@memberjunction/core-entities-server 5.51.0 → 6.1.0-edge.0

package/LICENSE

@@ -0,0 +1,7 @@
+ISC License
+
+Copyright (c) 2023 MemberJunction
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/dist/custom/MJAPIApplicationScopeEntityServer.server.d.ts

@@ -0,0 +1,16 @@
+import { ValidationResult } from '@memberjunction/core';
+import { MJAPIApplicationScopeEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: API Application Scopes` entity enforcing the same row-filter
+ * authoring rules as `MJAPIKeyScopeEntityServer` (plan §5.3 checks 1-6 +
+ * §5.6.1), scoped to the owning APPLICATION instead of an API key. Application
+ * ceiling-filter ENFORCEMENT is deferred to v2 (plan §9.3) — the column ships
+ * unused — but authoring validation applies from day one so no invalid
+ * configuration can accumulate before enforcement lands.
+ */
+export declare class MJAPIApplicationScopeEntityServer extends MJAPIApplicationScopeEntity {
+    /** Enable async validation so the row-filter checks (which query referrers) run on Save. */
+    get DefaultSkipAsyncValidation(): boolean;
+    ValidateAsync(): Promise<ValidationResult>;
+}
+//# sourceMappingURL=MJAPIApplicationScopeEntityServer.server.d.ts.map

package/dist/custom/MJAPIApplicationScopeEntityServer.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAPIApplicationScopeEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAPIApplicationScopeEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAG5E;;;;;;;GAOG;AACH,qBACa,iCAAkC,SAAQ,2BAA2B;IAC9E,4FAA4F;IAC5F,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAyBnE"}

package/dist/custom/MJAPIApplicationScopeEntityServer.server.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { MJAPIApplicationScopeEntity } from '@memberjunction/core-entities';
+import { ToValidationErrors, ValidateScopeRuleRowFilter } from './rowFilterValidation.js';
+/**
+ * Server-side `MJ: API Application Scopes` entity enforcing the same row-filter
+ * authoring rules as `MJAPIKeyScopeEntityServer` (plan §5.3 checks 1-6 +
+ * §5.6.1), scoped to the owning APPLICATION instead of an API key. Application
+ * ceiling-filter ENFORCEMENT is deferred to v2 (plan §9.3) — the column ships
+ * unused — but authoring validation applies from day one so no invalid
+ * configuration can accumulate before enforcement lands.
+ */
+let MJAPIApplicationScopeEntityServer = class MJAPIApplicationScopeEntityServer extends MJAPIApplicationScopeEntity {
+    /** Enable async validation so the row-filter checks (which query referrers) run on Save. */
+    get DefaultSkipAsyncValidation() {
+        return false;
+    }
+    async ValidateAsync() {
+        const result = await super.ValidateAsync();
+        const errors = await ValidateScopeRuleRowFilter({
+            RowId: this.IsSaved ? this.ID : '',
+            RuleEntityName: 'MJ: API Application Scopes',
+            OwnerFilterClause: `ApplicationID='${this.ApplicationID}'`,
+            OwnerLabel: 'application',
+            ScopeID: this.ScopeID,
+            ResourcePattern: this.ResourcePattern,
+            PatternType: this.PatternType,
+            IsDeny: this.IsDeny,
+            RowFilterID: this.RowFilterID
+        }, this.ProviderToUse, this.ContextCurrentUser);
+        if (errors.length > 0) {
+            result.Errors.push(...ToValidationErrors('RowFilterID', errors));
+            result.Success = false;
+        }
+        return result;
+    }
+};
+MJAPIApplicationScopeEntityServer = __decorate([
+    RegisterClass(BaseEntity, 'MJ: API Application Scopes')
+], MJAPIApplicationScopeEntityServer);
+export { MJAPIApplicationScopeEntityServer };
+//# sourceMappingURL=MJAPIApplicationScopeEntityServer.server.js.map

package/dist/custom/MJAPIApplicationScopeEntityServer.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAPIApplicationScopeEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAPIApplicationScopeEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAuC,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEvF;;;;;;;GAOG;AAEI,IAAM,iCAAiC,GAAvC,MAAM,iCAAkC,SAAQ,2BAA2B;IAC9E,4FAA4F;IAC5F,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC3C;YACI,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAClC,cAAc,EAAE,4BAA4B;YAC5C,iBAAiB,EAAE,kBAAkB,IAAI,CAAC,aAAa,GAAG;YAC1D,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,aAA6C,EAClD,IAAI,CAAC,kBAAkB,CAC1B,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA/BY,iCAAiC;IAD7C,aAAa,CAAC,UAAU,EAAE,4BAA4B,CAAC;GAC3C,iCAAiC,CA+B7C"}

package/dist/custom/MJAPIKeyScopeEntityServer.server.d.ts

@@ -0,0 +1,28 @@
+import { ValidationResult } from '@memberjunction/core';
+import { MJAPIKeyScopeEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: API Key Scopes` entity enforcing the API-key row-filter
+ * authoring rules (plan §5.3 checks 1-6 + §5.6.1) whenever a rule carries a
+ * `RowFilterID` — or IS a `full_access` grant on a key that has filtered rules:
+ *
+ * 1. `ResourcePattern` must name a single EXACT entity (no `*`/`?`/`,`).
+ * 2. That name must resolve via `EntityByName`.
+ * 3. Every `{{Token}}` in the filter's text must be in the registered vocabulary.
+ * 4. Every column identifier in the filter's text must resolve to a real
+ *    non-virtual field on that entity (STRICT — unknown identifiers reject).
+ * 5. The rule must not be `IsDeny` or `PatternType='Exclude'`.
+ * 6. Every OTHER referrer of the same filter record must resolve to the same
+ *    entity (same-entity invariant — a filter carries no entity binding of its
+ *    own).
+ * §5.6.1: `full_access` + row filter on the same key is invalid configuration,
+ * rejected in BOTH directions (filter added to a key holding full_access;
+ * full_access granted to a key holding a filtered rule).
+ *
+ * Unfiltered rules keep full pattern support — zero behavior change.
+ */
+export declare class MJAPIKeyScopeEntityServer extends MJAPIKeyScopeEntity {
+    /** Enable async validation so the row-filter checks (which query referrers) run on Save. */
+    get DefaultSkipAsyncValidation(): boolean;
+    ValidateAsync(): Promise<ValidationResult>;
+}
+//# sourceMappingURL=MJAPIKeyScopeEntityServer.server.d.ts.map

package/dist/custom/MJAPIKeyScopeEntityServer.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAPIKeyScopeEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJAPIKeyScopeEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,yBAA0B,SAAQ,mBAAmB;IAC9D,4FAA4F;IAC5F,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAyBnE"}

package/dist/custom/MJAPIKeyScopeEntityServer.server.js

@@ -0,0 +1,60 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { MJAPIKeyScopeEntity } from '@memberjunction/core-entities';
+import { ToValidationErrors, ValidateScopeRuleRowFilter } from './rowFilterValidation.js';
+/**
+ * Server-side `MJ: API Key Scopes` entity enforcing the API-key row-filter
+ * authoring rules (plan §5.3 checks 1-6 + §5.6.1) whenever a rule carries a
+ * `RowFilterID` — or IS a `full_access` grant on a key that has filtered rules:
+ *
+ * 1. `ResourcePattern` must name a single EXACT entity (no `*`/`?`/`,`).
+ * 2. That name must resolve via `EntityByName`.
+ * 3. Every `{{Token}}` in the filter's text must be in the registered vocabulary.
+ * 4. Every column identifier in the filter's text must resolve to a real
+ *    non-virtual field on that entity (STRICT — unknown identifiers reject).
+ * 5. The rule must not be `IsDeny` or `PatternType='Exclude'`.
+ * 6. Every OTHER referrer of the same filter record must resolve to the same
+ *    entity (same-entity invariant — a filter carries no entity binding of its
+ *    own).
+ * §5.6.1: `full_access` + row filter on the same key is invalid configuration,
+ * rejected in BOTH directions (filter added to a key holding full_access;
+ * full_access granted to a key holding a filtered rule).
+ *
+ * Unfiltered rules keep full pattern support — zero behavior change.
+ */
+let MJAPIKeyScopeEntityServer = class MJAPIKeyScopeEntityServer extends MJAPIKeyScopeEntity {
+    /** Enable async validation so the row-filter checks (which query referrers) run on Save. */
+    get DefaultSkipAsyncValidation() {
+        return false;
+    }
+    async ValidateAsync() {
+        const result = await super.ValidateAsync();
+        const errors = await ValidateScopeRuleRowFilter({
+            RowId: this.IsSaved ? this.ID : '',
+            RuleEntityName: 'MJ: API Key Scopes',
+            OwnerFilterClause: `APIKeyID='${this.APIKeyID}'`,
+            OwnerLabel: 'API key',
+            ScopeID: this.ScopeID,
+            ResourcePattern: this.ResourcePattern,
+            PatternType: this.PatternType,
+            IsDeny: this.IsDeny,
+            RowFilterID: this.RowFilterID
+        }, this.ProviderToUse, this.ContextCurrentUser);
+        if (errors.length > 0) {
+            result.Errors.push(...ToValidationErrors('RowFilterID', errors));
+            result.Success = false;
+        }
+        return result;
+    }
+};
+MJAPIKeyScopeEntityServer = __decorate([
+    RegisterClass(BaseEntity, 'MJ: API Key Scopes')
+], MJAPIKeyScopeEntityServer);
+export { MJAPIKeyScopeEntityServer };
+//# sourceMappingURL=MJAPIKeyScopeEntityServer.server.js.map

package/dist/custom/MJAPIKeyScopeEntityServer.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAPIKeyScopeEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJAPIKeyScopeEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAuC,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,mBAAmB;IAC9D,4FAA4F;IAC5F,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC3C;YACI,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAClC,cAAc,EAAE,oBAAoB;YACpC,iBAAiB,EAAE,aAAa,IAAI,CAAC,QAAQ,GAAG;YAChD,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,aAA6C,EAClD,IAAI,CAAC,kBAAkB,CAC1B,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AA/BY,yBAAyB;IADrC,aAAa,CAAC,UAAU,EAAE,oBAAoB,CAAC;GACnC,yBAAyB,CA+BrC"}

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.d.ts

@@ -0,0 +1,31 @@
+import { ValidationResult } from '@memberjunction/core';
+import { MJRowLevelSecurityFilterEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Row Level Security Filters` entity — the SECOND enforcement
+ * point of the row-filter validation (plan §5.3). The scope-rule subclasses
+ * validate `FilterText` (check 4) and the same-entity invariant (check 6)
+ * against the rule's entity when the RULE is saved; without an equivalent
+ * check when the FILTER is saved, both are trivially bypassable: attach a
+ * valid filter, then edit its text (or acquire a new, different-entity
+ * referrer) to reference anything. On a `FilterText` change — or whenever
+ * more than one referrer now exists — this subclass re-runs BOTH checks
+ * against EVERY current referrer (EntityPermission rows via their four
+ * `*RLSFilterID` columns, plus both API scope tables via `RowFilterID`) and
+ * rejects if any fails — including referrers whose entity cannot be resolved
+ * (fail closed). Check 6 has no single rule to anchor on here (a filter
+ * record itself carries no entity binding — see plan §5.1), so it anchors on
+ * the first referrer that DOES resolve to an entity and requires every other
+ * referrer to agree with it; zero or one resolvable referrer trivially
+ * satisfies the invariant.
+ *
+ * Note this makes the filter edit path stricter than it historically was for
+ * pure-EntityPermission filters, which had no such validation. That is a
+ * deliberate tightening: an invalid RLS filter fails closed at query time with
+ * an unexplainable SQL error; rejecting at save is the diagnosable version.
+ */
+export declare class MJRowLevelSecurityFilterEntityServer extends MJRowLevelSecurityFilterEntity {
+    /** Enable async validation so the referrer re-validation (which queries three tables) runs on Save. */
+    get DefaultSkipAsyncValidation(): boolean;
+    ValidateAsync(): Promise<ValidationResult>;
+}
+//# sourceMappingURL=MJRowLevelSecurityFilterEntityServer.server.d.ts.map

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B,IAAI,OAAO,CAExD;IAEqB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;CA+CnE"}

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.js

@@ -0,0 +1,84 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { MJRowLevelSecurityFilterEntity } from '@memberjunction/core-entities';
+import { BuildSameEntityErrors, CollectRowFilterReferrers, ToValidationErrors, ValidateRowFilterTextAgainstEntity } from './rowFilterValidation.js';
+/**
+ * Server-side `MJ: Row Level Security Filters` entity — the SECOND enforcement
+ * point of the row-filter validation (plan §5.3). The scope-rule subclasses
+ * validate `FilterText` (check 4) and the same-entity invariant (check 6)
+ * against the rule's entity when the RULE is saved; without an equivalent
+ * check when the FILTER is saved, both are trivially bypassable: attach a
+ * valid filter, then edit its text (or acquire a new, different-entity
+ * referrer) to reference anything. On a `FilterText` change — or whenever
+ * more than one referrer now exists — this subclass re-runs BOTH checks
+ * against EVERY current referrer (EntityPermission rows via their four
+ * `*RLSFilterID` columns, plus both API scope tables via `RowFilterID`) and
+ * rejects if any fails — including referrers whose entity cannot be resolved
+ * (fail closed). Check 6 has no single rule to anchor on here (a filter
+ * record itself carries no entity binding — see plan §5.1), so it anchors on
+ * the first referrer that DOES resolve to an entity and requires every other
+ * referrer to agree with it; zero or one resolvable referrer trivially
+ * satisfies the invariant.
+ *
+ * Note this makes the filter edit path stricter than it historically was for
+ * pure-EntityPermission filters, which had no such validation. That is a
+ * deliberate tightening: an invalid RLS filter fails closed at query time with
+ * an unexplainable SQL error; rejecting at save is the diagnosable version.
+ */
+let MJRowLevelSecurityFilterEntityServer = class MJRowLevelSecurityFilterEntityServer extends MJRowLevelSecurityFilterEntity {
+    /** Enable async validation so the referrer re-validation (which queries three tables) runs on Save. */
+    get DefaultSkipAsyncValidation() {
+        return false;
+    }
+    async ValidateAsync() {
+        const result = await super.ValidateAsync();
+        // Only re-validate when the text changes (or on create — a new filter has
+        // no referrers yet, so the loop below is a no-op there anyway).
+        const filterTextDirty = this.GetFieldByName('FilterText')?.Dirty ?? false;
+        if (this.IsSaved && !filterTextDirty) {
+            return result;
+        }
+        const errors = [];
+        const md = this.ProviderToUse;
+        const filterText = this.FilterText ?? '';
+        try {
+            const referrers = await CollectRowFilterReferrers(this.ID, md, this.ContextCurrentUser);
+            // Check 4 — FilterText's columns must resolve against every referrer's entity.
+            for (const referrer of referrers) {
+                if (!referrer.Entity) {
+                    errors.push(`${referrer.Description} references this filter but does not resolve to an entity — the new ` +
+                        `FilterText cannot be validated against it; rejecting (fail closed).`);
+                    continue;
+                }
+                const validation = ValidateRowFilterTextAgainstEntity(filterText, referrer.Entity);
+                errors.push(...validation.errors.map(e => `${referrer.Description}: ${e}`));
+            }
+            // Check 6 — every referrer must agree on the same entity. No single referrer is
+            // "the rule" here (unlike the scope-rule save path), so anchor on the first
+            // referrer that resolves to an entity and require every other referrer to match it.
+            const anchor = referrers.find(r => r.Entity)?.Entity;
+            if (anchor) {
+                errors.push(...BuildSameEntityErrors(referrers, anchor));
+            }
+        }
+        catch (e) {
+            errors.push(e instanceof Error ? e.message : String(e));
+        }
+        if (errors.length > 0) {
+            result.Errors.push(...ToValidationErrors('FilterText', errors));
+            result.Success = false;
+        }
+        return result;
+    }
+};
+MJRowLevelSecurityFilterEntityServer = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Row Level Security Filters')
+], MJRowLevelSecurityFilterEntityServer);
+export { MJRowLevelSecurityFilterEntityServer };
+//# sourceMappingURL=MJRowLevelSecurityFilterEntityServer.server.js.map

package/dist/custom/MJRowLevelSecurityFilterEntityServer.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJRowLevelSecurityFilterEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRowLevelSecurityFilterEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAuC,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAEjJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAqC,SAAQ,8BAA8B;IACpF,uGAAuG;IACvG,IAAoB,0BAA0B;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAEe,KAAK,CAAC,aAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAExF,+EAA+E;YAC/E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CACP,GAAG,QAAQ,CAAC,WAAW,sEAAsE;wBAC7F,qEAAqE,CACxE,CAAC;oBACF,SAAS;gBACb,CAAC;gBACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,gFAAgF;YAChF,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACrD,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAA;AArDY,oCAAoC;IADhD,aAAa,CAAC,UAAU,EAAE,gCAAgC,CAAC;GAC/C,oCAAoC,CAqDhD"}

package/dist/custom/rowFilterValidation.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Shared save-time validation for API-key row filters (plan §5.3 checks 1-6 +
+ * §5.6.1 authoring rejection).
+ *
+ * Used by three server-side entity subclasses:
+ * - MJAPIKeyScopeEntityServer / MJAPIApplicationScopeEntityServer — validate a
+ *   scope rule that carries a RowFilterID at rule save.
+ * - MJRowLevelSecurityFilterEntityServer — re-validate a filter's FilterText
+ *   against EVERY current referrer when the text changes (without this second
+ *   enforcement point, rule-save validation is bypassable by editing the
+ *   filter after attaching it).
+ *
+ * All checks fail closed: anything unresolvable rejects the save.
+ */
+import { EntityInfo, IMetadataProvider, UserInfo, ValidationErrorInfo } from '@memberjunction/core';
+/** Result of a row-filter text validation. */
+export interface RowFilterTextValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Validates a filter's FilterText against a specific entity (plan §5.3 checks
+ * 3 + 4, STRICT):
+ * - dangerous SQL patterns (DDL/DML/EXEC, statement-terminating `;`, comment
+ *   markers, UNION, etc.) are rejected via the shared `SQLExpressionValidator`
+ *   in `where_clause` context — the same injection-hardening every other
+ *   user-provided SQL fragment in MJ goes through, not a parallel definition;
+ * - every `{{Token}}` must be a member of the registered vocabulary;
+ * - every bare column identifier must resolve to a real, NON-VIRTUAL,
+ *   non-computed field on the entity (unknown identifiers reject — no lenient
+ *   "maybe it's a computed column" pass). `entityFields` is deliberately not
+ *   passed to the shared validator's own (lenient, warn-only) field check —
+ *   this function's own strict pass below is what enforces column identity;
+ *   the shared validator here contributes dangerous-pattern blocking only.
+ */
+export declare function ValidateRowFilterTextAgainstEntity(filterText: string, entity: EntityInfo): RowFilterTextValidationResult;
+/**
+ * True when a ResourcePattern is a single EXACT resource name — no `*` / `?`
+ * wildcards and no comma-separated list (plan §5.3 check 1).
+ */
+export declare function IsExactResourceName(pattern: string | null): pattern is string;
+/** One referrer of a RowLevelSecurityFilter record, resolved to its entity. */
+export interface RowFilterReferrer {
+    /** Human-readable description of the referring row, for error messages. */
+    Description: string;
+    /** The entity the referrer binds the filter to, or null when unresolvable. */
+    Entity: EntityInfo | null;
+}
+/**
+ * Collects EVERY referrer of a RowLevelSecurityFilter record (plan §5.3 check 6):
+ * - EntityPermission rows via their four `*RLSFilterID` columns (entity via EntityID),
+ * - APIKeyScope / APIApplicationScope rows via RowFilterID (entity via their
+ *   exact ResourcePattern).
+ * An optional `exclude` predicate lets the row being saved skip itself.
+ */
+export declare function CollectRowFilterReferrers(filterId: string, md: IMetadataProvider, contextUser: UserInfo, exclude?: {
+    entityName: string;
+    rowId: string;
+}): Promise<RowFilterReferrer[]>;
+/**
+ * Enforces the same-entity invariant (plan §5.1/§5.3 check 6): every referrer
+ * of a shared filter must resolve to the SAME entity the current save binds it
+ * to. A filter record carries no entity binding of its own — all entity context
+ * lives in the referrers — so cross-entity sharing would let one row's edit
+ * silently break another entity's filter. Unresolvable referrers reject too
+ * (fail closed).
+ */
+export declare function BuildSameEntityErrors(referrers: RowFilterReferrer[], targetEntity: EntityInfo): string[];
+/** Convenience: wraps validation failures as ValidationErrorInfo entries. */
+export declare function ToValidationErrors(fieldName: string, messages: string[]): ValidationErrorInfo[];
+/**
+ * The scope-rule fields the shared row-filter validation needs, abstracted over
+ * the two scope tables (key rules are owned by an API key, application rules by
+ * an application).
+ */
+export interface ScopeRuleForRowFilterValidation {
+    /** The saved row's ID ('' for a new record — used only to exclude self from referrer checks). */
+    RowId: string;
+    /** Which scope table the rule lives in. */
+    RuleEntityName: 'MJ: API Key Scopes' | 'MJ: API Application Scopes';
+    /** SQL filter selecting ALL rules of the same owner (e.g. `APIKeyID='...'`). */
+    OwnerFilterClause: string;
+    /** 'API key' | 'application' — for error messages. */
+    OwnerLabel: string;
+    ScopeID: string;
+    ResourcePattern: string | null;
+    PatternType: string;
+    IsDeny: boolean;
+    RowFilterID: string | null;
+}
+/**
+ * Full save-time validation for a scope rule (plan §5.3 checks 1-6 and the
+ * §5.6.1 full_access ⊕ row-filter authoring rejection). Returns error messages;
+ * empty = valid. Shared by MJAPIKeyScopeEntityServer and
+ * MJAPIApplicationScopeEntityServer.
+ */
+export declare function ValidateScopeRuleRowFilter(rule: ScopeRuleForRowFilterValidation, md: IMetadataProvider, contextUser: UserInfo): Promise<string[]>;
+//# sourceMappingURL=rowFilterValidation.d.ts.map

package/dist/custom/rowFilterValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rowFilterValidation.d.ts","sourceRoot":"","sources":["../../src/custom/rowFilterValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACH,UAAU,EACV,iBAAiB,EAEjB,QAAQ,EACR,mBAAmB,EAEtB,MAAM,sBAAsB,CAAC;AAiC9B,8CAA8C;AAC9C,MAAM,WAAW,6BAA6B;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,6BAA6B,CA4DxH;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,IAAI,MAAM,CAQ7E;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC3C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,iBAAiB,EACrB,WAAW,EAAE,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA8D9B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,UAAU,GAAG,MAAM,EAAE,CAiBxG;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAE/F;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC5C,iGAAiG;IACjG,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,cAAc,EAAE,oBAAoB,GAAG,4BAA4B,CAAC;IACpE,gFAAgF;IAChF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC5C,IAAI,EAAE,+BAA+B,EACrC,EAAE,EAAE,iBAAiB,EACrB,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgInB"}

package/dist/custom/rowFilterValidation.js

@@ -0,0 +1,318 @@
+/**
+ * Shared save-time validation for API-key row filters (plan §5.3 checks 1-6 +
+ * §5.6.1 authoring rejection).
+ *
+ * Used by three server-side entity subclasses:
+ * - MJAPIKeyScopeEntityServer / MJAPIApplicationScopeEntityServer — validate a
+ *   scope rule that carries a RowFilterID at rule save.
+ * - MJRowLevelSecurityFilterEntityServer — re-validate a filter's FilterText
+ *   against EVERY current referrer when the text changes (without this second
+ *   enforcement point, rule-save validation is bypassable by editing the
+ *   filter after attaching it).
+ *
+ * All checks fail closed: anything unresolvable rejects the save.
+ */
+import { RunView, ValidationErrorInfo, ValidationErrorType } from '@memberjunction/core';
+import { SQLExpressionValidator, UUIDsEqual } from '@memberjunction/global';
+/**
+ * Registered token vocabulary for row-filter FilterText (plan §5.2). `{{User*}}`
+ * is a family (any scalar UserInfo property), matched by pattern; the rest are
+ * exact names. Underscore-led User tokens (backing fields like
+ * `{{User_IsMagicLinkAnonymous}}`) are deliberately NOT registered.
+ */
+const EXACT_REGISTERED_TOKENS = new Set([
+    'ScopeResourceID',
+    'ScopeResourceType',
+    'ActingOrganizationID',
+    'ActingPersonID',
+    'ActingScopeID',
+    'ActingCompanyIDs'
+]);
+const USER_TOKEN_PATTERN = /^User[A-Za-z][A-Za-z0-9_]*$/;
+/**
+ * SQL keywords / operators / literals ignored by the STRICT column-reference
+ * check (emulating SQLExpressionValidator.checkFieldReferences, but rejecting
+ * instead of warning). Function names are handled separately (identifier
+ * followed by `(`), so this list only needs bare-word SQL vocabulary that
+ * legitimately appears in a WHERE-clause expression.
+ */
+const SQL_BARE_KEYWORDS = new Set([
+    'AND', 'OR', 'NOT', 'IN', 'IS', 'NULL', 'LIKE', 'BETWEEN', 'EXISTS',
+    'CASE', 'WHEN', 'THEN', 'ELSE', 'END', 'ESCAPE', 'ASC', 'DESC',
+    'TRUE', 'FALSE', 'DISTINCT', 'SOME', 'ANY', 'ALL', 'AS'
+]);
+/**
+ * Validates a filter's FilterText against a specific entity (plan §5.3 checks
+ * 3 + 4, STRICT):
+ * - dangerous SQL patterns (DDL/DML/EXEC, statement-terminating `;`, comment
+ *   markers, UNION, etc.) are rejected via the shared `SQLExpressionValidator`
+ *   in `where_clause` context — the same injection-hardening every other
+ *   user-provided SQL fragment in MJ goes through, not a parallel definition;
+ * - every `{{Token}}` must be a member of the registered vocabulary;
+ * - every bare column identifier must resolve to a real, NON-VIRTUAL,
+ *   non-computed field on the entity (unknown identifiers reject — no lenient
+ *   "maybe it's a computed column" pass). `entityFields` is deliberately not
+ *   passed to the shared validator's own (lenient, warn-only) field check —
+ *   this function's own strict pass below is what enforces column identity;
+ *   the shared validator here contributes dangerous-pattern blocking only.
+ */
+export function ValidateRowFilterTextAgainstEntity(filterText, entity) {
+    const errors = [];
+    // 0. Dangerous-pattern check (DDL/DML/EXEC/UNION/comments/semicolons) via
+    //    the shared validator, before any of this function's own tokenizing.
+    const dangerCheck = SQLExpressionValidator.Instance.validate(filterText, { context: 'where_clause' });
+    if (!dangerCheck.valid) {
+        errors.push(dangerCheck.error ?? 'FilterText failed SQL expression validation.');
+    }
+    // 1. Token vocabulary check, then strip tokens so their contents don't hit
+    //    the identifier scan.
+    let stripped = filterText.replace(/\{\{(\w+)\}\}/g, (_full, token) => {
+        if (!EXACT_REGISTERED_TOKENS.has(token) && !USER_TOKEN_PATTERN.test(token)) {
+            errors.push(`Token {{${token}}} is not in the registered vocabulary ` +
+                `({{User*}}, {{ScopeResourceID}}, {{ScopeResourceType}}, {{ActingOrganizationID}}, ` +
+                `{{ActingPersonID}}, {{ActingScopeID}}, {{ActingCompanyIDs}}).`);
+        }
+        return "''"; // replace with an empty string literal so surrounding quotes stay balanced
+    });
+    // 2. Strip string literals (handles '' escapes) so their contents are not
+    //    scanned as identifiers.
+    stripped = stripped.replace(/'(?:[^']|'')*'/g, '');
+    const writableFields = new Set(entity.Fields.filter(f => !f.IsVirtual).map(f => f.Name.toUpperCase()));
+    const checkIdentifier = (identifier) => {
+        if (!writableFields.has(identifier.toUpperCase())) {
+            errors.push(`Column '${identifier}' does not resolve to a real non-virtual field on entity '${entity.Name}'.`);
+        }
+    };
+    // 3. Bracketed identifiers ([Col]) always denote columns — check each, then
+    //    remove them from the identifier scan.
+    stripped = stripped.replace(/\[([^\]]+)\]/g, (_full, identifier) => {
+        checkIdentifier(identifier);
+        return '';
+    });
+    // 4. Bare identifiers not followed by '(' (function calls are SQL functions,
+    //    not columns) and not SQL keywords must be entity columns. Purely
+    //    numeric literals never match (pattern requires a leading letter/_).
+    const identifierPattern = /\b([A-Za-z_][A-Za-z0-9_]*)\b(?!\s*\()/g;
+    let match;
+    while ((match = identifierPattern.exec(stripped)) !== null) {
+        const word = match[1];
+        if (SQL_BARE_KEYWORDS.has(word.toUpperCase())) {
+            continue;
+        }
+        checkIdentifier(word);
+    }
+    return { valid: errors.length === 0, errors };
+}
+/**
+ * True when a ResourcePattern is a single EXACT resource name — no `*` / `?`
+ * wildcards and no comma-separated list (plan §5.3 check 1).
+ */
+export function IsExactResourceName(pattern) {
+    return (pattern != null &&
+        pattern.trim().length > 0 &&
+        !pattern.includes('*') &&
+        !pattern.includes('?') &&
+        !pattern.includes(','));
+}
+/**
+ * Collects EVERY referrer of a RowLevelSecurityFilter record (plan §5.3 check 6):
+ * - EntityPermission rows via their four `*RLSFilterID` columns (entity via EntityID),
+ * - APIKeyScope / APIApplicationScope rows via RowFilterID (entity via their
+ *   exact ResourcePattern).
+ * An optional `exclude` predicate lets the row being saved skip itself.
+ */
+export async function CollectRowFilterReferrers(filterId, md, contextUser, exclude) {
+    const rv = new RunView();
+    const [permissions, keyScopes, appScopes] = await rv.RunViews([
+        {
+            EntityName: 'MJ: Entity Permissions',
+            ExtraFilter: `ReadRLSFilterID='${filterId}' OR CreateRLSFilterID='${filterId}' OR ` +
+                `UpdateRLSFilterID='${filterId}' OR DeleteRLSFilterID='${filterId}'`,
+            Fields: ['ID', 'EntityID'],
+            ResultType: 'simple'
+        },
+        {
+            EntityName: 'MJ: API Key Scopes',
+            ExtraFilter: `RowFilterID='${filterId}'`,
+            Fields: ['ID', 'ResourcePattern'],
+            ResultType: 'simple'
+        },
+        {
+            EntityName: 'MJ: API Application Scopes',
+            ExtraFilter: `RowFilterID='${filterId}'`,
+            Fields: ['ID', 'ResourcePattern'],
+            ResultType: 'simple'
+        }
+    ], contextUser);
+    const failed = [permissions, keyScopes, appScopes].find(r => !r.Success);
+    if (failed) {
+        // Fail closed: an unreadable referrer set cannot prove the same-entity invariant.
+        throw new Error(`Unable to load referrers of Row Level Security Filter ${filterId}: ${failed.ErrorMessage}`);
+    }
+    const referrers = [];
+    for (const row of permissions.Results) {
+        const entity = (row.EntityID ? md.EntityByID(row.EntityID) : undefined) ?? null;
+        referrers.push({
+            Description: `Entity Permission ${row.ID} (entity ${entity?.Name ?? row.EntityID})`,
+            Entity: entity
+        });
+    }
+    const addScopeReferrers = (rows, entityName, label) => {
+        for (const row of rows) {
+            if (exclude && exclude.entityName === entityName && UUIDsEqual(exclude.rowId, row.ID)) {
+                continue;
+            }
+            const entity = IsExactResourceName(row.ResourcePattern) ? (md.EntityByName(row.ResourcePattern) ?? null) : null;
+            referrers.push({
+                Description: `${label} ${row.ID} (resource '${row.ResourcePattern ?? ''}')`,
+                Entity: entity
+            });
+        }
+    };
+    addScopeReferrers(keyScopes.Results, 'MJ: API Key Scopes', 'API Key Scope rule');
+    addScopeReferrers(appScopes.Results, 'MJ: API Application Scopes', 'API Application Scope rule');
+    return referrers;
+}
+/**
+ * Enforces the same-entity invariant (plan §5.1/§5.3 check 6): every referrer
+ * of a shared filter must resolve to the SAME entity the current save binds it
+ * to. A filter record carries no entity binding of its own — all entity context
+ * lives in the referrers — so cross-entity sharing would let one row's edit
+ * silently break another entity's filter. Unresolvable referrers reject too
+ * (fail closed).
+ */
+export function BuildSameEntityErrors(referrers, targetEntity) {
+    const errors = [];
+    for (const referrer of referrers) {
+        if (!referrer.Entity) {
+            errors.push(`${referrer.Description} references the same row filter but does not resolve to an entity — ` +
+                `cannot prove the same-entity invariant; rejecting (fail closed).`);
+        }
+        else if (!UUIDsEqual(referrer.Entity.ID, targetEntity.ID)) {
+            errors.push(`${referrer.Description} binds the same row filter to entity '${referrer.Entity.Name}', but this rule ` +
+                `binds it to '${targetEntity.Name}'. Every referrer of a filter must resolve to the same entity — ` +
+                `use a separate filter record per entity.`);
+        }
+    }
+    return errors;
+}
+/** Convenience: wraps validation failures as ValidationErrorInfo entries. */
+export function ToValidationErrors(fieldName, messages) {
+    return messages.map(m => new ValidationErrorInfo(fieldName, m, null, ValidationErrorType.Failure));
+}
+/**
+ * Full save-time validation for a scope rule (plan §5.3 checks 1-6 and the
+ * §5.6.1 full_access ⊕ row-filter authoring rejection). Returns error messages;
+ * empty = valid. Shared by MJAPIKeyScopeEntityServer and
+ * MJAPIApplicationScopeEntityServer.
+ */
+export async function ValidateScopeRuleRowFilter(rule, md, contextUser) {
+    const rv = new RunView();
+    // Resolve the full_access scope ID (needed for §5.6.1 in both directions).
+    const fullAccessResult = await rv.RunView({
+        EntityName: 'MJ: API Scopes',
+        ExtraFilter: `FullPath='full_access'`,
+        Fields: ['ID'],
+        ResultType: 'simple'
+    }, contextUser);
+    if (!fullAccessResult.Success) {
+        return [`Unable to resolve the full_access scope: ${fullAccessResult.ErrorMessage}. Rejecting (fail closed).`];
+    }
+    const fullAccessScopeId = fullAccessResult.Results[0]?.ID?.toLowerCase();
+    const isFullAccessGrant = fullAccessScopeId != null && rule.ScopeID?.toLowerCase() === fullAccessScopeId && !rule.IsDeny;
+    // Nothing row-filter-related on this rule and it is not a full_access grant → nothing to check.
+    if (rule.RowFilterID == null && !isFullAccessGrant) {
+        return [];
+    }
+    // Sibling rules of the same owner (for §5.6.1 both directions).
+    const siblingsResult = await rv.RunView({
+        EntityName: rule.RuleEntityName,
+        ExtraFilter: rule.OwnerFilterClause,
+        Fields: ['ID', 'ScopeID', 'RowFilterID', 'IsDeny'],
+        ResultType: 'simple'
+    }, contextUser);
+    if (!siblingsResult.Success) {
+        return [`Unable to load the ${rule.OwnerLabel}'s other scope rules: ${siblingsResult.ErrorMessage}. Rejecting (fail closed).`];
+    }
+    const siblings = siblingsResult.Results.filter(s => s.ID.toLowerCase() !== rule.RowId.toLowerCase());
+    const errors = [];
+    // §5.6.1 — a full_access grant on an owner that has (or is getting) a filtered rule.
+    if (isFullAccessGrant) {
+        const filteredSibling = siblings.find(s => s.RowFilterID != null);
+        if (rule.RowFilterID != null) {
+            errors.push(`Cannot set a row filter on a full_access grant: full_access is unrestricted by definition, so a row ` +
+                `filter alongside it is incoherent. Remove the full_access grant or the row filter — or split the ` +
+                `${rule.OwnerLabel}'s access across two keys.`);
+        }
+        if (filteredSibling) {
+            errors.push(`Cannot grant full_access to this ${rule.OwnerLabel}: scope rule ${filteredSibling.ID} already carries a ` +
+                `row filter, and full_access is unrestricted by definition — one of the two would be a lie about what ` +
+                `the ${rule.OwnerLabel} can reach. Remove the row filter or do not grant full_access (split the key).`);
+        }
+    }
+    if (rule.RowFilterID == null) {
+        return errors;
+    }
+    // §5.6.1 (other direction) — setting a row filter while the owner holds a full_access grant.
+    if (!isFullAccessGrant && fullAccessScopeId != null) {
+        const fullAccessSibling = siblings.find(s => s.ScopeID?.toLowerCase() === fullAccessScopeId && !s.IsDeny);
+        if (fullAccessSibling) {
+            errors.push(`Cannot set a row filter on this scope rule: the ${rule.OwnerLabel} also holds a full_access grant ` +
+                `(rule ${fullAccessSibling.ID}), which is unrestricted by definition. Remove the full_access grant or ` +
+                `the row filter.`);
+        }
+    }
+    // §5.3 check 5 — a filter narrows an ALLOW; deny/Exclude rules cannot carry one.
+    if (rule.IsDeny) {
+        errors.push(`A row filter cannot be attached to a deny rule — a filter narrows an allow; attaching it to a deny has no coherent meaning.`);
+    }
+    if (rule.PatternType === 'Exclude') {
+        errors.push(`A row filter cannot be attached to an Exclude rule — a filter narrows an allow; attaching it to an exclusion has no coherent meaning.`);
+    }
+    // §5.3 checks 1-2 — exact, resolvable entity.
+    if (!IsExactResourceName(rule.ResourcePattern)) {
+        errors.push(`A scope rule with a row filter must name a single exact entity in ResourcePattern — no '*' or '?' ` +
+            `wildcards and no comma-separated lists (current value: '${rule.ResourcePattern ?? ''}').`);
+        return errors; // no entity to validate the filter against
+    }
+    const entity = md.EntityByName(rule.ResourcePattern);
+    if (!entity) {
+        errors.push(`ResourcePattern '${rule.ResourcePattern}' does not resolve to an entity.`);
+        return errors;
+    }
+    // §5.3 checks 3-4 — the filter must exist and its text must pass the strict token/column validation.
+    const filterResult = await rv.RunView({
+        EntityName: 'MJ: Row Level Security Filters',
+        ExtraFilter: `ID='${rule.RowFilterID}'`,
+        Fields: ['ID', 'Name', 'FilterText'],
+        ResultType: 'simple'
+    }, contextUser);
+    if (!filterResult.Success) {
+        errors.push(`Unable to load Row Level Security Filter ${rule.RowFilterID}: ${filterResult.ErrorMessage}. Rejecting (fail closed).`);
+        return errors;
+    }
+    const filter = filterResult.Results[0];
+    if (!filter) {
+        errors.push(`Row Level Security Filter ${rule.RowFilterID} does not exist.`);
+        return errors;
+    }
+    if (!filter.FilterText || filter.FilterText.trim().length === 0) {
+        errors.push(`Row Level Security Filter '${filter.Name}' has no FilterText — an empty filter cannot restrict anything and is rejected (fail closed).`);
+        return errors;
+    }
+    const textValidation = ValidateRowFilterTextAgainstEntity(filter.FilterText, entity);
+    errors.push(...textValidation.errors.map(e => `Filter '${filter.Name}': ${e}`));
+    // §5.3 check 6 — same-entity invariant across every other referrer.
+    try {
+        const referrers = await CollectRowFilterReferrers(rule.RowFilterID, md, contextUser, {
+            entityName: rule.RuleEntityName,
+            rowId: rule.RowId
+        });
+        errors.push(...BuildSameEntityErrors(referrers, entity));
+    }
+    catch (e) {
+        errors.push(e instanceof Error ? e.message : String(e));
+    }
+    return errors;
+}
+//# sourceMappingURL=rowFilterValidation.js.map

package/dist/custom/rowFilterValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rowFilterValidation.js","sourceRoot":"","sources":["../../src/custom/rowFilterValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAGH,OAAO,EAEP,mBAAmB,EACnB,mBAAmB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IACzD,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,eAAe;IACf,kBAAkB;CACrB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACnD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;IACnE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM;IAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;CAC1D,CAAC,CAAC;AAQH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,UAAkB,EAAE,MAAkB;IACrF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,8CAA8C,CAAC,CAAC;IACrF,CAAC;IAED,2EAA2E;IAC3E,0BAA0B;IAC1B,IAAI,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;QACzE,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,IAAI,CACP,WAAW,KAAK,yCAAyC;gBACzD,oFAAoF;gBACpF,+DAA+D,CAClE,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,2EAA2E;IAC5F,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6BAA6B;IAC7B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACzE,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAQ,EAAE;QACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CACP,WAAW,UAAU,6DAA6D,MAAM,CAAC,IAAI,IAAI,CACpG,CAAC;QACN,CAAC;IACL,CAAC,CAAC;IAEF,4EAA4E;IAC5E,2CAA2C;IAC3C,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;QACvE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;IACnE,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACtD,OAAO,CACH,OAAO,IAAI,IAAI;QACf,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CACzB,CAAC;AACN,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAgB,EAChB,EAAqB,EACrB,WAAqB,EACrB,OAA+C;IAE/C,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC1D;YACI,UAAU,EAAE,wBAAwB;YACpC,WAAW,EACP,oBAAoB,QAAQ,2BAA2B,QAAQ,OAAO;gBACtE,sBAAsB,QAAQ,2BAA2B,QAAQ,GAAG;YACxE,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;YAC1B,UAAU,EAAE,QAAQ;SACvB;QACD;YACI,UAAU,EAAE,oBAAoB;YAChC,WAAW,EAAE,gBAAgB,QAAQ,GAAG;YACxC,MAAM,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACjC,UAAU,EAAE,QAAQ;SACvB;QACD;YACI,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,gBAAgB,QAAQ,GAAG;YACxC,MAAM,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACjC,UAAU,EAAE,QAAQ;SACvB;KACJ,EAAE,WAAW,CAAC,CAAC;IAEhB,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,MAAM,EAAE,CAAC;QACT,kFAAkF;QAClF,MAAM,IAAI,KAAK,CAAC,yDAAyD,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,SAAS,GAAwB,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAK,WAAW,CAAC,OAA8C,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QAChF,SAAS,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,qBAAqB,GAAG,CAAC,EAAE,YAAY,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,QAAQ,GAAG;YACnF,MAAM,EAAE,MAAM;SACjB,CAAC,CAAC;IACP,CAAC;IAED,MAAM,iBAAiB,GAAG,CACtB,IAAsD,EACtD,UAAkB,EAClB,KAAa,EACT,EAAE;QACN,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpF,SAAS;YACb,CAAC;YACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChH,SAAS,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,GAAG,KAAK,IAAI,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,eAAe,IAAI,EAAE,IAAI;gBAC3E,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC;IAEF,iBAAiB,CAAC,SAAS,CAAC,OAA2D,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACrI,iBAAiB,CAAC,SAAS,CAAC,OAA2D,EAAE,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;IAErJ,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAA8B,EAAE,YAAwB;IAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACP,GAAG,QAAQ,CAAC,WAAW,sEAAsE;gBAC7F,kEAAkE,CACrE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CACP,GAAG,QAAQ,CAAC,WAAW,yCAAyC,QAAQ,CAAC,MAAM,CAAC,IAAI,mBAAmB;gBACvG,gBAAgB,YAAY,CAAC,IAAI,kEAAkE;gBACnG,0CAA0C,CAC7C,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,QAAkB;IACpE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AACvG,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,IAAqC,EACrC,EAAqB,EACrB,WAAqB;IAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IAEzB,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;QACtD,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,wBAAwB;QACrC,MAAM,EAAE,CAAC,IAAI,CAAC;QACd,UAAU,EAAE,QAAQ;KACvB,EAAE,WAAW,CAAC,CAAC;IAChB,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,4CAA4C,gBAAgB,CAAC,YAAY,4BAA4B,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACzE,MAAM,iBAAiB,GACnB,iBAAiB,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAEnG,gGAAgG;IAChG,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjD,OAAO,EAAE,CAAC;IACd,CAAC;IAED,gEAAgE;IAChE,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,OAAO,CAA+E;QAClH,UAAU,EAAE,IAAI,CAAC,cAAc;QAC/B,WAAW,EAAE,IAAI,CAAC,iBAAiB;QACnC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC;QAClD,UAAU,EAAE,QAAQ;KACvB,EAAE,WAAW,CAAC,CAAC;IAChB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,sBAAsB,IAAI,CAAC,UAAU,yBAAyB,cAAc,CAAC,YAAY,4BAA4B,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAErG,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,qFAAqF;IACrF,IAAI,iBAAiB,EAAE,CAAC;QACpB,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACP,sGAAsG;gBACtG,mGAAmG;gBACnG,GAAG,IAAI,CAAC,UAAU,4BAA4B,CACjD,CAAC;QACN,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CACP,oCAAoC,IAAI,CAAC,UAAU,gBAAgB,eAAe,CAAC,EAAE,qBAAqB;gBAC1G,uGAAuG;gBACvG,OAAO,IAAI,CAAC,UAAU,gFAAgF,CACzG,CAAC;QACN,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1G,IAAI,iBAAiB,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,mDAAmD,IAAI,CAAC,UAAU,kCAAkC;gBACpG,SAAS,iBAAiB,CAAC,EAAE,0EAA0E;gBACvG,iBAAiB,CACpB,CAAC;QACN,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,6HAA6H,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAC;IACzJ,CAAC;IAED,8CAA8C;IAC9C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACP,oGAAoG;YACpG,2DAA2D,IAAI,CAAC,eAAe,IAAI,EAAE,KAAK,CAC7F,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,2CAA2C;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,eAAe,kCAAkC,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,qGAAqG;IACrG,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAA0D;QAC3F,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,GAAG;QACvC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC;QACpC,UAAU,EAAE,QAAQ;KACvB,EAAE,WAAW,CAAC,CAAC;IAChB,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,4CAA4C,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,YAAY,4BAA4B,CAAC,CAAC;QACpI,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,IAAI,+FAA+F,CAAC,CAAC;QACtJ,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,cAAc,GAAG,kCAAkC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrF,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhF,oEAAoE;IACpE,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE;YACjF,UAAU,EAAE,IAAI,CAAC,cAAc;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -35,6 +35,10 @@ export * from './custom/MJAISkillEntityServer.server.js';
 export * from './custom/MJMLTrainingPipelineEntityServer.server.js';
 export * from './custom/MJUserRoutineEntityServer.server.js';
 export * from './custom/MJUserRoutineRecipientEntityServer.server.js';
+export * from './custom/MJAPIKeyScopeEntityServer.server.js';
+export * from './custom/MJAPIApplicationScopeEntityServer.server.js';
+export * from './custom/MJRowLevelSecurityFilterEntityServer.server.js';
+export * from './custom/rowFilterValidation.js';
 export * from './custom/json-schema-lite.js';
 export * from './custom/IntegrationLLMPKCallback.js';
 export * from './custom/util.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kDAAkD,CAAC;AACjE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,uCAAuC,CAAC;AACtD,cAAc,kDAAkD,CAAC;AACjE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,eAAe,CAAC;AAE9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC;AAAA,cAAc,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kDAAkD,CAAC;AACjE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,uCAAuC,CAAC;AACtD,cAAc,kDAAkD,CAAC;AACjE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mDAAmD,CAAC;AAClE,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,eAAe,CAAC;AAE9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC;AAAA,cAAc,+CAA+C,CAAC"}

package/dist/index.js

@@ -35,6 +35,10 @@ export * from './custom/MJAISkillEntityServer.server.js';
 export * from './custom/MJMLTrainingPipelineEntityServer.server.js';
 export * from './custom/MJUserRoutineEntityServer.server.js';
 export * from './custom/MJUserRoutineRecipientEntityServer.server.js';
+export * from './custom/MJAPIKeyScopeEntityServer.server.js';
+export * from './custom/MJAPIApplicationScopeEntityServer.server.js';
+export * from './custom/MJRowLevelSecurityFilterEntityServer.server.js';
+export * from './custom/rowFilterValidation.js';
 export * from './custom/json-schema-lite.js';
 export * from './custom/IntegrationLLMPKCallback.js';
 export * from './custom/util.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kDAAkD,CAAC;AACjE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,uCAAuC,CAAC;AACtD,cAAc,kDAAkD,CAAC;AACjE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,eAAe,CAAC;AAE9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC;AAAA,cAAc,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kDAAkD,CAAC;AACjE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,uCAAuC,CAAC;AACtD,cAAc,kDAAkD,CAAC;AACjE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mDAAmD,CAAC;AAClE,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,eAAe,CAAC;AAE9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yCAAyC,CAAC;AAAA,cAAc,+CAA+C,CAAC"}

package/package.json

@@ -1,19 +1,13 @@
 {
   "name": "@memberjunction/core-entities-server",
   "type": "module",
-  "version": "5.51.0",
+  "version": "6.1.0-edge.0",
   "description": "Entity subclasses for the metadata layer of MemberJunction that are only used on server side applications like MJAPI, distributed as part of each release of MemberJunction",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "/dist"
   ],
-  "scripts": {
-    "start": "ts-node-dev src/index.ts",
-    "build": "tsc && tsc-alias -f",
-    "test": "vitest run",
-    "test:watch": "vitest"
-  },
   "author": "MemberJunction.com",
   "license": "ISC",
   "devDependencies": {
@@ -21,30 +15,30 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@memberjunction/actions-base": "5.51.0",
-    "@memberjunction/ai": "5.51.0",
-    "@memberjunction/ai-core-plus": "5.51.0",
-    "@memberjunction/ai-engine-base": "5.51.0",
-    "@memberjunction/ai-prompts": "5.51.0",
-    "@memberjunction/ai-provider-bundle": "5.51.0",
-    "@memberjunction/ai-vector-dupe": "5.51.0",
-    "@memberjunction/ai-vectordb": "5.51.0",
-    "@memberjunction/ai-vectors-memory": "5.51.0",
-    "@memberjunction/aiengine": "5.51.0",
-    "@memberjunction/core": "5.51.0",
-    "@memberjunction/core-entities": "5.51.0",
-    "@memberjunction/predictive-studio-core": "5.51.0",
-    "@memberjunction/doc-utils": "5.51.0",
-    "@memberjunction/generic-database-provider": "5.51.0",
-    "@memberjunction/global": "5.51.0",
-    "@memberjunction/integration-engine": "5.51.0",
-    "@memberjunction/integration-pk-classifier": "5.51.0",
-    "@memberjunction/scheduling-engine": "5.51.0",
-    "@memberjunction/sql-converter": "5.51.0",
-    "@memberjunction/sql-dialect": "5.51.0",
-    "@memberjunction/sql-parser": "5.51.0",
-    "@memberjunction/sqlserver-dataprovider": "5.51.0",
-    "@memberjunction/tag-engine": "5.51.0",
+    "@memberjunction/actions-base": "6.1.0-edge.0",
+    "@memberjunction/ai": "6.1.0-edge.0",
+    "@memberjunction/ai-core-plus": "6.1.0-edge.0",
+    "@memberjunction/ai-engine-base": "6.1.0-edge.0",
+    "@memberjunction/ai-prompts": "6.1.0-edge.0",
+    "@memberjunction/ai-provider-bundle": "6.1.0-edge.0",
+    "@memberjunction/ai-vector-dupe": "6.1.0-edge.0",
+    "@memberjunction/ai-vectordb": "6.1.0-edge.0",
+    "@memberjunction/ai-vectors-memory": "6.1.0-edge.0",
+    "@memberjunction/aiengine": "6.1.0-edge.0",
+    "@memberjunction/core": "6.1.0-edge.0",
+    "@memberjunction/core-entities": "6.1.0-edge.0",
+    "@memberjunction/predictive-studio-core": "6.1.0-edge.0",
+    "@memberjunction/doc-utils": "6.1.0-edge.0",
+    "@memberjunction/generic-database-provider": "6.1.0-edge.0",
+    "@memberjunction/global": "6.1.0-edge.0",
+    "@memberjunction/integration-engine": "6.1.0-edge.0",
+    "@memberjunction/integration-pk-classifier": "6.1.0-edge.0",
+    "@memberjunction/scheduling-engine": "6.1.0-edge.0",
+    "@memberjunction/sql-converter": "6.1.0-edge.0",
+    "@memberjunction/sql-dialect": "6.1.0-edge.0",
+    "@memberjunction/sql-parser": "6.1.0-edge.0",
+    "@memberjunction/sqlserver-dataprovider": "6.1.0-edge.0",
+    "@memberjunction/tag-engine": "6.1.0-edge.0",
     "nunjucks": "3.2.4",
     "rxjs": "~7.8.1",
     "zod": "^3.25.0"
@@ -52,5 +46,11 @@
   "repository": {
     "type": "git",
     "url": "https://github.com/MemberJunction/MJ"
+  },
+  "scripts": {
+    "start": "ts-node-dev src/index.ts",
+    "build": "tsc && tsc-alias -f",
+    "test": "vitest run",
+    "test:watch": "vitest"
   }
-}
+}