@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/scalabilityDatabaseIntegration.test.ts

@@ -0,0 +1,207 @@
+import 'reflect-metadata';
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import sql from 'mssql';
+import { RunViewParams, RunViewResult, SetProvider, UserInfo } from '@memberjunction/core';
+import { GenericDatabaseProvider, UserCache } from '@memberjunction/generic-database-provider';
+import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
+import {
+    CacheInvalidationBroadcastManager,
+    SequencedRoleBucketBroadcastProvider,
+} from '../broadcast/index.js';
+
+const IT_DB_NAME = process.env.MJ_IT_DB;
+
+describe.skipIf(!IT_DB_NAME)('MJServer Scalability Architecture — Live SQL Server Integration', () => {
+    let pool: sql.ConnectionPool;
+    let sharedProvider: SQLServerDataProvider;
+    let sysUser: UserInfo;
+
+    beforeAll(async () => {
+        pool = new sql.ConnectionPool({
+            server: process.env.MJ_IT_HOST || 'localhost',
+            port: parseInt(process.env.MJ_IT_PORT || '1433', 10),
+            database: IT_DB_NAME,
+            user: process.env.MJ_IT_USER || 'sa',
+            password: process.env.MJ_IT_PASSWORD || 'GHWUc7QKZNT8GQiqnJHdEPonPcukY2WA',
+            options: {
+                encrypt: false,
+                trustServerCertificate: true,
+            },
+        });
+        await pool.connect();
+
+        sharedProvider = new SQLServerDataProvider();
+        const config = new SQLServerProviderConfigData(pool, '__mj', 0);
+        await sharedProvider.Config(config);
+        SetProvider(sharedProvider);
+        await UserCache.Instance.Refresh(sharedProvider, 0);
+
+        const foundUser =
+            UserCache.Instance.GetSystemUser() ||
+            UserCache.Instance.Users.find((u) => u.IsActive && u.Type === 'Owner') ||
+            UserCache.Instance.Users[0];
+        if (!foundUser) {
+            throw new Error(`No user found in ${IT_DB_NAME}`);
+        }
+        sysUser = foundUser;
+    }, 60_000);
+
+    afterAll(async () => {
+        if (pool?.connected) {
+            await pool.close();
+        }
+    });
+
+    it('creates per-request SQLServerDataProvider with zero-copy prototype-delegated metadata shell and lazy transaction queues', async () => {
+        const reqProvider = new SQLServerDataProvider();
+        const reqConfig = new SQLServerProviderConfigData(
+            pool,
+            '__mj',
+            0,
+            undefined,
+            undefined,
+            false // ignoreExistingMetadata = false -> reuses shared metadata shell
+        );
+        await reqProvider.Config(reqConfig);
+
+        // Verify lazy RxJS Subjects are NOT allocated on a read-only request provider
+        const internal = reqProvider as unknown as {
+            _sqlQueue$: unknown;
+            _transactionState$: unknown;
+        };
+
+        expect(internal._sqlQueue$).toBeNull();
+        expect(internal._transactionState$).toBeNull();
+
+        // Verify zero-copy prototype delegation to shared metadata
+        expect(Object.getPrototypeOf(reqProvider.AllMetadata)).toBe(sharedProvider.AllMetadata);
+        expect(reqProvider.Entities.length).toBeGreaterThan(50);
+        expect(reqProvider.Entities).toBe(sharedProvider.Entities);
+    });
+
+    it('coalesces 10 concurrent identical InternalRunView calls against SQL Server into a single SQL execution and isolates result mutations', async () => {
+        // Warm up the view column order cache for vwEntities (must return >=1 row so sortViewRowKeys caches sys.columns)
+        await sharedProvider.RunView(
+            {
+                EntityName: 'MJ: Entities',
+                ExtraFilter: "Name = 'MJ: Entities'",
+                ResultType: 'simple',
+                IgnoreMaxRows: true,
+            },
+            sysUser
+        );
+
+        const executeSpy = vi.spyOn(sharedProvider, 'ExecuteSQL');
+        const internalRunner = sharedProvider as unknown as {
+            InternalRunView<T>(params: RunViewParams, contextUser?: UserInfo): Promise<RunViewResult<T>>;
+        };
+
+        try {
+            const concurrentCount = 10;
+            const promises = Array.from({ length: concurrentCount }, () =>
+                internalRunner.InternalRunView<Record<string, unknown>>(
+                    {
+                        EntityName: 'MJ: Entities',
+                        ExtraFilter: "SchemaName = '__mj' AND Name LIKE 'MJ: %'",
+                        OrderBy: 'Name ASC',
+                        IgnoreMaxRows: true,
+                        ResultType: 'simple',
+                    },
+                    sysUser
+                )
+            );
+
+            const results = await Promise.all(promises);
+
+            // Only 1 physical SQL execution should have been issued for the 10 identical concurrent views
+            expect(executeSpy).toHaveBeenCalledTimes(1);
+
+            for (const res of results) {
+                expect(res.Success).toBe(true);
+                expect(res.Results.length).toBeGreaterThan(0);
+            }
+
+            // Mutating caller 0's result array or row object must not affect caller 1's result
+            const originalName = results[1].Results[0].Name;
+            const originalLength = results[1].Results.length;
+            results[0].Results[0].Name = 'MUTATED_IN_CALLER_0';
+            results[0].Results.pop();
+
+            expect(results[1].Results[0].Name).toBe(originalName);
+            expect(results[0].Results.length).toBe(originalLength - 1);
+            expect(results[1].Results.length).toBe(originalLength);
+        } finally {
+            executeSpy.mockRestore();
+        }
+    });
+
+    it('bounds concurrent SQL executions in RunViews to MaxConcurrentViewsPerBatch', async () => {
+        let activeCount = 0;
+        let maxObservedConcurrency = 0;
+
+        const originalExecuteSQL = sharedProvider.ExecuteSQL.bind(sharedProvider);
+        const executeSpy = vi.spyOn(sharedProvider, 'ExecuteSQL').mockImplementation(async (query, params, options, contextUser) => {
+            activeCount++;
+            if (activeCount > maxObservedConcurrency) {
+                maxObservedConcurrency = activeCount;
+            }
+            try {
+                return await originalExecuteSQL(query, params, options, contextUser);
+            } finally {
+                activeCount--;
+            }
+        });
+
+        try {
+            const batchParams = Array.from({ length: 16 }, (_, idx) => ({
+                EntityName: 'MJ: Entities',
+                ExtraFilter: `SchemaName = '__mj' AND UserViewMaxRows IS NULL AND ${idx} = ${idx}`,
+                IgnoreMaxRows: true,
+                ResultType: 'simple' as const,
+            }));
+
+            const batchResults = await sharedProvider.RunViews(batchParams, sysUser);
+            expect(batchResults).toHaveLength(16);
+            for (const r of batchResults) {
+                expect(r.Success).toBe(true);
+            }
+            expect(maxObservedConcurrency).toBeLessThanOrEqual(GenericDatabaseProvider.MaxConcurrentViewsPerBatch);
+            expect(maxObservedConcurrency).toBeGreaterThan(1);
+        } finally {
+            executeSpy.mockRestore();
+        }
+    });
+
+    it('sequences and shapes cache invalidation broadcasts against live entity metadata and replays delta catch-up', async () => {
+        const provider = CacheInvalidationBroadcastManager.Instance.Configure({
+            provider: 'SequencedRoleBucket',
+            ringBufferSize: 500,
+        }) as SequencedRoleBucketBroadcastProvider;
+        expect(provider).toBeInstanceOf(SequencedRoleBucketBroadcastProvider);
+
+        const baseSeq = provider.CurrentSequence;
+        const entityInfo = sharedProvider.Entities.find((e) => e.Name === 'MJ: Entities');
+        expect(entityInfo).toBeDefined();
+
+        const published = provider.RecordInvalidation({
+            entityName: 'MJ: Entities',
+            primaryKeyValues: JSON.stringify([{ FieldName: 'ID', Value: entityInfo!.ID }]),
+            action: 'save',
+            sourceServerId: 'it-server-node-1',
+            timestamp: new Date(),
+            recordData: JSON.stringify({ ID: entityInfo!.ID, Name: entityInfo!.Name }),
+        });
+
+        expect(published.sequence).toBe(baseSeq + 1);
+        expect(provider.CurrentSequence).toBe(baseSeq + 1);
+
+        // Verify delta catch-up shapes payload for sysUser against real MJ: Entities metadata
+        const catchUp = provider.GetChangesSince(baseSeq, sysUser);
+        expect(catchUp.RequiresFullRefresh).toBe(false);
+        expect(catchUp.CurrentSequence).toBe(baseSeq + 1);
+        expect(catchUp.Events).toHaveLength(1);
+        expect(catchUp.Events[0].EntityName).toBe('MJ: Entities');
+        expect(catchUp.Events[0].Sequence).toBe(baseSeq + 1);
+        expect(catchUp.Events[0].RecordData).toContain(entityInfo!.Name);
+    });
+});

package/src/__tests__/securityHardeningPr6034.test.ts

@@ -0,0 +1,120 @@
+import 'reflect-metadata';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type express from 'express';
+
+const logStatusExCalls: Array<{ message: string; verboseOnly?: boolean }> = [];
+const runViewSpy = vi.fn();
+
+vi.mock('@memberjunction/core', async () => {
+    const actual = await vi.importActual<typeof import('@memberjunction/core')>('@memberjunction/core');
+    return {
+        ...actual,
+        LogStatusEx: vi.fn((entry: { message: string; verboseOnly?: boolean }) => {
+            logStatusExCalls.push(entry);
+        }),
+        RunView: class MockRunView {
+            public RunView = runViewSpy;
+        },
+    };
+});
+
+import {
+    DEFAULT_REST_API_OPTIONS,
+    REST_API_BASE_PATH,
+    SetupRESTEndpoints,
+} from '../rest/setupRESTEndpoints.js';
+import { OAuthCallbackHandler } from '../rest/OAuthCallbackHandler.js';
+import type { UserInfo } from '@memberjunction/core';
+
+function createSpyExpressApp(): { app: express.Application; useCalls: express.RequestHandler[][] } {
+    const useCalls: express.RequestHandler[][] = [];
+    const partialApp = {
+        use: vi.fn((...args: express.RequestHandler[]) => {
+            useCalls.push(args);
+            return partialApp as express.Application;
+        }),
+    };
+    return { app: partialApp as express.Application, useCalls };
+}
+
+describe('PR #6034 security hardening in MJServer', () => {
+    beforeEach(() => {
+        logStatusExCalls.length = 0;
+        runViewSpy.mockReset();
+    });
+
+    describe('SetupRESTEndpoints fail-closed default & auth warning', () => {
+        it('defaults DEFAULT_REST_API_OPTIONS.enabled to false and mounts nothing when called without options', () => {
+            expect(DEFAULT_REST_API_OPTIONS.enabled).toBe(false);
+
+            const { app, useCalls } = createSpyExpressApp();
+            SetupRESTEndpoints(app);
+
+            expect(useCalls).toHaveLength(0);
+        });
+
+        it('logs a non-verbose warning when enabled without a route-level authMiddleware', () => {
+            const { app, useCalls } = createSpyExpressApp();
+            SetupRESTEndpoints(app, { enabled: true });
+
+            expect(useCalls).toHaveLength(1);
+            expect(useCalls[0][0]).toBe(REST_API_BASE_PATH);
+            const warning = logStatusExCalls.find((c) =>
+                c.message.includes('WITHOUT a route-level auth middleware'),
+            );
+            expect(warning).toBeDefined();
+            expect(warning?.verboseOnly).toBeUndefined();
+        });
+
+        it('mounts authMiddleware and omits the unauthenticated warning when authMiddleware is supplied', () => {
+            const { app, useCalls } = createSpyExpressApp();
+            const authMw: express.RequestHandler = (_req, _res, next) => next();
+
+            SetupRESTEndpoints(app, { enabled: true }, authMw);
+
+            expect(useCalls).toHaveLength(1);
+            expect(useCalls[0]).toContain(authMw);
+            const warning = logStatusExCalls.find((c) =>
+                c.message.includes('WITHOUT a route-level auth middleware'),
+            );
+            expect(warning).toBeUndefined();
+        });
+    });
+
+    describe('OAuthCallbackHandler UUID validation on ExtraFilter IDs', () => {
+        it('refuses SQL injection connectionId before executing RunView', async () => {
+            const handler = new OAuthCallbackHandler({ baseUrl: 'https://api.example.com' });
+            const fakeUser = { ID: '00000000-0000-0000-0000-000000000001' } as UserInfo;
+
+            const loader = Reflect.get(handler, 'loadConnectionConfig') as (
+                connectionId: string,
+                contextUser: UserInfo,
+            ) => Promise<Record<string, string> | null>;
+
+            const injectedResult = await loader.call(handler, "' OR '1'='1", fakeUser);
+            expect(injectedResult).toBeNull();
+            expect(runViewSpy).not.toHaveBeenCalled();
+        });
+
+        it('refuses non-UUID MCPServerID returned from connection lookup before querying servers', async () => {
+            runViewSpy.mockResolvedValueOnce({
+                Success: true,
+                Results: [{ MCPServerID: "1234' UNION SELECT * FROM __mj.vwUsers --" }],
+            });
+
+            const handler = new OAuthCallbackHandler({ baseUrl: 'https://api.example.com' });
+            const fakeUser = { ID: '00000000-0000-0000-0000-000000000001' } as UserInfo;
+            const validConnId = '11111111-2222-3333-4444-555555555555';
+
+            const loader = Reflect.get(handler, 'loadConnectionConfig') as (
+                connectionId: string,
+                contextUser: UserInfo,
+            ) => Promise<Record<string, string> | null>;
+
+            const result = await loader.call(handler, validConnId, fakeUser);
+            expect(result).toBeNull();
+            // First query ran with validated connectionId; second query was blocked before executing
+            expect(runViewSpy).toHaveBeenCalledTimes(1);
+        });
+    });
+});

package/src/__tests__/sessionDeadline.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest';
+import { ExpiryCloseReason, ParseSessionDeadlineMs, VerifyTimeLimitClaim } from '../agentSessions/sessionDeadline.js';
+
+const T = Date.parse('2026-10-29T12:00:00Z');
+const MIN = 60_000;
+const row = (lastActive: number | null, deadline?: number): { LastActiveAt: Date | string | null; Config_: string } => ({
+  LastActiveAt: lastActive === null ? null : new Date(lastActive),
+  Config_: deadline === undefined ? '{}' : JSON.stringify({ maxSessionDeadlineIso: new Date(deadline).toISOString() }),
+});
+
+describe('ExpiryCloseReason', () => {
+  it('deadline passed, recently active → TimeLimit', () => expect(ExpiryCloseReason(row(T - MIN, T - MIN), T, 15 * MIN)).toBe('TimeLimit'));
+  it('idle past threshold, no deadline → Idle', () => expect(ExpiryCloseReason(row(T - 16 * MIN), T, 15 * MIN)).toBe('Idle'));
+  it('both passed, idle moment earlier → Idle', () => expect(ExpiryCloseReason(row(T - 20 * MIN, T - 2 * MIN), T, 15 * MIN)).toBe('Idle'));
+  it('both passed, deadline moment earlier → TimeLimit', () => expect(ExpiryCloseReason(row(T - 16 * MIN, T - 5 * MIN), T, 15 * MIN)).toBe('TimeLimit'));
+  it('same instant → TimeLimit', () => expect(ExpiryCloseReason(row(T - 15 * MIN, T), T, 15 * MIN)).toBe('TimeLimit'));
+  it('nothing passed → null', () => expect(ExpiryCloseReason(row(T - MIN, T + MIN), T, 15 * MIN)).toBeNull());
+  it('a row without LastActiveAt is never Idle', () => {
+    expect(ExpiryCloseReason(row(null), T, 15 * MIN)).toBeNull();
+    expect(ExpiryCloseReason(row(null, T - MIN), T, 15 * MIN)).toBe('TimeLimit');
+  });
+  it('nowMs exactly at the deadline → TimeLimit', () => expect(ExpiryCloseReason(row(T - MIN, T), T, 15 * MIN)).toBe('TimeLimit'));
+  it('a string LastActiveAt past the threshold → Idle', () => {
+    const r = { ...row(null), LastActiveAt: new Date(T - 16 * MIN).toISOString() };
+    expect(ExpiryCloseReason(r, T, 15 * MIN)).toBe('Idle');
+  });
+  it('an invalid LastActiveAt string is never Idle, TimeLimit still works', () => {
+    expect(ExpiryCloseReason({ ...row(null), LastActiveAt: 'garbage' }, T, 15 * MIN)).toBeNull();
+    expect(ExpiryCloseReason({ ...row(null, T - MIN), LastActiveAt: 'garbage' }, T, 15 * MIN)).toBe('TimeLimit');
+  });
+  it('a non-finite closeThresholdMs is never Idle', () => expect(ExpiryCloseReason(row(T - 99 * MIN), T, Number.NaN)).toBeNull());
+});
+
+describe('ParseSessionDeadlineMs', () => {
+  it('reads an ISO deadline', () => expect(ParseSessionDeadlineMs(JSON.stringify({ maxSessionDeadlineIso: '2026-10-29T12:00:00Z' }))).toBe(T));
+  it('treats a malformed deadline as absent', () => {
+    expect(ParseSessionDeadlineMs(JSON.stringify({ maxSessionDeadlineIso: 'soon' }))).toBeNull();
+    expect(ParseSessionDeadlineMs(JSON.stringify({ maxSessionDeadlineIso: 42 }))).toBeNull();
+    expect(ParseSessionDeadlineMs('not json')).toBeNull();
+    expect(ParseSessionDeadlineMs(null)).toBeNull();
+  });
+});
+
+describe('VerifyTimeLimitClaim', () => {
+  it('deadline passed → TimeLimit', () => expect(VerifyTimeLimitClaim(row(T - MIN, T - MIN), T)).toBe('TimeLimit'));
+  it('50 s ahead (inside the skew) → TimeLimit', () => expect(VerifyTimeLimitClaim(row(T - MIN, T + 50_000), T)).toBe('TimeLimit'));
+  it('10 min ahead → Explicit', () => expect(VerifyTimeLimitClaim(row(T - MIN, T + 10 * MIN), T)).toBe('Explicit'));
+  it('no stored deadline → Explicit', () => expect(VerifyTimeLimitClaim(row(T - MIN), T)).toBe('Explicit'));
+  it('Config_ null → Explicit', () => expect(VerifyTimeLimitClaim({ LastActiveAt: new Date(T), Config_: null }, T)).toBe('Explicit'));
+  it('a long-idle session is never promoted to TimeLimit by idleness', () => expect(VerifyTimeLimitClaim(row(T - 999 * MIN), T)).toBe('Explicit'));
+});

package/src/__tests__/sessionUserClone.test.ts

@@ -43,6 +43,7 @@ function buildSourceUser(): UserInfo {
   user.ReturningVisitorContext = { VisitorKey: 'vk-1' };
   user.WidgetGuestContext = { WidgetID: 'W0000000-0000-0000-0000-000000000001' };
   user.IsMagicLinkAnonymous = true;
+  user.AnonymousVisitorID = 'visitor-sid-1';
   return user;
 }
 
@@ -99,13 +100,14 @@ describe('CloneUserForSessionContext', () => {
     expect(clone.APIKeyRowFilters).toHaveLength(1);
   });
 
-  it('preserves ReturningVisitorContext, WidgetGuestContext, and IsMagicLinkAnonymous', () => {
+  it('preserves ReturningVisitorContext, WidgetGuestContext, IsMagicLinkAnonymous, and AnonymousVisitorID', () => {
     const source = buildSourceUser();
     const clone = CloneUserForSessionContext(source);
 
     expect(clone.ReturningVisitorContext).toEqual({ VisitorKey: 'vk-1' });
     expect(clone.WidgetGuestContext).toEqual({ WidgetID: 'W0000000-0000-0000-0000-000000000001' });
     expect(clone.IsMagicLinkAnonymous).toBe(true);
+    expect(clone.AnonymousVisitorID).toBe('visitor-sid-1');
   });
 
   it('stamping new contexts on the clone does NOT write through to the source', () => {
@@ -120,6 +122,7 @@ describe('CloneUserForSessionContext', () => {
     clone.APIKeyActingContext = { ActingOrganizationID: 'ORG-OTHER' };
     clone.APIKeyRowFilters = newBindings;
     clone.IsMagicLinkAnonymous = false;
+    clone.AnonymousVisitorID = 'visitor-sid-OTHER';
 
     // The source (potentially the shared UserCache instance) must be untouched
     expect(source.TenantContext).toEqual({ TenantID: 'tenant-1', Source: 'header' });
@@ -128,6 +131,7 @@ describe('CloneUserForSessionContext', () => {
     expect(source.APIKeyRowFilters).toHaveLength(1);
     expect(source.APIKeyRowFilters?.[0].FilterID).toBe('F0000000-0000-0000-0000-000000000001');
     expect(source.IsMagicLinkAnonymous).toBe(true);
+    expect(source.AnonymousVisitorID).toBe('visitor-sid-1');
   });
 
   it('clearing contexts on the clone does NOT clear them on the source', () => {

package/src/__tests__/sharedCache.test.ts

@@ -80,6 +80,17 @@ describe('shared cache event routing', () => {
         expect(publish).toHaveBeenCalledWith('CACHE_INVALIDATION', expect.objectContaining({ entityName: 'MJ: AI Models', action: 'set', primaryKeyValues: null }));
     });
 
+    it('dispatches a RunView row_delta to LocalCacheManager while normalizing browser CACHE_INVALIDATION action to set', () => {
+        const deltaEvt = event({
+            CacheKey: 'MJ: AI Models|_|_|-1|0|_|_|imr:1',
+            Action: 'row_delta',
+            Data: JSON.stringify({ primaryKeyFields: ['ID'], upsertedRows: [{ ID: '1' }], deletedPrimaryKeys: [], rowCount: 1, maxUpdatedAt: '' }),
+        });
+        RouteSharedCacheEvent(deltaEvt, provider(false));
+        expect(dispatch).toHaveBeenCalledWith(deltaEvt);
+        expect(publish).toHaveBeenCalledWith('CACHE_INVALIDATION', expect.objectContaining({ entityName: 'MJ: AI Models', action: 'set', primaryKeyValues: null }));
+    });
+
     it('does not relay other categories or category clears to browsers', () => {
         RouteSharedCacheEvent(event({ Category: 'default', CacheKey: '___MJCore_Metadata_AllMetadata' }), provider(false));
         RouteSharedCacheEvent(event({ Category: 'DatasetCache', CacheKey: 'ds' }), provider(false));

package/src/__tests__/startupSweepOrder.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `SweepInterruptedRuns` closes out run artifacts a dead process left open. It is only sound
+ * BEFORE anything in this process can start a run: a run started first is still in flight when
+ * the sweep looks, so the sweep marks a live run "killed" and the wizard and active-operations
+ * panel report a failure for work that is still going.
+ *
+ * Booting the server is far too heavy for a unit test, so this pins the order in the source:
+ * the sweep is awaited before the scheduler, the integration sync worker (whose Start() polls
+ * immediately), the HTTP listener, and pending RSU work.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+const source = readFileSync(join(__dirname, '..', 'index.ts'), 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/^\s*\/\/.*$/gm, '');
+
+function at(needle: string): number {
+    const i = source.indexOf(needle);
+    expect(i, `not found in index.ts: ${needle}`).toBeGreaterThan(-1);
+    return i;
+}
+
+describe('startup: the interrupted-run sweep runs before anything can start a run', () => {
+    const sweep = () => at('await SweepInterruptedRuns(');
+
+    it.each([
+        ['the scheduled jobs service', 'scheduledJobsService.Start()'],
+        ['the integration sync worker', 'integrationSyncWorker.Start()'],
+        ['the HTTP listener', 'httpServer.listen('],
+        ['pending RSU work', 'processRSUPendingWork().catch('],
+    ])('precedes %s', (_label, needle) => {
+        expect(sweep()).toBeLessThan(at(needle));
+    });
+
+    it('is called exactly once', () => {
+        expect(source.split('await SweepInterruptedRuns(').length - 1).toBe(1);
+    });
+});

package/src/__tests__/unifiedAuth.test.ts

@@ -8,7 +8,7 @@
  * module (context.ts), vi.mock cannot intercept the intra-module call.
  * Instead we mock the LOWER-LEVEL dependencies that `getUserPayload` calls.
  */
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 // ─── Hoisted mocks (available inside vi.mock factories) ─────────────────────
 const {
@@ -102,6 +102,7 @@ vi.mock('@memberjunction/api-keys', () => ({
 }));
 
 import { CreateUnifiedAuthMiddleware } from '../context.js';
+import { userEmailMap } from '../config.js';
 import type { Request, Response, NextFunction } from 'express';
 import type { DataSourceInfo } from '../types.js';
 
@@ -136,6 +137,8 @@ function makeMockRes(): Response & { _status: number; _json: Record<string, unkn
 }
 
 const mockDataSources: DataSourceInfo[] = [];
+/** The mocked config's map object; tests add entries and the afterEach clears them. */
+const mockedUserEmailMap = userEmailMap as Record<string, string>;
 const MOCK_POOL = {} as unknown as import('mssql').ConnectionPool;
 
 const mockUserRecord = {
@@ -263,6 +266,34 @@ describe('createUnifiedAuthMiddleware', () => {
     });
   });
 
+  describe('x-mj-timezone header', () => {
+    beforeEach(() => {
+      setupSuccessfulAuth();
+    });
+
+    async function payloadFor(headers: Record<string, string>) {
+      const req = makeMockReq({ headers: { authorization: 'Bearer valid-token', ...headers } });
+      await middleware(req, makeMockRes(), vi.fn());
+      return req.userPayload!;
+    }
+
+    it('carries a valid IANA zone on the user payload', async () => {
+      expect((await payloadFor({ 'x-mj-timezone': 'Pacific/Auckland' })).TimeZone).toBe('Pacific/Auckland');
+    });
+
+    it('drops an invalid zone, so callers fall back to UTC', async () => {
+      expect((await payloadFor({ 'x-mj-timezone': 'Mars/Olympus_Mons' })).TimeZone).toBeUndefined();
+      expect((await payloadFor({ 'x-mj-timezone': "UTC'; DROP TABLE x;--" })).TimeZone).toBeUndefined();
+      expect((await payloadFor({ 'x-mj-timezone': '' })).TimeZone).toBeUndefined();
+    });
+
+    it('leaves the payload exactly as before when the header is absent', async () => {
+      const payload = await payloadFor({});
+      expect(payload.TimeZone).toBeUndefined();
+      expect(Object.keys(payload)).not.toContain('TimeZone');
+    });
+  });
+
   describe('Authentication failures', () => {
     it('should return 401 when no authorization header is provided, quietly (no stack-trace log)', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
@@ -436,3 +467,72 @@ describe('createUnifiedAuthMiddleware', () => {
     });
   });
 });
+
+// ─── Login identity reporting ───────────────────────────────────────────────
+// The session-audit block runs once per issued token (deduped on iss/sub/iat), so each test
+// presents a token with its own `iat`.
+
+describe('login identity reporting', () => {
+  let middleware: ReturnType<typeof CreateUnifiedAuthMiddleware>;
+  let iat = 1_700_000_000;
+
+  function presentToken(email: string): void {
+    iat += 1;
+    mockJwtDecode.mockReturnValue({
+      iss: 'https://test-issuer.com',
+      sub: 'user-1',
+      iat,
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
+    mockExtractUserInfo.mockReturnValue({ email, preferredUsername: email });
+  }
+
+  async function authenticate(): Promise<void> {
+    const req = makeMockReq({ headers: { authorization: `Bearer token-${iat}` } });
+    await middleware(req, makeMockRes(), vi.fn());
+  }
+
+  function warnings(spy: ReturnType<typeof vi.spyOn>): string[] {
+    return spy.mock.calls.map((call) => String(call[0]));
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setupSuccessfulAuth();
+    middleware = CreateUnifiedAuthMiddleware(mockDataSources);
+  });
+
+  afterEach(() => {
+    for (const key of Object.keys(mockedUserEmailMap)) {
+      delete mockedUserEmailMap[key];
+    }
+  });
+
+  it('logs nothing when the token identity and the user record agree', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    presentToken('test@example.com');
+    await authenticate();
+    expect(warnings(warn).filter((w) => w.startsWith('[Auth]'))).toEqual([]);
+    warn.mockRestore();
+  });
+
+  it('looks the user up by the mapped email and logs the remap', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    mockedUserEmailMap['other@example.org'] = 'test@example.com';
+    presentToken('other@example.org');
+    await authenticate();
+    expect(mockVerifyUserRecord.mock.calls[0][0]).toBe('test@example.com');
+    expect(warnings(warn)).toContainEqual(expect.stringContaining("USER_EMAIL_MAP remapped login 'other@example.org' to 'test@example.com'"));
+    warn.mockRestore();
+  });
+
+  it('logs a login that resolved to a record with a different email', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    presentToken('someone-else@example.org');
+    await authenticate();
+    expect(warnings(warn)).toContainEqual(
+      expect.stringContaining("Login identity 'someone-else@example.org' resolved to user user-1 with a different email (test@example.com)"),
+    );
+    warn.mockRestore();
+  });
+});

package/src/__tests__/widgetGuestElevation.test.ts

@@ -155,6 +155,8 @@ describe('widgetGuestElevation — elevateUserPayload', () => {
     expect(elevated.isSystemUser).toBe(true);
     // The session id MUST be preserved so progress/streaming still routes to the guest's websocket.
     expect(elevated.sessionId).toBe('sess-123');
+    // The guest it stands in for, so conversation writes can stay the guest's (MJ#4791).
+    expect(elevated.ElevatedFrom).toBe(guestPayload.userRecord);
   });
 
   it('does not mutate the original guest payload', () => {

package/src/agentSessions/BridgeHostInstance.ts

@@ -1,6 +1,7 @@
-import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { IMetadataProvider, LogError, UserInfo } from '@memberjunction/core';
 import { AIBridgeEngine } from '@memberjunction/ai-bridge-server';
 import { GetCurrentHostInstance } from './HostInstance.js';
+import { DEFAULT_BRIDGE_RECONCILER_SETTINGS, type BridgeReconcilerSettings } from '../backgroundSweepConfigUnits.js';
 
 /**
  * Gives the realtime bridge engine (`AIBridgeEngine`) this MJAPI instance's identity, the one its agent-session rows
@@ -17,8 +18,11 @@ export function BindBridgeEngineHostInstance(): void {
 }
 
 /**
- * Starts the realtime bridge engine's orphan reconcile: now, then every 10 minutes, it closes the bridges an earlier
- * boot of this instance left `Connecting` or `Connected` (reason `Janitor`) and finalizes their co-agent runs.
+ * Starts the realtime bridge engine's orphan reconcile: now, then every `settings.sweepIntervalMs` (10 minutes by
+ * default), it closes the bridges an earlier boot of this instance left `Connecting` or `Connected` (reason `Janitor`)
+ * and finalizes their co-agent runs. With `settings.enabled` false it reconciles once now and schedules no repeat, so an
+ * idle server sends no periodic queries for it (`agentSessions.bridgeReconciler`; see the Serverless Database
+ * Auto-Pause guide).
  *
  * `Serve` calls it once the server listens on its port, where it starts the session janitor. Holding the port is what
  * makes another boot of this instance a process that has ended; before that, an MJAPI started on a port another MJAPI
@@ -26,7 +30,18 @@ export function BindBridgeEngineHostInstance(): void {
  *
  * @param provider The server's metadata provider, for the reads and writes.
  * @param systemUser The user the writes run as.
+ * @param settings Whether to repeat the reconcile, and how often. Defaults to the shipped settings.
  */
-export function StartBridgeOrphanReconciliation(provider: IMetadataProvider, systemUser: UserInfo): void {
-    AIBridgeEngine.Instance.StartOrphanReconciliation(systemUser, provider);
+export function StartBridgeOrphanReconciliation(
+    provider: IMetadataProvider,
+    systemUser: UserInfo,
+    settings: BridgeReconcilerSettings = DEFAULT_BRIDGE_RECONCILER_SETTINGS,
+): void {
+    if (settings.enabled) {
+        AIBridgeEngine.Instance.StartOrphanReconciliation(systemUser, provider, settings.sweepIntervalMs);
+        return;
+    }
+    void AIBridgeEngine.Instance.ReconcileOrphans(systemUser, provider).catch((err) =>
+        LogError(`[AIBridgeEngine] orphan reconciliation failed: ${err instanceof Error ? err.message : String(err)}`),
+    );
 }