@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/__tests__/TaskGraphContinuationDeliverer.test.ts

@@ -26,15 +26,18 @@ vi.mock('@memberjunction/core', () => ({
     },
 }));
 
+const { OWNER, SUBMITTER } = vi.hoisted(() => ({ OWNER: { ID: 'owner-1' }, SUBMITTER: { ID: 'submitter-1' } }));
 vi.mock('@memberjunction/generic-database-provider', () => ({
     UserCache: {
-        Instance: { Users: [{ ID: 'owner-user-99', Email: 'owner@example.com' }] },
-        Users: [{ ID: 'owner-user-99', Email: 'owner@example.com' }],
+        Instance: { Users: [OWNER, SUBMITTER, { ID: 'owner-user-99', Email: 'owner@example.com' }] },
+        Users: [OWNER, SUBMITTER, { ID: 'owner-user-99', Email: 'owner@example.com' }],
     },
 }));
 
 vi.mock('@memberjunction/core-entities', () => ({
     MJConversationDetailEntity: class {},
+    MJConversationDetailEntityExtended: class {},
+    MJConversationEntity: class {},
     MJAIAgentRunEntity: class {},
 }));
 
@@ -56,15 +59,19 @@ import type { PubSubEngine } from 'type-graphql';
 /** A conversation-detail row that can be loaded (the source) and saved (the reply). */
 function detailRow(over: Partial<{ loads: boolean; saves: boolean; conversationID: string; branchID: string | null }> = {}) {
     const { loads = true, saves = true, conversationID = 'conv-1', branchID = null } = over;
+    let marked = false;
     return {
         ID: 'reply-detail-1',
         ConversationID: conversationID,
         BranchID: branchID as string | null,
+        UserID: 'owner-1',
         Role: '', Status: '', HiddenToUser: true, Message: '',
         AgentID: null as string | null,
         NewRecord: vi.fn(),
+        MarkServerAuthoredReply: vi.fn(() => { marked = true; }),
         Load: vi.fn().mockResolvedValue(loads),
-        Save: vi.fn().mockResolvedValue(saves),
+        // Like MJConversationDetailEntityExtended, refuses to save an unmarked AI reply.
+        Save: vi.fn().mockImplementation(async () => saves && marked),
         LatestResult: { CompleteMessage: 'FK violation' },
     };
 }
@@ -88,6 +95,8 @@ function harness(over: Parameters<typeof detailRow>[0] = {}) {
         { ID: 'user-1' } as UserInfo,
         pubSub,
     );
+    // Rows in order: the source detail (Load), the reply (Save). The reply starts on a 'stale' fork, so a test sees
+    // the deliverer set it.
     return { deliverer, providerFactory, provider, rows, pubSub, reply: () => rows[1] };
 }
 
@@ -96,6 +105,7 @@ const params = (over: Partial<TaskContinuationParams> = {}): TaskContinuationPar
     WorkflowName: 'Weekly digest',
     ConversationDetailID: 'detail-1',
     SubmittedByAgentRunID: 'run-1',
+    SubmittedByUserID: 'submitter-1',
     ReinvokeDepth: 0,
     Tasks: [
         { TaskID: 't1', Name: 'Gather', Status: 'Complete', Summary: '412 rows' },
@@ -132,6 +142,51 @@ describe('posting the outcome', () => {
         expect(h.pubSub.publish).toHaveBeenCalledTimes(2);
     });
 
+    it("writes it as the graph's submitter, not the conversation's owner, marked as the server's reply", async () => {
+        // TaskGraph.Submit takes any conversation detail ID. Written as the owner, the gate would pass for a
+        // conversation the submitter cannot reach; written as the submitter, the gate checks their access.
+        const h = harness();
+        await h.deliverer.PostMessage(params());
+
+        expect(h.provider.GetEntityObject.mock.calls[0]).toEqual(['MJ: Conversation Details', SUBMITTER]);
+        expect(h.provider.GetEntityObject.mock.calls[1]).toEqual(['MJ: Conversation Details', SUBMITTER]);
+        expect(h.provider.GetEntityObject.mock.calls.some((call) => call[1] === OWNER)).toBe(false);
+        expect(h.rows[0].MarkServerAuthoredReply).toHaveBeenCalledOnce();
+        expect(h.reply().MarkServerAuthoredReply).toHaveBeenCalledOnce();
+    });
+
+    it("updates the originating message in-place as the graph's submitter, marked as the server's reply, when IsLatest is true", async () => {
+        const { RunView } = await import('@memberjunction/core');
+        vi.mocked(RunView.FromMetadataProvider).mockReturnValue({
+            RunView: vi.fn().mockImplementation(async (rvParams: { EntityName: string }) => {
+                if (rvParams.EntityName === 'MJ: Conversation Details') {
+                    return { Success: true, Results: [{ ID: 'detail-1' }] };
+                }
+                return { Success: false, Results: [] };
+            }),
+        } as never);
+
+        const h = harness();
+        await h.deliverer.PostMessage(params());
+
+        expect(h.rows.length).toBe(1);
+        expect(h.provider.GetEntityObject.mock.calls[0]).toEqual(['MJ: Conversation Details', SUBMITTER]);
+        expect(h.rows[0].MarkServerAuthoredReply).toHaveBeenCalledOnce();
+        expect(h.rows[0].Save).toHaveBeenCalledOnce();
+        expect(h.rows[0].Status).toBe('Complete');
+        expect(h.rows[0].Message).toContain('Weekly digest');
+        expect(h.pubSub.publish).toHaveBeenCalledTimes(1);
+    });
+
+    it("falls back to the deliverer's own user when the graph records no submitter it knows", async () => {
+        for (const submitter of [null, 'stranger-1']) {
+            const h = harness();
+            await h.deliverer.PostMessage(params({ SubmittedByUserID: submitter }));
+            expect(h.provider.GetEntityObject.mock.calls[0]).toEqual(['MJ: Conversation Details', { ID: 'user-1' }]);
+            expect(h.provider.GetEntityObject.mock.calls[1]).toEqual(['MJ: Conversation Details', { ID: 'user-1' }]);
+        }
+    });
+
     it('names the workflow and carries the roll-up', async () => {
         const h = harness();
         await h.deliverer.PostMessage(params());
@@ -409,6 +464,8 @@ describe('Reinvoke — on the fork of the message that started the graph', () =>
         // Only the originating detail was loaded and updated in-place — no second detail row created!
         expect(createdDetails.length).toBe(1);
         expect(originDetail.NewRecord).not.toHaveBeenCalled();
+        expect(originDetail.MarkServerAuthoredReply).toHaveBeenCalledOnce();
+        expect(originDetail.Save).toHaveBeenCalledOnce();
         expect(originDetail.Message).toBe('Synthesized workflow outcome');
         expect(originDetail.Status).toBe('Complete');
         expect(runAgent.mock.calls[0][0].conversationDetailId).toBe('detail-1');
@@ -460,8 +517,11 @@ describe('Reinvoke — on the fork of the message that started the graph', () =>
         await deliverer.Reinvoke(params());
 
         expect(replyDetail.NewRecord).toHaveBeenCalledTimes(1);
+        expect(replyDetail.MarkServerAuthoredReply).toHaveBeenCalledOnce();
         expect(replyDetail.ParentID).toBe('detail-1');
         expect(replyDetail.Message).toBe('Synthesized workflow outcome');
+        expect(originDetail.MarkServerAuthoredReply).toHaveBeenCalledOnce();
+        expect(originDetail.Save).toHaveBeenCalledOnce();
         expect(originDetail.Message).toContain('*(✅ **Weekly digest** completed — synthesized results posted below.)*');
         expect(originDetail.Message).not.toContain("I'll follow up when it finishes");
         expect(pubSub.publish).toHaveBeenCalledTimes(2);
@@ -625,6 +685,57 @@ describe('Reinvoke — on the fork of the message that started the graph', () =>
         expect(sentContent).toContain('- ⏭️ **Analyze Results** — Skipped: branch condition `output.rowCount > 0` on "Run Query" evaluated to false');
         expect(sentContent).toContain('briefly explaining any conditional steps that were skipped');
     });
+
+    it('logs an error and does not publish completion when an in-place (IsLatest = true) PostMessage save fails', async () => {
+        const { LogError, RunView } = await import('@memberjunction/core');
+        vi.mocked(RunView.FromMetadataProvider).mockReturnValue({
+            RunView: vi.fn().mockResolvedValue({
+                Success: true,
+                Results: [{ ID: 'detail-1' }],
+            }),
+        } as never);
+
+        const h = harness({ saves: false });
+        await h.deliverer.PostMessage(params());
+
+        expect(h.rows[0].Save).toHaveBeenCalledOnce();
+        expect(LogError).toHaveBeenCalledWith(expect.stringContaining('Could not update in-place outcome of "Weekly digest"'));
+        expect(h.pubSub.publish).not.toHaveBeenCalled();
+    });
+
+    it('loads the originating detail as SubmittedByUserID in Reinvoke when both run UserIDs are null', async () => {
+        const runRow = {
+            ID: 'run-1',
+            AgentID: 'agent-1',
+            ParentRunID: null as string | null,
+            UserID: null as string | null,
+            Load: vi.fn().mockResolvedValue(true),
+        };
+        const agentRow = {
+            ID: 'agent-1',
+            Name: 'Sage',
+            Load: vi.fn().mockResolvedValue(true),
+        };
+        const detail = detailRow();
+        const detailUsers: Array<UserInfo | undefined> = [];
+        const provider = {
+            GetEntityObject: vi.fn().mockImplementation(async (name: string, user?: UserInfo) => {
+                if (name === 'MJ: AI Agent Runs') return runRow;
+                if (name === 'MJ: AI Agents') return agentRow;
+                detailUsers.push(user);
+                return detail;
+            }),
+        };
+        const deliverer = new TaskGraphContinuationDeliverer(
+            { CreateProvider: vi.fn().mockResolvedValue(provider) } as never,
+            { ID: 'system-user' } as UserInfo,
+        );
+
+        await deliverer.Reinvoke(params({ SubmittedByUserID: SUBMITTER.ID }));
+
+        expect(detailUsers[0]).toBe(SUBMITTER);
+        expect(runAgent.mock.calls[0][0].contextUser).toBe(SUBMITTER);
+    });
 });
 
 

package/src/__tests__/TransactionGroupResolver.fieldSecurity.test.ts

@@ -0,0 +1,199 @@
+/**
+ * Field-level security on the transaction-group transport.
+ *
+ * Output: every `ResultsJSON` entry is projected for the caller. The update entry is a DELTA,
+ * computed by comparing the post-save row with a pre-save snapshot. When the snapshot came from a
+ * load narrowed for the caller and the post-save row is full width, every non-null denied value
+ * differs from its (absent) snapshot and counts as "changed", so the delta itself carried the
+ * values the caller may not read. The entity objects here deliberately return full-width rows
+ * to stand in for any object not narrowed at its source.
+ *
+ * Input: a restricted caller's item payload, and the field a transaction variable names, are
+ * refused when they carry a key the caller may not read or a key that names no field, with the
+ * same message for both, so the refusal does not reveal which columns exist.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import { BaseEntityResult, EntityInfo, UserInfo } from '@memberjunction/core';
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return { ...actual, LogError: () => undefined };
+});
+
+import {
+    TransactionResolver,
+    TransactionInputType,
+    TransactionOperationType,
+    TransactionVariableType,
+} from '../resolvers/TransactionGroupResolver.js';
+import type { AppContext } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, HRUser, Intern, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+class FakeTransactionGroup {
+    public Enrolled = 0;
+    public AddTransaction(): void { this.Enrolled++; }
+    public AddVariable(): void { /* variables are not under test here */ }
+    public async Submit(): Promise<boolean> { return true; }
+}
+
+/**
+ * An entity object that is NOT narrowed at its source: its load returns `loaded`, and after the
+ * save it reports the full-width row, as a save's re-read does.
+ */
+class FullWidthEntity {
+    public TransactionGroup: FakeTransactionGroup | null = null;
+    public LatestResult: BaseEntityResult | null = null;
+    public PrimaryKeys = [{ Name: 'ID' }];
+    public SetManyCalls: Array<Record<string, unknown>> = [];
+    private values: Record<string, unknown>;
+    private saved = false;
+
+    constructor(public readonly EntityInfo: EntityInfo, private readonly loaded: Record<string, unknown>) {
+        this.values = { ...loaded };
+    }
+    public SetMany(values: Record<string, unknown>): void {
+        this.SetManyCalls.push(values);
+        this.values = { ...this.values, ...values };
+    }
+    public async InnerLoad(): Promise<boolean> { this.values = { ...this.loaded }; return true; }
+    public async GetDataObject(): Promise<Record<string, unknown>> {
+        return this.saved ? { ...FullWidthEmployeeRow(), ...this.values, Salary: SECRET_SALARY } : { ...this.values };
+    }
+    public async GetDataObjectJSON(): Promise<string> { return JSON.stringify(await this.GetDataObject()); }
+    public async Save(): Promise<boolean> { return this.write(); }
+    public async Delete(): Promise<boolean> { return this.write(); }
+    private write(): boolean {
+        this.TransactionGroup?.AddTransaction();
+        this.saved = true;
+        const result = new BaseEntityResult();
+        result.Success = true;
+        this.LatestResult = result;
+        return true;
+    }
+}
+
+/** What a load narrowed for an intern holds: no salary keys at all. */
+const NARROW_ROW = { ID: 'emp-1', Name: 'Ada', Notes: 'n' };
+
+function buildContext(entities: FullWidthEntity[], user: UserInfo): AppContext {
+    let next = 0;
+    const provider = {
+        CreateTransactionGroup: async () => new FakeTransactionGroup(),
+        GetEntityObject: async () => entities[next++],
+        Entities: [] as EntityInfo[],
+        EntityByID: () => undefined,
+    };
+    return {
+        providers: [{ type: 'Read-Write', provider }],
+        userPayload: { userRecord: user, email: user.Email },
+    } as unknown as AppContext;
+}
+
+function group(operation: TransactionOperationType, payload: Record<string, unknown>): TransactionInputType {
+    return { Items: [{ EntityName: 'Employees', EntityObjectJSON: JSON.stringify(payload), OperationType: operation }], Variables: [] };
+}
+
+describe('ExecuteTransactionGroup: output is projected for the caller', () => {
+    it('REGRESSION: the update delta never carries a denied value, though the post-save row is full width', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.Success).toBe(true);
+        const delta = JSON.parse(result.ResultsJSON[0]);
+        expect(delta).toMatchObject({ ID: 'emp-1', Notes: 'edited' });
+        expect(delta).not.toHaveProperty('Salary');
+        expect(delta).not.toHaveProperty('Base Salary');
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('REGRESSION: the create result never carries a denied value', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), {});
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Create, { ID: 'emp-1', Name: 'Ada' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+        expect(JSON.parse(result.ResultsJSON[0])).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('REGRESSION: the delete result never carries a denied value', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), FullWidthEmployeeRow());
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Delete, { ID: 'emp-1' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.ResultsJSON[0]).not.toContain(String(SECRET_SALARY));
+        expect(JSON.parse(result.ResultsJSON[0])).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('a caller who may read the salary still gets it back', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), {});
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Create, { ID: 'emp-1', Name: 'Ada', Salary: 1 }),
+            buildContext([entity], HRUser())
+        );
+
+        expect(JSON.parse(result.ResultsJSON[0]).Salary).toBe(SECRET_SALARY);
+    });
+});
+
+describe('ExecuteTransactionGroup: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before anything is applied', async (_label, key) => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const run = new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited', [key]: 1 }),
+            buildContext([entity], Intern())
+        );
+
+        await expect(run).rejects.toThrow(RefusalFor(key));
+        expect(entity.SetManyCalls).toHaveLength(0);
+    });
+
+    it('REGRESSION: refuses a transaction variable that names a denied field (it would copy the value elsewhere)', async () => {
+        const source = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const target = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const input: TransactionInputType = {
+            Items: [
+                { EntityName: 'Employees', EntityObjectJSON: JSON.stringify({ ID: 'emp-1', Notes: 'a' }), OperationType: TransactionOperationType.Update },
+                { EntityName: 'Employees', EntityObjectJSON: JSON.stringify({ ID: 'emp-2', Notes: 'b' }), OperationType: TransactionOperationType.Update },
+            ],
+            Variables: [
+                { Name: 'leak', ItemIndex: 0, FieldName: 'Salary', Type: TransactionVariableType.Define },
+                { Name: 'leak', ItemIndex: 1, FieldName: 'Notes', Type: TransactionVariableType.Use },
+            ],
+        };
+
+        await expect(new TransactionResolver().ExecuteTransactionGroup(input, buildContext([source, target], Intern())))
+            .rejects.toThrow(RefusalFor('Salary'));
+    });
+
+    it('accepts the keys a well-behaved client sends, plus transport keys', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), NARROW_ROW);
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Notes: 'edited', __typename: 'Employee_' }),
+            buildContext([entity], Intern())
+        );
+
+        expect(result.Success).toBe(true);
+        expect(entity.SetManyCalls).toHaveLength(1);
+    });
+
+    it('does not gate a caller who is denied nothing', async () => {
+        const entity = new FullWidthEntity(EmployeeEntity(), FullWidthEmployeeRow());
+        const result = await new TransactionResolver().ExecuteTransactionGroup(
+            group(TransactionOperationType.Update, { ID: 'emp-1', Salary: 5 }),
+            buildContext([entity], HRUser())
+        );
+
+        expect(result.Success).toBe(true);
+    });
+});

package/src/__tests__/UserViewResolver.updateWhereClause.test.ts

@@ -35,6 +35,7 @@ vi.mock('../resolvers/UserResolver.js', () => ({ UserResolver: class {} }));
 
 import { UserViewResolver } from '../resolvers/UserViewResolver.js';
 import type { AppContext, ProviderInfo, UserPayload } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, SECRET_SALARY } from './fieldSecurityFixtures.js';
 
 const VIEW_ID = '0F8FAD5B-D9CB-469F-A165-70867728950E';
 const USER = { ID: 'user-1', Email: 'dev@example.com' } as unknown as UserInfo;
@@ -111,4 +112,18 @@ describe('UserViewResolver.UpdateWhereClause', () => {
         const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
         await expect(new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx)).rejects.toThrow(/Failed to update where clause/);
     });
+
+    it('REGRESSION: returns the saved view projected for the caller, never a denied value', async () => {
+        const { view } = makeView({ loadOk: true });
+        const fullWidth = view as FakeView & { EntityInfo?: unknown };
+        fullWidth.EntityInfo = EmployeeEntity();
+        fullWidth.GetAll = vi.fn(() => FullWidthEmployeeRow());
+        const ctx = makeContext([{ provider: makeProvider(view), type: 'Read-Write' }]);
+        (ctx.userPayload as { userRecord: unknown }).userRecord = Intern();
+
+        const result = await new UserViewResolver().UpdateWhereClause(VIEW_ID, ctx);
+
+        expect(JSON.stringify(result)).not.toContain(String(SECRET_SALARY));
+        expect(result).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
 });

package/src/__tests__/ViewOperationsHandler.test.ts

@@ -107,14 +107,19 @@ describe('ViewOperationsHandler.runView', () => {
     });
 
     describe('parameter sanitization', () => {
-        it('defaults ResultType to "simple" when unset and preserves an explicit one', async () => {
+        it('defaults ResultType to "simple" when unset, forces "simple" over "entity_object", and keeps "count_only"', async () => {
             const defaulted: RunViewParams = { EntityName: 'Customers' };
             await ViewOperationsHandler.runView(defaulted, makeUser());
             expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ResultType).toBe('simple');
 
+            // Entity objects cannot cross the wire: serializing one sends its internal state, not its fields.
             const explicit: RunViewParams = { EntityName: 'Customers', ResultType: 'entity_object' };
             await ViewOperationsHandler.runView(explicit, makeUser());
-            expect((mockRunViewFn.mock.calls[1][0] as RunViewParams).ResultType).toBe('entity_object');
+            expect((mockRunViewFn.mock.calls[1][0] as RunViewParams).ResultType).toBe('simple');
+
+            const countOnly: RunViewParams = { EntityName: 'Customers', ResultType: 'count_only' };
+            await ViewOperationsHandler.runView(countOnly, makeUser());
+            expect((mockRunViewFn.mock.calls[2][0] as RunViewParams).ResultType).toBe('count_only');
         });
 
         it('splits comma-separated Fields strings and coerces numeric strings for MaxRows/StartRow', async () => {