: 'a' }) }]);
             expect(callsFor('MJ: Entity Record Documents')).toHaveLength(0);
+        });
+
+        it('removes metadata keys naming fields the caller may not read', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata: { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' } }] },
+            });
+            access.deniedReadFields = new Set(['email']);
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual({ Entity: 'Members', RecordID: 'a', FirstName: 'Ada' });
+        });
+
+        it('keeps every metadata key for a caller denied nothing', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const metadata = { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' };
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata }] } });
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual(metadata);
+        });
+
+        it('refuses, without querying the index, a caller who may not read the source entity', async () => {
+            const { queryIndex } = useVectorDB(false);
+            access.canRead = false;
+            routeViews('Members', {});
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.ErrorMessage).toBe('Entity "Members" does not exist or you do not have permission to read it');
+            expect(queryIndex).not.toHaveBeenCalled();
+        });
+    });
+
+    describe('index-keyed providers: rows the caller cannot read', () => {
+        function matchesFor(recordIDs: Array<string | undefined>) {
+            return recordIDs.map((recordID, i) => ({
+                id: `pc-${i}`,
+                values: [i, i],
+                score: 1 - i / 10,
+                metadata: recordID === undefined ? { Entity: 'Members' } : { Entity: 'Members', RecordID: recordID },
+            }));
+        }
+
+        it('drops matches whose record the caller cannot read, keeping the order of the rest', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'ID|bbb', 'ID|ccc']) } });
+            routeViews('Members', { Members: readableMembersView(['ccc', 'aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-2']);
+            expect(result.Results.map((r) => r.Values)).toEqual([[0, 0], [2, 2]]);
+            expect(result.TotalCount).toBe(2);
+        });
+
+        it("REGRESSION: runs every view, the key check included, on the request's provider", async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('Members')).toHaveLength(1);
+            expect(runViewCalls.length).toBeGreaterThan(1);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
+        it('checks the matched keys with a simple view of the primary key, as the caller', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'bbb']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa', 'bbb']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-1']);
+            const [check] = callsFor('Members');
+            expect(check.contextUser).toBe(contextUser);
+            expect(check.params.ExtraFilter).toBe("ID IN ('aaa','bbb')");
+            expect(check.params.Fields).toEqual(['ID']);
+            expect(check.params.ResultType).toBe('simple');
+            expect(check.params.IgnoreMaxRows).toBe(true);
+        });
+
+        it('drops a match with no record ID, or one naming a field that is not the primary key, without querying for it', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined, "Salary|1' OR 1=1 --", 'ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-2']);
+            expect(callsFor('Members').map((c) => c.params.ExtraFilter)).toEqual(["ID IN ('aaa')"]);
+        });
+
+        it('returns no matches and runs no check when none carries a usable record ID', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined]) } });
+            routeViews('Members', { Members: readableMembersView([]) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results).toEqual([]);
             expect(callsFor('Members')).toHaveLength(0);
         });
+
+        it('checks composite keys with one clause per record, using the real key columns', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [
+                    { id: 'pc-a', values: [1], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-1||LineNo|2' } },
+                    { id: 'pc-b', values: [2], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-2||LineNo|1' } },
+                ] },
+            });
+            routeViews('Order Lines', {
+                'Order Lines': () => ({ Success: true, Results: [{ OrderID: 'o-2', LineNo: 1 }] }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(orderLinesEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-b']);
+            const [check] = callsFor('Order Lines');
+            expect(check.params.ExtraFilter).toBe("(OrderID='o-1' AND LineNo='2') OR (OrderID='o-2' AND LineNo='1')");
+            expect(check.params.Fields).toEqual(['OrderID', 'LineNo']);
+        });
+
+        it('splits a large key check into lists of at most 1000, sent in one RunViews batch', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const ids = Array.from({ length: 1500 }, (_, i) => `id-${i}`);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(ids.map((id) => `ID|${id}`)) } });
+            routeViews('Members', { Members: readableMembersView(ids) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 1500, undefined, appContext(membersEntity));
+
+            expect(result.TotalCount).toBe(1500);
+            expect(callsFor('Members').map((c) => (c.params.ExtraFilter ?? '').split(',').length)).toEqual([1000, 500]);
+            expect(runViewsBatches).toEqual([['Members', 'Members']]);
+        });
+
+        it('returns an error result when the key check fails', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: () => ({ Success: false, Results: [], ErrorMessage: 'timeout' }) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+        });
     });
 });

package/src/__tests__/FileResolver.fieldSecurity.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Field-level security on FileResolver's own create path and responses.
+ *
+ * `CreateFile` applies its input with `NewRecord` rather than through the generated create
+ * resolver, so it gates the input itself: a restricted caller's key for a field it may not read,
+ * or a key that names no field, is refused with the same message, before any storage work. The
+ * `File` it returns (and `UploadStorageFile`'s) is the record just saved or reloaded, which is
+ * projected for the caller. The file entity here stands in with the fixture's restricted fields.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ createUploadUrl: vi.fn() }));
+
+vi.mock('@memberjunction/server', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Arg: noopDecorator, Ctx: noopDecorator, Field: noopDecorator, FieldResolver: noopDecorator, InputType: noopDecorator,
+        Mutation: noopDecorator, ObjectType: noopDecorator, PubSub: noopDecorator, Query: noopDecorator, Resolver: noopDecorator,
+        Root: noopDecorator, Int: {}, Float: {}, DeleteOptionsInput: class {},
+    };
+});
+vi.mock('../generated/generated.js', () => ({
+    CreateMJFileInput: class {},
+    UpdateMJFileInput: class {},
+    MJFile_: class {},
+    MJFileResolver: class {
+        protected GetUserFromPayload(userPayload: { userRecord?: object } | undefined) {
+            return userPayload?.userRecord;
+        }
+    },
+}));
+vi.mock('@memberjunction/ai-agents', () => ({ readRealtimeRecordingFile: vi.fn() }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFields(o: object) { return o; } } }));
+vi.mock('../config.js', () => ({ configInfo: {} }));
+vi.mock('../rest/MediaAccessKeys.js', () => ({ MediaAccessKeyManager: { Instance: {} } }));
+vi.mock('../rest/UploadTokenManager.js', () => ({ UploadTokenManager: { Instance: { Consume: vi.fn() } } }));
+vi.mock('@memberjunction/storage', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/storage')>('@memberjunction/storage');
+    return { ...actual, createUploadUrl: mocks.createUploadUrl };
+});
+
+import type { PubSubEngine } from '@memberjunction/server';
+import { FileResolver } from '../resolvers/FileResolver.js';
+import type { AppContext } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+function fileEntity() {
+    return { EntityInfo: EmployeeEntity(), CheckPermissions: vi.fn(), NewRecord: vi.fn(() => true), GetAll: () => FullWidthEmployeeRow() };
+}
+
+function contextFor(entity: ReturnType<typeof fileEntity>): AppContext {
+    const provider = { GetEntityObject: vi.fn(async () => entity), RunView: vi.fn(), RunViews: vi.fn() };
+    return { providers: [{ provider, type: 'Read-Write' }], userPayload: { userRecord: Intern() } } as unknown as AppContext;
+}
+
+describe('FileResolver.CreateFile: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before any storage work', async (_label, key) => {
+        const entity = fileEntity();
+        const input = { Name: 'new.pdf', [key]: 1 }; // keys of the stand-in entity
+        await expect(new FileResolver().CreateFile(input as never, contextFor(entity), {} as PubSubEngine))
+            .rejects.toThrow(RefusalFor(key));
+        expect(entity.NewRecord).not.toHaveBeenCalled();
+        expect(mocks.createUploadUrl).not.toHaveBeenCalled();
+    });
+});
+
+describe('FileResolver responses are projected for the caller', () => {
+    it('REGRESSION: the File returned never carries a denied value of a full-width record', () => {
+        const respond = (FileResolver.prototype as unknown as {
+            fileResponse(entity: ReturnType<typeof fileEntity>, user: unknown, provider: unknown): Record<string, unknown>;
+        }).fileResponse;
+
+        const file = respond.call(new FileResolver(), fileEntity(), Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(file)).not.toContain(String(SECRET_SALARY));
+        expect(file).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});

package/src/__tests__/PipelineProgressResolver.filter.test.ts

@@ -0,0 +1,58 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator,
+        Mutation: noopDecorator,
+        Query: noopDecorator,
+        Subscription: noopDecorator,
+        ObjectType: noopDecorator,
+        InputType: noopDecorator,
+        Field: noopDecorator,
+        Arg: noopDecorator,
+        Args: noopDecorator,
+        Ctx: noopDecorator,
+        PubSub: noopDecorator,
+        Root: noopDecorator,
+        Float: class {},
+        Int: class {},
+        ID: class {},
+    };
+});
+
+import { PipelineProgressFilter, type PipelineProgressNotification } from '../resolvers/PipelineProgressResolver';
+
+const RUN_ID = 'AA11BB22-0000-4000-8000-000000000001';
+const OTHER_RUN_ID = 'CC33DD44-0000-4000-8000-000000000002';
+
+function makePayload(pipelineRunID: string): PipelineProgressNotification {
+    return {
+        PipelineRunID: pipelineRunID,
+        Stage: 'extract',
+        TotalItems: 100,
+        ProcessedItems: 25,
+        ElapsedMs: 500,
+        PercentComplete: 25,
+    };
+}
+
+describe('PipelineProgressFilter', () => {
+    it('delivers when PipelineRunID matches exactly', () => {
+        expect(PipelineProgressFilter({ payload: makePayload(RUN_ID), args: { pipelineRunID: RUN_ID } })).toBe(true);
+    });
+
+    it('delivers when PipelineRunID differs only in UUID casing (SQL Server uppercase vs client lowercase)', () => {
+        expect(
+            PipelineProgressFilter({
+                payload: makePayload(RUN_ID.toUpperCase()),
+                args: { pipelineRunID: RUN_ID.toLowerCase() },
+            })
+        ).toBe(true);
+    });
+
+    it('rejects notifications for a different pipeline run', () => {
+        expect(PipelineProgressFilter({ payload: makePayload(OTHER_RUN_ID), args: { pipelineRunID: RUN_ID } })).toBe(false);
+    });
+});

package/src/__tests__/QuerySystemUserResolver.fieldSecurity.test.ts

@@ -0,0 +1,49 @@
+/**
+ * The saved query that `CreateQueryExtended` / `UpdateQueryExtended` return is mapped for the
+ * CALLER. These mutations are reachable with the `query:create` / `query:update` API-key scopes,
+ * not only by the system user, and the record they return is the one just saved, whose re-read
+ * holds every column. Mapping it with no context user skipped the field-security projection
+ * altogether, so the caller received columns its roles may not read.
+ *
+ * The base resolver is stubbed with the real projection (`ProjectValuesForCaller`) standing in
+ * for its field mapping, so what is pinned is the identity the result is mapped for.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = ['Arg', 'Ctx', 'Field', 'InputType', 'Mutation', 'ObjectType', 'Resolver', 'PubSub', 'Int', 'Float'];
+    return { ...Object.fromEntries(exportNames.map((name) => [name, decoratorFactory])), registerEnumType: () => undefined };
+});
+vi.mock('@memberjunction/core-entities-server', () => ({ MJQueryEntityServer: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../generated/generated.js', async () => {
+    const { ProjectValuesForCaller } = await import('../generic/fieldSecurityTransport.js');
+    const { EmployeeEntity, NoRecordChangesMetadata } = await import('./fieldSecurityFixtures.js');
+    return {
+        MJQuery_: class {}, MJQueryField_: class {}, MJQueryParameter_: class {}, MJQueryEntity_: class {}, MJQueryPermission_: class {},
+        MJQueryResolver: class {
+            protected async MapFieldNamesToCodeNames(_entityName: string, values: Record<string, unknown>, contextUser?: unknown) {
+                return ProjectValuesForCaller(EmployeeEntity(), values, contextUser as never, NoRecordChangesMetadata);
+            }
+        },
+    };
+});
+
+import { MJQueryResolverExtended } from '../resolvers/QuerySystemUserResolver.js';
+import { FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+describe('QuerySystemUserResolver: the saved query is mapped for the caller', () => {
+    it('REGRESSION: buildSuccessResult never returns a column the caller may not read', async () => {
+        const build = (MJQueryResolverExtended.prototype as unknown as {
+            buildSuccessResult(entity: unknown, user: unknown, provider: unknown): Promise<{ Query: Record<string, unknown> }>;
+        }).buildSuccessResult;
+        const entity = { GetAll: () => FullWidthEmployeeRow(), QueryFields: [], QueryParameters: [], QueryEntities: [], QueryPermissions: [] };
+
+        const result = await build.call(new MJQueryResolverExtended(), entity, Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(result.Query)).not.toContain(String(SECRET_SALARY));
+        expect(result.Query).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});

package/src/__tests__/RESTEndpointHandler.test.ts

@@ -110,6 +110,7 @@ interface ReqShape {
     query?: Record<string, string>;
     body?: unknown;
     mjUser?: UserInfo;
+    timeZone?: string;
 }
 
 function makeReq(shape: ReqShape = {}): express.Request {
@@ -118,6 +119,7 @@ function makeReq(shape: ReqShape = {}): express.Request {
         query: shape.query ?? {},
         body: shape.body ?? {},
         mjUser: shape.mjUser ?? MJ_USER,
+        userPayload: { TimeZone: shape.timeZone },
     } as unknown as express.Request;
 }
 
@@ -540,6 +542,17 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual({ Success: true, Results: [{ ID: '1' }] });
         });
 
+        it('drops fields only server code may set, takes the time zone from the header, and keeps the route\'s entity over the body\'s', async () => {
+            mockOpsRunView.mockResolvedValue({ success: true, result: { Success: true, Results: [] } });
+            const handler = makeHandler();
+            const req = makeReq({ params: { entityName: 'Users' }, body: { EntityName: 'Secrets', TimeZone: 'Asia/Tokyo', MaxRows: 5 }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runView(req, res);
+
+            expect(mockOpsRunView).toHaveBeenCalledWith({ EntityName: 'Users', MaxRows: 5, TimeZone: 'Europe/Paris' }, MJ_USER);
+        });
+
         it('maps view-layer failures to 400', async () => {
             mockOpsRunView.mockResolvedValue({ success: false, error: 'does not have permission' });
             const handler = makeHandler();
@@ -591,6 +604,18 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual([{ Success: true, Results: [] }]);
         });
 
+        it('drops fields only server code may set from every batched view', async () => {
+            mockOpsRunViews.mockResolvedValue({ success: true, results: [{ Success: true, Results: [] }] });
+            const handler = makeHandler();
+            const req = makeReq({ body: { params: [{ EntityName: 'Users', TimeZone: 'Asia/Tokyo' }] }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runViews(req, res);
+
+            const [sent] = mockOpsRunViews.mock.calls[0] as [RunViewParams[], UserInfo];
+            expect(sent).toEqual([{ EntityName: 'Users', TimeZone: 'Europe/Paris' }]);
+        });
+
         it('maps view-layer batch failures to 400', async () => {
             mockOpsRunViews.mockResolvedValue({ success: false, error: 'batch failed' });
             const handler = makeHandler();

package/src/__tests__/RealtimeClientSessionResolver.configTamper.test.ts

@@ -122,7 +122,14 @@ function makeSession(config: Record<string, unknown>, overrides: Partial<FakeEnt
 }
 
 function makeDetail(): FakeEntity {
-    return { ID: 'c3c3c3c3-0000-4000-8000-0000000000d1', Save: vi.fn(async () => true), Load: vi.fn(async () => true), NewRecord: vi.fn() };
+    return {
+        ID: 'c3c3c3c3-0000-4000-8000-0000000000d1',
+        ExternalID: 'c3-shared-resource',
+        Save: vi.fn(async () => true),
+        Load: vi.fn(async () => true),
+        NewRecord: vi.fn(),
+        MarkServerAuthoredReply: vi.fn(),
+    };
 }
 
 /** A provider serving the session plus view rows per entity name; `runView` records every view run. */
@@ -167,9 +174,22 @@ function relayTool(resolver: RealtimeClientSessionResolver, toolName: string, ar
 }
 
 /** A scoped anonymous magic-link caller: the relay runs its work as the system user. */
-const SCOPED_ANONYMOUS = { ID: USER_ID, Email: 'guest@magic-link.local', IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'c3-scope' } };
+const SCOPED_ANONYMOUS = {
+    ID: USER_ID,
+    Email: 'guest@magic-link.local',
+    IsMagicLinkAnonymous: true,
+    AnonymousVisitorID: 'c3-redemption-sid',
+    // The session's conversation is stamped with the caller's resource scope (ResolveSessionScopeIdentity).
+    MagicLinkScope: { ResourceID: 'c3-shared-resource' },
+};
 /** A public web-widget guest: anonymous, but not elevated. */
-const WIDGET_GUEST = { ID: USER_ID, Email: 'guest@widget.local', IsMagicLinkAnonymous: true, WidgetGuestContext: { WidgetID: 'c3c3c3c3-0000-4000-8000-0000000000b1' } };
+const WIDGET_GUEST = {
+    ID: USER_ID,
+    Email: 'guest@widget.local',
+    IsMagicLinkAnonymous: true,
+    AnonymousVisitorID: 'c3-shared-resource',
+    WidgetGuestContext: { WidgetID: 'c3c3c3c3-0000-4000-8000-0000000000b1' },
+};
 /** A resource-scoped magic-link session: a normal role pinned to one shared resource. */
 const RESOURCE_SCOPED = { ID: USER_ID, Email: 'invitee@example.com', MagicLinkScope: { ResourceID: 'c3-shared-resource' } };
 const SYSTEM_USER = { ID: 'c3c3c3c3-0000-4000-8000-0000000000aa', Email: 'system@example.com' } as UserInfo;