@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/__tests__/resolverBase.fieldSecurityTransport.test.ts

@@ -0,0 +1,222 @@
+/**
+ * Field-level security on ResolverBase's own transports, other than the GraphQL field mapping:
+ *
+ * - **Create input.** A restricted caller's create payload is refused when it names a field the
+ *   caller may not read, or a key that names no field, with the same message for both.
+ * - **Cache-invalidation broadcast.** The event reaches every signed-in session unprojected, so an
+ *   entity under field security never carries its row, whatever the allowlist says.
+ * - **CloudEvents and their debug log.** The sink is external and has no reader identity to
+ *   project for, so an entity under field security emits only its key and the names of changed
+ *   fields, and the same goes for the debug log of the event.
+ *
+ * The entity objects here return FULL-WIDTH rows, standing in for an object saved by the system
+ * user (server-internal saves fire the same events) or otherwise not narrowed at its source.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+const { published, logDebugCalls, emitted, cloudEventInits } = vi.hoisted(() => ({
+    published: [] as Array<{ topic: string; payload: Record<string, unknown> }>,
+    logDebugCalls: [] as string[],
+    emitted: [] as unknown[],
+    cloudEventInits: [] as Array<Record<string, unknown>>,
+}));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({ SQLServerDataProvider: class {} }));
+vi.mock('@memberjunction/generic-database-provider', () => ({ UserCache: { Users: [] } }));
+vi.mock('cloudevents', () => ({
+    CloudEvent: class {
+        constructor(init: Record<string, unknown>) {
+            cloudEventInits.push(init);
+            Object.assign(this, init);
+        }
+    },
+    httpTransport: () => () => undefined,
+    emitterFor: () => () => undefined,
+}));
+vi.mock('type-graphql', () => {
+    const noop = () => () => undefined;
+    return {
+        Resolver: noop, Mutation: noop, Query: noop, Subscription: noop, Ctx: noop, Arg: noop, PubSub: noop,
+        Root: noop, ObjectType: noop, InputType: noop, Field: noop, FieldResolver: noop,
+        Int: undefined, Float: undefined, registerEnumType: () => undefined,
+    };
+});
+vi.mock('graphql', () => ({ GraphQLError: class extends Error {} }));
+vi.mock('mssql', () => ({}));
+vi.mock('@memberjunction/api-keys', () => ({ GetAPIKeyEngine: vi.fn() }));
+vi.mock('@memberjunction/encryption', () => ({ EncryptionEngine: { Instance: {} } }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFieldName(n: string) { return n; } ReverseMapFieldName(n: string) { return n; } } }));
+vi.mock('../generic/PubSubManager.js', () => ({
+    PubSubManager: {
+        Instance: {
+            Publish: (topic: string, payload: Record<string, unknown>) => { published.push({ topic, payload }); },
+        },
+    },
+}));
+vi.mock('../generic/PushStatusResolver.js', () => ({
+    PUSH_STATUS_UPDATES_TOPIC: 'test-push-topic',
+    PublishStatusUpdate: vi.fn(),
+}));
+vi.mock('../generic/RunViewResolver.js', () => ({ RunViewByIDInput: class {}, RunViewByNameInput: class {}, RunDynamicViewInput: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../types.js', () => ({ RunViewGenericParams: class {} }));
+vi.mock('@memberjunction/core-entities', () => ({}));
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return {
+        ...actual,
+        LogError: vi.fn(),
+        LogStatus: (msg: string) => { logDebugCalls.push(String(msg)); },
+        LogDebug: (msg: string) => { logDebugCalls.push(String(msg)); },
+    };
+});
+
+import { BaseEntity, BaseEntityEvent, EntityInfo, UserInfo } from '@memberjunction/core';
+import { MJEventType, MJGlobal } from '@memberjunction/global';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase';
+import { ConfigureRecordDataBroadcast } from '../generic/CacheInvalidationResolver.js';
+import type { UserPayload } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, HRUser, Intern, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+/** An entity object that holds a full-width row: system-saved, or not narrowed at its source. */
+function fullWidthEntity(entityInfo: EntityInfo, dirty: string[] = ['Notes']) {
+    const row = FullWidthEmployeeRow();
+    return {
+        EntityInfo: entityInfo,
+        GetAll: () => ({ ...row }),
+        PrimaryKey: { KeyValuePairs: [{ FieldName: 'ID', Value: row.ID }] },
+        PrimaryKeys: [],
+        Fields: entityInfo.Fields.map(f => ({ Name: f.Name, Dirty: dirty.includes(f.Name) })),
+        Get: (name: string) => (row as Record<string, unknown>)[name],
+        GetDirtyFieldNames: () => entityInfo.Fields.filter(f => dirty.includes(f.Name)).map(f => f.Name),
+        SetManyCalls: [] as Array<Record<string, unknown>>,
+        NewRecord(): boolean { return true; },
+        SetMany(values: Record<string, unknown>): void { this.SetManyCalls.push(values); },
+        Save: async () => true,
+    };
+}
+type FullWidthEntity = ReturnType<typeof fullWidthEntity>;
+
+class TestResolver extends ResolverBase {
+    public Create(entity: FullWidthEntity, input: Record<string, unknown>, user: UserInfo) {
+        const provider = { GetEntityObject: async () => entity };
+        return this.CreateRecord('Employees', input, provider as never, { userRecord: user } as UserPayload, {} as PubSubEngine);
+    }
+    public Broadcast(entity: FullWidthEntity) {
+        this.PublishCacheInvalidation(entity as unknown as BaseEntity, 'save', { sessionId: 's' } as UserPayload);
+    }
+    public Emit(entity: FullWidthEntity) {
+        const args = new BaseEntityEvent();
+        args.type = 'save';
+        args.baseEntity = entity as unknown as BaseEntity;
+        return this.EmitCloudEvent({ component: null, event: MJEventType.ComponentEvent, eventCode: BaseEntity.BaseEventCode, args });
+    }
+    public Listen(entity: FullWidthEntity) {
+        this.ListenForEntityMessages(entity as unknown as BaseEntity, {} as PubSubEngine, { sessionId: 's' } as UserPayload);
+    }
+}
+
+describe('ResolverBase.CreateRecord: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before anything is applied', async (_label, key) => {
+        const entity = fullWidthEntity(EmployeeEntity());
+        await expect(new TestResolver().Create(entity, { ID: 'emp-1', Name: 'Ada', [key]: 1 }, Intern()))
+            .rejects.toThrow(RefusalFor(key));
+        expect(entity.SetManyCalls).toHaveLength(0);
+    });
+
+    it('applies a well-behaved restricted client\'s create', async () => {
+        const entity = fullWidthEntity(EmployeeEntity());
+        // The response mapping needs metadata this unit test does not stand up; reaching it means the gate passed.
+        await new TestResolver().Create(entity, { ID: 'emp-1', Name: 'Ada', RestoreContext___: { SourceChangeID: 'x' } }, Intern()).catch(() => undefined);
+        expect(entity.SetManyCalls).toEqual([{ ID: 'emp-1', Name: 'Ada' }]);
+    });
+
+    it('does not gate a caller who is denied nothing', async () => {
+        const entity = fullWidthEntity(EmployeeEntity());
+        await new TestResolver().Create(entity, { ID: 'emp-1', Salary: 5 }, HRUser()).catch(() => undefined);
+        expect(entity.SetManyCalls).toEqual([{ ID: 'emp-1', Salary: 5 }]);
+    });
+});
+
+describe('ResolverBase.PublishCacheInvalidation: no row data for entities under field security', () => {
+    beforeEach(() => { published.length = 0; });
+    afterEach(() => ConfigureRecordDataBroadcast([]));
+
+    it("REGRESSION: an FLS entity's row never rides along, even under an explicit '*'", () => {
+        ConfigureRecordDataBroadcast(['*']);
+        new TestResolver().Broadcast(fullWidthEntity(EmployeeEntity(true)));
+
+        expect(published).toHaveLength(1);
+        expect(published[0].payload.recordData).toBeUndefined();
+        expect(published[0].payload.entityName).toBe('Employees');
+    });
+
+    it('an allowlisted entity without field security still carries its row', () => {
+        ConfigureRecordDataBroadcast(['*']);
+        new TestResolver().Broadcast(fullWidthEntity(EmployeeEntity(false)));
+
+        expect(JSON.parse(String(published[0].payload.recordData))).toMatchObject({ ID: 'emp-1' });
+    });
+});
+
+describe('ResolverBase CloudEvents: no field values for entities under field security', () => {
+    const emitterKey = '_emit';
+    let previousEmitter: unknown;
+
+    beforeEach(() => {
+        cloudEventInits.length = 0;
+        emitted.length = 0;
+        logDebugCalls.length = 0;
+        const statics = ResolverBase as unknown as Record<string, unknown>;
+        previousEmitter = statics[emitterKey];
+        statics[emitterKey] = async (event: unknown) => { emitted.push(event); return {}; };
+    });
+    afterEach(() => {
+        (ResolverBase as unknown as Record<string, unknown>)[emitterKey] = previousEmitter;
+    });
+
+    it('REGRESSION: emits only the key and the changed-field names', async () => {
+        await new TestResolver().Emit(fullWidthEntity(EmployeeEntity(true), ['Notes', 'Salary']));
+
+        expect(cloudEventInits).toHaveLength(1);
+        expect(cloudEventInits[0].data).toEqual({
+            PrimaryKey: [{ FieldName: 'ID', Value: 'emp-1' }],
+            ChangedFields: ['Salary', 'Notes'],
+        });
+        expect(logDebugCalls.join('\n')).not.toContain(String(SECRET_SALARY));
+    });
+
+    it('an entity without field security still emits its row', async () => {
+        await new TestResolver().Emit(fullWidthEntity(EmployeeEntity(false)));
+        expect(cloudEventInits[0].data).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+
+    it('REGRESSION: a Record Changes row emits only its key and changed-field names', async () => {
+        // The audit trail has no field security of its own, but its payload columns hold other
+        // entities' values, so its rows must not ride along to the sink either.
+        const recordChanges = EmployeeEntity(false);
+        recordChanges.Name = 'MJ: Record Changes';
+        await new TestResolver().Emit(fullWidthEntity(recordChanges, ['Notes']));
+        expect(cloudEventInits[0].data).toEqual({
+            PrimaryKey: [{ FieldName: 'ID', Value: 'emp-1' }],
+            ChangedFields: ['Notes'],
+        });
+    });
+
+    it('REGRESSION: the entity-event debug log carries no field values for an FLS entity', async () => {
+        const entity = fullWidthEntity(EmployeeEntity(true));
+        new TestResolver().Listen(entity);
+        const args = new BaseEntityEvent();
+        args.type = 'save';
+        args.baseEntity = entity as unknown as BaseEntity;
+        MJGlobal.Instance.RaiseEvent({ component: null, event: MJEventType.ComponentEvent, eventCode: BaseEntity.BaseEventCode, args });
+        await vi.waitFor(() => expect(logDebugCalls.some(m => m.includes('Received Event'))).toBe(true));
+
+        expect(logDebugCalls.join('\n')).not.toContain(String(SECRET_SALARY));
+        expect(logDebugCalls.join('\n')).toContain('emp-1');
+    });
+});

package/src/__tests__/resolverBase.fls.test.ts

@@ -1,15 +1,13 @@
 /**
- * Tests for ResolverBase.StripDeniedReadFieldsFromClientInput — the field-level-security
- * guard on the update path.
+ * Tests for ResolverBase.AssertClientInputFieldSecurity — the field-level-security gate on the
+ * update path — and MustLoadTruthFromDatabase.
  *
- * The hazard it closes: a read-denied field is stripped from every payload the client
- * receives, so the client's Save fabricates a value for it (default / 0 / '' / null) and sends
- * it back. Without the guard, UpdateRecord's SetMany applies the fabrication — silent data
- * loss when the user holds update access, and a spurious save failure on UNRELATED edits when
- * they don't. The guard strips denied-read keys from the client's new values and OldValues
- * before anything applies them, and its `true` return forces the caller onto the
- * load-truth-from-DB branch so denied fields hold real values a stripped SetMany never
- * touches.
+ * A read-denied field is absent from every payload the client receives, so a value coming back
+ * for it can only be fabricated. The gate REFUSES such a value (new values and OldValues alike)
+ * rather than dropping it, and refuses a key that names no field with the identical message, so
+ * the refusal cannot be used to learn which columns exist. Its `true` return (the caller is
+ * denied something) forces the caller onto the load-truth-from-DB branch, so denied fields keep
+ * the values the database holds.
  */
 import { describe, it, expect, vi, beforeEach, beforeAll, afterAll } from 'vitest';
 
@@ -116,7 +114,7 @@ vi.mock('@memberjunction/core-entities', () => ({}));
 
 // ─── Import after mocks ──────────────────────────────────────────────────
 import { ResolverBase } from '../generic/ResolverBase';
-import { EntityInfo, Metadata, RowLevelSecurityFilterInfo, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { EntityInfo, FieldSecurityClientInputMessage, IMetadataProvider, Metadata, RowLevelSecurityFilterInfo, UserInfo, UserRoleInfo } from '@memberjunction/core';
 
 // ─── Metadata builders (mirrors MJCore's fieldSecurity.enforcement tests) ──
 
@@ -189,7 +187,7 @@ type ClientInput = { OldValues___?: Array<{ Key: string; Value: unknown }> } & R
 /** Subclass that exposes the protected guards for testing. */
 class TestResolver extends ResolverBase {
     public TestStrip(entityInfo: EntityInfo, userInfo: UserInfo, input: ClientInput, clientNewValues: Record<string, unknown>): boolean {
-        return this.StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues);
+        return this.AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues);
     }
 
     /** The user defaults to HR, whose permission rows carry no row filter; pass null for a missing user. */
@@ -210,7 +208,10 @@ function makeClientPayload(fields: Record<string, unknown>, oldValues?: Array<{
 
 // ─── Tests ────────────────────────────────────────────────────────────────
 
-describe('ResolverBase.StripDeniedReadFieldsFromClientInput', () => {
+/** The refusal for `key` on Employees: one wording for a denied key and for a key that names no field. */
+const refusalFor = (key: string) => FieldSecurityClientInputMessage(key, 'Employees');
+
+describe('ResolverBase.AssertClientInputFieldSecurity', () => {
     let resolver: TestResolver;
     let flsEntity: EntityInfo;
     let noFlsEntity: EntityInfo;
@@ -221,93 +222,78 @@ describe('ResolverBase.StripDeniedReadFieldsFromClientInput', () => {
         noFlsEntity = new EntityInfo(employeeEntityInit(false));
     });
 
-    it('strips a denied-read field from clientNewValues AND input, and returns true', () => {
+    it('REGRESSION: refuses a value for a denied-read field instead of silently dropping it', () => {
         const { input, clientNewValues } = makeClientPayload({ ID: '1', Notes: 'edited', Salary: 0 });
-        const result = resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
+        expect(() => resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(refusalFor('Salary'));
+    });
 
-        expect(result).toBe(true);
-        expect(clientNewValues).not.toHaveProperty('Salary');
-        expect(input).not.toHaveProperty('Salary');
-        expect(clientNewValues).toEqual({ ID: '1', Notes: 'edited' });
+    it('REGRESSION: refuses a key that names no field with the SAME message as a denied one', () => {
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Notes: 'edited', Bogus: 0 });
+        let denied = '';
+        let unknown = '';
+        try { resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), makeClientPayload({ ID: '1', Salary: 0 }).input, { ID: '1', Salary: 0 }); }
+        catch (e) { denied = (e as Error).message; }
+        try { resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues); }
+        catch (e) { unknown = (e as Error).message; }
+
+        expect(unknown).toBe(refusalFor('Bogus'));
+        expect(denied.replace("'Salary'", "'X'")).toBe(unknown.replace("'Bogus'", "'X'"));
     });
 
-    it('removes denied-field entries from OldValues___ (fabricated old values must not drive conflict detection)', () => {
+    it('REGRESSION: refuses a denied field named only in OldValues___', () => {
         const { input, clientNewValues } = makeClientPayload(
-            { ID: '1', Notes: 'edited', Salary: 0 },
+            { ID: '1', Notes: 'edited' },
             [{ Key: 'ID', Value: '1' }, { Key: 'Notes', Value: 'orig' }, { Key: 'Salary', Value: '0' }]
         );
-        resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(input.OldValues___).toEqual([{ Key: 'ID', Value: '1' }, { Key: 'Notes', Value: 'orig' }]);
+        expect(() => resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(refusalFor('Salary'));
     });
 
-    it('bridges Name → CodeName: a denied field with a space is stripped by its CodeName key', () => {
-        // 'Base Salary' arrives from the wire as its CodeName 'Base_Salary'
-        const { input, clientNewValues } = makeClientPayload(
-            { ID: '1', Notes: 'edited', Base_Salary: 100 },
-            [{ Key: 'Base_Salary', Value: '100' }]
-        );
-        const result = resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
+    it('matches the CodeName of a denied field with a space in its name', () => {
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Notes: 'edited', Base_Salary: 100 });
+        expect(() => resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(refusalFor('Base_Salary'));
+    });
 
-        expect(result).toBe(true);
-        expect(clientNewValues).not.toHaveProperty('Base_Salary');
-        expect(input.OldValues___).toEqual([]);
+    it('matches input keys case-insensitively (wire casing must not defeat the gate)', () => {
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', SALARY: 0 });
+        expect(() => resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(refusalFor('SALARY'));
     });
 
-    it('leaves permitted fields and metadata blobs untouched', () => {
+    it('accepts permitted fields and metadata blobs untouched, and returns true', () => {
         const restore = { marker: true };
-        const { input, clientNewValues } = makeClientPayload({ ID: '1', Name: 'Ada', Notes: 'n', Salary: 5 });
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Name: 'Ada', Notes: 'n' }, [{ Key: 'Notes', Value: 'o' }]);
         (input as Record<string, unknown>)['RestoreContext___'] = restore;
-        resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
 
+        expect(resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues)).toBe(true);
         expect(clientNewValues).toEqual({ ID: '1', Name: 'Ada', Notes: 'n' });
         expect(input['RestoreContext___']).toBe(restore);
-        expect(input['Name']).toBe('Ada');
+        expect(input.OldValues___).toEqual([{ Key: 'Notes', Value: 'o' }]);
     });
 
-    it('returns true even when the client sent nothing for the denied field — the truth-load must still be forced', () => {
+    it('returns true when the caller is denied anything, so the truth-load is still forced', () => {
         const { input, clientNewValues } = makeClientPayload({ ID: '1', Notes: 'edited' });
-        const result = resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(result).toBe(true);
-        expect(clientNewValues).toEqual({ ID: '1', Notes: 'edited' });
+        expect(resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues)).toBe(true);
     });
 
     it('is a no-op returning false when the entity has no field security', () => {
-        const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 12345 });
-        const result = resolver.TestStrip(noFlsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(result).toBe(false);
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 12345, Bogus: 1 });
+        expect(resolver.TestStrip(noFlsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues)).toBe(false);
         expect(clientNewValues['Salary']).toBe(12345);
-        expect(input['Salary']).toBe(12345);
     });
 
     it('is a no-op returning false for a user who HOLDS the granting role', () => {
-        const { input, clientNewValues } = makeClientPayload(
-            { ID: '1', Salary: 99000 },
-            [{ Key: 'Salary', Value: '85000' }]
-        );
-        const result = resolver.TestStrip(flsEntity, buildUser([HR_ROLE_ID]), input, clientNewValues);
-
-        expect(result).toBe(false);
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 99000 }, [{ Key: 'Salary', Value: '85000' }]);
+        expect(resolver.TestStrip(flsEntity, buildUser([HR_ROLE_ID]), input, clientNewValues)).toBe(false);
         expect(clientNewValues['Salary']).toBe(99000);
         expect(input.OldValues___).toHaveLength(1);
     });
 
     it('is a no-op returning false without a user', () => {
         const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 1 });
-        const result = resolver.TestStrip(flsEntity, undefined as unknown as UserInfo, input, clientNewValues);
-
-        expect(result).toBe(false);
-        expect(clientNewValues['Salary']).toBe(1);
-    });
-
-    it('matches input keys case-insensitively (wire casing must not defeat the strip)', () => {
-        const { input, clientNewValues } = makeClientPayload({ ID: '1', SALARY: 0 });
-        const result = resolver.TestStrip(flsEntity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(result).toBe(true);
-        expect(clientNewValues).not.toHaveProperty('SALARY');
+        expect(resolver.TestStrip(flsEntity, undefined as unknown as UserInfo, input, clientNewValues)).toBe(false);
     });
 });
 
@@ -318,7 +304,7 @@ describe('ResolverBase.StripDeniedReadFieldsFromClientInput', () => {
 // cannot see. These tests write the forbidden rows DIRECTLY into metadata, bypassing the
 // constraint, and assert the runtime still refuses to produce a write-only outcome.
 
-describe('write-only fields are unreachable, so every denied-read field is stripped', () => {
+describe('write-only fields are unreachable, so a value for any denied-read field is refused', () => {
     const resolver = new TestResolver();
 
     /**
@@ -345,37 +331,11 @@ describe('write-only fields are unreachable, so every denied-read field is strip
         expect(entity.GetDeniedUpdateFields(intern).has('salary')).toBe(true);
     });
 
-    it('strips the value anyway — a client cannot have a legitimate value for a field it never saw', () => {
+    it('refuses the value anyway — a client cannot have a legitimate value for a field it never saw', () => {
         const entity = forbiddenWriteOnlyEntity();
         const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 123456 });
-        const result = resolver.TestStrip(entity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(result).toBe(true); // truth-load still forced — the denied-read set is non-empty
-        expect(clientNewValues).not.toHaveProperty('Salary');
-        expect(input).not.toHaveProperty('Salary');
-    });
-
-    it('removes the OldValues entry too (the client cannot know a true old value)', () => {
-        const entity = forbiddenWriteOnlyEntity();
-        const { input, clientNewValues } = makeClientPayload(
-            { ID: '1', Salary: 123456 },
-            [{ Key: 'ID', Value: '1' }, { Key: 'Salary', Value: '99' }]
-        );
-        resolver.TestStrip(entity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(input.OldValues___).toEqual([{ Key: 'ID', Value: '1' }]);
-        expect(clientNewValues).not.toHaveProperty('Salary');
-    });
-
-    it('strips EVERY denied-read field, with no update-permission split', () => {
-        // Base Salary is denied read AND update; Salary carries the forbidden write-only row.
-        // Both are stripped, because denied-read ∩ denied-update is now just denied-read.
-        const entity = forbiddenWriteOnlyEntity();
-        const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 123456, Base_Salary: 7 });
-        resolver.TestStrip(entity, buildUser([INTERN_ROLE_ID]), input, clientNewValues);
-
-        expect(clientNewValues).not.toHaveProperty('Salary');
-        expect(clientNewValues).not.toHaveProperty('Base_Salary');
+        expect(() => resolver.TestStrip(entity, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(refusalFor('Salary'));
     });
 });
 
@@ -564,3 +524,92 @@ describe('ResolverBase.MustLoadTruthFromDatabase: Update row filters (#4919)', (
         expect(resolver.TestMustLoadTruth(entity, claimsNewStatusAsOld(), false, false, buildUser([INTERN_ROLE_ID]))).toBe(false);
     });
 });
+
+/**
+ * IS-A children. A child carries its parent's fields as mirror fields of its own and nearly never
+ * has its own `EnableFieldLevelSecurity` on, so both guards must ask whether field security
+ * applies through the chain (`FieldLevelSecurityApplies`), not the child's own flag.
+ */
+describe('ResolverBase field-security guards on an IS-A child', () => {
+    const CHILD_ID = 'entity-contractors';
+    let resolver: TestResolver;
+
+    /** A `Contractors` IS-A `Employees` child with its own flag OFF and a mirror of every parent field. */
+    function childOf(parentInit: Record<string, unknown>): EntityInfo {
+        const entities: EntityInfo[] = [];
+        const provider = {
+            EntityByID: (id: string) => entities.find((e) => e.ID === id),
+            Entities: entities,
+        } as unknown as IMetadataProvider;
+        const parentFields = parentInit['Fields'] as Array<Record<string, unknown>>;
+        const childInit: Record<string, unknown> = {
+            ...parentInit,
+            ID: CHILD_ID,
+            Name: 'Contractors',
+            BaseTable: 'Contractor',
+            BaseView: 'vwContractors',
+            ParentID: ENTITY_ID,
+            EnableFieldLevelSecurity: false,
+            Permissions: (parentInit['Permissions'] as Array<Record<string, unknown>>).map((p) => ({ ...p, EntityID: CHILD_ID })),
+            Fields: parentFields.map((f) => ({ ID: `c-${f['ID']}`, EntityID: CHILD_ID, Sequence: f['Sequence'], Name: f['Name'], Entity: 'Contractors', Type: f['Type'], IsPrimaryKey: f['IsPrimaryKey'] })),
+        };
+        entities.push(new EntityInfo(parentInit, provider), new EntityInfo(childInit, provider));
+        return entities[1];
+    }
+
+    beforeEach(() => {
+        resolver = new TestResolver();
+    });
+
+    it('REGRESSION: AssertClientInputFieldSecurity refuses a field the parent denies in the child\'s input', () => {
+        const child = childOf(employeeEntityInit(true));
+        expect(child.EnableFieldLevelSecurity).toBe(false);
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Notes: 'edited', Salary: 0 }, [{ Key: 'Salary', Value: '0' }]);
+
+        expect(() => resolver.TestStrip(child, buildUser([INTERN_ROLE_ID]), input, clientNewValues))
+            .toThrow(FieldSecurityClientInputMessage('Salary', 'Contractors'));
+        const allowed = makeClientPayload({ ID: '1', Notes: 'edited' });
+        expect(resolver.TestStrip(child, buildUser([INTERN_ROLE_ID]), allowed.input, allowed.clientNewValues)).toBe(true);
+    });
+
+    it('AssertClientInputFieldSecurity leaves the child\'s input alone when no ancestor has field security', () => {
+        const child = childOf(employeeEntityInit(false));
+        const { input, clientNewValues } = makeClientPayload({ ID: '1', Salary: 0 });
+        expect(resolver.TestStrip(child, buildUser([INTERN_ROLE_ID]), input, clientNewValues)).toBe(false);
+        expect(clientNewValues).toEqual({ ID: '1', Salary: 0 });
+    });
+
+    /** Employees where the intern may read every field but not update Salary, with tracking off. */
+    function readAllowUpdateDenyInit(withFls: boolean): Record<string, unknown> {
+        const init = employeeEntityInit(withFls);
+        init['TrackRecordChanges'] = false;
+        const fields = init['Fields'] as Array<Record<string, unknown>>;
+        for (const f of fields) {
+            if (f['ID'] !== 'f-id') f['EntityFieldPermissions'] = openTo(f['ID'] as string);
+        }
+        fields.find((f) => f['ID'] === 'f-salary')!['EntityFieldPermissions'] = [
+            ...openTo('f-salary', [HR_ROLE_ID]),
+            { ID: 'f-salary-intern', EntityFieldID: 'f-salary', RoleID: INTERN_ROLE_ID, ReadAccess: 'Allow', UpdateAccess: 'Deny', CreateAccess: 'Deny' },
+        ];
+        return init;
+    }
+
+    const pinnedOldValues = (): ClientInput => ({
+        ID: '1',
+        Notes: 'edited',
+        OldValues___: [{ Key: 'ID', Value: '1' }, { Key: 'Notes', Value: 'original' }, { Key: 'Salary', Value: '999999' }],
+    });
+
+    it('REGRESSION: MustLoadTruthFromDatabase forces the truth-load on a child whose parent has field security', () => {
+        const child = childOf(readAllowUpdateDenyInit(true));
+        child.TrackRecordChanges = false;
+        expect(child.GetDeniedReadFields(buildUser([INTERN_ROLE_ID])).size).toBe(0);
+        expect(resolver.TestMustLoadTruth(child, pinnedOldValues(), false, false)).toBe(true);
+    });
+
+    it('MustLoadTruthFromDatabase keeps the OldValues shortcut on a child when no ancestor has field security', () => {
+        const child = childOf(readAllowUpdateDenyInit(false));
+        child.TrackRecordChanges = false;
+        expect(resolver.TestMustLoadTruth(child, pinnedOldValues(), false, false)).toBe(false);
+    });
+});