@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.8

package/src/__tests__/EntityMapLifecycle.rekey.test.ts

@@ -0,0 +1,252 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { RunView, type DatabaseProviderBase, type UserInfo } from '@memberjunction/core';
+import { CatalogIdentityKey, ClearRekeyedObjectData, DecideRekeyed, IdentityKeyFields } from '../integration/EntityMapLifecycle.js';
+
+/**
+ * A connector upgrade can change what identifies a row. PheedLoop 1.4.6 makes Attendees
+ * `code + eventCode`, because the object is fetched once per event and an attendee at two events
+ * comes back twice carrying the same `code`.
+ *
+ * `ToExternalRecord` joins every IsPrimaryKey field with '|' in Sequence order, so both the
+ * MEMBERS and the ORDER are part of identity. These pin the two pure decisions that drive the
+ * evolution's clear-and-rebuild.
+ */
+const f = (Name: string, IsPrimaryKey: boolean | null, Sequence: number | null) =>
+    ({ Name, IsPrimaryKey, Sequence });
+
+describe('IdentityKeyFields', () => {
+    it('takes only key fields, in Sequence order — not declaration order', () => {
+        expect(IdentityKeyFields([
+            f('eventCode', true, 2),
+            f('is_checked_in', false, 3),
+            f('code', true, 1),
+        ])).toEqual(['code', 'eventCode']);
+    });
+
+    it('is empty when nothing is flagged', () => {
+        expect(IdentityKeyFields([f('a', false, 1), f('b', null, 2)])).toEqual([]);
+    });
+
+    it('treats a missing Sequence as 0 rather than dropping the field', () => {
+        expect(IdentityKeyFields([f('b', true, null), f('a', true, 1)])).toEqual(['b', 'a']);
+    });
+
+    it('does not mutate the caller array', () => {
+        const input = [f('z', true, 9), f('a', true, 1)];
+        IdentityKeyFields(input);
+        expect(input[0].Name).toBe('z');
+    });
+});
+
+describe('DecideRekeyed', () => {
+    it('a column joining the key is a re-key — the PheedLoop case', () => {
+        expect(DecideRekeyed(['code'], ['code', 'eventCode'])).toBe(true);
+    });
+
+    it('a column leaving the key is a re-key', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['code'])).toBe(true);
+    });
+
+    it('the same columns in a different ORDER is a re-key — the identity string differs', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['eventCode', 'code'])).toBe(true);
+    });
+
+    it('an unchanged key is not', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['code', 'eventCode'])).toBe(false);
+    });
+
+    it('matches case-insensitively, as every catalog-to-map reconciliation does', () => {
+        expect(DecideRekeyed(['Code'], ['code'])).toBe(false);
+    });
+
+    // The guard that stops this from clearing the fleet. An empty BUILT key means the entity's
+    // fields could not be read, not that the table never had a key — and treating unknown as
+    // empty would re-key (and therefore WIPE) every table on a workspace whose metadata failed
+    // to load.
+    it('an unreadable built key is never a re-key, however different the catalog looks', () => {
+        expect(DecideRekeyed([], ['code', 'eventCode'])).toBe(false);
+        expect(DecideRekeyed([], [])).toBe(false);
+    });
+
+    it('a catalog that reports no key against a real built key IS a re-key', () => {
+        expect(DecideRekeyed(['code'], [])).toBe(true);
+    });
+
+    // The same guard on the catalog side. A refresh reading a per-connection object whose fields
+    // were never warmed got `[]`, and "no key" against a real built key cleared the object's
+    // record maps and rows on every refresh.
+    it('an unread catalog key is never a re-key', () => {
+        expect(DecideRekeyed(['code'], null)).toBe(false);
+        expect(DecideRekeyed(['code', 'eventCode'], CatalogIdentityKey([]))).toBe(false);
+    });
+});
+
+describe('CatalogIdentityKey', () => {
+    const row = (Name: string, IsPrimaryKey: boolean, Sequence: number, Status = 'Active') =>
+        ({ Name, IsPrimaryKey, Sequence, Status });
+
+    it('is null when no field row was read — a cold per-connection object answers []', () => {
+        expect(CatalogIdentityKey([])).toBeNull();
+    });
+
+    it('is null when no row is Active — nothing describes the object', () => {
+        expect(CatalogIdentityKey([row('code', true, 1, 'Inactive')])).toBeNull();
+    });
+
+    it('is the Active key fields in Sequence order', () => {
+        expect(CatalogIdentityKey([
+            row('eventCode', true, 2),
+            row('old_key', true, 0, 'Inactive'),
+            row('code', true, 1),
+            row('name', false, 3),
+        ])).toEqual(['code', 'eventCode']);
+    });
+
+    it('is [] when Active rows declare no key — read, and keyless, so still a re-key', () => {
+        const key = CatalogIdentityKey([row('name', false, 1)]);
+        expect(key).toEqual([]);
+        expect(DecideRekeyed(['code'], key)).toBe(true);
+    });
+});
+
+/**
+ * Two connections to the same vendor share one schema, so they share every entity table. The clear
+ * may only touch the rows THIS connection's record maps point at; the other connection's rows in
+ * the same table are not its to delete.
+ */
+describe('ClearRekeyedObjectData', () => {
+    const USER = { ID: 'user-1' } as UserInfo;
+    const RECORD_MAPS = { Name: 'MJ: Company Integration Record Maps', SchemaName: '__mj', BaseTable: 'CompanyIntegrationRecordMap' };
+    const TARGET = { ExternalObjectName: 'attendees', EntityMapID: 'M1', EntityID: 'E1', SchemaName: 'pheedloop', BaseTable: 'attendees' };
+    type MapRow = { ID: string; EntityRecordID: string };
+    type RunViewParams = Parameters<RunView['RunView']>[0];
+    type RunViewResult = Awaited<ReturnType<RunView['RunView']>>;
+
+    /** A provider that records every statement and transaction step, in order. */
+    function fakeProvider(key: string[], failOn?: string) {
+        const log: string[] = [];
+        const provider = {
+            Dialect: {
+                QuoteIdentifier: (s: string) => `[${s}]`,
+                QuoteStringLiteral: (s: string) => `'${s.replace(/'/g, "''")}'`,
+            },
+            Entities: [RECORD_MAPS],
+            EntityByName: (name: string) => (name === RECORD_MAPS.Name ? RECORD_MAPS : undefined),
+            EntityByID: (id: string) => (id === 'E1' ? { PrimaryKeys: key.map(Name => ({ Name })) } : undefined),
+            ExecuteSQL: async (sql: string) => {
+                log.push(sql);
+                if (failOn && sql.includes(failOn)) throw new Error('deadlock victim');
+                return [];
+            },
+            BeginTransaction: async () => { log.push('BEGIN'); },
+            CommitTransaction: async () => { log.push('COMMIT'); },
+            RollbackTransaction: async () => { log.push('ROLLBACK'); },
+        };
+        return { provider: provider as unknown as DatabaseProviderBase, log };
+    }
+
+    let runView: ReturnType<typeof vi.spyOn>;
+    /** Answers the record-map reads one page at a time, then empty. */
+    function recordMapPages(...pages: MapRow[][]) {
+        for (const page of pages) {
+            runView.mockResolvedValueOnce({ Success: true, Results: page } as unknown as RunViewResult);
+        }
+        runView.mockResolvedValue({ Success: true, Results: [] } as unknown as RunViewResult);
+    }
+    const reads = () => runView.mock.calls.map(c => c[0] as RunViewParams);
+
+    beforeEach(() => { runView = vi.spyOn(RunView.prototype, 'RunView'); });
+    afterEach(() => { vi.restoreAllMocks(); });
+
+    it('deletes only the rows this connection\'s record maps point at — never the whole table', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }, { ID: 'm2', EntityRecordID: 'r2' }]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual(['attendees']);
+        expect(log).not.toContain('DELETE FROM [pheedloop].[attendees]');
+        expect(log).toContain("DELETE FROM [pheedloop].[attendees] WHERE [ID] IN ('r1','r2')");
+        expect(reads()[0].EntityName).toBe(RECORD_MAPS.Name);
+        expect(reads()[0].ExtraFilter).toBe("CompanyIntegrationID='CI-A' AND EntityID='E1'");
+    });
+
+    it('deletes the rows while their maps still say which rows they are, in one transaction with the maps', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }]);
+
+        await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(log).toEqual([
+            'BEGIN',
+            "DELETE FROM [pheedloop].[attendees] WHERE [ID] IN ('r1')",
+            "DELETE FROM [__mj].[CompanyIntegrationRecordMap] WHERE [CompanyIntegrationID]='CI-A' AND [EntityID]='E1' AND [ID] IN ('m1')",
+            'COMMIT',
+        ]);
+    });
+
+    it('matches every column of a composite key, split the way the engine joined it', async () => {
+        const { provider, log } = fakeProvider(['code', 'eventCode']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'a|1' }, { ID: 'm2', EntityRecordID: "b'x|2" }]);
+
+        await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(log).toContain(
+            "DELETE FROM [pheedloop].[attendees] WHERE ([code]='a' AND [eventCode]='1') OR ([code]='b''x' AND [eventCode]='2')"
+        );
+    });
+
+    it('leaves a map whose id cannot name exactly one row, and does not report the object cleared', async () => {
+        // 'a|1|z' against a two-column key is a value that itself contained '|': splitting it would
+        // name some OTHER row. An empty component is a null key value, which matches nothing safely.
+        const { provider, log } = fakeProvider(['code', 'eventCode']);
+        recordMapPages([
+            { ID: 'm1', EntityRecordID: 'a|1' },
+            { ID: 'm2', EntityRecordID: 'a|1|z' },
+            { ID: 'm3', EntityRecordID: '|2' },
+        ]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toContain("DELETE FROM [pheedloop].[attendees] WHERE ([code]='a' AND [eventCode]='1')");
+        expect(log.some(s => s.includes('m2') || s.includes('m3'))).toBe(false);
+    });
+
+    it('pages through the maps by id, so a big table is never read or deleted whole', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages(
+            [{ ID: 'm1', EntityRecordID: 'r1' }, { ID: 'm2', EntityRecordID: 'r2' }],
+            [{ ID: 'm3', EntityRecordID: 'r3' }],
+        );
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider, 2);
+
+        expect(cleared).toEqual(['attendees']);
+        expect(reads()).toHaveLength(2);
+        expect(reads()[0]).toMatchObject({ OrderBy: 'ID', MaxRows: 2, SkipTotalRowCount: true, BypassCache: true });
+        expect(reads()[1].ExtraFilter).toBe("CompanyIntegrationID='CI-A' AND EntityID='E1' AND ID > 'm2'");
+        expect(log.filter(s => s === 'COMMIT')).toHaveLength(2);
+    });
+
+    it('rolls a failed chunk back and does not report the object cleared', async () => {
+        const { provider, log } = fakeProvider(['ID'], 'CompanyIntegrationRecordMap');
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toContain('ROLLBACK');
+        expect(log).not.toContain('COMMIT');
+    });
+
+    it('deletes nothing when the record maps cannot be read', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        runView.mockResolvedValue({ Success: false, Results: [], ErrorMessage: 'timeout' } as unknown as RunViewResult);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toEqual([]);
+    });
+});

package/src/__tests__/ExecuteRemoteOperationResolver.test.ts

@@ -0,0 +1,213 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { PubSubEngine } from 'type-graphql';
+
+vi.mock('../config.js', () => ({
+    configInfo: {},
+}));
+
+import { RegisterClass } from '@memberjunction/global';
+import {
+    BaseRemotableOperation,
+    RemoteOperationError,
+    type IMetadataProvider,
+    type RemoteOpInvokeOptions,
+    type RemoteOpResult,
+    type RemoteOpServerContext,
+    type UserInfo,
+} from '@memberjunction/core';
+import { RemoteOperationEngineBase } from '@memberjunction/core-entities';
+import { DispatchRemoteOperationInProcess } from '@memberjunction/core';
+import { ExecuteRemoteOperationResolver, ExecuteRemoteOperationInput } from '../resolvers/ExecuteRemoteOperationResolver.js';
+import type { AppContext } from '../types.js';
+
+interface TestOpInput {
+    message: string;
+}
+
+interface TestOpOutput {
+    echoed: string;
+    origin?: string;
+    ip?: string;
+    sessionId?: string;
+    apiKeyHash?: string;
+}
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.ContextEcho')
+class ContextEchoOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.ContextEcho';
+    public override readonly ContractFingerprint = 'ro_fp_expected12345678';
+
+    protected override async Authorize(
+        _input: TestOpInput,
+        _user: UserInfo,
+        context?: RemoteOpServerContext,
+    ): Promise<boolean> {
+        return context?.requestOrigin !== 'https://evil.example.com';
+    }
+
+    protected override async InternalExecute(
+        input: TestOpInput,
+        _provider: IMetadataProvider,
+        _user: UserInfo,
+        context: RemoteOpServerContext,
+    ): Promise<TestOpOutput> {
+        return {
+            echoed: input.message,
+            origin: context.requestOrigin,
+            ip: context.clientIp,
+            sessionId: context.sessionId,
+            apiKeyHash: context.apiKeyHash,
+        };
+    }
+}
+void ContextEchoOperation;
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.StructuredFailure')
+class StructuredFailureOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.StructuredFailure';
+
+    protected override async InternalExecute(): Promise<TestOpOutput> {
+        throw new RemoteOperationError('CUSTOM_DOMAIN_CODE', 'Structured domain validation rejected request');
+    }
+}
+void StructuredFailureOperation;
+
+describe('ExecuteRemoteOperationResolver', () => {
+    const fakeUser = { ID: 'user-1', Email: 'ada@example.com' } as UserInfo;
+    const pubSub: PubSubEngine = {
+        publish: vi.fn(async () => undefined),
+        subscribe: vi.fn(async () => 1),
+        unsubscribe: vi.fn(),
+        asyncIterator: vi.fn(),
+    } as PubSubEngine;
+
+    beforeEach(() => {
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'Config').mockResolvedValue(undefined);
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'IsInvokable').mockReturnValue({ Invokable: true });
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'GetContractFingerprint').mockReturnValue(undefined);
+    });
+
+    function buildContext(overrides: Partial<AppContext> = {}): {
+        ctx: AppContext;
+        capturedOptions: RemoteOpInvokeOptions[];
+    } {
+        const capturedOptions: RemoteOpInvokeOptions[] = [];
+        const provider = {
+            RouteOperation: async <TIn, TOut>(
+                key: string,
+                opInput: TIn,
+                options: RemoteOpInvokeOptions = {},
+            ): Promise<RemoteOpResult<TOut>> => {
+                capturedOptions.push(options);
+                return DispatchRemoteOperationInProcess<TIn, TOut>(
+                    key,
+                    opInput,
+                    options,
+                    provider as IMetadataProvider,
+                    fakeUser,
+                );
+            },
+        };
+
+        const ctx: AppContext = {
+            dataSource: {} as AppContext['dataSource'],
+            dataSources: [],
+            providers: [{ provider: provider as AppContext['providers'][number]['provider'], type: 'Read-Write' }],
+            userPayload: {
+                email: 'ada@example.com',
+                userRecord: fakeUser,
+                sessionId: 'sess-abc-123',
+                apiKeyHash: 'hash-xyz-987',
+            },
+            RequestOrigin: 'https://app.example.com',
+            ClientIp: '198.51.100.24',
+            ...overrides,
+        };
+        return { ctx, capturedOptions };
+    }
+
+    it('forwards RequestOrigin, ClientIp, sessionId, and apiKeyHash into RouteOperation and Authorize/InternalExecute', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const input: ExecuteRemoteOperationInput = {
+            operationKey: 'TestServer.ContextEcho',
+            inputJSON: JSON.stringify({ message: 'hi' }),
+            invokeMode: 'attached',
+            contractFingerprint: 'ro_fp_expected12345678',
+        };
+
+        const res = await resolver.ExecuteRemoteOperation(input, ctx, pubSub);
+        expect(res.success).toBe(true);
+        expect(res.resultCode).toBe('SUCCESS');
+        expect(capturedOptions).toHaveLength(1);
+        expect(capturedOptions[0].requestOrigin).toBe('https://app.example.com');
+        expect(capturedOptions[0].clientIp).toBe('198.51.100.24');
+        expect(capturedOptions[0].sessionId).toBe('sess-abc-123');
+        expect(capturedOptions[0].apiKeyHash).toBe('hash-xyz-987');
+
+        const parsed = JSON.parse(res.outputJSON!) as TestOpOutput;
+        expect(parsed).toEqual({
+            echoed: 'hi',
+            origin: 'https://app.example.com',
+            ip: '198.51.100.24',
+            sessionId: 'sess-abc-123',
+            apiKeyHash: 'hash-xyz-987',
+        });
+    });
+
+    it('enforces Authorize against context.requestOrigin', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext({ RequestOrigin: 'https://evil.example.com' });
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('FORBIDDEN');
+    });
+
+    it('rejects stale client contractFingerprint with CONTRACT_MISMATCH before running operation', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+                contractFingerprint: 'ro_fp_stale00000000000',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CONTRACT_MISMATCH');
+        expect(capturedOptions).toHaveLength(0);
+    });
+
+    it('surfaces custom RemoteOperationError ResultCodes on the GraphQL result', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.StructuredFailure',
+                inputJSON: JSON.stringify({ message: 'check' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CUSTOM_DOMAIN_CODE');
+        expect(res.errorMessage).toBe('Structured domain validation rejected request');
+    });
+});

package/src/__tests__/HandoffOfferExpiry.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `agentSessions.handoffOfferExpiry`: MJServer either stops the handoff offer registry's expiry sweep
+ * or puts it on the configured interval. The registry starts the sweep on its own when it loads.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { HandoffOfferRegistry } from '@memberjunction/livekit-room-server';
+import { ApplyHandoffOfferExpirySettings } from '../agentSessions/HandoffOfferExpiry.js';
+
+describe('ApplyHandoffOfferExpirySettings', () => {
+    afterEach(() => {
+        HandoffOfferRegistry.Instance.StartPeriodicSweep(15_000);
+        HandoffOfferRegistry.Instance.StopPeriodicSweep();
+        vi.restoreAllMocks();
+        vi.useRealTimers();
+    });
+
+    it('disabled: stops the sweep, and nothing is read for an hour', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        registry.StartPeriodicSweep(15_000);
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: false, sweepIntervalMs: 15_000 });
+        await vi.advanceTimersByTimeAsync(60 * 60_000);
+
+        expect(sweep).not.toHaveBeenCalled();
+        expect(registry.IsPeriodicSweepScheduled).toBe(false);
+    });
+
+    it('enabled: runs the sweep on the configured interval', async () => {
+        vi.useFakeTimers();
+        const registry = HandoffOfferRegistry.Instance;
+        const sweep = vi.spyOn(registry, 'Sweep').mockResolvedValue(0);
+
+        ApplyHandoffOfferExpirySettings({ enabled: true, sweepIntervalMs: 120_000 });
+        await vi.advanceTimersByTimeAsync(10 * 60_000);
+
+        expect(sweep).toHaveBeenCalledTimes(5);
+    });
+});

package/src/__tests__/IntegrationRunArtifactAuthorization.test.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect } from 'vitest';
+import type { IntegrationRunManifest } from '@memberjunction/integration-progress-artifacts';
+import { AuthorizeRunArtifact } from '../integration/RunArtifactAuthorization.js';
+
+/**
+ * Who may read a run artifact.
+ *
+ * This is a security boundary, not plumbing. A run artifact is one undivided event stream carrying
+ * migration descriptions, affected table names and error text; an RSU batch can span several
+ * connections, and there is no mechanism to serve a caller a partial view of one. So the rule is
+ * AND — authorized for EVERY connection the run touched — because "any one of them" would hand
+ * connection A's schema-change descriptions to a user who only holds rights on connection B.
+ *
+ * The per-connection check itself (a RunView under the caller's context, so the provider applies
+ * row-level security) is exercised elsewhere; these tests stub it to an allowlist and lock the
+ * COMBINING rule, which is the part that changed.
+ */
+
+/**
+ * A per-connection check that answers from `allowed` and records what it was asked, so the tests can
+ * assert the short-circuit as well as the verdict. Memoization lives in the resolver's cache, so a
+ * shared `asked` list across calls shows exactly how many lookups the rule performed.
+ */
+function checkFor(allowed: string[]): { canRead: (id: string) => Promise<boolean>; asked: string[] } {
+    const asked: string[] = [];
+    const seen = new Map<string, boolean>();
+    return {
+        asked,
+        canRead: async (companyIntegrationID: string): Promise<boolean> => {
+            const cached = seen.get(companyIntegrationID);
+            if (cached !== undefined) return cached;
+            asked.push(companyIntegrationID);
+            const verdict = allowed.includes(companyIntegrationID);
+            seen.set(companyIntegrationID, verdict);
+            return verdict;
+        },
+    };
+}
+
+function manifestOf(over: Partial<IntegrationRunManifest>): IntegrationRunManifest {
+    return { runID: 'r1', runKind: 'RSU', startedAt: new Date().toISOString(), ...over };
+}
+
+describe('run-artifact authorization', () => {
+    it('authorizes a single-connection run for a caller who holds that connection', async () => {
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('authorizes an RSU run at all — the manifest identity is what unblocks it', async () => {
+        // Regression guard for the original defect: an RSU manifest carried no connection, the check
+        // returned false on the missing field, and every RSU run answered "not authorized" to
+        // IntegrationGetRun and IntegrationTailRunEvents.
+        const { canRead } = checkFor(['CI-1']);
+        const withIdentity = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1'] }), canRead);
+        const withoutIdentity = await AuthorizeRunArtifact(manifestOf({}), canRead);
+        expect(withIdentity.Authorized).toBe(true);
+        expect(withoutIdentity.Authorized).toBe(false);
+    });
+
+    it('requires EVERY connection of a multi-connection batch — AND, not any', async () => {
+        // The leak this prevents: a user with rights only on CI-2 reading CI-1's schema-change
+        // descriptions out of the shared batch stream.
+        const { canRead } = checkFor(['CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+    });
+
+    it('denies the batch even when the caller holds all but one of its connections', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-3');
+    });
+
+    it('authorizes a multi-connection batch only for a caller who holds all of them', async () => {
+        const { canRead } = checkFor(['CI-1', 'CI-2']);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2'] }), canRead);
+        expect(result.Authorized).toBe(true);
+    });
+
+    it('stops at the first denial, so a caller cannot probe what else a run covers', async () => {
+        const { canRead, asked } = checkFor([]);
+        const result = await AuthorizeRunArtifact(manifestOf({ companyIntegrationIDs: ['CI-1', 'CI-2', 'CI-3'] }), canRead);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-1');
+        expect(asked).toEqual(['CI-1']);
+    });
+
+    it('denies a run with no connection identity at all, without asking anything', async () => {
+        // Non-tenant-scoped artifacts are not exposed through the per-company endpoints, and an
+        // identity-less run must not become readable as a side effect of runs gaining a set field.
+        const { canRead, asked } = checkFor(['CI-1']);
+        for (const manifest of [{}, { companyIntegrationIDs: [] }]) {
+            const result = await AuthorizeRunArtifact(manifestOf(manifest), canRead);
+            expect(result.Authorized).toBe(false);
+            expect(result.DeniedCompanyIntegrationID).toBeUndefined();
+        }
+        expect(asked).toEqual([]);
+    });
+
+    it('falls back to the singular field for runs written before the set existed', async () => {
+        // Every sync/discovery run carries only `companyIntegrationID`; those must keep working.
+        const { canRead } = checkFor(['CI-9']);
+        const ok = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-9' }), canRead);
+        const denied = await AuthorizeRunArtifact(manifestOf({ runKind: 'SyncRun', companyIntegrationID: 'CI-8' }), canRead);
+        expect(ok.Authorized).toBe(true);
+        expect(denied.Authorized).toBe(false);
+        expect(denied.DeniedCompanyIntegrationID).toBe('CI-8');
+    });
+
+    it('prefers the set over the singular field when both are present', async () => {
+        // A batch that also happens to carry a singular value must still be judged on the whole set.
+        const { canRead } = checkFor(['CI-1']);
+        const result = await AuthorizeRunArtifact(
+            manifestOf({ companyIntegrationID: 'CI-1', companyIntegrationIDs: ['CI-1', 'CI-2'] }),
+            canRead
+        );
+        expect(result.Authorized).toBe(false);
+        expect(result.DeniedCompanyIntegrationID).toBe('CI-2');
+    });
+});