fix: propagate runAsSystem

packages/flowerbase/src/utils/__tests__/contextExecuteCompatibility.test.ts

@@ -4,7 +4,7 @@ import { Functions } from '../../features/functions/interface'
 const mockServices = {
   api: jest.fn().mockReturnValue({}),
   aws: jest.fn().mockReturnValue({}),
-  'mongodb-atlas': jest.fn().mockReturnValue({})
+  'mongodb-atlas': jest.fn((_app, options) => options ?? {})
 } as any
 
 describe('context.functions.execute compatibility', () => {
@@ -91,4 +91,30 @@ describe('context.functions.execute compatibility', () => {
 
     expect(result).toBe(true)
   })
+
+  it('propagates run_as_system to child functions executed through context.functions.execute', () => {
+    const functionsList = {
+      caller: {
+        run_as_system: true,
+        code: 'module.exports = function() { return context.functions.execute("target") }'
+      },
+      target: {
+        run_as_system: false,
+        code: 'module.exports = function() { return context.services.get("mongodb-atlas").run_as_system }'
+      }
+    } as Functions
+
+    const result = GenerateContextSync({
+      args: [],
+      app: {} as any,
+      rules: {} as any,
+      user: {} as any,
+      currentFunction: functionsList.caller,
+      functionsList,
+      services: mockServices,
+      functionName: 'caller'
+    })
+
+    expect(result).toBe(true)
+  })
 })

packages/flowerbase/src/utils/__tests__/generateContextData.test.ts

@@ -79,7 +79,11 @@ describe('generateContextData', () => {
     mockErrorLog.mockRestore()
 
     context.functions.execute('test')
-    expect(GenerateContextSyncMock).toHaveBeenCalled()
+    expect(GenerateContextSyncMock).toHaveBeenCalledWith(expect.objectContaining({
+      currentFunction,
+      functionName: 'test',
+      runAsSystem: currentFunction.run_as_system
+    }))
 
     const token = jwt.sign(
       { sub: 'user', role: 'admin' },

packages/flowerbase/src/utils/context/helpers.ts

@@ -205,16 +205,17 @@ export const generateContextData = ({
       https: getService('api'),
       functions: {
         execute: (name: keyof typeof functionsList, ...args: Arguments) => {
-          const currentFunction = functionsList[name] as Function
+          const targetFunction = functionsList[name] as Function
           return GenerateContextSync({
             args,
             app,
             rules,
             user,
-            currentFunction,
+            currentFunction: targetFunction,
             functionName: String(name),
             functionsList,
             services,
+            runAsSystem: currentFunction.run_as_system,
             deserializeArgs: false
           })
         }

packages/flowerbase/src/utils/context/index.ts

@@ -189,8 +189,8 @@ export async function GenerateContext({
   if (!currentFunction) return
 
   const functionsQueue = StateManager.select("functionsQueue")
-
-  const functionToRun = { run_as_system: runAsSystem, ...currentFunction }
+  const effectiveRunAsSystem = Boolean(runAsSystem || currentFunction.run_as_system)
+  const functionToRun = { ...currentFunction, run_as_system: effectiveRunAsSystem }
 
   const run = async () => {
 
@@ -309,7 +309,8 @@ export function GenerateContextSync({
 }: GenerateContextParams): unknown {
   if (!currentFunction) return
 
-  const functionToRun = { run_as_system: runAsSystem, ...currentFunction }
+  const effectiveRunAsSystem = Boolean(runAsSystem || currentFunction.run_as_system)
+  const functionToRun = { ...currentFunction, run_as_system: effectiveRunAsSystem }
   const contextData = generateContextData({
     user,
     services,

tests/e2e/app/functions/config.json

@@ -44,6 +44,11 @@
     "private": false,
     "run_as_system": true
   },
+  {
+    "name": "systemOrchestratorListAuthUsers",
+    "private": false,
+    "run_as_system": true
+  },
   {
     "name": "returnError",
     "private": false,

tests/e2e/app/functions/systemOrchestratorListAuthUsers.js

@@ -0,0 +1,3 @@
+module.exports = async function () {
+  return await context.functions.execute('publicListAuthUsers')
+}

tests/e2e/mongodb-atlas.rules.e2e.functions-and-auth-flow.test.ts

@@ -639,6 +639,32 @@ describe('MongoDB Atlas rule enforcement (e2e)', () => {
     ])
   })
 
+  it('propagates run_as_system through context.functions.execute', async () => {
+    const token = getTokenFor(ownerUser)
+    expect(token).toBeDefined()
+
+    const response = await appInstance!.inject({
+      method: 'POST',
+      url: FUNCTION_CALL_URL,
+      headers: {
+        authorization: `Bearer ${token}`
+      },
+      payload: {
+        name: 'systemOrchestratorListAuthUsers',
+        arguments: []
+      }
+    })
+
+    expect(response.statusCode).toBe(200)
+    const body = EJSON.deserialize(response.json()) as { users: Array<{ email: string }> }
+    expect(body.users).toHaveLength(3)
+    expect(body.users.map((user) => user.email).sort()).toEqual([
+      'auth-admin@example.com',
+      'auth-guest@example.com',
+      'auth-owner@example.com'
+    ])
+  })
+
   it('blocks run_as_system=false function from accessing auth_users', async () => {
     const token = getTokenFor(ownerUser)
     expect(token).toBeDefined()