@memberjunction/data-context-server 6.2.0-edge.3 → 6.2.0-edge.5

package/README.md

@@ -1,16 +1,16 @@
 # @memberjunction/data-context-server
 
-Server-side implementation of the MemberJunction Data Context system. Provides SQL-based data loading for `DataContextItem` objects using direct database connections.
+Server-side implementation of the MemberJunction Data Context system. Loads the data of `sql`-type `DataContextItem` objects by running their SQL through a query provider's screened ad-hoc path.
 
 ## Overview
 
-The `@memberjunction/data-context-server` package extends the base `DataContextItem` class from `@memberjunction/data-context` with a server-side implementation that executes SQL queries directly against SQL Server using `mssql` connection pools. This is the server counterpart to the client-side GraphQL-based data context loading.
+The `@memberjunction/data-context-server` package extends the base `DataContextItem` class from `@memberjunction/data-context` with a server-side implementation of `LoadFromSQL`. It runs the item's SQL through `RunQuery({ SQL })` on a query provider, the same ad-hoc path `ExecuteAdhocQuery` uses, so the SQL must be a single read statement. On PostgreSQL that path also runs it in a read-only transaction that is rolled back. It never sends SQL to a raw connection pool. This is the server counterpart to the client-side GraphQL-based data context loading.
 
 ```mermaid
 graph TD
     A["DataContextItemServer"] -->|extends| B["DataContextItem<br/>(data-context package)"]
-    A -->|uses| C["mssql ConnectionPool"]
-    C --> D["SQL Server"]
+    A -->|"RunQuery({ SQL })"| C["Read-only query provider"]
+    C --> D["Database"]
 
     E["Server-Side Code<br/>(MJAPI, Actions, etc.)"] --> A
     F["Client-Side Code<br/>(Angular, React)"] --> G["DataContextItemClient<br/>(GraphQL-based)"]
@@ -31,28 +31,29 @@ npm install @memberjunction/data-context-server
 
 ## How It Works
 
-The package registers `DataContextItemServer` as a subclass of `DataContextItem` using MemberJunction's `@RegisterClass` decorator. When server-side code creates a `DataContextItem`, the class factory automatically returns the server implementation that uses direct SQL execution rather than GraphQL.
+The package registers `DataContextItemServer` as a subclass of `DataContextItem` using MemberJunction's `@RegisterClass` decorator. When server-side code creates a `DataContextItem`, the class factory automatically returns the server implementation.
 
 ```typescript
 import '@memberjunction/data-context-server';
-// DataContextItem instances now use direct SQL execution on the server
+// DataContextItem instances can now load `sql` items on the server
 ```
 
 The `LoadFromSQL` method:
-1. Receives a SQL Server `ConnectionPool` as the data source
-2. Creates a new `Request` from the pool
-3. Executes the `DataContextItem.SQL` query directly
-4. Stores the resulting recordset in `DataContextItem.Data`
+1. Receives a query provider (`IRunQueryProvider`) as the data source. MJServer passes its read-only provider.
+2. Refuses when there is no context user, or when the data source is not a query provider (for example a raw connection pool)
+3. Runs `DataContextItem.SQL` through `RunQuery({ SQL })` for the context user. The provider accepts only a single read statement.
+4. Stores the result rows in `DataContextItem.Data`
 5. Returns success/failure with error details on `DataLoadingError`
 
+Callers decide who may run an item's SQL. MJServer's `GetDataContextData` and `GetDataContextItemData` queries allow it only for the data context's owner or an administrator, never for a scope-limited session, and only on the read-only provider.
+
 ## Dependencies
 
 | Package | Purpose |
 |---------|---------|
-| `@memberjunction/core` | UserInfo, LogError utilities |
+| `@memberjunction/core` | `IRunQueryProvider`, `UserInfo`, `LogError` |
 | `@memberjunction/global` | RegisterClass decorator |
 | `@memberjunction/data-context` | Base DataContextItem class |
-| `mssql` | SQL Server connectivity |
 
 ## License
 

package/dist/index.d.ts

@@ -1,11 +1,19 @@
-import { UserInfo } from "@memberjunction/core";
+import type { IRunQueryProvider, UserInfo } from "@memberjunction/core";
 import { DataContextItem } from "@memberjunction/data-context";
+/**
+ * Server-side DataContextItem. Runs the SQL of a `sql` item through a query provider's ad-hoc path,
+ * which accepts only a single read statement.
+ */
 export declare class DataContextItemServer extends DataContextItem {
     /**
-     * Server-Side only method to load the data context item from a SQL statement
-     * @param dataSource - The data source to load the data context item from (this implementation uses mssql ConnectionPool object)
-     * @param contextUser - The user that is requesting the data context
+     * Loads the item's data by running its SQL through `dataSource.RunQuery` for `contextUser`.
+     * Refuses when there is no context user or when `dataSource` is not a query provider, such as a
+     * raw connection pool handed in through `LoadData`'s untyped data source.
+     * @param dataSource - the query provider to run the SQL on; MJServer passes its read-only provider
+     * @param contextUser - the user the SQL runs for
      */
-    protected LoadFromSQL(dataSource: any, contextUser?: UserInfo): Promise<boolean>;
+    protected LoadFromSQL(dataSource: IRunQueryProvider | null | undefined, contextUser?: UserInfo): Promise<boolean>;
+    /** Records why the item's SQL was not loaded and returns false. */
+    private failSQLLoad;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,qBACa,qBAAsB,SAAQ,eAAe;IACtD;;;;OAIG;cACsB,WAAW,CAAC,UAAU,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAclG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;GAGG;AACH,qBACa,qBAAsB,SAAQ,eAAe;IACtD;;;;;;OAMG;cACsB,WAAW,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBhI,mEAAmE;IACnE,OAAO,CAAC,WAAW;CAKtB"}

package/dist/index.js

@@ -7,27 +7,46 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 import { RegisterClass } from "@memberjunction/global";
 import { LogError } from "@memberjunction/core";
 import { DataContextItem } from "@memberjunction/data-context";
-import sql from "mssql";
+/**
+ * Server-side DataContextItem. Runs the SQL of a `sql` item through a query provider's ad-hoc path,
+ * which accepts only a single read statement.
+ */
 let DataContextItemServer = class DataContextItemServer extends DataContextItem {
     /**
-     * Server-Side only method to load the data context item from a SQL statement
-     * @param dataSource - The data source to load the data context item from (this implementation uses mssql ConnectionPool object)
-     * @param contextUser - The user that is requesting the data context
+     * Loads the item's data by running its SQL through `dataSource.RunQuery` for `contextUser`.
+     * Refuses when there is no context user or when `dataSource` is not a query provider, such as a
+     * raw connection pool handed in through `LoadData`'s untyped data source.
+     * @param dataSource - the query provider to run the SQL on; MJServer passes its read-only provider
+     * @param contextUser - the user the SQL runs for
      */
     async LoadFromSQL(dataSource, contextUser) {
+        if (!contextUser) {
+            return this.failSQLLoad('a context user is required');
+        }
+        if (!dataSource || typeof dataSource.RunQuery !== 'function') {
+            return this.failSQLLoad('SQL items run only through a query provider, never on a raw connection');
+        }
+        if (!this.SQL?.trim()) {
+            return this.failSQLLoad('the item has no SQL');
+        }
         try {
-            const pool = dataSource;
-            const request = new sql.Request(pool);
-            const result = await request.query(this.SQL);
-            this.Data = result.recordset;
-            return true; // if we get here the above query didn't fail by throwing an exception which would get caught below
+            const result = await dataSource.RunQuery({ SQL: this.SQL }, contextUser);
+            if (!result.Success) {
+                return this.failSQLLoad(result.ErrorMessage);
+            }
+            this.Data = result.Results;
+            return true;
         }
         catch (e) {
-            this.DataLoadingError = `Error loading data context item from SQL: ${e && e.message ? e.message : e}`;
-            LogError(this.DataLoadingError);
-            return false;
+            return this.failSQLLoad(e instanceof Error ? e.message : String(e));
         }
     }
+    /** Records why the item's SQL was not loaded and returns false. */
+    failSQLLoad(reason) {
+        this.DataLoadingError = `Error loading data context item from SQL: ${reason}`;
+        LogError(this.DataLoadingError);
+        return false;
+    }
 };
 DataContextItemServer = __decorate([
     RegisterClass(DataContextItem, undefined, undefined, true)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,GAAG,MAAM,OAAO,CAAC;AAGjB,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,eAAe;IACtD;;;;OAIG;IACgB,KAAK,CAAC,WAAW,CAAC,UAAe,EAAE,WAAsB;QACxE,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,UAAgC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;YAC7B,OAAO,IAAI,CAAC,CAAC,mGAAmG;QACpH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,gBAAgB,GAAG,6CAA6C,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACrG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;CACJ,CAAA;AApBY,qBAAqB;IADjC,aAAa,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;GAC9C,qBAAqB,CAoBjC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,eAAe;IACtD;;;;;;OAMG;IACgB,KAAK,CAAC,WAAW,CAAC,UAAgD,EAAE,WAAsB;QACzG,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,WAAW,CAAC,wEAAwE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IAED,mEAAmE;IAC3D,WAAW,CAAC,MAAc;QAC9B,IAAI,CAAC,gBAAgB,GAAG,6CAA6C,MAAM,EAAE,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AArCY,qBAAqB;IADjC,aAAa,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;GAC9C,qBAAqB,CAqCjC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@memberjunction/data-context-server",
   "type": "module",
-  "version": "6.2.0-edge.3",
+  "version": "6.2.0-edge.5",
   "description": "This library provides a server-side implementation of the DataContextItem class from @memberjunction/data-context that can handle the server-side only use case of loading data into a context using raw SQL statements.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,9 +15,9 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@memberjunction/core": "6.2.0-edge.3",
-    "@memberjunction/data-context": "6.2.0-edge.3",
-    "@memberjunction/global": "6.2.0-edge.3",
+    "@memberjunction/core": "6.2.0-edge.5",
+    "@memberjunction/data-context": "6.2.0-edge.5",
+    "@memberjunction/global": "6.2.0-edge.5",
     "mssql": "^12.2.0"
   },
   "repository": {

package/readme.md

@@ -1,16 +1,16 @@
 # @memberjunction/data-context-server
 
-Server-side implementation of the MemberJunction Data Context system. Provides SQL-based data loading for `DataContextItem` objects using direct database connections.
+Server-side implementation of the MemberJunction Data Context system. Loads the data of `sql`-type `DataContextItem` objects by running their SQL through a query provider's screened ad-hoc path.
 
 ## Overview
 
-The `@memberjunction/data-context-server` package extends the base `DataContextItem` class from `@memberjunction/data-context` with a server-side implementation that executes SQL queries directly against SQL Server using `mssql` connection pools. This is the server counterpart to the client-side GraphQL-based data context loading.
+The `@memberjunction/data-context-server` package extends the base `DataContextItem` class from `@memberjunction/data-context` with a server-side implementation of `LoadFromSQL`. It runs the item's SQL through `RunQuery({ SQL })` on a query provider, the same ad-hoc path `ExecuteAdhocQuery` uses, so the SQL must be a single read statement. On PostgreSQL that path also runs it in a read-only transaction that is rolled back. It never sends SQL to a raw connection pool. This is the server counterpart to the client-side GraphQL-based data context loading.
 
 ```mermaid
 graph TD
     A["DataContextItemServer"] -->|extends| B["DataContextItem<br/>(data-context package)"]
-    A -->|uses| C["mssql ConnectionPool"]
-    C --> D["SQL Server"]
+    A -->|"RunQuery({ SQL })"| C["Read-only query provider"]
+    C --> D["Database"]
 
     E["Server-Side Code<br/>(MJAPI, Actions, etc.)"] --> A
     F["Client-Side Code<br/>(Angular, React)"] --> G["DataContextItemClient<br/>(GraphQL-based)"]
@@ -31,28 +31,29 @@ npm install @memberjunction/data-context-server
 
 ## How It Works
 
-The package registers `DataContextItemServer` as a subclass of `DataContextItem` using MemberJunction's `@RegisterClass` decorator. When server-side code creates a `DataContextItem`, the class factory automatically returns the server implementation that uses direct SQL execution rather than GraphQL.
+The package registers `DataContextItemServer` as a subclass of `DataContextItem` using MemberJunction's `@RegisterClass` decorator. When server-side code creates a `DataContextItem`, the class factory automatically returns the server implementation.
 
 ```typescript
 import '@memberjunction/data-context-server';
-// DataContextItem instances now use direct SQL execution on the server
+// DataContextItem instances can now load `sql` items on the server
 ```
 
 The `LoadFromSQL` method:
-1. Receives a SQL Server `ConnectionPool` as the data source
-2. Creates a new `Request` from the pool
-3. Executes the `DataContextItem.SQL` query directly
-4. Stores the resulting recordset in `DataContextItem.Data`
+1. Receives a query provider (`IRunQueryProvider`) as the data source. MJServer passes its read-only provider.
+2. Refuses when there is no context user, or when the data source is not a query provider (for example a raw connection pool)
+3. Runs `DataContextItem.SQL` through `RunQuery({ SQL })` for the context user. The provider accepts only a single read statement.
+4. Stores the result rows in `DataContextItem.Data`
 5. Returns success/failure with error details on `DataLoadingError`
 
+Callers decide who may run an item's SQL. MJServer's `GetDataContextData` and `GetDataContextItemData` queries allow it only for the data context's owner or an administrator, never for a scope-limited session, and only on the read-only provider.
+
 ## Dependencies
 
 | Package | Purpose |
 |---------|---------|
-| `@memberjunction/core` | UserInfo, LogError utilities |
+| `@memberjunction/core` | `IRunQueryProvider`, `UserInfo`, `LogError` |
 | `@memberjunction/global` | RegisterClass decorator |
 | `@memberjunction/data-context` | Base DataContextItem class |
-| `mssql` | SQL Server connectivity |
 
 ## License