@memberjunction/server 3.2.0 → 3.4.0

package/src/generic/ResolverBase.ts

@@ -1,4 +1,5 @@
 import {
+  AggregateExpression,
   BaseEntity,
   BaseEntityEvent,
   CompositeKey,
@@ -18,8 +19,9 @@ import {
 } from '@memberjunction/core';
 import { AuditLogEntity, ErrorLogEntity, UserViewEntityExtended } from '@memberjunction/core-entities';
 import { SQLServerDataProvider, UserCache } from '@memberjunction/sqlserver-dataprovider';
-import { PubSubEngine } from 'type-graphql';
+import { PubSubEngine, AuthorizationError } from 'type-graphql';
 import { GraphQLError } from 'graphql';
+import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import sql from 'mssql';
 import { httpTransport, CloudEvent, emitterFor } from 'cloudevents';
 
@@ -266,6 +268,11 @@ export class ResolverBase {
 
   async RunViewByNameGeneric(viewInput: RunViewByNameInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
     try {
+      // Log aggregate input for debugging
+      if (viewInput.Aggregates?.length) {
+        LogStatus(`[ResolverBase] RunViewByNameGeneric received aggregates: viewName=${viewInput.ViewName}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
+      }
+
       const rv = provider as any as IRunViewProvider;
       const result = await rv.RunView<UserViewEntityExtended>({
         EntityName: 'User Views',
@@ -290,7 +297,8 @@ export class ResolverBase {
           viewInput.ResultType,
           userPayload,
           viewInput.MaxRows,
-          viewInput.StartRow
+          viewInput.StartRow,
+          viewInput.Aggregates
         );
       }
       else {
@@ -305,6 +313,11 @@ export class ResolverBase {
 
   async RunViewByIDGeneric(viewInput: RunViewByIDInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
     try {
+      // Log aggregate input for debugging
+      if (viewInput.Aggregates?.length) {
+        LogStatus(`[ResolverBase] RunViewByIDGeneric received aggregates: viewID=${viewInput.ViewID}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
+      }
+
       const contextUser = this.GetUserFromPayload(userPayload);
       const viewInfo = await provider.GetEntityObject<UserViewEntityExtended>('User Views', contextUser);
       await viewInfo.Load(viewInput.ViewID);
@@ -325,7 +338,8 @@ export class ResolverBase {
         viewInput.ResultType,
         userPayload,
         viewInput.MaxRows,
-        viewInput.StartRow
+        viewInput.StartRow,
+        viewInput.Aggregates
       );
     } catch (err) {
       console.log(err);
@@ -335,6 +349,11 @@ export class ResolverBase {
 
   async RunDynamicViewGeneric(viewInput: RunDynamicViewInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
     try {
+      // Log aggregate input for debugging
+      if (viewInput.Aggregates?.length) {
+        LogStatus(`[ResolverBase] RunDynamicViewGeneric received aggregates: entityName=${viewInput.EntityName}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
+      }
+
       const md = provider;
       const entity = md.Entities.find((e) => e.Name === viewInput.EntityName);
       if (!entity) throw new Error(`Entity ${viewInput.EntityName} not found in metadata`);
@@ -363,7 +382,8 @@ export class ResolverBase {
         viewInput.ResultType,
         userPayload,
         viewInput.MaxRows,
-        viewInput.StartRow
+        viewInput.StartRow,
+        viewInput.Aggregates
       );
     } catch (err) {
       console.log(err);
@@ -422,7 +442,8 @@ export class ResolverBase {
           forceAuditLog: viewInput.ForceAuditLog,
           auditLogDescription: viewInput.AuditLogDescription,
           resultType: viewInput.ResultType,
-          userPayload, 
+          userPayload,
+          aggregates: viewInput.Aggregates,
         });
       } catch (err) {
         LogError(err);
@@ -484,7 +505,7 @@ export class ResolverBase {
     if (!userPayload) {
       throw new Error(`userPayload is null`);
     }
-    
+
     // first check permissions, the logged in user must have read permissions on the entity to run the view
     if (entityInfo) {
       const userInfo = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload.email.toLowerCase().trim()); // get the user record from MD so we have ROLES attached, don't use the one from payload directly
@@ -496,12 +517,85 @@ export class ResolverBase {
       if (!userPermissions.CanRead) {
         throw new Error(`User ${userPayload.email} does not have read permissions on ${entityInfo.Name}`);
       }
-    } 
+    }
     else {
       throw new Error(`Entity not found in metadata`);
     }
   }
 
+  /**
+   * Checks API key scope authorization. Only performs check if request
+   * was authenticated via API key (apiKeyHash present in userPayload).
+   * For OAuth/JWT auth, this is a no-op.
+   *
+   * @param scopePath - The scope path (e.g., 'entity:read', 'agent:execute')
+   * @param resource - The resource name (e.g., entity name, agent name)
+   * @param userPayload - The user payload from context
+   * @throws AuthorizationError if API key lacks required scope
+   */
+  protected async CheckAPIKeyScopeAuthorization(
+    scopePath: string,
+    resource: string,
+    userPayload: UserPayload
+  ): Promise<void> {
+    // Skip scope check for OAuth/JWT auth (no API key)
+    if (!userPayload.apiKeyHash) {
+      return;
+    }
+
+    // Get system user for authorization call
+    // NOTE: We use system user here because Authorize() needs to run internal
+    // database queries (loading scope rules, logging decisions). The system user
+    // ensures these queries work regardless of what permissions the API key's
+    // user has. The API key's associated user (in userPayload.userRecord) is
+    // used later when the actual operation executes - their permissions are
+    // the ultimate ceiling that scopes can only narrow, never expand.
+    const systemUser = UserCache.Instance.Users.find(u => u.Type === 'System');
+    if (!systemUser) {
+      throw new Error('System user not found');
+    }
+
+    const apiKeyEngine = GetAPIKeyEngine();
+
+    // Check for full_access scope first (god power - bypasses all other checks)
+    const fullAccessResult = await apiKeyEngine.Authorize(
+      userPayload.apiKeyHash,
+      'MJAPI',
+      'full_access',
+      '*',
+      systemUser,
+      { endpoint: '/graphql', method: 'POST' }
+    );
+
+    if (fullAccessResult.Allowed) {
+      // full_access granted - skip specific scope check
+      return;
+    }
+
+    // Check specific scope
+    const result = await apiKeyEngine.Authorize(
+      userPayload.apiKeyHash,
+      'MJAPI',
+      scopePath,
+      resource,
+      systemUser,
+      {
+        endpoint: '/graphql',
+        method: 'POST'
+      }
+    );
+
+    if (!result.Allowed) {
+      // Provide specific, actionable error message
+      throw new AuthorizationError(
+        `Access denied. This API key requires the '${scopePath}' scope ` +
+        `for resource '${resource}' to perform this operation. ` +
+        `Please update the API key's scopes or use an API key with appropriate permissions. ` +
+        `Denial reason: ${result.Reason}`
+      );
+    }
+  }
+
   /**
    * Optimized RunViewGenericInternal implementation with:
    * - Field filtering at source (Fix #7)
@@ -524,11 +618,15 @@ export class ResolverBase {
     resultType: string | undefined,
     userPayload: UserPayload | null,
     maxRows: number | undefined,
-    startRow: number | undefined
+    startRow: number | undefined,
+    aggregates?: AggregateExpression[]
   ) {
     try {
       if (!viewInfo || !userPayload) return null;
 
+      // Check API key scope authorization for view operations
+      await this.CheckAPIKeyScopeAuthorization('view:run', viewInfo.Entity, userPayload);
+
       const md = provider
       const user = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
       if (!user) throw new Error(`User ${userPayload?.email} not found in metadata`);
@@ -559,6 +657,11 @@ export class ResolverBase {
         }
       }
 
+      // Log aggregate request for debugging
+      if (aggregates?.length) {
+        LogStatus(`[ResolverBase] RunViewGenericInternal with aggregates: entityName=${viewInfo.Entity}, viewName=${viewInfo.Name}, aggregateCount=${aggregates.length}, aggregates=${JSON.stringify(aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
+      }
+
       const result = await rv.RunView(
         {
           ViewID: viewInfo.ID,
@@ -578,10 +681,16 @@ export class ResolverBase {
           ForceAuditLog: forceAuditLog,
           AuditLogDescription: auditLogDescription,
           ResultType: rt,
+          Aggregates: aggregates,
         },
         user
       );
 
+      // Log aggregate results for debugging
+      if (aggregates?.length) {
+        LogStatus(`[ResolverBase] RunView result aggregate info: entityName=${viewInfo.Entity}, hasAggregateResults=${!!result?.AggregateResults}, aggregateResultCount=${result?.AggregateResults?.length || 0}, aggregateExecutionTime=${result?.AggregateExecutionTime}, aggregateResults=${JSON.stringify(result?.AggregateResults)}`);
+      }
+
       // Process results for GraphQL transport
       const mapper = new FieldMapper();
       if (result?.Success && result.Results?.length) {
@@ -682,6 +791,7 @@ export class ResolverBase {
           ForceAuditLog: param.forceAuditLog,
           AuditLogDescription: param.auditLogDescription,
           ResultType: rt,
+          Aggregates: param.aggregates,
         });
       }
 
@@ -875,6 +985,9 @@ export class ResolverBase {
   }
 
   protected async CreateRecord(entityName: string, input: any, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
+    // Check API key scope authorization for entity create operations
+    await this.CheckAPIKeyScopeAuthorization('entity:create', entityName, userPayload);
+
     if (await this.BeforeCreate(provider, input)) {
       // fire event and proceed if it wasn't cancelled
       const entityObject = await provider.GetEntityObject(entityName, this.GetUserFromPayload(userPayload));
@@ -907,6 +1020,9 @@ export class ResolverBase {
   protected async AfterCreate(provider: DatabaseProviderBase, input: any) {}
 
   protected async UpdateRecord(entityName: string, input: any, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
+    // Check API key scope authorization for entity update operations
+    await this.CheckAPIKeyScopeAuthorization('entity:update', entityName, userPayload);
+
     if (await this.BeforeUpdate(provider, input)) {
       // fire event and proceed if it wasn't cancelled
       const userInfo = this.GetUserFromPayload(userPayload);
@@ -1169,6 +1285,9 @@ export class ResolverBase {
     userPayload: UserPayload,
     pubSub: PubSubEngine
   ) {
+    // Check API key scope authorization for entity delete operations
+    await this.CheckAPIKeyScopeAuthorization('entity:delete', entityName, userPayload);
+
     if (await this.BeforeDelete(provider, key)) {
       // fire event and proceed if it wasn't cancelled
       const entityObject = await provider.GetEntityObject(entityName, this.GetUserFromPayload(userPayload));

package/src/generic/RunViewResolver.ts

@@ -1,7 +1,7 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, PubSubEngine, Query, Resolver } from 'type-graphql';
 import { AppContext } from '../types.js';
 import { ResolverBase } from './ResolverBase.js';
-import { LogError, LogStatus, EntityInfo, RunViewWithCacheCheckResult, RunViewsWithCacheCheckResponse, RunViewWithCacheCheckParams } from '@memberjunction/core';
+import { LogError, LogStatus, EntityInfo, RunViewWithCacheCheckResult, RunViewsWithCacheCheckResponse, RunViewWithCacheCheckParams, AggregateResult } from '@memberjunction/core';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadOnlyProvider } from '../util.js';
 import { UserViewEntityExtended } from '@memberjunction/core-entities';
@@ -15,6 +15,52 @@ import { SQLServerDataProvider } from '@memberjunction/sqlserver-dataprovider';
  * back the results, and have your own type checking in place, this resolver can be used.
  *
  */
+
+//****************************************************************************
+// INPUT/OUTPUT TYPE for Aggregates
+//****************************************************************************
+
+/**
+ * Input type for a single aggregate expression
+ */
+@InputType()
+export class AggregateExpressionInput {
+  @Field(() => String, {
+    description: 'SQL expression for the aggregate (e.g., "SUM(OrderTotal)", "COUNT(*)", "AVG(Price)")'
+  })
+  expression: string;
+
+  @Field(() => String, {
+    nullable: true,
+    description: 'Optional alias for the result (used in error messages and debugging)'
+  })
+  alias?: string;
+}
+
+/**
+ * Output type for a single aggregate result
+ */
+@ObjectType()
+export class AggregateResultOutput {
+  @Field(() => String, { description: 'The expression that was calculated' })
+  expression: string;
+
+  @Field(() => String, { description: 'The alias (or expression if no alias provided)' })
+  alias: string;
+
+  @Field(() => String, {
+    nullable: true,
+    description: 'The calculated value as a JSON string (preserves type information)'
+  })
+  value?: string;
+
+  @Field(() => String, {
+    nullable: true,
+    description: 'Error message if calculation failed'
+  })
+  error?: string;
+}
+
 //****************************************************************************
 // INPUT TYPE for Running Views
 //****************************************************************************
@@ -111,6 +157,12 @@ export class RunViewByIDInput {
     description: 'If a value > 0 is provided, this value will be used to offset the rows returned.',
   })
   StartRow?: number;
+
+  @Field(() => [AggregateExpressionInput], {
+    nullable: true,
+    description: 'Optional aggregate expressions to calculate on the full result set (e.g., SUM, COUNT, AVG). Results are returned in AggregateResults.',
+  })
+  Aggregates?: AggregateExpressionInput[];
 }
 
 @InputType()
@@ -206,6 +258,12 @@ export class RunViewByNameInput {
     description: 'If a value > 0 is provided, this value will be used to offset the rows returned.',
   })
   StartRow?: number;
+
+  @Field(() => [AggregateExpressionInput], {
+    nullable: true,
+    description: 'Optional aggregate expressions to calculate on the full result set (e.g., SUM, COUNT, AVG). Results are returned in AggregateResults.',
+  })
+  Aggregates?: AggregateExpressionInput[];
 }
 
 @InputType()
@@ -287,6 +345,12 @@ export class RunDynamicViewInput {
     description: 'If a value > 0 is provided, this value will be used to offset the rows returned.',
   })
   StartRow?: number;
+
+  @Field(() => [AggregateExpressionInput], {
+    nullable: true,
+    description: 'Optional aggregate expressions to calculate on the full result set (e.g., SUM, COUNT, AVG). Results are returned in AggregateResults.',
+  })
+  Aggregates?: AggregateExpressionInput[];
 }
 
 @InputType()
@@ -382,6 +446,12 @@ export class RunViewGenericInput {
     description: 'If a value > 0 is provided, this value will be used to offset the rows returned.',
   })
   StartRow?: number;
+
+  @Field(() => [AggregateExpressionInput], {
+    nullable: true,
+    description: 'Optional aggregate expressions to calculate on the full result set (e.g., SUM, COUNT, AVG). Results are returned in AggregateResults.',
+  })
+  Aggregates?: AggregateExpressionInput[];
 }
 
 //****************************************************************************
@@ -518,6 +588,18 @@ export class RunViewResult {
 
   @Field(() => Boolean, { nullable: false })
   Success: boolean;
+
+  @Field(() => [AggregateResultOutput], {
+    nullable: true,
+    description: 'Results of aggregate calculations, in same order as input Aggregates array. Only present if Aggregates were requested.'
+  })
+  AggregateResults?: AggregateResultOutput[];
+
+  @Field(() => Int, {
+    nullable: true,
+    description: 'Execution time for aggregate query specifically (in milliseconds). Only present if Aggregates were requested.'
+  })
+  AggregateExecutionTime?: number;
 }
 
 @ObjectType()
@@ -542,6 +624,18 @@ export class RunViewGenericResult {
 
   @Field(() => Boolean, { nullable: false })
   Success: boolean;
+
+  @Field(() => [AggregateResultOutput], {
+    nullable: true,
+    description: 'Results of aggregate calculations, in same order as input Aggregates array. Only present if Aggregates were requested.'
+  })
+  AggregateResults?: AggregateResultOutput[];
+
+  @Field(() => Int, {
+    nullable: true,
+    description: 'Execution time for aggregate query specifically (in milliseconds). Only present if Aggregates were requested.'
+  })
+  AggregateExecutionTime?: number;
 }
 
 @Resolver(RunViewResultRow)
@@ -567,6 +661,9 @@ export class RunViewResolver extends ResolverBase {
         RowCount: rawData?.RowCount,
         TotalRowCount: rawData?.TotalRowCount,
         ExecutionTime: rawData?.ExecutionTime,
+        Success: rawData?.Success,
+        AggregateResults: this.processAggregateResults(rawData?.AggregateResults),
+        AggregateExecutionTime: rawData?.AggregateExecutionTime,
       };
     } catch (err) {
       console.log(err);
@@ -595,6 +692,9 @@ export class RunViewResolver extends ResolverBase {
         RowCount: rawData?.RowCount,
         TotalRowCount: rawData?.TotalRowCount,
         ExecutionTime: rawData?.ExecutionTime,
+        Success: rawData?.Success,
+        AggregateResults: this.processAggregateResults(rawData?.AggregateResults),
+        AggregateExecutionTime: rawData?.AggregateExecutionTime,
       };
     } catch (err) {
       console.log(err);
@@ -621,6 +721,9 @@ export class RunViewResolver extends ResolverBase {
         RowCount: rawData?.RowCount,
         TotalRowCount: rawData?.TotalRowCount,
         ExecutionTime: rawData?.ExecutionTime,
+        Success: rawData?.Success,
+        AggregateResults: this.processAggregateResults(rawData?.AggregateResults),
+        AggregateExecutionTime: rawData?.AggregateExecutionTime,
       };
     } catch (err) {
       console.log(err);
@@ -636,7 +739,8 @@ export class RunViewResolver extends ResolverBase {
   ) {
     try {
       const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
-      const rawData: RunViewGenericResult[] = await super.RunViewsGeneric(input, provider, userPayload);
+      // Note: RunViewsGeneric returns the core RunViewResult type, not the GraphQL type
+      const rawData = await super.RunViewsGeneric(input, provider, userPayload);
       if (!rawData) {
         return null;
       }
@@ -653,6 +757,8 @@ export class RunViewResolver extends ResolverBase {
           TotalRowCount: data?.TotalRowCount,
           ExecutionTime: data?.ExecutionTime,
           Success: data?.Success,
+          AggregateResults: this.processAggregateResults(data?.AggregateResults),
+          AggregateExecutionTime: data?.AggregateExecutionTime,
         });
       }
 
@@ -824,7 +930,7 @@ export class RunViewResolver extends ResolverBase {
   ) {
     try {
       const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
-      const rawData: RunViewGenericResult[] = await super.RunViewsGeneric(input, provider, userPayload);
+      const rawData = await super.RunViewsGeneric(input, provider, userPayload);
       if (!rawData) {
         return null;
       }
@@ -846,6 +952,8 @@ export class RunViewResolver extends ResolverBase {
           ExecutionTime: data?.ExecutionTime,
           Success: data?.Success,
           ErrorMessage: data?.ErrorMessage,
+          AggregateResults: this.processAggregateResults(data?.AggregateResults),
+          AggregateExecutionTime: data?.AggregateExecutionTime,
         });
       }
 
@@ -979,13 +1087,13 @@ export class RunViewResolver extends ResolverBase {
     const returnResult = [];
     for (let i = 0; i < rawData.length; i++) {
       const row = rawData[i];
-      
+
       // Build the primary key array from the entity's primary key fields
       const primaryKey: KeyValuePairOutputType[] = entityInfo.PrimaryKeys.map(pk => ({
         FieldName: pk.Name,
         Value: row[pk.Name]?.toString() || ''
       }));
-      
+
       returnResult.push({
         PrimaryKey: primaryKey,
         EntityID: entityId,
@@ -994,4 +1102,23 @@ export class RunViewResolver extends ResolverBase {
     }
     return returnResult;
   }
+
+  /**
+   * Transform core AggregateResult[] to GraphQL AggregateResultOutput[].
+   * Converts the value to a JSON string to preserve type information across GraphQL.
+   */
+  protected processAggregateResults(aggregateResults: AggregateResult[] | undefined): AggregateResultOutput[] | undefined {
+    if (!aggregateResults || aggregateResults.length === 0) {
+      return undefined;
+    }
+
+    return aggregateResults.map(result => ({
+      expression: result.expression,
+      alias: result.alias,
+      value: result.value !== null && result.value !== undefined
+        ? JSON.stringify(result.value)
+        : undefined,
+      error: result.error
+    }));
+  }
 }

package/src/index.ts

@@ -81,7 +81,16 @@ export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
 export * from './directives/index.js';
 export * from './entitySubclasses/entityPermissions.server.js';
 export * from './types.js';
-export { TokenExpiredError, getSystemUser } from './auth/index.js';
+export {
+    TokenExpiredError,
+    getSystemUser,
+    getSigningKeys,
+    extractUserInfoFromPayload,
+    verifyUserRecord,
+    AuthProviderFactory,
+    IAuthProvider,
+} from './auth/index.js';
+export * from './auth/APIKeyScopeAuth.js';
 
 export * from './generic/PushStatusResolver.js';
 export * from './generic/ResolverBase.js';
@@ -97,7 +106,6 @@ export * from './generic/DeleteOptionsInput.js';
 export * from './agents/skip-agent.js';
 export * from './agents/skip-sdk.js';
 
-export * from './resolvers/AskSkipResolver.js';
 export * from './resolvers/ColorResolver.js';
 export * from './resolvers/ComponentRegistryResolver.js';
 export * from './resolvers/DatasetResolver.js';
@@ -113,6 +121,8 @@ export * from './resolvers/GetDataContextDataResolver.js';
 export * from './resolvers/TransactionGroupResolver.js';
 export * from './resolvers/CreateQueryResolver.js';
 export * from './resolvers/TelemetryResolver.js';
+export * from './resolvers/APIKeyResolver.js';
+export * from './resolvers/MCPResolver.js';
 export { GetReadOnlyDataSource, GetReadWriteDataSource, GetReadWriteProvider, GetReadOnlyProvider } from './util.js';
 
 export * from './generated/generated.js';