@memberjunction/core 6.1.0-edge.6 → 6.1.0

package/dist/generic/baseEntity.js

@@ -8,9 +8,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var EntityField_1;
-import { IsMemberOverridden, MJEventType, MJGlobal, OptionalKeyedSpecialization, uuidv4, UUIDsEqual, WarningManager } from '@memberjunction/global';
+import { DeserializeValidationErrors, IsMemberOverridden, MJEventType, MJGlobal, OptionalKeyedSpecialization, uuidv4, UUIDsEqual, WarningManager } from '@memberjunction/global';
 import { GetDataHooks } from './dataHooks.js';
-import { EntityFieldInfo, EntityInfo, EntityFieldTSType, EntityPermissionType, RecordChange, ValidationErrorInfo, ValidationResult } from './entityInfo.js';
+import { EntityFieldInfo, EntityInfo, EntityFieldTSType, EntityPermissionType, FieldSecurityError, RecordChange, ValidationErrorInfo, ValidationResult } from './entityInfo.js';
 import { EntitySubtypeResolver } from './entitySubtypeResolver.js';
 import { BaseEngineRegistry } from './baseEngineRegistry.js';
 import { IsPermittedImageFieldValue, IsValidCssColor, TryParseJsonText } from './extendedTypeValue.js';
@@ -52,6 +52,57 @@ let EntityField = class EntityField {
         "real": { min: -3.402823466e+38, max: 3.402823466e+38 },
         "money": { min: -922337203685477.5808, max: 922337203685477.5807 },
     }; }
+    /**
+     * True when the source this entity was hydrated from OMITTED this field's key — most
+     * commonly because field-level security stripped it before the payload reached us, but
+     * equally for any partial hydration. The field's in-memory state (its metadata default,
+     * else null) is a construction artifact, not data: the save path skips not-loaded fields
+     * entirely (the generated procs' `ISNULL(@p, [Col])` merge then preserves the stored
+     * value), {@link Dirty} always reports false for them, and {@link Validate} exempts them
+     * from the required/null check.
+     *
+     * Deliberately DISTINCT from `_NeverSet`, which means "no set since construction," exists
+     * to permit the one-time write to ReadOnly fields on load, and is re-armed wholesale by
+     * `InnerLoad` — reusing it would conflate defaults with omissions. This flag is set only
+     * by the hydration paths (via {@link MarkNotLoaded}) when a source omits the key, is
+     * cleared by ANY explicit set (an intentional blind write to a read-denied field is a
+     * legitimate write-only update and must save), and is never present on new (unhydrated)
+     * entities — their fields legitimately hold metadata defaults for INSERT.
+     */
+    get NotLoaded() {
+        return this._NotLoaded;
+    }
+    /**
+     * Framework-internal: hydration paths call this for each field whose key the hydration
+     * source omitted. Application code should never need it — an explicit {@link Value} set
+     * clears the flag.
+     */
+    MarkNotLoaded() {
+        this._NotLoaded = true;
+    }
+    /**
+     * True when field-level security bars this user from supplying the field's value on INSERT,
+     * so the save path must omit it and let the column take its database default.
+     *
+     * Deliberately DISTINCT from {@link NotLoaded}, even though both end in "leave this
+     * parameter out of the SP call". `NotLoaded` means "the hydration source omitted this key"
+     * and carries consequences this must not: it suppresses the `_Clear` companion, exempts the
+     * field from required/null validation, and forces {@link Dirty} to false. A create-suppressed
+     * field, by contrast, holds a perfectly real value the user typed — it is simply not one they
+     * are permitted to supply. Conflating them would silently disarm validation on fields a user
+     * IS allowed to create.
+     *
+     * Set per-save by the create-path gate and cleared at the start of every save, because the
+     * answer depends on the acting user and the same entity object can be saved by different
+     * users over its lifetime.
+     */
+    get CreateSuppressed() {
+        return this._CreateSuppressed;
+    }
+    /** Framework-internal: set by the save path's field-security create gate. */
+    SetCreateSuppressed(suppressed) {
+        this._CreateSuppressed = suppressed;
+    }
     get Name() {
         return this._entityFieldInfo.Name;
     }
@@ -126,8 +177,16 @@ let EntityField = class EntityField {
                 value = value.replace(/ +$/, '');
             }
             this._Value = value;
+            // Any explicit set means the field now holds REAL data — including a blind write to
+            // a read-denied field (the write-only case), which must flow to the save. Captured
+            // BEFORE clearing so the OldValue branch below can see it: a set onto a not-loaded
+            // field is an EDIT (must become dirty and reach the save), never the "initial value
+            // set" of record setup — the record's setup moment was the hydration that omitted
+            // this field.
+            const wasNotLoaded = this._NotLoaded;
+            this._NotLoaded = false;
             // in the below, we set the OldValue, but only if (a) we have never set the value before, or (b) the value or the old value is not null - which means that we are in a record setup scenario
-            if (this._NeverSet &&
+            if (this._NeverSet && !wasNotLoaded &&
                 (value !== null || this._OldValue !== null)) {
                 // initial value set
                 this._OldValue = value;
@@ -145,9 +204,11 @@ let EntityField = class EntityField {
     }
     /**
      * Returns true if the field is dirty, false otherwise. A field is considered dirty if the value is different from the old value. If the field is read only, it is never dirty.
+     * A {@link NotLoaded} field is never dirty either — its in-memory state is a construction
+     * artifact, not data, and nothing that was never loaded can have been changed.
      */
     get Dirty() {
-        if (this.ReadOnly)
+        if (this.ReadOnly || this._NotLoaded)
             return false;
         else {
             const oldNull = this._OldValue === null || this.OldValue === undefined || Number.isNaN(this.OldValue); // check for NaN because sometimes we have old values that are NaN and we need to account for that
@@ -281,7 +342,13 @@ let EntityField = class EntityField {
         // no longer false-warns or throws here.
         if (!ef.ReadOnly && !ef.SkipValidation) {
             // only do validation on updatable fields and skip the special case fields defined inside the SkipValidation property (like ID/CreatedAt/UpdatedAt)
-            if (!ef.AllowsNull && (this.Value === null || this.Value === undefined)) {
+            // NotLoaded exemption: a field the hydration source omitted holds null/default by
+            // construction and is SKIPPED by the save SQL, so the stored value is untouched —
+            // failing the required check here would make every partially hydrated record
+            // unsaveable for unrelated edits (the exact NOT-NULL breakage mode the not-loaded
+            // design exists to remove). Length/type checks below still apply to whatever the
+            // constructor state is; only the required/null check is meaningless for it.
+            if (!ef.AllowsNull && !this._NotLoaded && (this.Value === null || this.Value === undefined)) {
                 // make sure this isn't a field that has a default value and we are inside a new record
                 if (ef.DefaultValue === null || ef.DefaultValue === undefined || ef.DefaultValue.trim().length === 0) {
                     // we have no default value, so this is an error
@@ -364,6 +431,8 @@ let EntityField = class EntityField {
     }
     constructor(fieldInfo, Value) {
         this._NeverSet = true;
+        this._NotLoaded = false;
+        this._CreateSuppressed = false;
         // NOTE: constructing an EntityField for a deprecated/disabled field is always allowed — the
         // column is physically part of the entity and the instance must exist. Active-status is
         // asserted only when code accesses the field by name via BaseEntity.Get/Set/SetMany, never
@@ -521,6 +590,21 @@ export class BaseEntityAIActionParams {
  */
 export class BaseEntityResult {
     constructor(success, message, type) {
+        /**
+         * Set by a producer whose `Message` ALREADY renders every entry of `Errors`, so that
+         * {@link CompleteMessage} does not say the same thing twice.
+         *
+         * Two kinds of producer build `Message` out of `Errors`: the client-side providers, which copy
+         * the SERVER's `CompleteMessage` (= its errors, joined) into `Message` and then rehydrate the same
+         * entries into `Errors` so a form can paint the fields; and the IS-A parent-failure paths, which
+         * write "Failed to save parent entity … : <errors joined>". Without this flag every one of them
+         * read twice in `CompleteMessage`. A substring dedupe was tried and reverted (it is lossy in ways
+         * a reader cannot detect — see `CompleteMessage`); a producer stating the fact is exact.
+         *
+         * Only honoured when `Message` actually has text: a producer that set the flag and left `Message`
+         * empty is contradicting itself, and the errors are still rendered rather than lost.
+         */
+        this.MessageIncludesErrors = false;
         /**
          * A copy of the values of the entity object BEFORE the operation was performed
          */
@@ -612,8 +696,12 @@ export class BaseEntityResult {
         // or dropped depending on ARRAY ORDER; and a distinct error vanishes when its text happens to
         // appear inside the summary. Saying something twice is ugly. Silently reporting one problem
         // when there were three is the failure this whole class of bug is about, so the duplication
-        // stays until a producer-side fix removes it at the source.
-        if (this.Errors && this.Errors.length > 0) {
+        // stays UNLESS the producer states, via `MessageIncludesErrors`, that `Message` already
+        // renders every entry — an exact fact, not a guess, and the only producer-side fix that
+        // removes the repeat at the source.
+        const messageHasText = !!this.Message && this.Message.trim().length > 0;
+        const errorsAlreadyInMessage = this.MessageIncludesErrors && messageHasText;
+        if (this.Errors && this.Errors.length > 0 && !errorsAlreadyInMessage) {
             // append
             msg = (msg ? msg + '\n' : '') + this.Errors.map(err => BaseEntityResult.ErrorText(err)).join('\n');
         }
@@ -1578,6 +1666,8 @@ export class BaseEntity {
         // ignoreNonExistentFields=true remains as a safety net; ownedFieldsFrom already
         // dropped columns that belong to another level of the IS-A chain.
         this.SetMany(this.ownedFieldsFrom(data), true, true, true);
+        // Hydrate is a hydration entry point: keys the source omitted are not-loaded.
+        this.markFieldsOmittedBySourceAsNotLoaded(data);
     }
     /**
      * Columns on `data` that this entity actually defines (by field name or CodeName).
@@ -1821,7 +1911,10 @@ export class BaseEntity {
             }, { provider: this.ProviderToUse, user: this.ActiveUser });
             if (!result.Success || !result.Output?.Success) {
                 const detail = result.ErrorMessage ?? result.Output?.ErrorMessage ?? 'unknown error';
-                this.registerGraphFailure(detail);
+                // The structured refusal rides alongside the prose so a form can paint the fields a
+                // server-side ValidateAsync named — the same thing a plain save gets from the
+                // GraphQL error's `extensions.validationErrors`.
+                this.registerGraphFailure(detail, 'save', result.Output?.ValidationErrors);
                 this.RaiseEvent('graph_save', { Success: false, NodeCount: plan.NodeCount, Error: detail });
                 return false;
             }
@@ -2240,11 +2333,16 @@ export class BaseEntity {
      *
      * @param message - The failure detail.
      */
-    registerGraphFailure(message, operation = 'save') {
+    registerGraphFailure(message, operation = 'save', validationErrors) {
         const result = new BaseEntityResult();
         result.Success = false;
         result.Type = operation === 'delete' ? 'delete' : this.IsSaved ? 'update' : 'create';
         result.Message = message ?? 'Entity graph operation failed';
+        // Rehydrated into real ValidationErrorInfo instances so `LatestResult.Errors` reads exactly as
+        // it does after a local `Validate()` refusal; `[]` when the server sent none.
+        result.Errors = DeserializeValidationErrors(validationErrors);
+        // `message` is the server's CompleteMessage — the same errors, already joined — so say so.
+        result.MessageIncludesErrors = result.Errors.length > 0 && !!message;
         result.StartedAt = new Date();
         result.EndedAt = new Date();
         result.OriginalValues = this.Fields.map(f => ({ FieldName: f.CodeName, Value: f.OldValue }));
@@ -2702,6 +2800,7 @@ export class BaseEntity {
             if (this.EntityInfo?.HasInactiveFields) {
                 this.AssertFieldActiveStatus(FieldName, 'BaseEntity.Set');
             }
+            this.AssertFieldReadable(FieldName);
             this.SetLocal(FieldName, Value);
         }
     }
@@ -2721,6 +2820,33 @@ export class BaseEntity {
             EntityFieldInfo.AssertEntityFieldActiveStatus(fi, caller);
         }
     }
+    /**
+     * Field-level security choke point for the strongly-typed accessor path. Throws when the
+     * acting user may not READ the field.
+     *
+     * Called by `Get()` and `Set()` — every generated typed accessor
+     * (`get Salary() { return this.Get('Salary'); }`) routes through them, so these two sites
+     * cover the whole typed surface. Gated on both READ, because a field a user cannot see is
+     * one they cannot meaningfully address by name at all; update and create denials are
+     * enforced on the write path, where a rejection can name a save rather than a keystroke.
+     *
+     * **Deliberately NOT called by `SetMany`.** That is the hydration and resolver-apply path —
+     * throwing there would break loading a record that merely CONTAINS a restricted column.
+     *
+     * **Fails open when no user resolves.** `ActiveUser` is legitimately null in plenty of
+     * server paths, and a gate that threw there would break unrelated code in ways that look
+     * nothing like field security.
+     *
+     * Framework-internal value machinery (`Dirty`, `Validate`, `GetAll`, hydration, save-SQL
+     * build) reads `EntityField.Value` directly and never routes through here — that exemption
+     * is load-bearing, not an oversight. Do not "fix" it.
+     */
+    AssertFieldReadable(fieldName) {
+        const denied = this.deniedFieldsForActiveUser(u => this.EntityInfo.GetDeniedReadFields(u));
+        if (denied?.has(fieldName?.trim().toLowerCase())) {
+            throw new FieldSecurityError(fieldName, this.EntityInfo.Name);
+        }
+    }
     /**
      * Internal helper that sets a field value directly on THIS entity's own Fields array
      * without IS-A routing. Used by Set() for own-fields and for mirroring parent field values.
@@ -2788,6 +2914,10 @@ export class BaseEntity {
         if (this.EntityInfo?.HasInactiveFields) {
             this.AssertFieldActiveStatus(FieldName, 'BaseEntity.Get');
         }
+        // Field security sits BEFORE the raw-mode fast path below, not after: an entity whose
+        // fields are not yet hydrated would otherwise return denied values straight out of _raw
+        // without the gate ever running.
+        this.AssertFieldReadable(FieldName);
         // Raw mode fast path: read directly from the cached data without building EntityField
         // instances. This is the dominant cost in engine warm-loads — generated typed getters
         // (e.g. `get Name() { return this.Get('Name'); }`) flow through here, so a consumer that
@@ -2944,6 +3074,13 @@ export class BaseEntity {
     GetAll(oldValues = false, onlyDirtyFields = false) {
         let obj = {};
         for (let field of this.Fields) {
+            // NotLoaded fields are OMITTED (D-3 decision): their in-memory state is a
+            // construction artifact, and serializing it would launder a default/null into
+            // something downstream code treats as data — the exact masquerade the flag exists
+            // to prevent. Key-absence also propagates the flag naturally: hydrating another
+            // entity from this output re-marks the same fields not-loaded.
+            if (field.NotLoaded)
+                continue;
             if (!onlyDirtyFields || (onlyDirtyFields && field.Dirty)) {
                 // Reads field.Value directly — serialization is framework-internal, so it does not
                 // (and must not) assert active status. No suppression toggle needed: the assertion no
@@ -3135,6 +3272,9 @@ export class BaseEntity {
                     }
                 }
             }
+            // _raw IS a hydration source (LoadFromData fast path) — fields whose key it omitted
+            // are not-loaded, not defaulted. See EntityField.NotLoaded.
+            this.markFieldsOmittedBySourceAsNotLoaded(this._raw);
             // Raw data has been promoted into Fields — release the reference so we don't carry
             // duplicate state. Fields hold their own copies, so a frozen source no longer
             // constrains anything from here on.
@@ -3142,6 +3282,22 @@ export class BaseEntity {
             this._rawConverted = null;
         }
     }
+    /**
+     * Marks every field whose key the given HYDRATION SOURCE omitted as {@link EntityField.NotLoaded}.
+     * Called only by the hydration entry points ({@link LoadFromData} both modes, {@link Hydrate},
+     * {@link InnerLoad}) — never by plain {@link SetMany}, which is an incremental mutation API
+     * where omitting a field means "leave it alone," not "this field was never loaded."
+     * Both the field Name and CodeName are checked, matching SetMany's key acceptance.
+     */
+    markFieldsOmittedBySourceAsNotLoaded(source) {
+        if (!source || typeof source !== 'object')
+            return;
+        for (const field of this.Fields) {
+            if (source[field.Name] === undefined && source[field.CodeName] === undefined) {
+                field.MarkNotLoaded();
+            }
+        }
+    }
     /**
      * This method will copy the values from the other entity object into the current one. This is useful for things like cloning a record.
      * This method will ONLY copy values for fields that exist in the current entity object. If the other object has fields that don't exist in the current object, they will be ignored.
@@ -3155,7 +3311,9 @@ export class BaseEntity {
             for (let field of this.Fields) {
                 if (!field.IsPrimaryKey || includePrimaryKeys) {
                     const otherField = other.GetFieldByName(field.Name);
-                    if (otherField) {
+                    // Skip fields the SOURCE never loaded (D-3): copying their construction
+                    // state would masquerade a default/null as real data on this entity.
+                    if (otherField && !otherField.NotLoaded) {
                         this.Set(field.Name, otherField.Value);
                         if (replaceOldValues) {
                             field.ResetOldValue();
@@ -3476,6 +3634,9 @@ export class BaseEntity {
                             `Failed to save parent entity '${this._parentEntity.EntityInfo?.Name}': ${detail}`;
                         // Surface the parent's field-level errors so the caller can act on them.
                         newResult.Errors = parentErrors;
+                        // When `detail` was built from `parentErrors` (no parent Message), `Message` already renders
+                        // them — say so, or CompleteMessage repeats every one.
+                        newResult.MessageIncludesErrors = !parentLatest?.Message && parentErrors.length > 0;
                         newResult.OriginalValues = this.Fields.map(f => { return { FieldName: f.CodeName, Value: f.OldValue }; });
                         newResult.EndedAt = new Date();
                         this.RegisterResultHistoryEntry(newResult);
@@ -3486,6 +3647,8 @@ export class BaseEntity {
             const type = this.IsSaved ? EntityPermissionType.Update : EntityPermissionType.Create;
             const saveSubType = this.IsSaved ? 'update' : 'create';
             this.CheckPermissions(type, true); // this will throw an error and exit out if we don't have permission
+            this.CheckFieldLevelUpdatePermissions(); // field-level security — throws if a dirty field is not updatable by this user
+            this.ApplyFieldLevelCreateSuppression(); // field-level security on INSERT — omits fields, never rejects
             // IS-A disjoint subtype enforcement: on CREATE, ensure parent record
             // isn't already claimed by another child type (e.g., can't create Meeting
             // if a Publication already exists with the same Product ID).
@@ -3705,6 +3868,14 @@ export class BaseEntity {
             // does not own (e.g. OrderHeader on Event Order Line). Keep only columns
             // this entity defines, and ignore anything leftover.
             this.SetMany(this.ownedFieldsFrom(fieldData), true, true, true);
+            // finalizeSave re-hydrates from the save RESPONSE — a hydration source. Keys it
+            // omitted (e.g. fields the server stripped for field security) must be marked
+            // not-loaded, or the defaults init() just produced would masquerade as confirmed
+            // values and be resent on the NEXT save (the create/update-response corner: a
+            // trigger/system adjustment or concurrent change would be silently stomped).
+            if (typeof fieldData === 'object' && !Array.isArray(fieldData)) {
+                this.markFieldsOmittedBySourceAsNotLoaded(fieldData);
+            }
             this._everSaved = true; // Mark as saved after successful save
             const result = this.LatestResult;
             if (result)
@@ -3824,6 +3995,158 @@ export class BaseEntity {
         else
             return bAllowed;
     }
+    /**
+     * Field-level security on the write path: rejects a save that modifies a field this user
+     * has no update permission on.
+     *
+     * ENFORCEMENT LAYER — read this before treating it as the security boundary. `BaseEntity`
+     * also runs in the browser, where this guard is trivially bypassable. The AUTHORITATIVE
+     * check is the server-side execution of this same code: the MJServer mutation resolver
+     * re-instantiates the entity and re-runs Save on the server, where the client cannot reach
+     * it. The client-side occurrence is UX and defense-in-depth — fail fast with a clear
+     * message before a network round-trip — and must never be relied on alone.
+     *
+     * UPDATE rejects; CREATE does not — see {@link ApplyFieldLevelCreateSuppression}.
+     *
+     * Note this checks DIRTY fields only. CLIENT-side that is safe on its own: nothing ever
+     * nulls a restricted value in memory, so a field the user cannot see was never loaded as
+     * null, is not dirty, and an unrelated edit saves cleanly with the restricted column
+     * keeping its stored value.
+     *
+     * SERVER-side, dirty-only is safe only because `ResolverBase.UpdateRecord` guarantees the
+     * entity was hydrated FROM THE DATABASE on every FLS entity. Two distinct resolver behaviours
+     * carry that premise, and BOTH are load-bearing:
+     *
+     * 1. `StripDeniedReadFieldsFromClientInput` removes client-sent values for fields the caller
+     *    cannot READ, which `SetMany` would otherwise make genuinely dirty with fabricated data.
+     * 2. `entityInfo.EnableFieldLevelSecurity` forces the truth-load branch, so the entity's
+     *    non-dirty baseline is the real stored row rather than the client's `OldValues___`.
+     *
+     * (2) is not redundant with (1). A value arriving through `LoadFromData` is recorded by the
+     * EntityField setter as the field's INITIAL value, so it is not dirty — and this check would
+     * never see it, while `GenerateSaveSQL` sends it anyway (it filters on `NotLoaded`, never on
+     * `Dirty`). Without the forced truth-load, a caller with Read Allow + Update Deny — the
+     * canonical FLS configuration, and one that leaves (1) with nothing to strip — could write an
+     * update-denied field just by pinning its value in `OldValues___` and never naming it in the
+     * mutation. If you are considering relaxing that branch condition, this check is what breaks.
+     *
+     * The refusal names the missing permission when the caller can READ the field, and falls back
+     * to the ambiguous "does not exist or you do not have access" wording when they cannot. See
+     * {@link FieldSecurityWriteDenialMessage} for why that split discloses nothing.
+     */
+    CheckFieldLevelUpdatePermissions() {
+        if (!this.IsSaved) {
+            return; // INSERT — handled by ApplyFieldLevelCreateSuppression, which never rejects
+        }
+        const denied = this.deniedFieldsForActiveUser(u => this.EntityInfo.GetDeniedUpdateFields(u));
+        if (!denied) {
+            return;
+        }
+        // Resolved once, and only if we are actually going to reject: the wording depends on
+        // whether the caller can READ the field they were refused a write on.
+        let deniedRead;
+        for (const field of this.Fields) {
+            const key = field.Name.trim().toLowerCase();
+            if (field.Dirty && denied.has(key)) {
+                LogDebug(`[FieldSecurity] Rejected save on '${this.EntityInfo.Name}': ` +
+                    `field '${field.Name}' is not updatable by this user`);
+                // A field the caller can READ gets the real reason. Both facts the ambiguous
+                // wording protects — that the column exists, and that it is restricted for them —
+                // are already theirs, so withholding the reason only tells someone a field whose
+                // values they are looking at might not exist.
+                //
+                // A field they CANNOT read keeps the ambiguous wording. Not hypothetical: SetMany
+                // deliberately skips the readability assertion (hydration / resolver-apply path),
+                // so server-side code can dirty a read-denied field and land here.
+                if (deniedRead === undefined) {
+                    deniedRead = this.deniedFieldsForActiveUser(u => this.EntityInfo.GetDeniedReadFields(u));
+                }
+                throw deniedRead?.has(key)
+                    ? new FieldSecurityError(field.Name, this.EntityInfo.Name)
+                    : FieldSecurityError.WriteDenial(field.Name, this.EntityInfo.Name);
+            }
+        }
+    }
+    /**
+     * Field-level security on the INSERT path: marks the fields this user may not supply so the
+     * save omits them and each column takes its database default.
+     *
+     * **This never rejects, and that is deliberate.** Rejecting would be inconsistent with the
+     * read path (a denied field is simply absent, not an error) and would leak information — an
+     * error naming `Salary` confirms the field exists and is restricted, which the ambiguous
+     * denial wording exists to prevent. Silently defaulting is also what an unrestricted user
+     * gets by leaving the field blank, so a restricted user creating a record ends up with the
+     * same record SHAPE rather than a failure.
+     *
+     * The cost is that a user who supplies a value for a create-denied field gets no feedback
+     * that it was dropped, which is why the drop is logged and why the admin UI should not
+     * render the field at all.
+     *
+     * Runs on every save (clearing prior marks first) because the answer depends on the acting
+     * user, and one entity object can be saved by different users over its lifetime.
+     */
+    ApplyFieldLevelCreateSuppression() {
+        for (const field of this.Fields) {
+            field.SetCreateSuppressed(false);
+        }
+        if (this.IsSaved) {
+            return; // UPDATE — CheckFieldLevelUpdatePermissions owns that path
+        }
+        const denied = this.deniedFieldsForActiveUser(u => this.EntityInfo.GetDeniedCreateFields(u));
+        if (!denied) {
+            return;
+        }
+        const suppressed = [];
+        for (const field of this.Fields) {
+            if (denied.has(field.Name.trim().toLowerCase())) {
+                field.SetCreateSuppressed(true);
+                suppressed.push(field.Name);
+            }
+        }
+        if (suppressed.length > 0) {
+            LogDebug(`[FieldSecurity] Create on '${this.EntityInfo.Name}': ` +
+                `omitted field(s) ${suppressed.join(', ')}; each column takes its default`);
+        }
+    }
+    /**
+     * The denied-field set for the acting user, or null when field security does not apply —
+     * the entity has it switched off, no user resolves, or the user is denied nothing.
+     *
+     * Returning null rather than an empty Set lets callers skip their loop entirely, and keeps
+     * the three cheap short-circuits in one place instead of repeated at each gate.
+     */
+    deniedFieldsForActiveUser(select) {
+        if (!this.EntityInfo?.EnableFieldLevelSecurity) {
+            return null; // one boolean for the overwhelming majority of entities
+        }
+        const u = this.resolveActiveUserOrNull();
+        if (!u) {
+            return null; // no user resolves — fail open, see AssertFieldReadable
+        }
+        const denied = select(u);
+        return denied.size > 0 ? denied : null;
+    }
+    /**
+     * {@link ActiveUser}, but null instead of throwing when no provider is configured to resolve
+     * one from.
+     *
+     * `ActiveUser` ends in `Metadata.Provider.CurrentUser`, which throws a TypeError when there
+     * is no global provider — during early boot, in tests, or in any context that never
+     * configured one. That was harmless while only the save path consulted it, but `Get()` and
+     * `Set()` now do on every access to an FLS-enabled entity, so an unresolvable provider would
+     * turn an ordinary read into a crash.
+     *
+     * "No provider to ask" is the same answer as "no user" for this purpose, and field security
+     * fails open on both.
+     */
+    resolveActiveUserOrNull() {
+        try {
+            return this.ActiveUser ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
     ThrowPermissionError(u, type, additionalInfoMessage) {
         throw new Error(`User: ${u.Name} (ID: ${u.ID}, Email: ${u.Email})
                          Does NOT have permission to ${EntityPermissionType[type]} ${this.EntityInfo.Name} records.
@@ -3891,6 +4214,10 @@ export class BaseEntity {
                 f.ResetNeverSetFlag();
             }
             this.SetMany(data, false, true, true); // don't ignore non-existent fields, but DO replace old values
+            // InnerLoad is a hydration entry point: any field the provider's row omitted (e.g.
+            // a client-side load whose server response stripped read-denied fields) is
+            // not-loaded, so its constructor state never masquerades as data on the next save.
+            this.markFieldsOmittedBySourceAsNotLoaded(data);
             if (EntityRelationshipsToLoad) {
                 for (let relationship of EntityRelationshipsToLoad) {
                     if (data[relationship]) {
@@ -4052,6 +4379,10 @@ export class BaseEntity {
         // Hits when: subsequent LoadFromData call on an already-loaded instance, IS-A entity
         // (parent or child), or non-plain-object input. Preserves original semantics exactly.
         this.SetMany(data, true, _replaceOldValues, true); // ignore non-existent fields, but DO replace old values based on the provided param
+        if (isPlainObject) {
+            // LoadFromData is a hydration entry point: keys the source omitted are not-loaded.
+            this.markFieldsOmittedBySourceAsNotLoaded(data);
+        }
         // now, check to see if we have the primary key set, if so, we should consider ourselves
         // loaded from the database and set the _recordLoaded flag to true along with the _everSaved flag
         if (this.PrimaryKeys && this.PrimaryKeys.length > 0) {
@@ -4361,6 +4692,9 @@ export class BaseEntity {
                                         `Failed to delete parent entity '${this._parentEntity.EntityInfo?.Name}': ${detail}`;
                                     // Surface the parent's field-level errors so the caller can act on them.
                                     newResult.Errors = parentErrors;
+                                    // When `detail` was built from `parentErrors` (no parent Message), `Message` already renders
+                                    // them — say so, or CompleteMessage repeats every one.
+                                    newResult.MessageIncludesErrors = !parentLatest?.Message && parentErrors.length > 0;
                                     newResult.OriginalValues = this.Fields.map(f => { return { FieldName: f.CodeName, Value: f.OldValue }; });
                                     newResult.EndedAt = new Date();
                                     this.RegisterResultHistoryEntry(newResult);
@@ -4653,9 +4987,20 @@ export class BaseEntity {
         if (!f) {
             return null;
         }
-        else {
-            return this.Get(f.Name);
+        // Field security: the name field is an ordinary field and can be denied like any other.
+        // `Get()` THROWS for a denied field, and this method runs AUTOMATICALLY after every
+        // Load / LoadFromData / Save via CacheRecordName — so an unguarded read here does not
+        // hide a name, it makes the record fail to load at all, with a message about the name
+        // field that reads like the record itself is broken.
+        //
+        // Returning null is the same answer callers already handle for "this entity has no name
+        // field", and every one of them degrades to the primary key. It also keeps a denied name
+        // OUT of the provider's record-name cache, which is keyed by entity + primary key and NOT
+        // by user — caching it would leak it to the next caller.
+        if (!this.EntityInfo.IsFieldReadableByUser(f.Name, this.ActiveUser)) {
+            return null;
         }
+        return this.Get(f.Name);
     }
     /**
      * Static Utility method to get RecordChanges for a given entityName/KeyValuePair combination