@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.7

package/src/__tests__/ExecuteRemoteOperationResolver.test.ts

@@ -0,0 +1,213 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { PubSubEngine } from 'type-graphql';
+
+vi.mock('../config.js', () => ({
+    configInfo: {},
+}));
+
+import { RegisterClass } from '@memberjunction/global';
+import {
+    BaseRemotableOperation,
+    RemoteOperationError,
+    type IMetadataProvider,
+    type RemoteOpInvokeOptions,
+    type RemoteOpResult,
+    type RemoteOpServerContext,
+    type UserInfo,
+} from '@memberjunction/core';
+import { RemoteOperationEngineBase } from '@memberjunction/core-entities';
+import { DispatchRemoteOperationInProcess } from '@memberjunction/core';
+import { ExecuteRemoteOperationResolver, ExecuteRemoteOperationInput } from '../resolvers/ExecuteRemoteOperationResolver.js';
+import type { AppContext } from '../types.js';
+
+interface TestOpInput {
+    message: string;
+}
+
+interface TestOpOutput {
+    echoed: string;
+    origin?: string;
+    ip?: string;
+    sessionId?: string;
+    apiKeyHash?: string;
+}
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.ContextEcho')
+class ContextEchoOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.ContextEcho';
+    public override readonly ContractFingerprint = 'ro_fp_expected12345678';
+
+    protected override async Authorize(
+        _input: TestOpInput,
+        _user: UserInfo,
+        context?: RemoteOpServerContext,
+    ): Promise<boolean> {
+        return context?.requestOrigin !== 'https://evil.example.com';
+    }
+
+    protected override async InternalExecute(
+        input: TestOpInput,
+        _provider: IMetadataProvider,
+        _user: UserInfo,
+        context: RemoteOpServerContext,
+    ): Promise<TestOpOutput> {
+        return {
+            echoed: input.message,
+            origin: context.requestOrigin,
+            ip: context.clientIp,
+            sessionId: context.sessionId,
+            apiKeyHash: context.apiKeyHash,
+        };
+    }
+}
+void ContextEchoOperation;
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.StructuredFailure')
+class StructuredFailureOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.StructuredFailure';
+
+    protected override async InternalExecute(): Promise<TestOpOutput> {
+        throw new RemoteOperationError('CUSTOM_DOMAIN_CODE', 'Structured domain validation rejected request');
+    }
+}
+void StructuredFailureOperation;
+
+describe('ExecuteRemoteOperationResolver', () => {
+    const fakeUser = { ID: 'user-1', Email: 'ada@example.com' } as UserInfo;
+    const pubSub: PubSubEngine = {
+        publish: vi.fn(async () => undefined),
+        subscribe: vi.fn(async () => 1),
+        unsubscribe: vi.fn(),
+        asyncIterator: vi.fn(),
+    } as PubSubEngine;
+
+    beforeEach(() => {
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'Config').mockResolvedValue(undefined);
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'IsInvokable').mockReturnValue({ Invokable: true });
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'GetContractFingerprint').mockReturnValue(undefined);
+    });
+
+    function buildContext(overrides: Partial<AppContext> = {}): {
+        ctx: AppContext;
+        capturedOptions: RemoteOpInvokeOptions[];
+    } {
+        const capturedOptions: RemoteOpInvokeOptions[] = [];
+        const provider = {
+            RouteOperation: async <TIn, TOut>(
+                key: string,
+                opInput: TIn,
+                options: RemoteOpInvokeOptions = {},
+            ): Promise<RemoteOpResult<TOut>> => {
+                capturedOptions.push(options);
+                return DispatchRemoteOperationInProcess<TIn, TOut>(
+                    key,
+                    opInput,
+                    options,
+                    provider as IMetadataProvider,
+                    fakeUser,
+                );
+            },
+        };
+
+        const ctx: AppContext = {
+            dataSource: {} as AppContext['dataSource'],
+            dataSources: [],
+            providers: [{ provider: provider as AppContext['providers'][number]['provider'], type: 'Read-Write' }],
+            userPayload: {
+                email: 'ada@example.com',
+                userRecord: fakeUser,
+                sessionId: 'sess-abc-123',
+                apiKeyHash: 'hash-xyz-987',
+            },
+            RequestOrigin: 'https://app.example.com',
+            ClientIp: '198.51.100.24',
+            ...overrides,
+        };
+        return { ctx, capturedOptions };
+    }
+
+    it('forwards RequestOrigin, ClientIp, sessionId, and apiKeyHash into RouteOperation and Authorize/InternalExecute', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const input: ExecuteRemoteOperationInput = {
+            operationKey: 'TestServer.ContextEcho',
+            inputJSON: JSON.stringify({ message: 'hi' }),
+            invokeMode: 'attached',
+            contractFingerprint: 'ro_fp_expected12345678',
+        };
+
+        const res = await resolver.ExecuteRemoteOperation(input, ctx, pubSub);
+        expect(res.success).toBe(true);
+        expect(res.resultCode).toBe('SUCCESS');
+        expect(capturedOptions).toHaveLength(1);
+        expect(capturedOptions[0].requestOrigin).toBe('https://app.example.com');
+        expect(capturedOptions[0].clientIp).toBe('198.51.100.24');
+        expect(capturedOptions[0].sessionId).toBe('sess-abc-123');
+        expect(capturedOptions[0].apiKeyHash).toBe('hash-xyz-987');
+
+        const parsed = JSON.parse(res.outputJSON!) as TestOpOutput;
+        expect(parsed).toEqual({
+            echoed: 'hi',
+            origin: 'https://app.example.com',
+            ip: '198.51.100.24',
+            sessionId: 'sess-abc-123',
+            apiKeyHash: 'hash-xyz-987',
+        });
+    });
+
+    it('enforces Authorize against context.requestOrigin', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext({ RequestOrigin: 'https://evil.example.com' });
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('FORBIDDEN');
+    });
+
+    it('rejects stale client contractFingerprint with CONTRACT_MISMATCH before running operation', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+                contractFingerprint: 'ro_fp_stale00000000000',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CONTRACT_MISMATCH');
+        expect(capturedOptions).toHaveLength(0);
+    });
+
+    it('surfaces custom RemoteOperationError ResultCodes on the GraphQL result', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.StructuredFailure',
+                inputJSON: JSON.stringify({ message: 'check' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CUSTOM_DOMAIN_CODE');
+        expect(res.errorMessage).toBe('Structured domain validation rejected request');
+    });
+});

package/src/__tests__/HandoffOfferExpiry.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `agentSessions.handoffOfferExpiry`: MJServer either stops the handoff offer registry's expiry sweep
+ * or puts it on the configured interval. The registry starts the sweep on its own when it loads.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { HandoffOfferRegistry } from '@memberjunction/livekit-room-server';
+import { ApplyHandoffOfferExpirySettings } from '../agentSessions/HandoffOfferExpiry.js';
+
+describe('ApplyHandoffOfferExpirySettings', () => {
+    afterEach(() => {
+        HandoffOfferRegistry.Instance.StartPeriodicSweep(15_000);
+        HandoffOfferRegistry.Instance.StopPeriodicSweep();
+        vi.restoreAllMocks();
+        vi.useRealTimers();
+    });
+
+    it('disabled: stops the sweep, and nothing is read for an hour', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        registry.StartPeriodicSweep(15_000);
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: false, sweepIntervalMs: 15_000 });
+        await vi.advanceTimersByTimeAsync(60 * 60_000);
+
+        expect(sweep).not.toHaveBeenCalled();
+        expect(registry.IsPeriodicSweepScheduled).toBe(false);
+    });
+
+    it('enabled: runs the sweep on the configured interval', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: true, sweepIntervalMs: 120_000 });
+        await vi.advanceTimersByTimeAsync(10 * 60_000);
+
+        expect(sweep).toHaveBeenCalledTimes(5);
+    });
+});

package/src/__tests__/IntegrationRunArtifactAuthorization.test.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect } from 'vitest';
+import type { IntegrationRunManifest } from '@memberjunction/integration-progress-artifacts';
+import { AuthorizeRunArtifact } from '../integration/RunArtifactAuthorization.js';
+
+/**
+ * Who may read a run artifact.
+ *
+ * This is a security boundary, not plumbing. A run artifact is one undivided event stream carrying
+ * migration descriptions, affected table names and error text; an RSU batch can span several
+ * connections, and there is no mechanism to serve a caller a partial view of one. So the rule is
+ * AND — authorized for EVERY connection the run touched — because "any one of them" would hand
+ * connection A's schema-change descriptions to a user who only holds rights on connection B.
+ *
+ * The per-connection check itself (a RunView under the caller's context, so the provider applies
+ * row-level security) is exercised elsewhere; these tests stub it to an allowlist and lock the
+ * COMBINING rule, which is the part that changed.
+ */
+
+/**
+ * A per-connection check that answers from `allowed` and records what it was asked, so the tests can
+ * assert the short-circuit as well as the verdict. Memoization lives in the resolver's cache, so a
+ * shared `asked` list across calls shows exactly how many lookups the rule performed.
+ */
+function checkFor(allowed: string[]): { canRead: (id: string) => Promise<boolean>; asked: string[] } {
+    const asked: string[] = [];
+    const seen = new Map<string, boolean>();
+    return {
+        asked,
+        canRead: async (companyIntegrationID: string): Promise<boolean> => {
+            const cached = seen.get(companyIntegrationID);
+            if (cached !== undefined) return cached;
+            asked.push(companyIntegrationID);
+            const verdict = allowed.includes(companyIntegrationID);
+            seen.set(companyIntegrationID, verdict);
+            return verdict;
+        },
+    };
+}
+
+function manifestOf(over: Partial<IntegrationRunManifest>): IntegrationRunManifest {
+    return { runID: 'r1', runKind: 'RSU', startedAt: new Date().toISOString(), ...over };
+}
+
+describe('run-artifact authorization', () => {
+    it('authorizes a single-connection run for a caller who holds that connection', async () => {
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('authorizes an RSU run at all — the manifest identity is what unblocks it', async () => {
+        // Regression guard for the original defect: an RSU manifest carried no connection, the check
+        // returned false on the missing field, and every RSU run answered "not authorized" to
+        // IntegrationGetRun and IntegrationTailRunEvents.
+        const { canRead } = checkFor(['CI-1']);
+        const withIdentity = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1'] }), canRead);
+        const withoutIdentity = await AuthorizeRunArtifact(manifestOf({}), canRead);
+        expect(withIdentity.Authorized).toBe(true);
+        expect(withoutIdentity.Authorized).toBe(false);
+    });
+
+    it('requires EVERY connection of a multi-connection batch — AND, not any', async () => {
+        // The leak this prevents: a user with rights only on CI-2 reading CI-1's schema-change
+        // descriptions out of the shared batch stream.
+        const { canRead } = checkFor(['CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+    });
+
+    it('denies the batch even when the caller holds all but one of its connections', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-3');
+    });
+
+    it('authorizes a multi-connection batch only for a caller who holds all of them', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('stops at the first denial, so a caller cannot probe what else a run covers', async () => {
+        const { canRead, asked } = checkFor([]);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+        expect(asked).toEqual(['CI-1']);
+    });
+
+    it('denies a run with no connection identity at all, without asking anything', async () => {
+        // Non-tenant-scoped artifacts are not exposed through the per-company endpoints, and an
+        // identity-less run must not become readable as a side effect of runs gaining a set field.
+        const { canRead, asked } = checkFor(['CI-1']);
+        for (const manifest of [{}, { companyIntegrationIDs: [] }]) {
+            const result = await AuthorizeRunArtifact(manifestOf(manifest), canRead);
+            expect(result.Authorized).toBe(false);
+            expect(result.DeniedCompanyIntegrationID).toBeUndefined();
+        }
+        expect(asked).toEqual([]);
+    });
+
+    it('falls back to the singular field for runs written before the set existed', async () => {
+        // Every sync/discovery run carries only `companyIntegrationID`; those must keep working.
+        const { canRead } = checkFor(['CI-9']);
+        const ok = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-9' }), canRead);
+        const denied = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-8' }), canRead);
+        expect(ok.Authorized).toBe(true);
+        expect(denied.Authorized).toBe(false);
+        expect(denied.DeniedCompanyIntegrationID).toBe('CI-8');
+    });
+
+    it('prefers the set over the singular field when both are present', async () => {
+        // A batch that also happens to carry a singular value must still be judged on the whole set.
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1', 'CI-2'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-2');
+    });
+});

package/src/__tests__/MagicLinkKeys.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { generateKeyPairSync } from 'node:crypto';
+
+const logDoubles = vi.hoisted(() => ({
+  LogWarning: vi.fn(),
+  LogStatusEx: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async importOriginal => {
+  const actual = await importOriginal<typeof import('@memberjunction/core')>();
+  return { ...actual, LogWarning: logDoubles.LogWarning, LogStatusEx: logDoubles.LogStatusEx };
+});
+
+import { GetGlobalObjectStore } from '@memberjunction/global';
+import {
+  MagicLinkKeyManager,
+  IsMagicLinkLocalDevEnvironment,
+  EPHEMERAL_MAGIC_LINK_KEY_WARNING,
+} from '../auth/magicLink/MagicLinkKeys.js';
+
+/** Subclass so each test gets its own singleton slot instead of sharing the app-wide instance. */
+class IsolatedKeyManager extends MagicLinkKeyManager {}
+
+function freshManager(): IsolatedKeyManager {
+  const manager = new IsolatedKeyManager();
+  const store = GetGlobalObjectStore();
+  if (store) {
+    delete store[manager.GlobalKey];
+  }
+  return new IsolatedKeyManager();
+}
+
+describe('IsMagicLinkLocalDevEnvironment', () => {
+  it('treats NODE_ENV=production (any case, padded) as not local dev', () => {
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'production' })).toBe(false);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: ' Production ' })).toBe(false);
+  });
+
+  it('treats unset, development and test as local dev', () => {
+    expect(IsMagicLinkLocalDevEnvironment({})).toBe(true);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'development' })).toBe(true);
+    expect(IsMagicLinkLocalDevEnvironment({ NODE_ENV: 'test' })).toBe(true);
+  });
+});
+
+describe('MagicLinkKeyManager ephemeral key reporting', () => {
+  let manager: IsolatedKeyManager;
+
+  beforeEach(() => {
+    logDoubles.LogWarning.mockClear();
+    logDoubles.LogStatusEx.mockClear();
+    manager = freshManager();
+  });
+
+  afterEach(() => {
+    const store = GetGlobalObjectStore();
+    if (store) {
+      delete store[manager.GlobalKey];
+    }
+  });
+
+  it('warns in the default output when no key is configured and NODE_ENV=production', () => {
+    manager.Initialize(undefined, { NODE_ENV: 'production' });
+
+    expect(manager.IsEphemeral).toBe(true);
+    expect(logDoubles.LogWarning).toHaveBeenCalledTimes(1);
+    expect(logDoubles.LogWarning).toHaveBeenCalledWith(EPHEMERAL_MAGIC_LINK_KEY_WARNING);
+    expect(logDoubles.LogStatusEx).not.toHaveBeenCalled();
+  });
+
+  it('the warning names the restart and multi-instance consequences and how to configure a key', () => {
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('restarts');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('other MJAPI instance');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('magicLink.rsaPrivateKey');
+    expect(EPHEMERAL_MAGIC_LINK_KEY_WARNING).toContain('MJ_MAGIC_LINK_PRIVATE_KEY');
+  });
+
+  it('keeps the notice verbose-only in local dev', () => {
+    manager.Initialize(undefined, {});
+
+    expect(manager.IsEphemeral).toBe(true);
+    expect(logDoubles.LogWarning).not.toHaveBeenCalled();
+    expect(logDoubles.LogStatusEx).toHaveBeenCalledTimes(1);
+    expect(logDoubles.LogStatusEx.mock.calls[0][0]).toMatchObject({ verboseOnly: true });
+  });
+
+  it('is not ephemeral and logs nothing when a key is configured, even in production', () => {
+    const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+    const pem = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+
+    manager.Initialize(pem, { NODE_ENV: 'production' });
+
+    expect(manager.IsEphemeral).toBe(false);
+    expect(logDoubles.LogWarning).not.toHaveBeenCalled();
+    expect(logDoubles.LogStatusEx).not.toHaveBeenCalled();
+  });
+
+  it('reports IsEphemeral false before initialization', () => {
+    expect(manager.IsEphemeral).toBe(false);
+    expect(manager.IsInitialized).toBe(false);
+  });
+});

package/src/__tests__/MediaAccessKeys.test.ts

@@ -1,5 +1,7 @@
 import { describe, it, expect } from 'vitest';
+import { createHmac } from 'node:crypto';
 import jwt from 'jsonwebtoken';
+import { GetGlobalObjectStore } from '@memberjunction/global';
 import { MediaAccessKeyManager, MEDIA_ACCESS_TOKEN_TYPE } from '../rest/MediaAccessKeys.js';
 
 /**
@@ -53,16 +55,61 @@ describe('MediaAccessKeyManager', () => {
     expect(km.Verify(Token).Valid).toBe(false);
   });
 
-  it('rejects a token with the wrong typ even if validly signed', () => {
+  it('rejects a token with the wrong typ even when validly signed with the real secret', () => {
     const km = MediaAccessKeyManager.Instance;
-    // Mint a valid token, then read the real secret out of a known-good token by
-    // re-signing through the manager is not possible; instead assert that a token
-    // whose typ differs is rejected by signing a structurally-valid JWT with a
-    // foreign secret (signature failure also yields false, which is the safe outcome).
-    const foreign = jwt.sign({ fileId: 'FILE-5', userId: 'USER-5', typ: 'something-else' }, 'foreign-secret', {
-      algorithm: 'HS256',
-      expiresIn: 3600,
-    });
-    expect(km.Verify(foreign).Valid).toBe(false);
+    const uploadToken = km.SignUpload('USER-5').Token;
+    expect(km.Verify(uploadToken).Valid).toBe(false);
+
+    const mediaToken = km.Sign('FILE-5', 'USER-5').Token;
+    expect(km.VerifyUpload(mediaToken).Valid).toBe(false);
+  });
+
+  it('derives a domain-separated HS256 signing key from MJ_BASE_ENCRYPTION_KEY and rejects tokens signed with the raw master key', () => {
+    const store = GetGlobalObjectStore();
+    const savedStoreSecret = store?.['___MEDIA_ACCESS_SECRET___'];
+    const savedEnvKey = process.env.MJ_BASE_ENCRYPTION_KEY;
+    const rawMasterKey = 'test-master-encryption-key-do-not-use-directly';
+
+    try {
+      if (store) {
+        delete store['___MEDIA_ACCESS_SECRET___'];
+      }
+      process.env.MJ_BASE_ENCRYPTION_KEY = rawMasterKey;
+
+      const isolatedKm = new MediaAccessKeyManager();
+      const { Token } = isolatedKm.Sign('FILE-KEY-SEP', 'USER-KEY-SEP');
+
+      // Round-trips through the manager using the derived subkey
+      const verified = isolatedKm.Verify(Token);
+      expect(verified.Valid).toBe(true);
+
+      // Matches the documented HMAC-SHA256 key derivation label
+      const expectedDerivedSecret = createHmac('sha256', rawMasterKey)
+        .update('mj-media-access-token-signing-v1')
+        .digest('base64');
+      const decoded = jwt.verify(Token, expectedDerivedSecret, { algorithms: ['HS256'] });
+      expect(typeof decoded).toBe('object');
+
+      // A JWT signed directly with the raw MJ_BASE_ENCRYPTION_KEY MUST be rejected
+      const forgedWithRawMasterKey = jwt.sign(
+        { fileId: 'FILE-KEY-SEP', userId: 'USER-KEY-SEP', typ: MEDIA_ACCESS_TOKEN_TYPE },
+        rawMasterKey,
+        { algorithm: 'HS256', expiresIn: 3600 },
+      );
+      expect(isolatedKm.Verify(forgedWithRawMasterKey).Valid).toBe(false);
+    } finally {
+      if (savedEnvKey === undefined) {
+        delete process.env.MJ_BASE_ENCRYPTION_KEY;
+      } else {
+        process.env.MJ_BASE_ENCRYPTION_KEY = savedEnvKey;
+      }
+      if (store) {
+        if (savedStoreSecret === undefined) {
+          delete store['___MEDIA_ACCESS_SECRET___'];
+        } else {
+          store['___MEDIA_ACCESS_SECRET___'] = savedStoreSecret;
+        }
+      }
+    }
   });
 });

package/src/__tests__/NewArrivalsDefaultDisabled.test.ts

@@ -0,0 +1,50 @@
+/**
+ * everything.txt is explicit about what a schema refresh does with objects it has just found:
+ * "we create entity maps for all objects that are determined as things that should be now added
+ * but arent, we enable nothing (because the user needs to, after the refresh, then go turn them
+ * on)". These pin that contract at the only place it is expressed - the argument defaults.
+ *
+ * They defaulted TRUE for a period on the claim that a disabled new object never reached a
+ * migration. That claim was wrong: `CreateDisabled` governs only the entity/field MAP status,
+ * new IntegrationObject rows are written Active unconditionally, and phase 4 evolves over
+ * `continuingMaps + newObjects` regardless of the flag. The table is created either way; the
+ * flag decides only whether the object starts SYNCING unasked.
+ *
+ * Read from source rather than by invoking the resolver: the default lives in a type-graphql
+ * decorator, and a test that booted the schema to read it back would be testing type-graphql.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC = readFileSync(
+  join(__dirname, '..', 'resolvers', 'IntegrationDiscoveryResolver.ts'),
+  'utf-8',
+);
+
+function argDefault(name: string): string | null {
+  const m = SRC.match(new RegExp(`@Arg\\("${name}",\\s*\\{\\s*defaultValue:\\s*(true|false)`));
+  return m ? m[1] : null;
+}
+
+describe('new arrivals default to disabled', () => {
+  it('autoEnableNewObjects defaults false', () => {
+    expect(argDefault('autoEnableNewObjects')).toBe('false');
+  });
+
+  it('autoEnableNewColumns defaults false', () => {
+    expect(argDefault('autoEnableNewColumns')).toBe('false');
+  });
+
+  it('the description does not promise auto-adoption', () => {
+    const line = SRC.split('\n').find(l => l.includes('@Arg("autoEnableNewObjects"'));
+    expect(line).toBeDefined();
+    expect(line!).toMatch(/DISABLED/);
+    expect(line!).not.toMatch(/created ENABLED/);
+  });
+
+  it('CreateDisabled is still what carries the decision to the post-restart consumer', () => {
+    // If this coupling is ever renamed, the defaults above stop meaning anything.
+    expect(SRC).toMatch(/CreateDisabled:\s*!autoEnableNewObjects/);
+  });
+});