@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/magicLinkExtensionCapabilities.test.ts

@@ -0,0 +1,413 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockCorsConfig } = vi.hoisted(() => ({
+    mockCorsConfig: {
+        allowedOrigins: ['https://portal.example.com', 'https://forms.example.com'],
+    },
+}));
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+    UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+    CommunicationEngine: {
+        Instance: {
+            Config: vi.fn(async () => undefined),
+            SendSingleMessage: vi.fn(async () => ({ Success: true })),
+        },
+    },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+    Message: class {
+        From = '';
+        To = '';
+        Subject = '';
+        Body = '';
+        HTMLBody = '';
+    },
+}));
+vi.mock('../config.js', () => ({
+    configInfo: {
+        cors: mockCorsConfig,
+    },
+}));
+vi.mock('../isolatedProvider.js', () => ({
+    CreateIsolatedProvider: async () => {
+        throw new Error('provisioning is not exercised in this suite');
+    },
+}));
+
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import { CommunicationEngine } from '@memberjunction/communication-engine';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+import { MagicLinkService, IsMagicLinkRedirectUrlAllowed } from '../auth/magicLink/MagicLinkService.js';
+import { BuildSessionClaims, HashToken } from '../auth/magicLink/magicLinkCore.js';
+
+interface StoredInviteState {
+    ID: string;
+    TokenHash: string;
+    Email: string | null;
+    ApplicationID: string;
+    RoleID: string;
+    ExpiresAt: Date;
+    MaxUses: number;
+    UseCount: number;
+    CreatedByUserID: string;
+    Status: MJMagicLinkInviteEntity['Status'];
+}
+
+function makeConfig(overrides: Partial<MagicLinkConfig> = {}): MagicLinkConfig {
+    return {
+        enabled: true,
+        audience: 'mj-magic-link',
+        restrictedRoleName: 'External Guest',
+        grantableRoleNames: ['External Guest'],
+        inviteIssuerRoleNames: ['Invite Issuer'],
+        defaultExpiresInHours: 24,
+        sessionTokenTtlHours: 8,
+        explorerUrl: 'https://explorer.example.com',
+        communicationProvider: 'SendGrid',
+        fromAddress: 'noreply@example.com',
+        provisioningGuard: 'block',
+        rateLimitWindowMs: 60_000,
+        redeemRateLimitMax: 20,
+        createRateLimitMax: 20,
+        ...overrides,
+    };
+}
+
+function makeFakeProvider(storedInvites: Map<string, StoredInviteState>): IMetadataProvider {
+    let seq = 1;
+    const provider = {
+        Roles: [{ ID: 'role-guest', Name: 'External Guest' }],
+        Applications: [{ ID: 'app-forms', Name: 'Public Forms', Path: 'public-forms' }],
+        GetEntityObject: async (entityName: string) => {
+            if (entityName === 'MJ: Magic Link Invites') {
+                const record: StoredInviteState & {
+                    NewRecord: () => void;
+                    Load: (id: string) => Promise<boolean>;
+                    Save: () => Promise<boolean>;
+                    LatestResult?: { CompleteMessage: string };
+                } = {
+                    ID: '',
+                    TokenHash: '',
+                    Email: null,
+                    ApplicationID: '',
+                    RoleID: '',
+                    ExpiresAt: new Date(),
+                    MaxUses: 1,
+                    UseCount: 0,
+                    CreatedByUserID: '',
+                    Status: 'Active',
+                    NewRecord: () => {
+                        record.ID = `invite-${seq++}`;
+                    },
+                    Load: async (id: string) => {
+                        const existing = storedInvites.get(id);
+                        if (!existing) {
+                            return false;
+                        }
+                        Object.assign(record, existing);
+                        return true;
+                    },
+                    Save: async () => {
+                        storedInvites.set(record.ID, {
+                            ID: record.ID,
+                            TokenHash: record.TokenHash,
+                            Email: record.Email,
+                            ApplicationID: record.ApplicationID,
+                            RoleID: record.RoleID,
+                            ExpiresAt: record.ExpiresAt,
+                            MaxUses: record.MaxUses,
+                            UseCount: record.UseCount,
+                            CreatedByUserID: record.CreatedByUserID,
+                            Status: record.Status,
+                        });
+                        return true;
+                    },
+                };
+                return record;
+            }
+            return {
+                NewRecord: () => undefined,
+                Save: async () => true,
+            };
+        },
+    };
+    return provider as object as IMetadataProvider;
+}
+
+describe('MagicLinkService programmatic extension capabilities (Item 3.6)', () => {
+    const ownerUser = {
+        ID: 'user-owner',
+        Email: 'owner@example.com',
+        Type: 'Owner',
+        UserRoles: [],
+    } as object as UserInfo;
+
+    const regularUser = {
+        ID: 'user-guest',
+        Email: 'guest@example.com',
+        Type: 'User',
+        UserRoles: [{ Role: 'External Guest' }],
+    } as object as UserInfo;
+
+    beforeEach(() => {
+        mockCorsConfig.allowedOrigins = ['https://portal.example.com', 'https://forms.example.com'];
+        MagicLinkKeyManager.Instance.Initialize();
+        vi.clearAllMocks();
+    });
+
+    describe('IsMagicLinkRedirectUrlAllowed', () => {
+        it('allows matching http(s) origins and rejects non-http schemes, unlisted origins, and wildcard *', () => {
+            const allowed = ['https://explorer.example.com', 'https://forms.example.com:8443'];
+            expect(IsMagicLinkRedirectUrlAllowed('https://forms.example.com:8443/respond/abc?step=2', allowed)).toBe(true);
+            expect(IsMagicLinkRedirectUrlAllowed('https://evil.example.com/phish', allowed)).toBe(false);
+            expect(IsMagicLinkRedirectUrlAllowed('javascript:alert(1)', allowed)).toBe(false);
+            expect(IsMagicLinkRedirectUrlAllowed('https://anywhere.example/cb', ['*'])).toBe(false);
+            expect(IsMagicLinkRedirectUrlAllowed('https://anywhere.example.org/ok', ['*', ''])).toBe(false);
+        });
+    });
+
+    describe('CreateInvite RedirectUrl & SendEmail controls', () => {
+        it('binds a permitted RedirectUrl via RS256 and skips default email when SendEmail=false', async () => {
+            const invites = new Map<string, StoredInviteState>();
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+
+            const res = await service.CreateInvite(
+                {
+                    email: 'respondent@example.com',
+                    ApplicationId: 'app-forms',
+                    RedirectUrl: 'https://forms.example.com/survey/42',
+                    SendEmail: false,
+                },
+                ownerUser,
+                provider,
+            );
+
+            expect(res.success).toBe(true);
+            expect(res.emailSent).toBe(false);
+            expect(res.rawToken).toBeDefined();
+            expect(CommunicationEngine.Instance.SendSingleMessage).not.toHaveBeenCalled();
+
+            const url = new URL(res.redemptionUrl!);
+            const rt = url.searchParams.get('rt') ?? undefined;
+            expect(rt).toBeTruthy();
+
+            // Validated against matching rawToken
+            expect(service.ResolveVerifiedRedirectUrl(res.rawToken!, rt)).toBe('https://forms.example.com/survey/42');
+            // Fails closed if an attacker swaps `rt` onto a different invite's token
+            expect(service.ResolveVerifiedRedirectUrl('mj_ml_0000000000000000000000000000000000000000000000000000000000000000', rt)).toBeUndefined();
+        });
+
+        it('rejects disallowed RedirectUrl origins with invalid_redirect_url', async () => {
+            const invites = new Map<string, StoredInviteState>();
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+
+            const res = await service.CreateInvite(
+                {
+                    email: 'respondent@example.com',
+                    ApplicationId: 'app-forms',
+                    RedirectUrl: 'https://attacker.invalid/steal',
+                },
+                ownerUser,
+                provider,
+            );
+
+            expect(res.success).toBe(false);
+            expect(res.errorCode).toBe('invalid_redirect_url');
+            expect(invites.size).toBe(0);
+        });
+
+        it('ignores wildcard * in cors.allowedOrigins while honoring explicit magicLink.allowedRedirectOrigins', async () => {
+            mockCorsConfig.allowedOrigins = ['*'];
+            const invites = new Map<string, StoredInviteState>();
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService(
+                'https://api.example.com',
+                makeConfig({
+                    explorerUrl: 'https://explorer.example.com',
+                    allowedRedirectOrigins: ['https://surveys.example.com'],
+                }),
+            );
+
+            // Wildcard CORS does NOT open up arbitrary redirect origins
+            const rejected = await service.CreateInvite(
+                {
+                    email: 'respondent@example.com',
+                    ApplicationId: 'app-forms',
+                    RedirectUrl: 'https://anywhere.example/cb',
+                    SendEmail: false,
+                },
+                ownerUser,
+                provider,
+            );
+            expect(rejected.success).toBe(false);
+            expect(rejected.errorCode).toBe('invalid_redirect_url');
+
+            // Explicit magicLink.allowedRedirectOrigins works cleanly under wildcard CORS
+            const permitted = await service.CreateInvite(
+                {
+                    email: 'respondent@example.com',
+                    ApplicationId: 'app-forms',
+                    RedirectUrl: 'https://surveys.example.com/respond/99',
+                    SendEmail: false,
+                },
+                ownerUser,
+                provider,
+            );
+            expect(permitted.success).toBe(true);
+            const url = new URL(permitted.redemptionUrl!);
+            const rt = url.searchParams.get('rt') ?? undefined;
+            expect(service.ResolveVerifiedRedirectUrl(permitted.rawToken!, rt)).toBe('https://surveys.example.com/respond/99');
+        });
+    });
+
+    describe('RevokeInvite & UpdateInviteExpiry', () => {
+        it('revokes an active invite and enforces issuer authorization', async () => {
+            const invites = new Map<string, StoredInviteState>();
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+
+            const created = await service.CreateInvite(
+                { email: 'person@example.com', ApplicationId: 'app-forms', SendEmail: false },
+                ownerUser,
+                provider,
+            );
+            expect(created.success).toBe(true);
+
+            const denied = await service.RevokeInvite(created.inviteId!, regularUser, provider);
+            expect(denied.success).toBe(false);
+            expect(denied.errorCode).toBe('forbidden');
+
+            const revoked = await service.RevokeInvite(created.inviteId!, ownerUser, provider);
+            expect(revoked.success).toBe(true);
+            expect(revoked.status).toBe('Revoked');
+            expect(invites.get(created.inviteId!)?.Status).toBe('Revoked');
+
+            // Cannot extend a revoked invite
+            const extendRevoked = await service.UpdateInviteExpiry(
+                created.inviteId!,
+                new Date(Date.now() + 72 * 3600 * 1000),
+                ownerUser,
+                provider,
+            );
+            expect(extendRevoked.success).toBe(false);
+            expect(extendRevoked.errorCode).toBe('invalid_state');
+        });
+
+        it('updates expiry on an active or expired invite and re-activates expired status when extended', async () => {
+            const invites = new Map<string, StoredInviteState>();
+            invites.set('inv-expired', {
+                ID: 'inv-expired',
+                TokenHash: HashToken('mj_ml_sample'),
+                Email: 'late@example.com',
+                ApplicationID: 'app-forms',
+                RoleID: 'role-guest',
+                ExpiresAt: new Date(Date.now() - 3600_000),
+                MaxUses: 1,
+                UseCount: 0,
+                CreatedByUserID: ownerUser.ID,
+                Status: 'Expired',
+            });
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+
+            const newExpiry = new Date(Date.now() + 48 * 3600 * 1000);
+            const updated = await service.UpdateInviteExpiry('inv-expired', newExpiry, ownerUser, provider);
+            expect(updated.success).toBe(true);
+            expect(updated.status).toBe('Active');
+            expect(updated.expiresAt).toBe(newExpiry.toISOString());
+        });
+
+        it('keeps &rt= redirect binding valid after UpdateInviteExpiry extends an invite past its initial expiry, and guards UseCount/past-expiry transitions', async () => {
+            const invites = new Map<string, StoredInviteState>();
+            const provider = makeFakeProvider(invites);
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+
+            const rawToken = 'mj_ml_1111222233334444555566667777888899990000aaaabbbbccccddddeeeeffff';
+            const tokenHash = HashToken(rawToken);
+            const pastExpiry = new Date(Date.now() - 3600_000);
+            // Mint redirect binding with a past ExpiresAt epoch
+            const rt = MagicLinkKeyManager.Instance.SignRedirectBinding(
+                tokenHash,
+                'https://forms.example.com/survey/extended',
+                Math.floor(pastExpiry.getTime() / 1000),
+            );
+
+            invites.set('inv-extend-rt', {
+                ID: 'inv-extend-rt',
+                TokenHash: tokenHash,
+                Email: 'respondent@example.com',
+                ApplicationID: 'app-forms',
+                RoleID: 'role-guest',
+                ExpiresAt: pastExpiry,
+                MaxUses: 1,
+                UseCount: 0,
+                CreatedByUserID: ownerUser.ID,
+                Status: 'Expired',
+            });
+
+            // Extend invite into the future without re-issuing the URL
+            const extendedExpiry = new Date(Date.now() + 24 * 3600_000);
+            const extended = await service.UpdateInviteExpiry('inv-extend-rt', extendedExpiry, ownerUser, provider);
+            expect(extended.success).toBe(true);
+            expect(extended.status).toBe('Active');
+
+            // Original &rt= binding still resolves the allowlisted RedirectUrl
+            expect(service.ResolveVerifiedRedirectUrl(rawToken, rt)).toBe('https://forms.example.com/survey/extended');
+
+            // Shortening an Active invite to <= now transitions Status to Expired
+            const shortened = await service.UpdateInviteExpiry('inv-extend-rt', new Date(Date.now() - 1000), ownerUser, provider);
+            expect(shortened.success).toBe(true);
+            expect(shortened.status).toBe('Expired');
+
+            // An Expired invite whose UseCount >= MaxUses is NOT reactivated to Active
+            invites.set('inv-exhausted-expired', {
+                ID: 'inv-exhausted-expired',
+                TokenHash: HashToken('mj_ml_exhausted'),
+                Email: 'used@example.com',
+                ApplicationID: 'app-forms',
+                RoleID: 'role-guest',
+                ExpiresAt: pastExpiry,
+                MaxUses: 1,
+                UseCount: 1,
+                CreatedByUserID: ownerUser.ID,
+                Status: 'Expired',
+            });
+            const notReactivated = await service.UpdateInviteExpiry('inv-exhausted-expired', extendedExpiry, ownerUser, provider);
+            expect(notReactivated.success).toBe(true);
+            expect(notReactivated.status).toBe('Expired');
+        });
+    });
+
+    describe('VerifySessionToken', () => {
+        it('verifies a signed magic-link session JWT and rejects wrong audience or issuer', () => {
+            const service = new MagicLinkService('https://api.example.com', makeConfig());
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const claims = BuildSessionClaims({
+                issuer: 'https://api.example.com',
+                audience: 'mj-magic-link',
+                inviteId: 'inv-123',
+                email: 'person@example.com',
+                applicationId: 'app-forms',
+                roleName: 'External Guest',
+                nowSeconds,
+                ttlSeconds: 3600,
+            });
+            const jwtToken = MagicLinkKeyManager.Instance.Sign(claims);
+
+            const verified = service.VerifySessionToken(jwtToken);
+            expect(verified).not.toBeNull();
+            expect(verified?.email).toBe('person@example.com');
+            expect(verified?.mj_app_id).toBe('app-forms');
+
+            const wrongIssuerService = new MagicLinkService('https://other-api.example.com', makeConfig());
+            expect(wrongIssuerService.VerifySessionToken(jwtToken)).toBeNull();
+        });
+    });
+});

package/src/__tests__/orphanedConversationDetailReconciler.start.test.ts

@@ -0,0 +1,82 @@
+/**
+ * `conversationDetailReconciler` settings: the reconciler always runs its startup pass, and repeats
+ * on the configured interval only while enabled. Disabled, an idle server sends it no periodic query.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { UserInfo } from '@memberjunction/core';
+
+const { mockRunView } = vi.hoisted(() => ({ mockRunView: vi.fn() }));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+    UserCache: { Instance: { Users: [] } },
+}));
+
+vi.mock('@memberjunction/core', () => {
+    class MockRunView {
+        public static FromMetadataProvider(): MockRunView {
+            return new MockRunView();
+        }
+        public async RunView(...args: unknown[]): Promise<unknown> {
+            return mockRunView(...args);
+        }
+    }
+    return { LogError: vi.fn(), LogStatus: vi.fn(), RunView: MockRunView };
+});
+
+import { StartOrphanedConversationDetailReconciler } from '../generic/OrphanedConversationDetailReconciler.js';
+
+const USER = { ID: 'U1' } as unknown as UserInfo;
+const PROVIDER = {
+    EntityByName: (name: string) =>
+        name === 'MJ: AI Agent Runs' ? { SchemaName: '__mj', BaseView: 'vwAIAgentRuns' } : undefined,
+    QuoteIdentifier: (name: string) => `[${name}]`,
+    QuoteSchemaAndView: (schema: string, view: string) => `[${schema}].[${view}]`,
+} as never;
+const HOUR = 60 * 60_000;
+
+/** Passes run so far: each pass starts with one read of in-progress conversation details. */
+const passes = (): number => mockRunView.mock.calls.length;
+
+describe('StartOrphanedConversationDetailReconciler', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+        mockRunView.mockReset();
+        mockRunView.mockResolvedValue({ Success: true, Results: [] });
+    });
+    afterEach(() => {
+        vi.clearAllTimers();
+        vi.useRealTimers();
+    });
+
+    it('enabled: runs a pass now, then one every interval', async () => {
+        const timer = StartOrphanedConversationDetailReconciler(PROVIDER, USER, { enabled: true, sweepIntervalMs: 60_000 });
+        await vi.advanceTimersByTimeAsync(5 * 60_000);
+
+        expect(timer).not.toBeNull();
+        expect(passes()).toBe(6);
+    });
+
+    it('disabled: runs the startup pass only, and schedules nothing', async () => {
+        const timer = StartOrphanedConversationDetailReconciler(PROVIDER, USER, { enabled: false, sweepIntervalMs: 60_000 });
+        await vi.advanceTimersByTimeAsync(HOUR);
+
+        expect(passes()).toBe(1);
+        expect(timer).toBeNull();
+    });
+
+    it('with no settings keeps the shipped 5-minute repeat', async () => {
+        StartOrphanedConversationDetailReconciler(PROVIDER, USER);
+        await vi.advanceTimersByTimeAsync(HOUR);
+
+        expect(passes()).toBe(13);
+    });
+
+    it('a failing pass is logged, not thrown, and the next pass still runs', async () => {
+        mockRunView.mockRejectedValueOnce(new Error('db down'));
+        StartOrphanedConversationDetailReconciler(PROVIDER, USER, { enabled: true, sweepIntervalMs: 60_000 });
+        await vi.advanceTimersByTimeAsync(60_000);
+
+        expect(passes()).toBe(2);
+    });
+});

package/src/__tests__/orphanedConversationDetailReconciler.test.ts

@@ -74,6 +74,7 @@ function writable(saveResult = true, loadedStatus = 'In-Progress') {
         ID: DETAIL_ID,
         Status: loadedStatus,
         Message: '',
+        MarkServerAuthoredReply: vi.fn(),
         Load: vi.fn(async () => true),
         Save: vi.fn(async () => saveResult),
         LatestResult: { CompleteMessage: 'denied' },
@@ -245,6 +246,15 @@ describe('ReconcileOrphanedConversationDetails', () => {
         );
     });
 
+    it("marks the close as the server's write: the reply gate refuses an unmarked change to a reply's status", async () => {
+        script([detail()], [{ ConversationDetailID: DETAIL_ID, Status: 'Failed', CompletedAt: longAgo() }]);
+
+        await ReconcileOrphanedConversationDetails(PROVIDER, USER);
+
+        expect(writableStore.last?.MarkServerAuthoredReply).toHaveBeenCalledOnce();
+        expect(writableStore.last?.Save).toHaveBeenCalled();
+    });
+
     it('leaves the detail alone when no owner can be resolved', async () => {
         script([detail()], [{ ConversationDetailID: DETAIL_ID, Status: 'Failed', CompletedAt: longAgo() }], null);
 

package/src/__tests__/ownedRealtimeSession.test.ts

@@ -36,4 +36,18 @@ describe('LoadOwnedRealtimeSession', () => {
         await expect(LoadOwnedRealtimeSession(SESSION, STRANGER, providerWith({ UserID: OWNER.ID })))
             .rejects.toThrow('Not authorized: you do not own this realtime session');
     });
+
+    it('skips loading MJ: Conversations when the caller is a standard named user without a scope identity', async () => {
+        const getEntityObject = vi.fn(async (name: string) => ({
+            UserID: OWNER.ID,
+            ConversationID: '22222222-2222-4222-8222-222222222222',
+            Load: vi.fn(async () => name === 'MJ: AI Agent Sessions'),
+        }));
+        const prov = { GetEntityObject: getEntityObject } as unknown as IMetadataProvider;
+
+        await LoadOwnedRealtimeSession(SESSION, OWNER, prov);
+
+        expect(getEntityObject).toHaveBeenCalledTimes(1);
+        expect(getEntityObject).toHaveBeenCalledWith('MJ: AI Agent Sessions', OWNER);
+    });
 });

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -10,7 +10,7 @@
  */
 import 'reflect-metadata';
 import { describe, it, expect } from 'vitest';
-import { StatusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
+import { StatusUpdatesFilter, StatusUpdateOwnerID, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
 import type { UserPayload } from '../types';
 
 const OWNER = 'AA11BB22-0000-4000-8000-000000000001';
@@ -61,3 +61,59 @@ describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
   });
 });
 
+
+describe('StatusUpdateOwnerID (#4931)', () => {
+    it('is the request user, or the user an elevated payload stands in for', () => {
+        expect(StatusUpdateOwnerID({ sessionId: 's', email: 'e', userRecord: { ID: 'user-1' } } as UserPayload)).toBe('user-1');
+        expect(StatusUpdateOwnerID({ sessionId: 's', email: 'e', userRecord: { ID: 'system' }, ElevatedFrom: { ID: 'guest' } } as unknown as UserPayload)).toBe('guest');
+        expect(StatusUpdateOwnerID(undefined)).toBe('');
+    });
+});
+
+describe('statusUpdatesFilter — anonymous visitors share one user id (#4931)', () => {
+    const ANON = 'AAAAAAAA-0000-4000-8000-0000000000A0';
+    const visitor = (sid: string) => ({ ID: ANON, IsMagicLinkAnonymous: true, AnonymousVisitorID: sid, MagicLinkScope: { ResourceID: sid } });
+    const connection = (user: object): StatusUpdatesFilterContext => ({ userPayload: { sessionId: 'same-session', email: 'anonymous@magic-link.local', userRecord: user } as unknown as UserPayload });
+    // Visitor A's run, elevated to the system user: the event's owner comes from ElevatedFrom.
+    const aRun = { sessionId: 'same-session', email: 'system@example.com', userRecord: { ID: 'system' }, ElevatedFrom: visitor('sid-a') } as unknown as UserPayload;
+    const event = (): PushStatusNotificationPayload => ({ sessionId: 'same-session', ownerUserId: StatusUpdateOwnerID(aRun), message: 'complete' });
+
+    it("delivers visitor A's run events to visitor A's connection", () => {
+        expect(StatusUpdatesFilter({ payload: event(), args: { sessionId: 'same-session' }, context: connection(visitor('sid-a')) })).toBe(true);
+    });
+
+    it('does not deliver them to visitor B, even with the same (client-chosen) session id', () => {
+        expect(StatusUpdatesFilter({ payload: event(), args: { sessionId: 'same-session' }, context: connection(visitor('sid-b')) })).toBe(false);
+    });
+
+    it('does not deliver them to an anonymous connection with no scope identity (fail closed)', () => {
+        expect(StatusUpdatesFilter({ payload: event(), args: { sessionId: 'same-session' }, context: connection({ ID: ANON, IsMagicLinkAnonymous: true }) })).toBe(false);
+    });
+});
+
+describe('statusUpdatesFilter — an anonymous owner key matches exactly', () => {
+    // The scope part is a signed, case-significant identity (an mj_sid or a resource scope), so the anonymous key is
+    // compared exactly. A UUID comparison (case- and whitespace-insensitive) would let a visitor whose scope differs
+    // only in case or padding receive another visitor's run events.
+    const ANON = 'AAAAAAAA-0000-4000-8000-0000000000A0';
+    const visitor = (sid: string) => ({ ID: ANON, IsMagicLinkAnonymous: true, AnonymousVisitorID: sid, MagicLinkScope: { ResourceID: sid } });
+    const connection = (user: object): StatusUpdatesFilterContext => ({ userPayload: { sessionId: 's', email: 'anonymous@magic-link.local', userRecord: user } as UserPayload });
+    const eventOwnedBy = (sid: string): PushStatusNotificationPayload => ({
+        sessionId: 's',
+        ownerUserId: `${ANON.toLowerCase()}|${sid}`,
+        message: 'complete',
+    });
+
+    it('delivers to the visitor whose scope is identical', () => {
+        expect(StatusUpdatesFilter({ payload: eventOwnedBy('sid-a'), args: { sessionId: 's' }, context: connection(visitor('sid-a')) })).toBe(true);
+    });
+
+    it('does not deliver when the scopes differ only by case', () => {
+        expect(StatusUpdatesFilter({ payload: eventOwnedBy('SID-A'), args: { sessionId: 's' }, context: connection(visitor('sid-a')) })).toBe(false);
+    });
+
+    it('does not deliver when the scopes differ only by surrounding whitespace', () => {
+        expect(StatusUpdatesFilter({ payload: eventOwnedBy('sid-a '), args: { sessionId: 's' }, context: connection(visitor('sid-a')) })).toBe(false);
+        expect(StatusUpdatesFilter({ payload: eventOwnedBy('sid-a'), args: { sessionId: 's' }, context: connection(visitor(' sid-a')) })).toBe(false);
+    });
+});