@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/CustomColumnPromoterCompletion.test.ts

@@ -0,0 +1,142 @@
+/**
+ * Completing a promotion after the restart.
+ *
+ * The post-restart consumer calls CompletePromotion with no catalog scope. Unscoped, a connection
+ * with per-connection rows reads as having none, so building its catalog writer threw
+ * PER_CONNECTION_CATALOG_MISSING. CompletePromotion caught that per entity and returned normally,
+ * and the consumer marked the pending work Completed: the columns existed in the database and were
+ * never mapped, with nothing failed anywhere.
+ *
+ * So: the catalog writes run in the connection's own scope, entered per entry; and a failed entry
+ * no longer returns normally — the others still run, then the failure is thrown, so the consumer
+ * fails the pending row instead of completing it.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+const h = vi.hoisted(() => ({
+    scopeAtBuild: [] as Array<string | undefined>,
+    savedFields: [] as string[],
+}));
+
+vi.mock('@memberjunction/schema-engine', () => ({
+    RuntimeSchemaManager: { get Instance() { return {}; } },
+}));
+vi.mock('@memberjunction/integration-schema-builder', () => ({ DDLGenerator: class {} }));
+
+// The real scope; only the writer is replaced. It behaves as the real one does for a connection
+// with per-connection rows: outside that connection's scope it cannot tell, and refuses.
+vi.mock('@memberjunction/integration-engine', async (orig) => {
+    const actual = await orig<typeof import('@memberjunction/integration-engine')>();
+    return {
+        ...actual,
+        BuildCatalogWriter: () => {
+            const ci = actual.CurrentCatalogCI();
+            h.scopeAtBuild.push(ci);
+            if (!ci) throw new Error('PER_CONNECTION_CATALOG_MISSING: built outside the connection scope');
+            return {
+                ObjectsInScope: async () => [{ Name: 'Members', ID: 'obj-members' }],
+                FieldsForObject: async () => [],
+                LoadField: async () => null,
+                NewFieldRow: async () => {
+                    const row: Record<string, unknown> = {};
+                    return Object.assign(row, { Save: async () => { h.savedFields.push(String(row.Name)); return true; } });
+                },
+                StampNewField: () => undefined,
+            };
+        },
+    };
+});
+
+import type { UserInfo, IMetadataProvider, EntityInfo } from '@memberjunction/core';
+import { IntegrationEngineBase } from '@memberjunction/integration-engine-base';
+import { WithCatalogScope } from '@memberjunction/integration-engine';
+import { IntegrationCustomColumnPromoter } from '../integration/CustomColumnPromoter.js';
+
+const USER = { ID: 'u-1' } as UserInfo;
+const CONN = 'CCCCCCCC-0000-0000-0000-000000000001';
+const OTHER_CONN = 'CCCCCCCC-0000-0000-0000-000000000002';
+
+type Seams = {
+    createIntegrationObjectFields: (integrationID: string, entityMapID: string, objectName: string, named: unknown[]) => Promise<void>;
+    activeFieldMaps: unknown; createFieldMaps: unknown; spreadAndRebaseline: unknown;
+};
+
+function provider(known: string[]): IMetadataProvider {
+    return {
+        EntityByName: (n: string) => (known.includes(n) ? ({ Name: n } as unknown as EntityInfo) : undefined),
+        PlatformKey: 'sqlserver',
+    } as unknown as IMetadataProvider;
+}
+
+const region = { sourceKey: 'region', columnName: 'region', candidate: { Coverage: 0.5, Inferred: { SchemaFieldType: 'nvarchar', MaxLength: 50 } } };
+
+function entry(entityName: string) {
+    return {
+        EntityName: entityName, EntityMapID: `em-${entityName}`, ExternalObjectName: 'Members', IntegrationID: 'int-1',
+        Columns: [{ SourceKey: 'region', ColumnName: 'region', SchemaFieldType: 'nvarchar', MaxLength: 50, Coverage: 0.5 }],
+    };
+}
+
+beforeEach(() => {
+    h.scopeAtBuild.length = 0;
+    h.savedFields.length = 0;
+    // No catalog entities registered: entering a scope loads nothing and reads nothing.
+    vi.spyOn(IntegrationEngineBase.Instance, 'ProviderToUse', 'get').mockImplementation(() => ({ EntityByName: () => undefined }) as never);
+    vi.spyOn(IntegrationEngineBase.Instance, 'EntityMaps', 'get')
+        .mockReturnValue([{ ID: 'em-Members', CompanyIntegrationID: CONN }] as never);
+    vi.spyOn(IntegrationEngineBase.Instance, 'GetCompanyIntegrationByID')
+        .mockImplementation((id: string) => ({ ID: id }) as never);
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+afterEach(() => { vi.restoreAllMocks(); });
+
+describe('the catalog writes of a promotion run in the connection\'s own scope', () => {
+    it('called with no scope (the post-restart consumer), the writer is built in the connection\'s scope', async () => {
+        const promoter = new IntegrationCustomColumnPromoter(USER, provider([])) as unknown as Seams;
+        await promoter.createIntegrationObjectFields('int-1', 'em-Members', 'Members', [region]);
+        expect(h.scopeAtBuild).toEqual([CONN]);
+        expect(h.savedFields).toEqual(['region']);
+    });
+
+    it('called inside another connection\'s scope, the entry\'s own connection wins', async () => {
+        const promoter = new IntegrationCustomColumnPromoter(USER, provider([])) as unknown as Seams;
+        await WithCatalogScope(OTHER_CONN, () => promoter.createIntegrationObjectFields('int-1', 'em-Members', 'Members', [region]), USER);
+        expect(h.scopeAtBuild).toEqual([CONN]);
+    });
+});
+
+describe('CompletePromotion does not complete over a failed entity', () => {
+    function stub(known: string[], failing: string[] = []) {
+        const promoter = new IntegrationCustomColumnPromoter(USER, provider(known));
+        const p = promoter as unknown as Seams;
+        p.activeFieldMaps = vi.fn().mockResolvedValue(new Map<string, string>());
+        p.createIntegrationObjectFields = vi.fn(async (_i: string, emID: string) => {
+            if (failing.some(f => emID === `em-${f}`)) throw new Error('PER_CONNECTION_CATALOG_MISSING');
+        });
+        const maps = vi.fn().mockResolvedValue(undefined);
+        p.createFieldMaps = maps;
+        p.spreadAndRebaseline = vi.fn().mockResolvedValue(undefined);
+        return { promoter, maps };
+    }
+
+    it('every entry completes: returns the columns and throws nothing', async () => {
+        const { promoter } = stub(['A', 'B']);
+        await expect(promoter.CompletePromotion([entry('A'), entry('B')])).resolves.toEqual([
+            { EntityName: 'A', ColumnName: 'region' },
+            { EntityName: 'B', ColumnName: 'region' },
+        ]);
+    });
+
+    it('one entry fails: the others still complete, then it throws naming the failed one', async () => {
+        const { promoter, maps } = stub(['A', 'B'], ['A']);
+        await expect(promoter.CompletePromotion([entry('A'), entry('B')]))
+            .rejects.toThrow(/PROMOTION_INCOMPLETE: 1 of 2 .*A: PER_CONNECTION_CATALOG_MISSING/);
+        expect(maps).toHaveBeenCalledTimes(1);   // B's field maps were still created
+    });
+
+    it('an entity that is not found after the restart is a failure, not a skip', async () => {
+        const { promoter } = stub(['B']);
+        await expect(promoter.CompletePromotion([entry('A'), entry('B')]))
+            .rejects.toThrow(/PROMOTION_INCOMPLETE: 1 of 2 .*A: entity not found/);
+    });
+});

package/src/__tests__/CustomColumnPromoterOnePass.test.ts

@@ -14,10 +14,19 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 
 const runPipelineBatchMock = vi.fn();
+/**
+ * MJ-APPLY-6 — the BARE, non-retrying entry point. Bound separately so a regression back to it is
+ * an assertion failure rather than an invisible loss of the retry. Promotion runs unattended
+ * mid-sync; a transient pipeline step failing there drops the whole promotion silently.
+ */
+const runPipelineBatchBareMock = vi.fn();
 vi.mock('@memberjunction/schema-engine', () => ({
     RuntimeSchemaManager: {
         get Instance() {
-            return { RunPipelineBatch: runPipelineBatchMock };
+            return {
+                RunPipelineBatch: runPipelineBatchBareMock,
+                RunPipelineBatchWithRetry: runPipelineBatchMock,
+            };
         },
     },
 }));
@@ -104,6 +113,7 @@ function stubPromoter(
 
 beforeEach(() => {
     runPipelineBatchMock.mockReset();
+    runPipelineBatchBareMock.mockReset();
 });
 
 describe('PromoteForSync — one batched RSU pass', () => {
@@ -122,6 +132,10 @@ describe('PromoteForSync — one batched RSU pass', () => {
         const result = await promoter.PromoteForSync('ci-1', ['A', 'B', 'C']);
 
         expect(runPipelineBatchMock).toHaveBeenCalledTimes(1);
+        // MJ-APPLY-6 — the ONE pass has to be the RETRYING one. Promotion is unattended: a
+        // transient ExecuteMigration/RunCodeGen/Compile/Restart failure with no replay drops every
+        // accepted column back into overflow and nothing reruns it.
+        expect(runPipelineBatchBareMock).not.toHaveBeenCalled();
         expect(runPipelineBatchMock.mock.calls[0][0]).toHaveLength(3);
         expect(result.Promoted).toBe(true);
         expect(result.ColumnsAdded).toEqual([

package/src/__tests__/DeleteConnectionRemovesPerConnectionCatalog.test.ts

@@ -0,0 +1,51 @@
+/**
+ * The per-connection catalog rows carry a plain FK to the connection and nothing cascades, so a
+ * connection that ever ran a discovery on it could not be deleted at all: the CompanyIntegration
+ * delete violated the constraint and the whole cascade rolled back (MJ-CAT-18). The fix deletes
+ * the field rows, then the object rows, inside the same transaction group, before the connection.
+ *
+ * Pinned from source, like PostRestartMapsInCatalogScope: the delete is a transaction over a live
+ * provider, and the fact being pinned is ORDER inside one method body.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC = readFileSync(join(__dirname, '..', 'resolvers', 'IntegrationDiscoveryResolver.ts'), 'utf-8');
+const start = SRC.indexOf('async IntegrationDeleteConnection(');
+const end = SRC.indexOf('// ── SCHEMA EVOLUTION', start);
+const BODY = SRC.slice(start, end);
+
+describe('IntegrationDeleteConnection removes the per-connection catalog before the connection', () => {
+  it('is scoped to the method body', () => {
+    expect(start).toBeGreaterThan(0);
+    expect(end).toBeGreaterThan(start);
+  });
+
+  it('deletes per-connection fields, then objects, then the CompanyIntegration — in that order', () => {
+    const fields = BODY.indexOf("EntityName: 'MJ: Company Integration Object Fields'");
+    const objects = BODY.indexOf("EntityName: 'MJ: Company Integration Objects'");
+    const fieldDelete = BODY.indexOf('field.TransactionGroup = tg;');
+    const objectDelete = BODY.indexOf('object.TransactionGroup = tg;');
+    const ciDelete = BODY.indexOf('ci.TransactionGroup = tg;');
+    expect(objects).toBeGreaterThan(0);
+    expect(fields).toBeGreaterThan(objects);
+    expect(fieldDelete).toBeGreaterThan(fields);
+    expect(objectDelete).toBeGreaterThan(fieldDelete);
+    expect(ciDelete).toBeGreaterThan(objectDelete);
+  });
+
+  it('queues every catalog delete on the same transaction group as the cascade', () => {
+    expect(BODY).toMatch(/field\.TransactionGroup = tg;\s*await field\.Delete\(\);/);
+    expect(BODY).toMatch(/object\.TransactionGroup = tg;\s*await object\.Delete\(\);/);
+  });
+
+  it('is guarded on the catalog entities being registered, so an unmigrated workspace is untouched', () => {
+    expect(BODY).toMatch(/md\.Entities\.some\(e => e\.Name === 'MJ: Company Integration Objects'\)/);
+  });
+
+  it('selects the fields by the objects of THIS connection only', () => {
+    expect(BODY).toMatch(/ExtraFilter: `CompanyIntegrationID='\$\{companyIntegrationID\}'`,\s*ResultType: 'entity_object',\s*\}, sysUser\);\s*const perConnectionObjects/);
+    expect(BODY).toMatch(/ExtraFilter: `CompanyIntegrationObjectID IN \(\$\{objectIDs\}\)`/);
+  });
+});

package/src/__tests__/DetachedDiscoveryStart.test.ts

@@ -0,0 +1,65 @@
+/**
+ * plan.md: "going to a page should NEVER, NEVER trigger such things automatically, it must in a
+ * very clean way tell the user to click a button to start discovery of tables".
+ *
+ * A button needs a call that returns at once. The only discovery entry point that existed was
+ * synchronous - it runs the whole pipeline inline and times out at the gateway on a large catalog -
+ * so both wizards auto-triggered on page entry and adopted whatever run they happened to find.
+ * IntegrationStartSchemaRefresh is the explicit start: it returns a tailable RunID immediately.
+ *
+ * Source-level, for the same reason the sibling default tests are: these are decorator and
+ * argument shapes, and invoking the resolver needs a provider, a connector driver and the RSU
+ * pipeline stood up.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC = readFileSync(
+  join(__dirname, '..', 'resolvers', 'IntegrationDiscoveryResolver.ts'), 'utf-8');
+
+function methodBody(name: string): string {
+  const start = SRC.indexOf(`async ${name}(`);
+  expect(start, `${name} not found`).toBeGreaterThan(-1);
+  const rest = SRC.slice(start);
+  const end = rest.search(/\n    @(Query|Mutation)\(/);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+describe('IntegrationStartSchemaRefresh', () => {
+  it('exists as a mutation', () => {
+    expect(SRC).toMatch(/@Mutation\(\(\) => StartSchemaRefreshOutput\)/);
+    expect(SRC).toMatch(/async IntegrationStartSchemaRefresh\(/);
+  });
+
+  it('launches DETACHED rather than awaiting the pipeline', () => {
+    const body = methodBody('IntegrationStartSchemaRefresh');
+    expect(body).toMatch(/startSchemaRefreshPipelineDetached\(/);
+    // an await on the pipeline would reintroduce the gateway timeout this exists to avoid
+    expect(body).not.toMatch(/await this\.runSchemaRefreshPipeline\(/);
+  });
+
+  it('refuses a second start with the reason, instead of handing back a doomed RunID', () => {
+    const body = methodBody('IntegrationStartSchemaRefresh');
+    expect(body).toMatch(/GetMaintenanceLock\(/);
+    expect(body).toMatch(/RunID: 'not-started'/);
+    expect(body).toMatch(/BlockedBy/);
+  });
+
+  it('probes the lock BEFORE launching, or the refusal is useless', () => {
+    const body = methodBody('IntegrationStartSchemaRefresh');
+    expect(body.indexOf('GetMaintenanceLock('))
+      .toBeLessThan(body.indexOf('startSchemaRefreshPipelineDetached('));
+  });
+
+  it('uses the read-write provider, since the pipeline writes the catalog', () => {
+    expect(methodBody('IntegrationStartSchemaRefresh')).toMatch(/GetReadWriteProvider\(/);
+  });
+
+  it('is a separate mutation, so the synchronous one keeps its real-counts contract', () => {
+    // the synchronous reply promises counts because it waited; a detached launch has only zeros
+    expect(SRC).toMatch(/async IntegrationRefreshConnectorSchema\(/);
+    const detached = methodBody('IntegrationStartSchemaRefresh');
+    expect(detached).not.toMatch(/ObjectsCreated/);
+  });
+});

package/src/__tests__/DurableEntityActionTaskSubmitter.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+
+const { submitMock } = vi.hoisted(() => ({
+    submitMock: vi.fn(),
+}));
+
+vi.mock('@memberjunction/task-graph', () => ({
+    TaskGraphService: class {
+        public Submit = submitMock;
+    },
+}));
+
+import { DurableEntityActionTaskSubmitter } from '../services/DurableEntityActionTaskSubmitter.js';
+
+describe('DurableEntityActionTaskSubmitter', () => {
+    const contextUser = { ID: 'user-1', Email: 'test@example.com' } as UserInfo;
+
+    beforeEach(() => {
+        submitMock.mockReset();
+        submitMock.mockResolvedValue({ Success: true, ParentTaskID: 'parent-task-1' });
+    });
+
+    it('enlists in request.Provider when supplied instead of minting an isolated provider connection', async () => {
+        const savingProvider = { Name: 'saving-tx-provider', GetEntityObject: vi.fn() } as object as IMetadataProvider;
+        const createProvider = vi.fn();
+        const submitter = new DurableEntityActionTaskSubmitter({ CreateProvider: createProvider }, 'env-1');
+
+        const result = await submitter.Submit({
+            EntityActionID: 'ea-1',
+            ActionID: 'act-1',
+            ActionName: 'Send Order Webhook',
+            EntityID: 'ent-1',
+            EntityName: 'Orders',
+            RecordID: 'ID|ord-1',
+            InvocationType: 'AfterCreate',
+            RedactedParams: { OrderID: 'ord-1' },
+            ContextUser: contextUser,
+            Provider: savingProvider,
+        });
+
+        expect(result).toEqual({ Success: true, ParentTaskID: 'parent-task-1' });
+        expect(createProvider).not.toHaveBeenCalled();
+        expect(submitMock).toHaveBeenCalledTimes(1);
+        expect(submitMock.mock.calls[0][1]).toMatchObject({
+            EnvironmentID: 'env-1',
+            ContextUser: contextUser,
+            Provider: savingProvider,
+        });
+    });
+
+    it('falls back to providerFactory.CreateProvider() when request.Provider is omitted', async () => {
+        const factoryProvider = { Name: 'factory-provider' } as IMetadataProvider;
+        const createProvider = vi.fn().mockResolvedValue(factoryProvider);
+        const submitter = new DurableEntityActionTaskSubmitter({ CreateProvider: createProvider }, 'env-1');
+
+        const result = await submitter.Submit({
+            EntityActionID: 'ea-1',
+            ActionID: 'act-1',
+            ActionName: 'Send Order Webhook',
+            EntityID: 'ent-1',
+            EntityName: 'Orders',
+            RecordID: 'ID|ord-1',
+            InvocationType: 'AfterCreate',
+            RedactedParams: {},
+            ContextUser: contextUser,
+        });
+
+        expect(result).toEqual({ Success: true, ParentTaskID: 'parent-task-1' });
+        expect(createProvider).toHaveBeenCalledTimes(1);
+        expect(submitMock.mock.calls[0][1]).toMatchObject({ Provider: factoryProvider });
+    });
+});

package/src/__tests__/EntityCommunicationsResolver.actingUser.test.ts

@@ -0,0 +1,151 @@
+// The resolver module pulls in type-graphql decorators, which need the Reflect.metadata polyfill.
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import type { EntityCommunicationParams } from '@memberjunction/entity-communications-base';
+
+/**
+ * `RunEntityCommunicationByViewID` with `previewOnly` + `includeProcessedMessages` returns the rows
+ * it read. It must hand the engine the authenticated caller as the acting user, and screen the
+ * view's client-supplied clauses the way a RunView request is screened, because this entry point
+ * does not pass through the RunView resolvers.
+ */
+
+const { captured } = vi.hoisted(() => ({ captured: { params: [] as EntityCommunicationParams[] } }));
+
+// The resolver's input types declare fields without explicit GraphQL types; the test runner emits no
+// decorator metadata, so the decorators are stubbed out.
+vi.mock('type-graphql', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+        ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+        Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+        Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+        createUnionType: () => class {},
+        AuthorizationError: class AuthorizationError extends Error {},
+        Float: class {}, Int: class {}, ID: class {},
+    };
+});
+
+vi.mock('@memberjunction/entity-communications-server', () => ({
+    EntityCommunicationsEngine: {
+        Instance: {
+            Config: vi.fn(),
+            RunEntityCommunication: vi.fn(async (params: EntityCommunicationParams) => {
+                captured.params.push(params);
+                return { Success: true, Results: [] };
+            }),
+        },
+    },
+}));
+
+vi.mock('@memberjunction/templates', () => ({
+    TemplateEngineServer: { Instance: { Config: vi.fn(), FindTemplate: vi.fn() } },
+}));
+
+import { ReportResolver } from '../resolvers/EntityCommunicationsResolver.js';
+import type { AppContext } from '../types.js';
+import type { RunViewByIDInput } from '../generic/RunViewResolver.js';
+import type { CommunicationMessageInput } from '../resolvers/EntityCommunicationsResolver.js';
+
+const SENDER = { ID: 'sender', Email: 'sender@example.com' } as UserInfo;
+
+/** Entity metadata the clause screen reads: one entity the sender can read, one it cannot. */
+function fakeProvider(): DatabaseProviderBase {
+    const entity = (name: string, view: string, canRead: boolean) => ({
+        ID: name,
+        Name: name,
+        SchemaName: '__mj',
+        BaseView: view,
+        BaseTable: view.replace(/^vw/, ''),
+        Fields: [{ Name: 'ID', NeedsQuotes: true }, { Name: 'Email', NeedsQuotes: true }],
+        GetUserPermisions: () => ({ CanRead: canRead }),
+        GetEffectiveRowFilterWhereClause: () => '',
+        GetDeniedReadFields: () => new Set<string>(),
+    });
+    return {
+        Entities: [entity('Customers', 'vwCustomers', true), entity('Salaries', 'vwSalaries', false)],
+        GetEntityObject: async () => fakeView(),
+    } as unknown as DatabaseProviderBase;
+}
+
+/** Saved views by ID, as the caller can load them: `view-1` is a Customers view, `view-salaries` is not. */
+const VIEWS: Record<string, { ID: string; EntityID: string }> = {
+    'view-1': { ID: 'view-1', EntityID: 'Customers' },
+    'view-salaries': { ID: 'view-salaries', EntityID: 'Salaries' },
+};
+
+function fakeView() {
+    const view = {
+        ID: undefined as string | undefined,
+        EntityID: undefined as string | undefined,
+        async Load(id: string) {
+            const found = VIEWS[id];
+            if (!found) return false;
+            Object.assign(view, found);
+            return true;
+        },
+    };
+    return view;
+}
+
+function context(): AppContext {
+    return {
+        userPayload: { email: SENDER.Email, userRecord: SENDER },
+        providers: [{ provider: fakeProvider(), type: 'Read-Write' }],
+    } as unknown as AppContext;
+}
+
+function run(extraFilter?: string, viewID = 'view-1') {
+    const viewInput = { ViewID: viewID, ExtraFilter: extraFilter } as RunViewByIDInput;
+    const message = { MessageType: {}, From: 'a@example.com', To: '' } as unknown as CommunicationMessageInput;
+    return new ReportResolver().RunEntityCommunicationByViewID('Customers', viewInput, 'SendGrid', 'Email', message, true, true, context());
+}
+
+describe('RunEntityCommunicationByViewID — runs as the caller', () => {
+    beforeEach(() => {
+        captured.params = [];
+    });
+
+    it('passes the authenticated caller to the engine as the acting user', async () => {
+        const result = await run();
+        expect(result.Success).toBe(true);
+        expect(captured.params).toHaveLength(1);
+        expect(captured.params[0].ContextUser).toBe(SENDER);
+    });
+
+    it('refuses an ExtraFilter whose subquery reads an entity the caller cannot read, before the engine runs', async () => {
+        const result = await run("ID IN (SELECT ID FROM __mj.vwSalaries WHERE Amount > 100000)");
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+        expect(captured.params).toHaveLength(0);
+    });
+
+    it('refuses an ExtraFilter that carries a second statement', async () => {
+        const result = await run("1=1; SELECT 1");
+        expect(result.Success).toBe(false);
+        expect(captured.params).toHaveLength(0);
+    });
+});
+
+describe('RunEntityCommunicationByViewID — the view must belong to the entity', () => {
+    beforeEach(() => {
+        captured.params = [];
+    });
+
+    it('refuses a view of a different entity, before the engine runs', async () => {
+        const result = await run(undefined, 'view-salaries');
+        expect(result.Success).toBe(false);
+        expect(captured.params).toHaveLength(0);
+    });
+
+    it('gives the same error for a view of another entity as for a view that does not exist', async () => {
+        const mismatched = await run(undefined, 'view-salaries');
+        const missing = await run(undefined, 'view-missing');
+        expect(missing.Success).toBe(false);
+        expect(mismatched.ErrorMessage).toBe(missing.ErrorMessage);
+        expect(mismatched.ErrorMessage).toMatch(/does not exist or you do not have access/);
+        expect(captured.params).toHaveLength(0);
+    });
+});