FIX: surface failed MFA resets

src/modules/auth/auth.service.reset-users.spec.ts

@@ -0,0 +1,57 @@
+import { HttpException, HttpStatus } from '@nestjs/common';
+import { Metadata } from '@grpc/grpc-js';
+import { of } from 'rxjs';
+
+import { AuthClientService } from './auth.service';
+
+describe('AuthClientService.resetUsers', () => {
+  const logger = {
+    info: jest.fn(),
+    debug: jest.fn(),
+    error: jest.fn(),
+  };
+  const resetUser = jest.fn();
+  let service: AuthClientService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    service = new AuthClientService({ logger } as any, {} as any);
+    (service as any).authService = { ResetUser: resetUser };
+  });
+
+  it('returns the DUC response when every requested user was reset', async () => {
+    const response = {
+      message: 'Users reset successfully',
+      successfulUsers: ['user-1'],
+      failedUsers: [],
+    };
+    resetUser.mockReturnValue(of(response));
+
+    await expect(
+      service.resetUsers(['user-1'], new Metadata()),
+    ).resolves.toEqual(response);
+  });
+
+  it('returns a non-2xx error instead of masking failed resets', async () => {
+    const response = {
+      message: 'Some users failed',
+      successfulUsers: ['user-1'],
+      failedUsers: ['user-2'],
+    };
+    resetUser.mockReturnValue(of(response));
+
+    try {
+      await service.resetUsers(['user-1', 'user-2'], new Metadata());
+      fail('Expected resetUsers to reject');
+    } catch (error) {
+      expect(error).toBeInstanceOf(HttpException);
+      expect((error as HttpException).getStatus()).toBe(HttpStatus.BAD_GATEWAY);
+      expect((error as HttpException).getResponse()).toEqual({
+        statusCode: HttpStatus.BAD_GATEWAY,
+        message: 'Failed to reset MFA for one or more users.',
+        successfulUsers: ['user-1'],
+        failedUsers: ['user-2'],
+      });
+    }
+  });
+});

src/modules/auth/auth.service.ts

@@ -295,6 +295,22 @@ export class AuthClientService implements OnModuleInit {
         this.authService.ResetUser({ users }, metadata),
       );
 
+      if (response.failedUsers?.length > 0) {
+        this.logger.error('resetUsers - Partial or total failure', {
+          successfulUsers: response.successfulUsers,
+          failedUsers: response.failedUsers,
+        });
+        throw new HttpException(
+          {
+            statusCode: HttpStatus.BAD_GATEWAY,
+            message: 'Failed to reset MFA for one or more users.',
+            successfulUsers: response.successfulUsers,
+            failedUsers: response.failedUsers,
+          },
+          HttpStatus.BAD_GATEWAY,
+        );
+      }
+
       this.logger.info('resetUsers - Success', { response });
       return response;
     } catch (error) {

src/modules/connection-test/connection-test.service.spec.ts

@@ -65,7 +65,7 @@ describe('ConnectionTestService catalog cache', () => {
     });
   });
 
-  it('maps cached columns and derives references from the engine allowlist', async () => {
+  it('maps cached columns to the existing table metadata contract', async () => {
     connectionsApiService.proxy.mockResolvedValue({
       columns: [
         {
@@ -73,16 +73,6 @@ describe('ConnectionTestService catalog cache', () => {
           data_type: 'bigint',
           is_primary_key: true,
         },
-        {
-          column_name: 'name',
-          data_type: 'varchar',
-          is_primary_key: false,
-        },
-      ],
-    });
-    platformApiService.proxy.mockResolvedValue({
-      allowed_datatypes: [
-        { engine: 'postgresql', allowed_datatypes: ['bigint', 'timestamp'] },
       ],
     });
 
@@ -102,10 +92,13 @@ describe('ConnectionTestService catalog cache', () => {
         {
           table_name: 'customers',
           columns: [
-            { name: 'id', type: 'bigint', is_primary_key: true },
-            { name: 'name', type: 'varchar', is_primary_key: false },
+            {
+              name: 'id',
+              type: 'bigint',
+              is_primary_key: true,
+            },
           ],
-          references: [{ name: 'id', type: 'bigint', is_primary_key: true }],
+          references: [],
         },
       ],
     });
@@ -114,39 +107,6 @@ describe('ConnectionTestService catalog cache', () => {
       '/connection_catalog/config-id/schemas/public/tables/customers/columns',
       user,
     );
-    expect(platformApiService.proxy).toHaveBeenCalledWith(
-      'GET',
-      '/jobs/jdbc/configs/allowed_datatypes',
-      user,
-    );
-  });
-
-  it('returns empty references when the allowlist call fails', async () => {
-    connectionsApiService.proxy.mockResolvedValue({
-      columns: [{ column_name: 'id', data_type: 'bigint', is_primary_key: true }],
-    });
-    platformApiService.proxy.mockRejectedValue(new Error('platform down'));
-
-    await expect(
-      service.getTableMetadata(
-        {
-          connection_id: 'config-id',
-          plugin: 'postgresql',
-          schema: 'public',
-          table_list: ['customers'],
-        },
-        user,
-      ),
-    ).resolves.toEqual({
-      operation_result: true,
-      tables_metadata: [
-        {
-          table_name: 'customers',
-          columns: [{ name: 'id', type: 'bigint', is_primary_key: true }],
-          references: [],
-        },
-      ],
-    });
   });
 
   it('submits a catalog refresh without holding the request open', async () => {

src/modules/connection-test/connection-test.service.ts

@@ -187,20 +187,6 @@ export class ConnectionTestService {
     body: GetTableMetadataReq,
     user: RequestUser,
   ): Promise<GetTableMetadataRes> {
-    // Columns eligible as the incremental reference field are the ones whose
-    // data type is allowed for this engine (e.g. int/date/timestamp). The
-    // allowlist is owned by the platform API, keyed by engine === plugin.
-    const allowedByEngine = await this.platformApiService
-      .proxy('GET', '/jobs/jdbc/configs/allowed_datatypes', user)
-      .catch(() => null);
-    const allowedDataTypes: string[] =
-      allowedByEngine?.allowed_datatypes?.find(
-        (datatypes) => datatypes.engine === body.plugin,
-      )?.allowed_datatypes ?? [];
-    const allowedSet = new Set(
-      allowedDataTypes.map((type) => type.toLowerCase()),
-    );
-
     const tables_metadata = await Promise.all(
       body.table_list.map(async (table_name) => {
         const result = await this.connectionsApiService.proxy(
@@ -210,18 +196,14 @@ export class ConnectionTestService {
             `/tables/${encodeURIComponent(table_name)}/columns`,
           user,
         );
-        const columns = result.columns.map((column) => ({
-          name: column.column_name,
-          type: column.data_type,
-          is_primary_key: column.is_primary_key,
-        }));
-        const references = columns.filter((column) =>
-          allowedSet.has(String(column.type).toLowerCase()),
-        );
         return {
           table_name,
-          columns,
-          references,
+          columns: result.columns.map((column) => ({
+            name: column.column_name,
+            type: column.data_type,
+            is_primary_key: column.is_primary_key,
+          })),
+          references: [],
         };
       }),
     );