@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/__tests__/realtimeSessions/sessionAccess.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi } from 'vitest';
 import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
-import { AuthorizeSessionAccess, LoadSessionForAccess } from '../../realtimeSessions/sessionAccess.js';
+import { AuthorizeSessionAccess, AuthorizeConversationTurn, AuthorizeAnonymousRoomSessions, LoadSessionForAccess, LoadConversationScope } from '../../realtimeSessions/sessionAccess.js';
 
 const OWNER = 'AAAAAAAA-0000-4000-8000-000000000001';
 const OTHER = 'AAAAAAAA-0000-4000-8000-000000000002';
@@ -27,27 +27,57 @@ describe('AuthorizeSessionAccess', () => {
         expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null }, { ID: '' })).toEqual({ Allowed: false, Reason: 'not_owner' });
     });
 
-    describe('anonymous widget guests (one shared Anonymous user)', () => {
-        const guest = (scope?: string) => ({ ID: OWNER, IsMagicLinkAnonymous: true, MagicLinkScope: scope ? { ResourceID: scope } : undefined });
+    describe('anonymous visitors (one shared Anonymous user, per-visitor AnonymousVisitorID)', () => {
+        const guest = (visitorId?: string, resourceScope?: string) => ({
+            ID: OWNER,
+            IsMagicLinkAnonymous: true,
+            AnonymousVisitorID: visitorId,
+            MagicLinkScope: resourceScope ? { ResourceID: resourceScope } : visitorId ? { ResourceID: visitorId } : undefined,
+        });
 
-        it('allows a guest whose signed scope matches the conversation ExternalID', () => {
+        it('allows a visitor whose AnonymousVisitorID matches the conversation ExternalID', () => {
             expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'scope-1' }, guest('scope-1'))).toEqual({ Allowed: true });
         });
 
-        it('refuses a different guest (same Anonymous user id, different scope) — the cross-guest leak', () => {
+        it('refuses a different widget guest (same Anonymous user id, different visitor id) — the cross-guest leak', () => {
             expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'scope-1' }, guest('scope-2'))).toEqual({
                 Allowed: false,
                 Reason: 'scope_mismatch',
             });
         });
 
-        it('refuses an anonymous principal with no scope at all', () => {
-            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'scope-1' }, guest())).toEqual({
+        it('refuses an anonymous principal with neither a resource scope nor an AnonymousVisitorID', () => {
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'scope-1' }, guest(undefined))).toEqual({
                 Allowed: false,
                 Reason: 'scope_missing',
             });
         });
 
+        describe('identity per token kind: MagicLinkScope.ResourceID when the token carries one, else mj_sid', () => {
+            it('widget guest (ResourceID == mj_sid): matches its own sessionId', () => {
+                expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'sid-w' }, guest('sid-w', 'sid-w'))).toEqual({ Allowed: true });
+            });
+
+            it('anonymous invite WITH a ResourceID: identity is the ResourceID, not its per-redemption mj_sid', () => {
+                const visitor = guest('sid-redemption-1', 'invite-scope-R');
+                expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'invite-scope-R' }, visitor)).toEqual({ Allowed: true });
+                expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'sid-redemption-1' }, visitor)).toEqual({
+                    Allowed: false,
+                    Reason: 'scope_mismatch',
+                });
+            });
+
+            it('anonymous invite WITHOUT a ResourceID: identity is mj_sid, so two redemptions are told apart', () => {
+                const first = { ID: OWNER, IsMagicLinkAnonymous: true, AnonymousVisitorID: 'sid-r1' };
+                const second = { ID: OWNER, IsMagicLinkAnonymous: true, AnonymousVisitorID: 'sid-r2' };
+                expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'sid-r1' }, first)).toEqual({ Allowed: true });
+                expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'sid-r1' }, second)).toEqual({
+                    Allowed: false,
+                    Reason: 'scope_mismatch',
+                });
+            });
+        });
+
         it('refuses when the conversation carries no scope id (unreadable or unscoped)', () => {
             expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null }, guest('scope-1'))).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
             expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: undefined }, guest('scope-1'))).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
@@ -68,6 +98,28 @@ describe('AuthorizeSessionAccess', () => {
         expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'other' }, scoped)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
     });
 
+    describe('a NAMED principal with a resource scope on a conversation with no scope stamp', () => {
+        const scoped = { ID: OWNER, MagicLinkScope: { ResourceID: 'share-1' } };
+
+        it('is allowed when it could read the conversation (e.g. one started from the Conversations app)', () => {
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null, ConversationReadable: true }, scoped)).toEqual({ Allowed: true });
+        });
+
+        it('is refused when it could not read the conversation, or readability is unknown (fail closed)', () => {
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null, ConversationReadable: false }, scoped)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null }, scoped)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+        });
+
+        it('still refuses a conversation stamped with another scope, readable or not', () => {
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'share-2', ConversationReadable: true }, scoped)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+        });
+
+        it('does not extend to an anonymous visitor, which an unstamped conversation cannot identify', () => {
+            const visitor = { ID: OWNER, IsMagicLinkAnonymous: true, AnonymousVisitorID: 'sid-1' };
+            expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: null, ConversationReadable: true }, visitor)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+        });
+    });
+
     it('does not require a scope of a named principal without one, whatever the conversation says', () => {
         expect(AuthorizeSessionAccess({ SessionUserID: OWNER, ConversationExternalID: 'scope-1' }, { ID: OWNER })).toEqual({ Allowed: true });
     });
@@ -99,6 +151,7 @@ describe('LoadSessionForAccess', () => {
         const loaded = await LoadSessionForAccess(SESSION_ID, USER, provider);
         expect(loaded?.Session.ID).toBe(SESSION_ID);
         expect(loaded?.ConversationExternalID).toBe('scope-1');
+        expect(loaded?.ConversationReadable).toBe(true);
     });
 
     it('returns null for a malformed id without touching the database', async () => {
@@ -114,16 +167,102 @@ describe('LoadSessionForAccess', () => {
     it('reports a null scope id when the session has no conversation', async () => {
         const loaded = await LoadSessionForAccess(SESSION_ID, USER, fakeProvider({ session: { ID: SESSION_ID, UserID: OWNER, ConversationID: null } }));
         expect(loaded?.ConversationExternalID).toBeNull();
+        expect(loaded?.ConversationReadable).toBe(false);
     });
 
     it('reports a null scope id when the conversation is unreadable, so a scoped caller is refused downstream', async () => {
         const unreadable = await LoadSessionForAccess(SESSION_ID, USER, fakeProvider({ session: { ID: SESSION_ID, UserID: OWNER, ConversationID: CONVERSATION_ID }, conversation: null }));
         expect(unreadable?.ConversationExternalID).toBeNull();
+        expect(unreadable?.ConversationReadable).toBe(false);
         const throwing = await LoadSessionForAccess(
             SESSION_ID,
             USER,
             fakeProvider({ session: { ID: SESSION_ID, UserID: OWNER, ConversationID: CONVERSATION_ID }, conversation: {}, conversationThrows: true }),
         );
         expect(throwing?.ConversationExternalID).toBeNull();
+        expect(throwing?.ConversationReadable).toBe(false);
+    });
+
+    it('reports a readable conversation that carries no scope stamp', async () => {
+        const loaded = await LoadSessionForAccess(SESSION_ID, USER, fakeProvider({ session: { ID: SESSION_ID, UserID: OWNER, ConversationID: CONVERSATION_ID }, conversation: { ExternalID: null } }));
+        expect(loaded?.ConversationExternalID).toBeNull();
+        expect(loaded?.ConversationReadable).toBe(true);
+    });
+});
+
+describe('LoadConversationScope (a conversation addressed directly, e.g. by a text agent turn)', () => {
+    it('reports the owner and scope id of a readable conversation', async () => {
+        const scope = await LoadConversationScope(CONVERSATION_ID, USER, fakeProvider({ conversation: { UserID: OWNER, ExternalID: 'scope-1' } }));
+        expect(scope).toEqual({ UserID: OWNER, ExternalID: 'scope-1', Readable: true });
+    });
+
+    it('reports an unreadable conversation (missing, refused by RLS, or a failed read) without an owner', async () => {
+        expect(await LoadConversationScope(CONVERSATION_ID, USER, fakeProvider({ conversation: null }))).toEqual({ UserID: null, ExternalID: null, Readable: false });
+        expect(await LoadConversationScope(CONVERSATION_ID, USER, fakeProvider({ conversation: {}, conversationThrows: true }))).toEqual({ UserID: null, ExternalID: null, Readable: false });
+    });
+
+    it('reports a null scope id for a readable conversation with no stamp', async () => {
+        const scope = await LoadConversationScope(CONVERSATION_ID, USER, fakeProvider({ conversation: { UserID: OWNER, ExternalID: null } }));
+        expect(scope).toEqual({ UserID: OWNER, ExternalID: null, Readable: true });
+    });
+
+    it('does not touch the database for an empty id', async () => {
+        const provider = fakeProvider({});
+        expect(await LoadConversationScope('', USER, provider)).toEqual({ UserID: null, ExternalID: null, Readable: false });
+        expect(provider.GetEntityObject).not.toHaveBeenCalled();
     });
 });
+
+describe('AuthorizeConversationTurn (a text agent turn addressed by a message in the conversation, MJ#6032)', () => {
+    const ANON = 'AAAAAAAA-0000-4000-8000-00000000A0A0';
+    const visitor = (sid: string) => ({ ID: ANON, IsMagicLinkAnonymous: true, AnonymousVisitorID: sid, MagicLinkScope: { ResourceID: sid } }) as unknown as UserInfo;
+
+    it('allows a named principal without reading the conversation (its permissions already decided the turn)', async () => {
+        const provider = fakeProvider({});
+        expect(await AuthorizeConversationTurn(CONVERSATION_ID, { ID: OWNER } as UserInfo, provider)).toEqual({ Allowed: true });
+        expect(provider.GetEntityObject).not.toHaveBeenCalled();
+    });
+
+    it('allows the anonymous visitor whose scope id the conversation carries', async () => {
+        const provider = fakeProvider({ conversation: { UserID: ANON, ExternalID: 'sid-1' } });
+        expect(await AuthorizeConversationTurn(CONVERSATION_ID, visitor('sid-1'), provider)).toEqual({ Allowed: true });
+    });
+
+    it('refuses a second anonymous visitor — same shared user, different scope id (the UI-guest-role leak)', async () => {
+        const provider = fakeProvider({ conversation: { UserID: ANON, ExternalID: 'sid-1' } });
+        expect(await AuthorizeConversationTurn(CONVERSATION_ID, visitor('sid-2'), provider)).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+    });
+
+    it('refuses an anonymous visitor when the conversation cannot be read or carries no scope id', async () => {
+        expect(await AuthorizeConversationTurn(CONVERSATION_ID, visitor('sid-1'), fakeProvider({ conversation: null }))).toEqual({ Allowed: false, Reason: 'not_owner' });
+        expect(await AuthorizeConversationTurn(CONVERSATION_ID, visitor('sid-1'), fakeProvider({ conversation: { UserID: ANON, ExternalID: null } }))).toEqual({ Allowed: false, Reason: 'scope_mismatch' });
+    });
+});
+
+describe('AuthorizeAnonymousRoomSessions (who of the anonymous visitors owns a LiveKit room\'s agent session, MJ#6044)', () => {
+    const ANON = 'AAAAAAAA-0000-4000-8000-00000000A0A0';
+    const visitor = (sid: string) => ({ ID: ANON, IsMagicLinkAnonymous: true, AnonymousVisitorID: sid, MagicLinkScope: { ResourceID: sid } }) as unknown as UserInfo;
+    const roomSession = { ID: SESSION_ID, UserID: ANON, ConversationID: CONVERSATION_ID };
+
+    it("admits the visitor whose scope id the session's conversation carries", async () => {
+        const provider = fakeProvider({ session: roomSession, conversation: { UserID: ANON, ExternalID: 'sid-1' } });
+        expect(await AuthorizeAnonymousRoomSessions([SESSION_ID], visitor('sid-1'), provider)).toBe(true);
+    });
+
+    it('refuses another visitor — same shared user, different scope id', async () => {
+        const provider = fakeProvider({ session: roomSession, conversation: { UserID: ANON, ExternalID: 'sid-1' } });
+        expect(await AuthorizeAnonymousRoomSessions([SESSION_ID], visitor('sid-2'), provider)).toBe(false);
+    });
+
+    it('refuses when the session cannot be read as the caller', async () => {
+        expect(await AuthorizeAnonymousRoomSessions([SESSION_ID], visitor('sid-1'), fakeProvider({ session: null }))).toBe(false);
+    });
+
+    it('refuses without reading anything when there is no session or no provider', async () => {
+        const provider = fakeProvider({});
+        expect(await AuthorizeAnonymousRoomSessions([], visitor('sid-1'), provider)).toBe(false);
+        expect(await AuthorizeAnonymousRoomSessions([SESSION_ID], visitor('sid-1'), undefined)).toBe(false);
+        expect(provider.GetEntityObject).not.toHaveBeenCalled();
+    });
+});
+

package/src/__tests__/realtimeSessions/sessionConfigStamps.test.ts

@@ -117,7 +117,7 @@ describe('LoadInheritedVerifiedIdentity', () => {
 
     it('refuses another anonymous guest (same Anonymous user, different scope) and accepts the same guest', async () => {
         const prov = provider({ externalId: 'scope-A' });
-        const guest = (scope: string) => user({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: scope } });
+        const guest = (scope: string) => user({ IsMagicLinkAnonymous: true, AnonymousVisitorID: scope, MagicLinkScope: { ResourceID: scope } });
         expect(await LoadInheritedVerifiedIdentity(PRIOR, guest('scope-B'), prov)).toBeUndefined();
         expect(await LoadInheritedVerifiedIdentity(PRIOR, guest('scope-A'), prov)).toEqual(VERIFIED);
     });

package/src/__tests__/realtimeSessions/verificationWorkflow.test.ts

@@ -96,6 +96,7 @@ class FakePorts implements VerificationPorts {
             AgentSessionID: SESSION_ID,
             OwnerUserID: OWNER,
             ConversationExternalID: null,
+            ConversationReadable: false,
             Status: 'Active',
             ConfigRaw: JSON.stringify({ targetAgentID: 'target-1' }),
             StartedAtMs: T0,
@@ -219,11 +220,17 @@ describe('RealtimeSessionVerificationWorkflow', () => {
         it('refuses another anonymous guest sharing the Anonymous user (scope mismatch) and a scope-less anonymous caller', async () => {
             ports.AddSession({ ConversationExternalID: 'scope-A' });
             expect(
-                await workflow.RequestVerification(REQUEST, principal({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'scope-B' } })),
+                await workflow.RequestVerification(
+                    REQUEST,
+                    principal({ IsMagicLinkAnonymous: true, AnonymousVisitorID: 'scope-B', MagicLinkScope: { ResourceID: 'scope-B' } }),
+                ),
             ).toMatchObject({ ErrorCode: 'session_not_found' });
             expect(await workflow.RequestVerification(REQUEST, principal({ IsMagicLinkAnonymous: true }))).toMatchObject({ ErrorCode: 'session_not_found' });
             expect(
-                await workflow.RequestVerification(REQUEST, principal({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'scope-A' } })),
+                await workflow.RequestVerification(
+                    REQUEST,
+                    principal({ IsMagicLinkAnonymous: true, AnonymousVisitorID: 'scope-A', MagicLinkScope: { ResourceID: 'scope-A' } }),
+                ),
             ).toMatchObject({ Success: true });
         });
 
@@ -232,6 +239,17 @@ describe('RealtimeSessionVerificationWorkflow', () => {
             expect(await workflow.RequestVerification(REQUEST, principal())).toMatchObject({ ErrorCode: 'session_closed' });
         });
 
+        it("lets a named owner holding a link scope use an unstamped conversation only when it can read that conversation", async () => {
+            // A conversation started outside any link carries no ExternalID. The owner's own row-level security
+            // decides: readable is allowed, unreadable is refused like a missing session.
+            const linkHolder = principal({ MagicLinkScope: { ResourceID: 'invite-scope-1' } });
+            ports.AddSession({ ConversationExternalID: null, ConversationReadable: false });
+            expect(await workflow.RequestVerification(REQUEST, linkHolder)).toMatchObject({ ErrorCode: 'session_not_found' });
+
+            ports.AddSession({ ConversationExternalID: null, ConversationReadable: true });
+            expect(await workflow.RequestVerification(REQUEST, linkHolder)).toMatchObject({ Success: true });
+        });
+
         it('treats an already-verified session as success without sending anything', async () => {
             await workflow.RequestVerification(REQUEST, principal());
             const { code } = secretsFrom(ports);
@@ -362,7 +380,7 @@ describe('RealtimeSessionVerificationWorkflow', () => {
 
         it('routes the event with the session scope so an anonymous guest\'s event reaches only that guest', async () => {
             ports.AddSession({ ConversationExternalID: 'scope-A' });
-            const guest = principal({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'scope-A' } });
+            const guest = principal({ IsMagicLinkAnonymous: true, AnonymousVisitorID: 'scope-A', MagicLinkScope: { ResourceID: 'scope-A' } });
             await workflow.RequestVerification(REQUEST, guest);
             await workflow.SubmitCode({ AgentSessionID: SESSION_ID, Code: secretsFrom(ports).code }, guest);
             expect(ports.Published[0].routing.ScopeKey).toBe('scope-A');
@@ -445,7 +463,10 @@ describe('RealtimeSessionVerificationWorkflow', () => {
             expect(await workflow.SubmitCode({ AgentSessionID: SESSION_ID, Code: code }, principal({ ID: STRANGER }))).toMatchObject({ ErrorCode: 'session_not_found' });
             ports.AddSession({ ConversationExternalID: 'scope-A', ConfigRaw: ports.Sessions.get(SESSION_ID.toLowerCase())?.ConfigRaw ?? null });
             expect(
-                await workflow.SubmitCode({ AgentSessionID: SESSION_ID, Code: code }, principal({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'scope-B' } })),
+                await workflow.SubmitCode(
+                    { AgentSessionID: SESSION_ID, Code: code },
+                    principal({ IsMagicLinkAnonymous: true, AnonymousVisitorID: 'scope-B', MagicLinkScope: { ResourceID: 'scope-B' } }),
+                ),
             ).toMatchObject({ ErrorCode: 'session_not_found' });
             expect(ports.Published).toHaveLength(0);
         });

package/src/__tests__/resolverBase.cloudEventChangedFields.test.ts

@@ -0,0 +1,157 @@
+/**
+ * CloudEvents for an entity under field-level security carry the primary key and the names of the
+ * fields the save changed, never values.
+ *
+ * Driven by a REAL `BaseEntity` save rather than a stand-in object with `Dirty` set: a completed
+ * save rebases the object before it raises `save`, so nothing on it is dirty by the time a
+ * listener runs. The names must come from the event, which captures them before the rebase.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+const { cloudEventInits } = vi.hoisted(() => ({
+    cloudEventInits: [] as Array<Record<string, unknown>>,
+}));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({ SQLServerDataProvider: class {} }));
+vi.mock('@memberjunction/generic-database-provider', () => ({ UserCache: { Users: [] } }));
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {
+        constructor(init: Record<string, unknown>) {
+            cloudEventInits.push(init);
+            Object.assign(this, init);
+        }
+    },
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+vi.mock('type-graphql', () => {
+    const noop = () => () => undefined;
+    return {
+        Resolver: noop, Mutation: noop, Query: noop, Subscription: noop, Ctx: noop, Arg: noop, PubSub: noop,
+        Root: noop, ObjectType: noop, InputType: noop, Field: noop, FieldResolver: noop,
+        Int: undefined, Float: undefined, registerEnumType: () => undefined,
+    };
+});
+vi.mock('graphql', () => ({ GraphQLError: class extends Error {} }));
+vi.mock('mssql', () => ({}));
+vi.mock('@memberjunction/api-keys', () => ({ GetAPIKeyEngine: vi.fn() }));
+vi.mock('@memberjunction/encryption', () => ({ EncryptionEngine: { Instance: {} } }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFieldName(n: string) { return n; } ReverseMapFieldName(n: string) { return n; } } }));
+vi.mock('../generic/PubSubManager.js', () => ({ PubSubManager: { Instance: { Publish: () => undefined } } }));
+vi.mock('../generic/PushStatusResolver.js', () => ({ PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic', PublishStatusUpdate: vi.fn() }));
+vi.mock('../generic/RunViewResolver.js', () => ({ RunViewByIDInput: class {}, RunViewByNameInput: class {}, RunDynamicViewInput: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../types.js', () => ({ RunViewGenericParams: class {} }));
+vi.mock('@memberjunction/core-entities', () => ({}));
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return { ...actual, LogError: vi.fn(), LogStatus: vi.fn(), LogDebug: vi.fn() };
+});
+
+import { BaseEntity, CompositeKey, EntityInfo, IEntityDataProvider, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase';
+import type { UserPayload } from '../types.js';
+import { EmployeeEntityInit, FullWidthEmployeeRow, HRUser, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+/** `Employees` with every field updatable through the API, so a real save can dirty them. */
+function updatableEmployees(withFls: boolean): EntityInfo {
+    const init = EmployeeEntityInit(withFls);
+    const fields = (init.Fields as Record<string, unknown>[]).map(f => ({ ...f, AllowUpdateAPI: true, AllowsNull: true }));
+    return new EntityInfo({ ...init, Fields: fields });
+}
+
+class Employee extends BaseEntity {
+    public override CheckPermissions(): boolean {
+        return true;
+    }
+}
+
+/** A provider whose database holds one full-width employee row and whose Save returns the stored row. */
+function makeProvider() {
+    let stored = FullWidthEmployeeRow();
+    return {
+        CurrentUser: null as UserInfo | null,
+        async Load(): Promise<Record<string, unknown>> { return { ...stored }; },
+        async Save(entity: BaseEntity): Promise<Record<string, unknown>> {
+            stored = { ...stored, ...(entity.GetAll() as Record<string, unknown>) };
+            return { ...stored };
+        },
+        SetCachedRecordName(): void { /* no-op */ },
+        GetCachedRecordName(): string | undefined { return undefined; },
+    };
+}
+
+class TestResolver extends ResolverBase {
+    public Listen(entity: BaseEntity) {
+        this.ListenForEntityMessages(entity, {} as PubSubEngine, { sessionId: 's' } as UserPayload);
+    }
+    public Payload(entity: BaseEntity, changed?: string[]): Record<string, unknown> {
+        return this.EntityEventPayload(entity, changed);
+    }
+}
+
+async function loadedEmployee(entityInfo: EntityInfo, user: UserInfo): Promise<Employee> {
+    const e = new Employee(entityInfo, makeProvider() as unknown as IEntityDataProvider);
+    e.ContextCurrentUser = user;
+    await e.InnerLoad(CompositeKey.FromID('emp-1'));
+    return e;
+}
+
+describe('ResolverBase CloudEvents: changed fields from a real save', () => {
+    const emitterKey = '_emit';
+    let previousEmitter: unknown;
+
+    beforeEach(() => {
+        cloudEventInits.length = 0;
+        const statics = ResolverBase as unknown as Record<string, unknown>;
+        previousEmitter = statics[emitterKey];
+        statics[emitterKey] = async () => ({});
+    });
+    afterEach(() => {
+        (ResolverBase as unknown as Record<string, unknown>)[emitterKey] = previousEmitter;
+    });
+
+    /** The data of the CloudEvent emitted for the completed save. */
+    async function saveEventData(entity: Employee): Promise<Record<string, unknown>> {
+        new TestResolver().Listen(entity);
+        await expect(entity.Save()).resolves.toBe(true);
+        await vi.waitFor(() => expect(cloudEventInits.some(c => String(c.type).endsWith('.save'))).toBe(true));
+        return cloudEventInits.find(c => String(c.type).endsWith('.save'))!.data as Record<string, unknown>;
+    }
+
+    it('REGRESSION: names the fields the save changed, not an empty list', async () => {
+        const entity = await loadedEmployee(updatableEmployees(true), HRUser());
+        entity.Set('Notes', 'edited');
+        entity.Set('Salary', 1);
+
+        const data = await saveEventData(entity);
+
+        expect(entity.Dirty).toBe(false);
+        expect(data.PrimaryKey).toEqual([{ FieldName: 'ID', Value: 'emp-1' }]);
+        expect([...(data.ChangedFields as string[])].sort()).toEqual(['Notes', 'Salary']);
+        expect(JSON.stringify(data)).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('an entity without field security still emits its row', async () => {
+        const entity = await loadedEmployee(updatableEmployees(false), HRUser());
+        entity.Set('Notes', 'edited');
+
+        const data = await saveEventData(entity);
+
+        expect(data).toMatchObject({ ID: 'emp-1', Notes: 'edited' });
+    });
+
+    it('a payload for a record still in raw mode does not build its field objects', async () => {
+        const entity = new Employee(updatableEmployees(true), makeProvider() as unknown as IEntityDataProvider);
+        entity.ContextCurrentUser = HRUser();
+        await entity.LoadFromData(FullWidthEmployeeRow()); // a load_complete listener sees exactly this object
+        const hydrated = () => (entity as unknown as { _fieldsHydrated: boolean })._fieldsHydrated;
+        expect(hydrated()).toBe(false);
+
+        const data = new TestResolver().Payload(entity);
+
+        expect(data.ChangedFields).toEqual([]);
+        expect(hydrated()).toBe(false);
+    });
+});