@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/FetchEntityVectorsResolver.test.ts

@@ -21,7 +21,7 @@ vi.mock('type-graphql', () => {
     return Object.fromEntries(exportNames.map((name) => [name, decoratorFactory]));
 });
 
-const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined }> = [];
+const runViewCalls: Array<{ params: RunViewParams; contextUser: UserInfo | undefined; provider: unknown }> = [];
 /** Each RunViews call, as the list of entity names it batched. */
 const runViewsBatches: string[][] = [];
 let runViewHandler: RunViewHandler = () => ({ Success: true, Results: [] });
@@ -29,8 +29,12 @@ let runViewHandler: RunViewHandler = () => ({ Success: true, Results: [] });
 vi.mock('@memberjunction/core', async (importOriginal) => {
     const actual = await importOriginal<typeof import('@memberjunction/core')>();
     class MockRunView {
+        constructor(private readonly provider?: unknown) {}
+        static FromMetadataProvider(provider: unknown): MockRunView {
+            return new MockRunView(provider);
+        }
         async RunView(params: RunViewParams, contextUser?: UserInfo): Promise<ViewResult> {
-            runViewCalls.push({ params, contextUser });
+            runViewCalls.push({ params, contextUser, provider: this.provider });
             return runViewHandler(params, contextUser);
         }
         async RunViews(params: RunViewParams[], contextUser?: UserInfo): Promise<ViewResult[]> {
@@ -60,9 +64,13 @@ import type { AppContext } from '../types.js';
 const DOC_ID = 'DOC-1';
 const contextUser = new UserInfo();
 
+/** Entity read and field-level security the external-index path checks, per test. */
+const access = { canRead: true, deniedReadFields: new Set<string>() };
+
 const membersEntity = {
     Name: 'Members',
     PrimaryKeys: [{ Name: 'ID' }],
+    FirstPrimaryKey: { Name: 'ID' },
     Fields: [
         { Name: 'ID', IsNameField: false },
         { Name: 'FirstName', IsNameField: true },
@@ -70,11 +78,16 @@ const membersEntity = {
         { Name: 'Email', IsNameField: false },
     ],
     NameField: undefined,
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: (user: UserInfo) => (user === contextUser ? access.deniedReadFields : new Set<string>()),
 } as unknown as EntityInfo;
 
 const orderLinesEntity = {
     Name: 'Order Lines',
     PrimaryKeys: [{ Name: 'OrderID' }, { Name: 'LineNo' }],
+    FirstPrimaryKey: { Name: 'OrderID' },
+    GetUserPermisions: (user: UserInfo) => ({ CanRead: user === contextUser && access.canRead }),
+    GetDeniedReadFields: () => new Set<string>(),
     Fields: [
         { Name: 'OrderID', IsNameField: false },
         { Name: 'LineNo', IsNameField: false },
@@ -143,6 +156,19 @@ function erdView(rows: Array<Record<string, string>>) {
     };
 }
 
+/**
+ * A fake `Members` view of the rows the caller may read (row-level security already applied):
+ * returns the requested `Fields` of the rows named by an `ID IN ('a','b')` filter.
+ */
+function readableMembersView(readableIDs: string[]) {
+    return (params: RunViewParams): ViewResult => {
+        const idList = /^ID IN \((.*)\)$/.exec(params.ExtraFilter ?? '');
+        const requested = idList ? idList[1].split(',').map((v) => v.trim().replace(/^'|'$/g, '')) : [];
+        const rows = requested.filter((id) => readableIDs.includes(id)).map((id) => ({ ID: id }));
+        return { Success: true, Results: rows.map((r) => Object.fromEntries((params.Fields ?? ['ID']).map((f) => [f, r[f as 'ID']]))) };
+    };
+}
+
 /** The VectorJSON fetches: Entity Record Documents views filtered by ID. */
 function vectorFetches() {
     return callsFor('MJ: Entity Record Documents').filter((c) => c.params.ExtraFilter?.startsWith('ID IN ('));
@@ -160,6 +186,8 @@ describe('FetchEntityVectorsResolver', () => {
     beforeEach(() => {
         runViewCalls.length = 0;
         runViewsBatches.length = 0;
+        access.canRead = true;
+        access.deniedReadFields = new Set<string>();
     });
 
     afterEach(() => {
@@ -202,6 +230,21 @@ describe('FetchEntityVectorsResolver', () => {
             expect(vectorCall.params.IgnoreMaxRows).toBe(true);
         });
 
+        it("REGRESSION: runs every view on the request's provider", async () => {
+            useVectorDB(true);
+            routeViews('Members', {
+                'MJ: Entity Record Documents': erdView(storedRows),
+                Members: () => ({ Success: true, Results: memberRows }),
+            });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, undefined, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('MJ: Entity Record Documents')).toHaveLength(2);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
         it('bypasses the server RunView cache for both Entity Record Documents views, so Fields is honoured', async () => {
             useVectorDB(true);
             routeViews('Members', {
@@ -413,7 +456,7 @@ describe('FetchEntityVectorsResolver', () => {
     describe('index-keyed providers (Pinecone path, unchanged)', () => {
         it('queries the provider index by name and never reads Entity Record Documents', async () => {
             const { queryIndex } = useVectorDB(false);
-            routeViews('Members', {});
+            routeViews('Members', { Members: readableMembersView(['a']) });
 
             const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
 
@@ -427,7 +470,167 @@ describe('FetchEntityVectorsResolver', () => {
             expect(query.vector).toHaveLength(2);
             expect(result.Results).toEqual([{ ID: 'pc-1', Values: [0.5, 0.5], Metadata: JSON.stringify({ Entity: 'Members', RecordID: 'a' }) }]);
             expect(callsFor('MJ: Entity Record Documents')).toHaveLength(0);
+        });
+
+        it('removes metadata keys naming fields the caller may not read', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata: { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' } }] },
+            });
+            access.deniedReadFields = new Set(['email']);
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual({ Entity: 'Members', RecordID: 'a', FirstName: 'Ada' });
+        });
+
+        it('keeps every metadata key for a caller denied nothing', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const metadata = { Entity: 'Members', RecordID: 'a', FirstName: 'Ada', Email: 'ada@secret.org' };
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: [{ id: 'pc-1', values: [0.5, 0.5], metadata }] } });
+            routeViews('Members', { Members: readableMembersView(['a']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(JSON.parse(result.Results[0].Metadata)).toEqual(metadata);
+        });
+
+        it('refuses, without querying the index, a caller who may not read the source entity', async () => {
+            const { queryIndex } = useVectorDB(false);
+            access.canRead = false;
+            routeViews('Members', {});
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+            expect(result.ErrorMessage).toBe('Entity "Members" does not exist or you do not have permission to read it');
+            expect(queryIndex).not.toHaveBeenCalled();
+        });
+    });
+
+    describe('index-keyed providers: rows the caller cannot read', () => {
+        function matchesFor(recordIDs: Array<string | undefined>) {
+            return recordIDs.map((recordID, i) => ({
+                id: `pc-${i}`,
+                values: [i, i],
+                score: 1 - i / 10,
+                metadata: recordID === undefined ? { Entity: 'Members' } : { Entity: 'Members', RecordID: recordID },
+            }));
+        }
+
+        it('drops matches whose record the caller cannot read, keeping the order of the rest', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'ID|bbb', 'ID|ccc']) } });
+            routeViews('Members', { Members: readableMembersView(['ccc', 'aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-2']);
+            expect(result.Results.map((r) => r.Values)).toEqual([[0, 0], [2, 2]]);
+            expect(result.TotalCount).toBe(2);
+        });
+
+        it("REGRESSION: runs every view, the key check included, on the request's provider", async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+            const context = appContext(membersEntity);
+
+            await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, context);
+
+            const requestProvider = context.providers[0].provider;
+            expect(callsFor('Members')).toHaveLength(1);
+            expect(runViewCalls.length).toBeGreaterThan(1);
+            expect(runViewCalls.every((c) => c.provider === requestProvider)).toBe(true);
+        });
+
+        it('checks the matched keys with a simple view of the primary key, as the caller', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa', 'bbb']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa', 'bbb']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-0', 'pc-1']);
+            const [check] = callsFor('Members');
+            expect(check.contextUser).toBe(contextUser);
+            expect(check.params.ExtraFilter).toBe("ID IN ('aaa','bbb')");
+            expect(check.params.Fields).toEqual(['ID']);
+            expect(check.params.ResultType).toBe('simple');
+            expect(check.params.IgnoreMaxRows).toBe(true);
+        });
+
+        it('drops a match with no record ID, or one naming a field that is not the primary key, without querying for it', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined, "Salary|1' OR 1=1 --", 'ID|aaa']) } });
+            routeViews('Members', { Members: readableMembersView(['aaa']) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-2']);
+            expect(callsFor('Members').map((c) => c.params.ExtraFilter)).toEqual(["ID IN ('aaa')"]);
+        });
+
+        it('returns no matches and runs no check when none carries a usable record ID', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor([undefined]) } });
+            routeViews('Members', { Members: readableMembersView([]) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(true);
+            expect(result.Results).toEqual([]);
             expect(callsFor('Members')).toHaveLength(0);
         });
+
+        it('checks composite keys with one clause per record, using the real key columns', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({
+                success: true,
+                data: { matches: [
+                    { id: 'pc-a', values: [1], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-1||LineNo|2' } },
+                    { id: 'pc-b', values: [2], metadata: { Entity: 'Order Lines', RecordID: 'OrderID|o-2||LineNo|1' } },
+                ] },
+            });
+            routeViews('Order Lines', {
+                'Order Lines': () => ({ Success: true, Results: [{ OrderID: 'o-2', LineNo: 1 }] }),
+            });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(orderLinesEntity));
+
+            expect(result.Results.map((r) => r.ID)).toEqual(['pc-b']);
+            const [check] = callsFor('Order Lines');
+            expect(check.params.ExtraFilter).toBe("(OrderID='o-1' AND LineNo='2') OR (OrderID='o-2' AND LineNo='1')");
+            expect(check.params.Fields).toEqual(['OrderID', 'LineNo']);
+        });
+
+        it('splits a large key check into lists of at most 1000, sent in one RunViews batch', async () => {
+            const { queryIndex } = useVectorDB(false);
+            const ids = Array.from({ length: 1500 }, (_, i) => `id-${i}`);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(ids.map((id) => `ID|${id}`)) } });
+            routeViews('Members', { Members: readableMembersView(ids) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 1500, undefined, appContext(membersEntity));
+
+            expect(result.TotalCount).toBe(1500);
+            expect(callsFor('Members').map((c) => (c.params.ExtraFilter ?? '').split(',').length)).toEqual([1000, 500]);
+            expect(runViewsBatches).toEqual([['Members', 'Members']]);
+        });
+
+        it('returns an error result when the key check fails', async () => {
+            const { queryIndex } = useVectorDB(false);
+            queryIndex.mockResolvedValueOnce({ success: true, data: { matches: matchesFor(['ID|aaa']) } });
+            routeViews('Members', { Members: () => ({ Success: false, Results: [], ErrorMessage: 'timeout' }) });
+
+            const result = await new FetchEntityVectorsResolver().FetchEntityVectors(DOC_ID, 50, undefined, appContext(membersEntity));
+
+            expect(result.Success).toBe(false);
+            expect(result.Results).toEqual([]);
+        });
     });
 });

package/src/__tests__/FileResolver.fieldSecurity.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Field-level security on FileResolver's own create path and responses.
+ *
+ * `CreateFile` applies its input with `NewRecord` rather than through the generated create
+ * resolver, so it gates the input itself: a restricted caller's key for a field it may not read,
+ * or a key that names no field, is refused with the same message, before any storage work. The
+ * `File` it returns (and `UploadStorageFile`'s) is the record just saved or reloaded, which is
+ * projected for the caller. The file entity here stands in with the fixture's restricted fields.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ createUploadUrl: vi.fn() }));
+
+vi.mock('@memberjunction/server', () => {
+    const noopDecorator = () => () => undefined;
+    return {
+        Arg: noopDecorator, Ctx: noopDecorator, Field: noopDecorator, FieldResolver: noopDecorator, InputType: noopDecorator,
+        Mutation: noopDecorator, ObjectType: noopDecorator, PubSub: noopDecorator, Query: noopDecorator, Resolver: noopDecorator,
+        Root: noopDecorator, Int: {}, Float: {}, DeleteOptionsInput: class {},
+    };
+});
+vi.mock('../generated/generated.js', () => ({
+    CreateMJFileInput: class {},
+    UpdateMJFileInput: class {},
+    MJFile_: class {},
+    MJFileResolver: class {
+        protected GetUserFromPayload(userPayload: { userRecord?: object } | undefined) {
+            return userPayload?.userRecord;
+        }
+    },
+}));
+vi.mock('@memberjunction/ai-agents', () => ({ readRealtimeRecordingFile: vi.fn() }));
+vi.mock('@memberjunction/graphql-dataprovider', () => ({ FieldMapper: class { MapFields(o: object) { return o; } } }));
+vi.mock('../config.js', () => ({ configInfo: {} }));
+vi.mock('../rest/MediaAccessKeys.js', () => ({ MediaAccessKeyManager: { Instance: {} } }));
+vi.mock('../rest/UploadTokenManager.js', () => ({ UploadTokenManager: { Instance: { Consume: vi.fn() } } }));
+vi.mock('@memberjunction/storage', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/storage')>('@memberjunction/storage');
+    return { ...actual, createUploadUrl: mocks.createUploadUrl };
+});
+
+import type { PubSubEngine } from '@memberjunction/server';
+import { FileResolver } from '../resolvers/FileResolver.js';
+import type { AppContext } from '../types.js';
+import { EmployeeEntity, FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, RefusalFor, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+function fileEntity() {
+    return { EntityInfo: EmployeeEntity(), CheckPermissions: vi.fn(), NewRecord: vi.fn(() => true), GetAll: () => FullWidthEmployeeRow() };
+}
+
+function contextFor(entity: ReturnType<typeof fileEntity>): AppContext {
+    const provider = { GetEntityObject: vi.fn(async () => entity), RunView: vi.fn(), RunViews: vi.fn() };
+    return { providers: [{ provider, type: 'Read-Write' }], userPayload: { userRecord: Intern() } } as unknown as AppContext;
+}
+
+describe('FileResolver.CreateFile: client input is gated for a restricted caller', () => {
+    it.each([
+        ['a denied field', 'Salary'],
+        ['a key that names no field', 'Bogus'],
+    ])('REGRESSION: refuses %s with the same message, before any storage work', async (_label, key) => {
+        const entity = fileEntity();
+        const input = { Name: 'new.pdf', [key]: 1 }; // keys of the stand-in entity
+        await expect(new FileResolver().CreateFile(input as never, contextFor(entity), {} as PubSubEngine))
+            .rejects.toThrow(RefusalFor(key));
+        expect(entity.NewRecord).not.toHaveBeenCalled();
+        expect(mocks.createUploadUrl).not.toHaveBeenCalled();
+    });
+});
+
+describe('FileResolver responses are projected for the caller', () => {
+    it('REGRESSION: the File returned never carries a denied value of a full-width record', () => {
+        const respond = (FileResolver.prototype as unknown as {
+            fileResponse(entity: ReturnType<typeof fileEntity>, user: unknown, provider: unknown): Record<string, unknown>;
+        }).fileResponse;
+
+        const file = respond.call(new FileResolver(), fileEntity(), Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(file)).not.toContain(String(SECRET_SALARY));
+        expect(file).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});

package/src/__tests__/HandoffOfferExpiry.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `agentSessions.handoffOfferExpiry`: MJServer either stops the handoff offer registry's expiry sweep
+ * or puts it on the configured interval. The registry starts the sweep on its own when it loads.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { HandoffOfferRegistry } from '@memberjunction/livekit-room-server';
+import { ApplyHandoffOfferExpirySettings } from '../agentSessions/HandoffOfferExpiry.js';
+
+describe('ApplyHandoffOfferExpirySettings', () => {
+    afterEach(() => {
+        HandoffOfferRegistry.Instance.StartPeriodicSweep(15_000);
+        HandoffOfferRegistry.Instance.StopPeriodicSweep();
+        vi.restoreAllMocks();
+        vi.useRealTimers();
+    });
+
+    it('disabled: stops the sweep, and nothing is read for an hour', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        registry.StartPeriodicSweep(15_000);
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: false, sweepIntervalMs: 15_000 });
+        await vi.advanceTimersByTimeAsync(60 * 60_000);
+
+        expect(sweep).not.toHaveBeenCalled();
+        expect(registry.IsPeriodicSweepScheduled).toBe(false);
+    });
+
+    it('enabled: runs the sweep on the configured interval', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: true, sweepIntervalMs: 120_000 });
+        await vi.advanceTimersByTimeAsync(10 * 60_000);
+
+        expect(sweep).toHaveBeenCalledTimes(5);
+    });
+});

package/src/__tests__/IntegrationRunArtifactAuthorization.test.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect } from 'vitest';
+import type { IntegrationRunManifest } from '@memberjunction/integration-progress-artifacts';
+import { AuthorizeRunArtifact } from '../integration/RunArtifactAuthorization.js';
+
+/**
+ * Who may read a run artifact.
+ *
+ * This is a security boundary, not plumbing. A run artifact is one undivided event stream carrying
+ * migration descriptions, affected table names and error text; an RSU batch can span several
+ * connections, and there is no mechanism to serve a caller a partial view of one. So the rule is
+ * AND — authorized for EVERY connection the run touched — because "any one of them" would hand
+ * connection A's schema-change descriptions to a user who only holds rights on connection B.
+ *
+ * The per-connection check itself (a RunView under the caller's context, so the provider applies
+ * row-level security) is exercised elsewhere; these tests stub it to an allowlist and lock the
+ * COMBINING rule, which is the part that changed.
+ */
+
+/**
+ * A per-connection check that answers from `allowed` and records what it was asked, so the tests can
+ * assert the short-circuit as well as the verdict. Memoization lives in the resolver's cache, so a
+ * shared `asked` list across calls shows exactly how many lookups the rule performed.
+ */
+function checkFor(allowed: string[]): { canRead: (id: string) => Promise<boolean>; asked: string[] } {
+    const asked: string[] = [];
+    const seen = new Map<string, boolean>();
+    return {
+        asked,
+        canRead: async (companyIntegrationID: string): Promise<boolean> => {
+            const cached = seen.get(companyIntegrationID);
+            if (cached !== undefined) return cached;
+            asked.push(companyIntegrationID);
+            const verdict = allowed.includes(companyIntegrationID);
+            seen.set(companyIntegrationID, verdict);
+            return verdict;
+        },
+    };
+}
+
+function manifestOf(over: Partial<IntegrationRunManifest>): IntegrationRunManifest {
+    return { runID: 'r1', runKind: 'RSU', startedAt: new Date().toISOString(), ...over };
+}
+
+describe('run-artifact authorization', () => {
+    it('authorizes a single-connection run for a caller who holds that connection', async () => {
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('authorizes an RSU run at all — the manifest identity is what unblocks it', async () => {
+        // Regression guard for the original defect: an RSU manifest carried no connection, the check
+        // returned false on the missing field, and every RSU run answered "not authorized" to
+        // IntegrationGetRun and IntegrationTailRunEvents.
+        const { canRead } = checkFor(['CI-1']);
+        const withIdentity = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1'] }), canRead);
+        const withoutIdentity = await AuthorizeRunArtifact(manifestOf({}), canRead);
+        expect(withIdentity.Authorized).toBe(true);
+        expect(withoutIdentity.Authorized).toBe(false);
+    });
+
+    it('requires EVERY connection of a multi-connection batch — AND, not any', async () => {
+        // The leak this prevents: a user with rights only on CI-2 reading CI-1's schema-change
+        // descriptions out of the shared batch stream.
+        const { canRead } = checkFor(['CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+    });
+
+    it('denies the batch even when the caller holds all but one of its connections', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-3');
+    });
+
+    it('authorizes a multi-connection batch only for a caller who holds all of them', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('stops at the first denial, so a caller cannot probe what else a run covers', async () => {
+        const { canRead, asked } = checkFor([]);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+        expect(asked).toEqual(['CI-1']);
+    });
+
+    it('denies a run with no connection identity at all, without asking anything', async () => {
+        // Non-tenant-scoped artifacts are not exposed through the per-company endpoints, and an
+        // identity-less run must not become readable as a side effect of runs gaining a set field.
+        const { canRead, asked } = checkFor(['CI-1']);
+        for (const manifest of [{}, { companyIntegrationIDs: [] }]) {
+            const result = await AuthorizeRunArtifact(manifestOf(manifest), canRead);
+            expect(result.Authorized).toBe(false);
+            expect(result.DeniedCompanyIntegrationID).toBeUndefined();
+        }
+        expect(asked).toEqual([]);
+    });
+
+    it('falls back to the singular field for runs written before the set existed', async () => {
+        // Every sync/discovery run carries only `companyIntegrationID`; those must keep working.
+        const { canRead } = checkFor(['CI-9']);
+        const ok = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-9' }), canRead);
+        const denied = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-8' }), canRead);
+        expect(ok.Authorized).toBe(true);
+        expect(denied.Authorized).toBe(false);
+        expect(denied.DeniedCompanyIntegrationID).toBe('CI-8');
+    });
+
+    it('prefers the set over the singular field when both are present', async () => {
+        // A batch that also happens to carry a singular value must still be judged on the whole set.
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1', 'CI-2'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-2');
+    });
+});

package/src/__tests__/MagicLinkKeys.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { generateKeyPairSync } from 'node:crypto';
+
+const logDoubles = vi.hoisted(() => ({
+  LogWarning: vi.fn(),
+  LogStatusEx: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async importOriginal => {
+  const actual = await importOriginal<typeof import('@memberjunction/core')>();
+  return { ...actual, LogWarning: logDoubles.LogWarning, LogStatusEx: logDoubles.LogStatusEx };
+});
+
+import { GetGlobalObjectStore } from '@memberjunction/global';
+import {
+  MagicLinkKeyManager,
+  IsMagicLinkLocalDevEnvironment,
+  EPHEMERAL_MAGIC_LINK_KEY_WARNING,
+} from '../auth/magicLink/MagicLinkKeys.js';
+
+/** Subclass so each test gets its own singleton slot instead of sharing the app-wide instance. */
+class IsolatedKeyManager extends MagicLinkKeyManager {}
+
+function freshManager(): IsolatedKeyManager {
+  const manager = new IsolatedKeyManager();
+  const store = GetGlobalObjectStore();
+  if (store) {
+    delete store[manager.GlobalKey];
+  }
+  return new IsolatedKeyManager();
+}
+
+describe('IsMagicLinkLocalDevEnvironment', () => {
+  it('treats NODE_ENV=production (any case, padded) as not local dev', () => {
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'production' })).toBe(false);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: ' Production ' })).toBe(false);
+  });
+
+  it('treats unset, development and test as local dev', () => {
+    expect(IsMagicLinkLocalDevEnvironment({})).toBe(true);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'development' })).toBe(true);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'test' })).toBe(true);
+  });
+});
+
+describe('MagicLinkKeyManager ephemeral key reporting', () => {
+  let manager: IsolatedKeyManager;
+
+  beforeEach(() => {
+    logDoubles.LogWarning.mockClear();
+    logDoubles.LogStatusEx.mockClear();
+    manager = freshManager();
+  });
+
+  afterEach(() => {
+    const store = GetGlobalObjectStore();
+    if (store) {
+      delete store[manager.GlobalKey];
+    }
+  });
+
+  it('warns in the default output when no key is configured and NODE_ENV=production', () => {
+    manager.Initialize(undefined, { NODE_ENV: 'production' });
+
+    expect(manager.IsEphemeral).toBe(true);
+    expect(logDoubles.LogWarning).toHaveBeenCalledTimes(1);
+    expect(logDoubles.LogWarning).toHaveBeenCalledWith(EPHEMERAL_MAGIC_LINK_KEY_WARNING);
+    expect(logDoubles.LogStatusEx).not.toHaveBeenCalled();
+  });
+
+  it('the warning names the restart and multi-instance consequences and how to configure a key', () => {
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('restarts');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('other MJAPI instance');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('magicLink.rsaPrivateKey');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('MJ_MAGIC_LINK_PRIVATE_KEY');
+  });
+
+  it('keeps the notice verbose-only in local dev', () => {
+    manager.Initialize(undefined, {});
+
+    expect(manager.IsEphemeral).toBe(true);
+    expect(logDoubles.LogWarning).not.toHaveBeenCalled();
+    expect(logDoubles.LogStatusEx).toHaveBeenCalledTimes(1);
+    expect(logDoubles.LogStatusEx.mock.calls[0][0]).toMatchObject({ verboseOnly: true });
+  });
+
+  it('is not ephemeral and logs nothing when a key is configured, even in production', () => {
+    const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+    const pem = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+
+    manager.Initialize(pem, { NODE_ENV: 'production' });
+
+    expect(manager.IsEphemeral).toBe(false);
+    expect(logDoubles.LogWarning).not.toHaveBeenCalled();
+    expect(logDoubles.LogStatusEx).not.toHaveBeenCalled();
+  });
+
+  it('reports IsEphemeral false before initialization', () => {
+    expect(manager.IsEphemeral).toBe(false);
+    expect(manager.IsInitialized).toBe(false);
+  });
+});