@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/QuerySystemUserResolver.collision.test.ts

@@ -0,0 +1,200 @@
+/**
+ * #6007: concurrent `CreateQueryExtended` calls with the same name.
+ *
+ * Every request first checks that the name is free, so N requests that arrive together all pass
+ * the check and then race to insert. The database's unique index on (Name, CategoryID) lets one
+ * win. Before the fix, every loser found the winner's row and returned it as its own result, even
+ * with `AutoResolveCollision`, so N callers shared one query. Now:
+ *
+ * - with `AutoResolveCollision`, a loser picks a new unique name and inserts again (bounded), so
+ *   every request gets its own query;
+ * - without it, the existing create-or-get behaviour stays: losers get the query that now exists;
+ * - the existence lookup reads the database, never a cache.
+ *
+ * The provider is a stub whose saves yield before inserting, so concurrent saves interleave the
+ * way they do against a real database, and whose insert enforces the unique name.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { RunViewParams } from '@memberjunction/core';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = ['Arg', 'Ctx', 'Field', 'InputType', 'Mutation', 'ObjectType', 'Resolver', 'PubSub', 'Int', 'Float'];
+    return { ...Object.fromEntries(exportNames.map((name) => [name, decoratorFactory])), registerEnumType: () => undefined };
+});
+vi.mock('@memberjunction/core-entities-server', () => ({ MJQueryEntityServer: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return { ...actual, AssertClientInputWritableForUser: () => undefined, LogStatus: () => undefined };
+});
+vi.mock('../generated/generated.js', () => ({
+    MJQuery_: class {}, MJQueryField_: class {}, MJQueryParameter_: class {}, MJQueryEntity_: class {}, MJQueryPermission_: class {},
+    MJQueryResolver: class {
+        protected async CheckAPIKeyScopeAuthorization(): Promise<void> { /* authorized */ }
+        protected async AfterCreate(): Promise<void> { /* no event */ }
+        protected ListenForEntityMessages(): void { /* no pub/sub */ }
+        protected async MapFieldNamesToCodeNames(_entityName: string, values: Record<string, unknown>) { return values; }
+    },
+}));
+
+import { MJQueryResolverExtended, CreateQuerySystemUserInput } from '../resolvers/QuerySystemUserResolver.js';
+import type { AppContext } from '../types.js';
+
+/** One stored query row. */
+interface StoredQuery { ID: string; Name: string; CategoryID: string | null }
+
+const CATEGORY = 'C0000000-0000-0000-0000-000000000001';
+let rows: StoredQuery[];
+let lookups: RunViewParams[];
+/** The child-row reads the resolver made, with every cache bypassed or not. */
+let childReads: RunViewParams[];
+/** The field rows stored per query ID, as the database holds them (the query cache holds none). */
+let storedFields: Map<string, Array<{ ID: string; QueryID: string; Name: string; Sequence: number }>>;
+let nextID: number;
+
+/** A query record as the stub provider hands out: its insert yields first and enforces the unique name. */
+class StubQueryRecord {
+    public ID = '';
+    public Name = '';
+    public CategoryID: string | null = null;
+    public ParameterHints?: Map<string, string>;
+    public EntityInfo = {};
+    public LatestResult: { Message: string; CompleteMessage: string } | null = null;
+    public QueryFields = [];
+    public QueryParameters = [];
+    public QueryEntities = [];
+    public QueryPermissions = [];
+
+    SetMany(values: Record<string, unknown>): void {
+        if (typeof values.Name === 'string') this.Name = values.Name;
+        if (typeof values.CategoryID === 'string') this.CategoryID = values.CategoryID;
+    }
+
+    async Save(): Promise<boolean> {
+        await new Promise(resolve => setTimeout(resolve, 1));
+        if (rows.some(r => r.Name.toLowerCase() === this.Name.toLowerCase() && r.CategoryID === this.CategoryID)) {
+            const message = `Cannot insert duplicate key row in object '__mj.Query' with unique index 'UX_Query_Name_CategoryID'. The duplicate key value is (${this.Name}).`;
+            this.LatestResult = { Message: message, CompleteMessage: message };
+            return false;
+        }
+        this.ID = `Q${++nextID}`;
+        rows.push({ ID: this.ID, Name: this.Name, CategoryID: this.CategoryID });
+        return true;
+    }
+
+    async Load(id: string): Promise<boolean> {
+        const row = rows.find(r => r.ID === id);
+        if (!row) return false;
+        Object.assign(this, row);
+        return true;
+    }
+
+    GetAll(): Record<string, unknown> {
+        return { ID: this.ID, Name: this.Name, CategoryID: this.CategoryID };
+    }
+}
+
+const provider = {
+    async GetEntityObject(): Promise<StubQueryRecord> {
+        return new StubQueryRecord();
+    },
+    async RunViews(params: RunViewParams[]) {
+        childReads.push(...params);
+        return params.map(p => {
+            const queryID = /QueryID='(.*)'/.exec(p.ExtraFilter ?? '')?.[1] ?? '';
+            const results = p.EntityName === 'MJ: Query Fields' ? (storedFields.get(queryID) ?? []) : [];
+            return { Success: true, Results: results, RowCount: results.length, TotalRowCount: results.length, ExecutionTime: 0, ErrorMessage: '', UserViewRunID: '' };
+        });
+    },
+    async RunView(params: RunViewParams) {
+        lookups.push(params);
+        await new Promise(resolve => setTimeout(resolve, 0));
+        const name = /LOWER\(Name\) = LOWER\('(.*)'\)/.exec(params.ExtraFilter ?? '')?.[1]?.replace(/''/g, "'") ?? '';
+        const matches = rows.filter(r => r.Name.toLowerCase() === name.toLowerCase() && r.CategoryID === CATEGORY);
+        return { Success: true, Results: matches, RowCount: matches.length, TotalRowCount: matches.length, ExecutionTime: 0, ErrorMessage: '', UserViewRunID: '' };
+    },
+};
+
+const context = {
+    providers: [{ provider, type: 'Read-Write' }],
+    userPayload: { userRecord: { ID: 'user-1', Email: 'u@example.com', UserRoles: [] } },
+} as unknown as AppContext;
+
+function input(name: string, autoResolve: boolean): CreateQuerySystemUserInput {
+    return Object.assign(new CreateQuerySystemUserInput(), { Name: name, CategoryID: CATEGORY, SQL: 'SELECT 1 AS One', AutoResolveCollision: autoResolve });
+}
+
+async function createConcurrently(count: number, name: string, autoResolve: boolean) {
+    const resolver = new MJQueryResolverExtended();
+    const pubSub = { publish: async () => undefined } as unknown as Parameters<MJQueryResolverExtended['CreateQueryExtended']>[2];
+    return Promise.all(Array.from({ length: count }, () => resolver.CreateQueryExtended(input(name, autoResolve), context, pubSub)));
+}
+
+beforeEach(() => {
+    rows = [];
+    lookups = [];
+    childReads = [];
+    storedFields = new Map();
+    nextID = 0;
+});
+
+describe('CreateQueryExtended — concurrent creates with the same name (#6007)', () => {
+    it('with AutoResolveCollision, gives every concurrent request its own query with its own name', async () => {
+        const results = await createConcurrently(8, 'Revenue By Region', true);
+
+        expect(results.every(r => r.Success)).toBe(true);
+        const ids = new Set(results.map(r => r.Query?.ID));
+        const names = new Set(results.map(r => r.Query?.Name));
+        expect(ids.size).toBe(8);
+        expect(names.size).toBe(8);
+        expect(rows).toHaveLength(8);
+        expect([...names]).toContain('Revenue By Region');
+        expect([...names].filter(n => n !== 'Revenue By Region').every(n => /^Revenue By Region \(\d+\)$/.test(String(n)))).toBe(true);
+    });
+
+    it('without AutoResolveCollision, keeps create-or-get: the requests that lose the race get the query that now exists', async () => {
+        const results = await createConcurrently(5, 'Orders Today', false);
+
+        expect(results.every(r => r.Success)).toBe(true);
+        expect(rows).toHaveLength(1);
+        expect(new Set(results.map(r => r.Query?.ID))).toEqual(new Set([rows[0].ID]));
+    });
+
+    it('without AutoResolveCollision, a request that loses the race gets the other query\'s fields, read from the database', async () => {
+        const saveOnce = StubQueryRecord.prototype.Save;
+        vi.spyOn(StubQueryRecord.prototype, 'Save').mockImplementation(async function (this: StubQueryRecord) {
+            const saved = await saveOnce.call(this);
+            if (saved) storedFields.set(this.ID, [{ ID: `${this.ID}-f1`, QueryID: this.ID, Name: 'One', Sequence: 1 }]);
+            return saved;
+        });
+        const results = await createConcurrently(3, 'With Fields', false);
+
+        const winnerID = rows[0].ID;
+        const losers = results.filter(r => r.Fields?.length === 1);
+        expect(losers).toHaveLength(2);
+        expect(losers.every(r => r.Query?.ID === winnerID && r.Fields?.[0].Name === 'One')).toBe(true);
+        expect(childReads.length).toBeGreaterThan(0);
+        expect(childReads.every(r => r.BypassCache === true)).toBe(true);
+    });
+
+    it('reads every existence check from the database, never a cache', async () => {
+        await createConcurrently(3, 'Uncached', true);
+
+        expect(lookups.length).toBeGreaterThan(0);
+        expect(lookups.every(l => l.BypassCache === true)).toBe(true);
+    });
+
+    it('returns the save failure itself when it is not a name race', async () => {
+        vi.spyOn(StubQueryRecord.prototype, 'Save').mockImplementationOnce(async function (this: StubQueryRecord) {
+            this.LatestResult = { Message: 'Query "Bad" was not saved: MJQ_TAG_IN_STRING_LITERAL', CompleteMessage: 'Query "Bad" was not saved: MJQ_TAG_IN_STRING_LITERAL' };
+            return false;
+        });
+        const [result] = await createConcurrently(1, 'Bad', true);
+
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toContain('MJQ_TAG_IN_STRING_LITERAL');
+        expect(rows).toHaveLength(0);
+    });
+});

package/src/__tests__/QuerySystemUserResolver.fieldSecurity.test.ts

@@ -0,0 +1,49 @@
+/**
+ * The saved query that `CreateQueryExtended` / `UpdateQueryExtended` return is mapped for the
+ * CALLER. These mutations are reachable with the `query:create` / `query:update` API-key scopes,
+ * not only by the system user, and the record they return is the one just saved, whose re-read
+ * holds every column. Mapping it with no context user skipped the field-security projection
+ * altogether, so the caller received columns its roles may not read.
+ *
+ * The base resolver is stubbed with the real projection (`ProjectValuesForCaller`) standing in
+ * for its field mapping, so what is pinned is the identity the result is mapped for.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = ['Arg', 'Ctx', 'Field', 'InputType', 'Mutation', 'ObjectType', 'Resolver', 'PubSub', 'Int', 'Float'];
+    return { ...Object.fromEntries(exportNames.map((name) => [name, decoratorFactory])), registerEnumType: () => undefined };
+});
+vi.mock('@memberjunction/core-entities-server', () => ({ MJQueryEntityServer: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('../generated/generated.js', async () => {
+    const { ProjectValuesForCaller } = await import('../generic/fieldSecurityTransport.js');
+    const { EmployeeEntity, NoRecordChangesMetadata } = await import('./fieldSecurityFixtures.js');
+    return {
+        MJQuery_: class {}, MJQueryField_: class {}, MJQueryParameter_: class {}, MJQueryEntity_: class {}, MJQueryPermission_: class {},
+        MJQueryResolver: class {
+            protected async MapFieldNamesToCodeNames(_entityName: string, values: Record<string, unknown>, contextUser?: unknown) {
+                return ProjectValuesForCaller(EmployeeEntity(), values, contextUser as never, NoRecordChangesMetadata);
+            }
+        },
+    };
+});
+
+import { MJQueryResolverExtended } from '../resolvers/QuerySystemUserResolver.js';
+import { FullWidthEmployeeRow, Intern, NoRecordChangesMetadata, SECRET_SALARY } from './fieldSecurityFixtures.js';
+
+describe('QuerySystemUserResolver: the saved query is mapped for the caller', () => {
+    it('REGRESSION: buildSuccessResult never returns a column the caller may not read', async () => {
+        const build = (MJQueryResolverExtended.prototype as unknown as {
+            buildSuccessResult(entity: unknown, user: unknown, provider: unknown): Promise<{ Query: Record<string, unknown> }>;
+        }).buildSuccessResult;
+        const entity = { GetAll: () => FullWidthEmployeeRow(), QueryFields: [], QueryParameters: [], QueryEntities: [], QueryPermissions: [] };
+
+        const result = await build.call(new MJQueryResolverExtended(), entity, Intern(), NoRecordChangesMetadata);
+
+        expect(JSON.stringify(result.Query)).not.toContain(String(SECRET_SALARY));
+        expect(result.Query).toMatchObject({ ID: 'emp-1', Name: 'Ada' });
+    });
+});

package/src/__tests__/QuerySystemUserResolver.permissions.test.ts

@@ -0,0 +1,132 @@
+/**
+ * `CreateQueryExtended` / `UpdateQueryExtended`: a query-permission row that is not saved or not
+ * deleted fails the mutation with the entity's own reason, instead of reporting success.
+ *
+ * The provider is a stub; permission rows are stubs whose Save / Delete report failure on demand.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { RunViewParams } from '@memberjunction/core';
+import { QueryEngine } from '@memberjunction/core-entities';
+
+vi.mock('type-graphql', () => {
+    const decoratorFactory = (..._args: unknown[]) => (..._decorated: unknown[]) => undefined;
+    const exportNames = ['Arg', 'Ctx', 'Field', 'InputType', 'Mutation', 'ObjectType', 'Resolver', 'PubSub', 'Int', 'Float'];
+    return { ...Object.fromEntries(exportNames.map((name) => [name, decoratorFactory])), registerEnumType: () => undefined };
+});
+vi.mock('@memberjunction/core-entities-server', () => ({ MJQueryEntityServer: class {} }));
+vi.mock('../generic/DeleteOptionsInput.js', () => ({ DeleteOptionsInput: class {} }));
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    return { ...actual, AssertClientInputWritableForUser: () => undefined, LogStatus: () => undefined, LogError: () => undefined };
+});
+vi.mock('../generated/generated.js', () => ({
+    MJQuery_: class {}, MJQueryField_: class {}, MJQueryParameter_: class {}, MJQueryEntity_: class {}, MJQueryPermission_: class {},
+    MJQueryResolver: class {
+        protected async CheckAPIKeyScopeAuthorization(): Promise<void> { /* authorized */ }
+        protected async AfterCreate(): Promise<void> { /* no event */ }
+        protected ListenForEntityMessages(): void { /* no pub/sub */ }
+        protected async MapFieldNamesToCodeNames(_entityName: string, values: Record<string, unknown>) { return values; }
+    },
+}));
+
+import { MJQueryResolverExtended, CreateQuerySystemUserInput, UpdateQuerySystemUserInput } from '../resolvers/QuerySystemUserResolver.js';
+import type { AppContext } from '../types.js';
+
+const QUERY_ID = 'Q0000000-0000-0000-0000-000000000001';
+const ROLE = 'R0000000-0000-0000-0000-000000000001';
+const REFUSED = 'The INSERT statement conflicted with the FOREIGN KEY constraint "FK_QueryPermission_Role".';
+
+/** A query or permission row as the stub provider hands out. */
+class StubRecord {
+    public ID = '';
+    public Name = 'Revenue';
+    public CategoryID: string | null = null;
+    public QueryID = '';
+    public RoleID = '';
+    public EntityInfo = {};
+    public LatestResult: { Message: string; CompleteMessage: string } | null = null;
+    public QueryFields = [];
+    public QueryParameters = [];
+    public QueryEntities = [];
+    public QueryPermissions = [];
+    constructor(private readonly entityName: string) {}
+    SetMany(): void { /* fields are not inspected */ }
+    async Load(id: string): Promise<boolean> { this.ID = id; return true; }
+    async Save(): Promise<boolean> {
+        if (this.entityName === 'MJ: Query Permissions' && failPermissionSave) {
+            this.LatestResult = { Message: REFUSED, CompleteMessage: REFUSED };
+            return false;
+        }
+        if (!this.ID) this.ID = QUERY_ID;
+        permissionWrites.push(`${this.entityName}:save`);
+        return true;
+    }
+    GetAll(): Record<string, unknown> { return { ID: this.ID, Name: this.Name }; }
+}
+
+let failPermissionSave: boolean;
+let permissionWrites: string[];
+
+const provider = {
+    async GetEntityObject(entityName: string): Promise<StubRecord> { return new StubRecord(entityName); },
+    async RunView(_params: RunViewParams) {
+        return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ExecutionTime: 0, ErrorMessage: '', UserViewRunID: '' };
+    },
+    async RunViews(params: RunViewParams[]) {
+        return params.map(() => ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ExecutionTime: 0, ErrorMessage: '', UserViewRunID: '' }));
+    },
+};
+
+const context = {
+    providers: [{ provider, type: 'Read-Write' }],
+    userPayload: { userRecord: { ID: 'user-1', Email: 'u@example.com', UserRoles: [] } },
+} as unknown as AppContext;
+const pubSub = { publish: async () => undefined } as unknown as Parameters<MJQueryResolverExtended['CreateQueryExtended']>[2];
+
+/** A stored permission row whose Delete fails with the entity's reason. */
+function undeletablePermission() {
+    return {
+        RoleID: ROLE,
+        LatestResult: { Message: 'Delete refused by row-level security', CompleteMessage: 'Delete refused by row-level security' },
+        Delete: async () => false,
+    };
+}
+
+beforeEach(() => {
+    failPermissionSave = false;
+    permissionWrites = [];
+    vi.restoreAllMocks();
+    vi.spyOn(QueryEngine, 'Instance', 'get').mockReturnValue({ GetQueryPermissions: () => [] } as unknown as QueryEngine);
+});
+
+describe('query permission writes report their failures', () => {
+    it('a create whose permission row is not saved fails, naming the query, the role and the reason', async () => {
+        failPermissionSave = true;
+        const input = Object.assign(new CreateQuerySystemUserInput(), { Name: 'Revenue', SQL: 'SELECT 1 AS One', Permissions: [{ RoleID: ROLE }] });
+        const result = await new MJQueryResolverExtended().CreateQueryExtended(input, context, pubSub);
+
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toContain(`Query 'Revenue' (ID ${QUERY_ID}) was created, but its permissions were not`);
+        expect(result.ErrorMessage).toContain(`role ${ROLE}: ${REFUSED}`);
+    });
+
+    it('an update whose new permission row is not saved fails with the reason', async () => {
+        failPermissionSave = true;
+        const input = Object.assign(new UpdateQuerySystemUserInput(), { ID: QUERY_ID, Permissions: [{ RoleID: ROLE }] });
+        const result = await new MJQueryResolverExtended().UpdateQueryExtended(input, context, pubSub);
+
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toBe(`Failed to update query permissions: Failed to save the query permission for role ${ROLE}: ${REFUSED}`);
+    });
+
+    it('an update whose old permission row is not deleted fails with the reason and saves no new row', async () => {
+        vi.spyOn(QueryEngine, 'Instance', 'get').mockReturnValue({ GetQueryPermissions: () => [undeletablePermission()] } as unknown as QueryEngine);
+        const input = Object.assign(new UpdateQuerySystemUserInput(), { ID: QUERY_ID, Permissions: [{ RoleID: ROLE }] });
+        const result = await new MJQueryResolverExtended().UpdateQueryExtended(input, context, pubSub);
+
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toBe(`Failed to update query permissions: Failed to delete the query permission for role ${ROLE}: Delete refused by row-level security`);
+        expect(permissionWrites).not.toContain('MJ: Query Permissions:save');
+    });
+});

package/src/__tests__/RESTEndpointHandler.test.ts

@@ -110,6 +110,7 @@ interface ReqShape {
     query?: Record<string, string>;
     body?: unknown;
     mjUser?: UserInfo;
+    timeZone?: string;
 }
 
 function makeReq(shape: ReqShape = {}): express.Request {
@@ -118,6 +119,7 @@ function makeReq(shape: ReqShape = {}): express.Request {
         query: shape.query ?? {},
         body: shape.body ?? {},
         mjUser: shape.mjUser ?? MJ_USER,
+        userPayload: { TimeZone: shape.timeZone },
     } as unknown as express.Request;
 }
 
@@ -540,6 +542,17 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual({ Success: true, Results: [{ ID: '1' }] });
         });
 
+        it('drops fields only server code may set, takes the time zone from the header, and keeps the route\'s entity over the body\'s', async () => {
+            mockOpsRunView.mockResolvedValue({ success: true, result: { Success: true, Results: [] } });
+            const handler = makeHandler();
+            const req = makeReq({ params: { entityName: 'Users' }, body: { EntityName: 'Secrets', TimeZone: 'Asia/Tokyo', MaxRows: 5 }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runView(req, res);
+
+            expect(mockOpsRunView).toHaveBeenCalledWith({ EntityName: 'Users', MaxRows: 5, TimeZone: 'Europe/Paris' }, MJ_USER);
+        });
+
         it('maps view-layer failures to 400', async () => {
             mockOpsRunView.mockResolvedValue({ success: false, error: 'does not have permission' });
             const handler = makeHandler();
@@ -591,6 +604,18 @@ describe('RESTEndpointHandler view routes', () => {
             expect(jsonBody()).toEqual([{ Success: true, Results: [] }]);
         });
 
+        it('drops fields only server code may set from every batched view', async () => {
+            mockOpsRunViews.mockResolvedValue({ success: true, results: [{ Success: true, Results: [] }] });
+            const handler = makeHandler();
+            const req = makeReq({ body: { params: [{ EntityName: 'Users', TimeZone: 'Asia/Tokyo' }] }, timeZone: 'Europe/Paris' });
+            const { res } = makeRes();
+
+            await handler.runViews(req, res);
+
+            const [sent] = mockOpsRunViews.mock.calls[0] as [RunViewParams[], UserInfo];
+            expect(sent).toEqual([{ EntityName: 'Users', TimeZone: 'Europe/Paris' }]);
+        });
+
         it('maps view-layer batch failures to 400', async () => {
             mockOpsRunViews.mockResolvedValue({ success: false, error: 'batch failed' });
             const handler = makeHandler();