@memberjunction/server 5.38.0 → 5.40.0

package/dist/logging/bootAudit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Structural shape of an `@Arg` parameter as seen from outside type-graphql's internals.
+ * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
+ */
+export type AuditArgParam = {
+    kind: 'arg';
+    index: number;
+    name: string;
+    target: Function;
+    methodName: string;
+    getType: () => unknown;
+};
+/**
+ * Structural shape of a resolver metadata entry from outside type-graphql's internals.
+ * Includes `@Query`, `@Mutation`, `@Subscription` entries.
+ */
+export type AuditResolver = {
+    target: Function;
+    methodName: string;
+    params?: ReadonlyArray<{
+        kind: string;
+        index: number;
+    } & Partial<AuditArgParam>>;
+};
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export declare function auditResolversForUndecoratedArgs(): void;
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export declare function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void;
+//# sourceMappingURL=bootAudit.d.ts.map

package/dist/logging/bootAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootAudit.d.ts","sourceRoot":"","sources":["../../src/logging/bootAudit.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;CAClF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAevD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,IAAI,CAI/E"}

package/dist/logging/bootAudit.js

@@ -0,0 +1,83 @@
+import { getMetadataStorage } from 'type-graphql';
+import { configInfo } from '../config.js';
+import { hasNoLogParameter } from './NoLog.js';
+// Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
+// metadata-bound and don't flood the audit with false positives (their args are PK + Options
+// only — no encrypted values by construction). Must stay in sync with the redactor's
+// INPUT_TYPE_REGEX in secretRedactor.ts. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export function auditResolversForUndecoratedArgs() {
+    if (!configInfo.loggingSettings.graphql.logVariables) {
+        return;
+    }
+    const storage = getMetadataStorage();
+    auditResolverList([
+        ...storage.queries,
+        ...storage.mutations,
+        ...storage.subscriptions,
+    ]);
+}
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export function auditResolverList(resolvers) {
+    for (const resolver of resolvers) {
+        auditResolver(resolver);
+    }
+}
+function auditResolver(resolver) {
+    for (const param of resolver.params ?? []) {
+        if (param.kind !== 'arg') {
+            continue;
+        }
+        auditArg(resolver, param);
+    }
+}
+function auditArg(resolver, argParam) {
+    const typeName = readArgTypeName(argParam);
+    if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
+        return;
+    }
+    if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+        return;
+    }
+    const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+    console.warn(`[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
+        `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
+        `not carry sensitive material; if it does, apply @NoLog. Variables for this resolver will ` +
+        `be logged in plaintext while logVariables=true is active.`);
+}
+/**
+ * Reads the declared input type name from an `@Arg` parameter's `getType()` thunk.
+ * Returns the class/scalar name when the thunk resolves to a class or named scalar; otherwise
+ * returns `undefined` (e.g. for array literals or complex generics we don't unwrap).
+ */
+function readArgTypeName(argParam) {
+    try {
+        const type = argParam.getType();
+        if (typeof type === 'function') {
+            return type.name;
+        }
+        if (type && typeof type === 'object' && 'name' in type && typeof type.name === 'string') {
+            return type.name;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=bootAudit.js.map

package/dist/logging/bootAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootAudit.js","sourceRoot":"","sources":["../../src/logging/bootAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,0FAA0F;AAC1F,6FAA6F;AAC7F,qFAAqF;AACrF,2GAA2G;AAC3G,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAyB3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC;IAC9C,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,EAIjC,CAAC;IACF,iBAAiB,CAAC;QAChB,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,OAAO,CAAC,SAAS;QACpB,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAuC;IACvE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAuB;IAC5C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,QAAQ,EAAE,KAAsB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAuB,EAAE,QAAuB;IAChE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;IACtE,OAAO,CAAC,IAAI,CACV,oCAAoC,YAAY,oBAAoB,QAAQ,CAAC,IAAI,IAAI;QACrF,SAAS,QAAQ,IAAI,SAAS,0DAA0D;QACxF,2FAA2F;QAC3F,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAQ,IAA0B,CAAC,IAAI,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,OAAQ,IAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/G,OAAQ,IAAyB,CAAC,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/logging/boundaryLogPayload.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export declare function buildBoundaryLogPayload(operationName: string | undefined): {
+    operationName: string | undefined;
+};
+//# sourceMappingURL=boundaryLogPayload.d.ts.map

package/dist/logging/boundaryLogPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaryLogPayload.d.ts","sourceRoot":"","sources":["../../src/logging/boundaryLogPayload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC;IAAE,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAEvC"}

package/dist/logging/boundaryLogPayload.js

@@ -0,0 +1,18 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export function buildBoundaryLogPayload(operationName) {
+    return { operationName };
+}
+//# sourceMappingURL=boundaryLogPayload.js.map

package/dist/logging/boundaryLogPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaryLogPayload.js","sourceRoot":"","sources":["../../src/logging/boundaryLogPayload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAiC;IAEjC,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC"}

package/dist/logging/secretRedactor.d.ts

@@ -0,0 +1,23 @@
+import type { IMetadataProvider } from '@memberjunction/core';
+/**
+ * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
+ *
+ * - `inputTypeName` is the GraphQL input type name from the schema (e.g. `"CreateMJCredentialInput"`),
+ *   derived from `info.parentType.getFields()[info.fieldName].args[i].type` — NOT from any
+ *   `args[i].constructor.name`, because type-graphql v2.0.0-beta.3 passes raw plain-object args
+ *   to middleware (conversion to typed instances happens after the middleware chain unwinds).
+ * - `provider` is the per-request metadata provider (`context.providers[0].provider`).
+ * - `noLogParameter` indicates the `@Arg` itself was decorated `@NoLog` at the parameter level.
+ * - `noLogFields` lists field names that were decorated `@NoLog` at the `@Field()` level on the
+ *   input class. The redactor honors both `EntityFieldInfo.Encrypt=true` (metadata-driven) and
+ *   this set (decorator-driven) when walking top-level keys.
+ */
+export type RedactionContext = {
+    inputTypeName: string;
+    rawValue: unknown;
+    provider: IMetadataProvider;
+    noLogParameter: boolean;
+    noLogFields: ReadonlySet<string>;
+};
+export declare function redactArg(ctx: RedactionContext): unknown;
+//# sourceMappingURL=secretRedactor.d.ts.map

package/dist/logging/secretRedactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedactor.d.ts","sourceRoot":"","sources":["../../src/logging/secretRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAaF,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CA4CxD"}

package/dist/logging/secretRedactor.js

@@ -0,0 +1,53 @@
+import { shortenForLog } from './shortenForLog.js';
+// Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
+// or value-free encrypted-field walk) instead of falling to the fail-open shortenForLog path —
+// keeps the boot audit quiet on them. Security is identical either way: Delete inputs carry
+// PK + Options only, no encrypted values. Must stay in sync with bootAudit.ts's INPUT_TYPE_REGEX.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
+// Assumes EntityFieldInfo.Name === GraphQLFieldName for input-type fields.
+// True today for all codegen output (323 Create*Input + 323 Update*Input).
+// type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
+// GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
+// encrypted field at the GraphQL layer would silently miss redaction.
+export function redactArg(ctx) {
+    if (ctx.noLogParameter) {
+        return '<redacted>';
+    }
+    if (ctx.provider.Entities.length === 0) {
+        return '<metadata-not-ready>';
+    }
+    // Determine the encrypted-field set from entity metadata IF this input maps to a known entity.
+    // Custom / non-CRUD inputs (e.g. GetDataInput) have no entity binding — that's fine; field-level
+    // @NoLog still applies below. The entity path only adds metadata-driven encrypted-field names.
+    let encryptedFieldNames = EMPTY_SET;
+    const match = INPUT_TYPE_REGEX.exec(ctx.inputTypeName);
+    if (match?.groups?.name) {
+        const entity = ctx.provider.Entities.find((e) => e.ClassName === match.groups.name);
+        if (entity) {
+            encryptedFieldNames = new Set(entity.EncryptedFields.map((f) => f.Name));
+        }
+    }
+    // Walk top-level keys whenever we have BOTH a redaction source (encrypted fields or @NoLog fields)
+    // AND a plain-object value. This honors field-level @NoLog even on non-entity-bound inputs — the
+    // exact case @NoLog exists for (custom resolvers, e.g. GetDataInputType.Token). Without a redaction
+    // source, or for non-object values, fall through to shortenForLog as before.
+    const canWalk = (encryptedFieldNames.size > 0 || ctx.noLogFields.size > 0) &&
+        ctx.rawValue !== null &&
+        typeof ctx.rawValue === 'object' &&
+        !Array.isArray(ctx.rawValue);
+    if (!canWalk) {
+        return shortenForLog(ctx.rawValue);
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(ctx.rawValue)) {
+        if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
+            result[key] = '<redacted>';
+        }
+        else {
+            result[key] = shortenForLog(value);
+        }
+    }
+    return result;
+}
+const EMPTY_SET = new Set();
+//# sourceMappingURL=secretRedactor.js.map

package/dist/logging/secretRedactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedactor.js","sourceRoot":"","sources":["../../src/logging/secretRedactor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAuBnD,4FAA4F;AAC5F,+FAA+F;AAC/F,4FAA4F;AAC5F,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAEpE,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,GAAqB;IAC7C,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,IAAI,mBAAmB,GAAwB,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,CAAC;YACX,mBAAmB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,oGAAoG;IACpG,6EAA6E;IAC7E,MAAM,OAAO,GACX,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1D,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAmC,CAAC,EAAE,CAAC;QACnF,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,GAAwB,IAAI,GAAG,EAAU,CAAC"}

package/dist/logging/shortenForLog.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export declare function shortenForLog(value: unknown, maxLen?: number): unknown;
+//# sourceMappingURL=shortenForLog.d.ts.map

package/dist/logging/shortenForLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortenForLog.d.ts","sourceRoot":"","sources":["../../src/logging/shortenForLog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,OAAO,CAUnE"}

package/dist/logging/shortenForLog.js

@@ -0,0 +1,21 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export function shortenForLog(value, maxLen = 300) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => shortenForLog(v, maxLen));
+    const json = JSON.stringify(value);
+    if (json.length <= maxLen)
+        return json;
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+        result[k] = shortenForLog(v, maxLen);
+    }
+    return result;
+}
+//# sourceMappingURL=shortenForLog.js.map

package/dist/logging/shortenForLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortenForLog.js","sourceRoot":"","sources":["../../src/logging/shortenForLog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/logging/variablesLoggingMiddleware.d.ts

@@ -0,0 +1,22 @@
+import type { MiddlewareFn } from 'type-graphql';
+import type { AppContext } from '../types.js';
+/**
+ * Variables-logging middleware. Default-off; gated on `loggingSettings.graphql.logVariables`.
+ *
+ * NOTE: this middleware is NOT the primary leak defense. The primary defense is the removal
+ * of the `variables` field from the always-on log line in `context.ts`. This middleware
+ * provides an opt-in, redacted verbose-echo path for developers debugging locally.
+ *
+ * When enabled, fires once per root resolver call (skips field resolvers via
+ * `info.path.prev === undefined`). For each `@Arg`:
+ *   - Derives the GraphQL input type name from the schema (NOT from `args[i].constructor.name`,
+ *     because type-graphql v2.0.0-beta.3 passes raw plain-object args to middleware).
+ *   - Looks up `@NoLog` marks (parameter-level on the resolver, field-level on the input class).
+ *   - Delegates redaction to `redactArg`.
+ *
+ * Emits a single `console.dir` line with shape `{ operation, args }`. Note: the key names
+ * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
+ * — operators with log-grep automation should update their patterns.
+ */
+export declare const variablesLoggingMiddleware: MiddlewareFn<AppContext>;
+//# sourceMappingURL=variablesLoggingMiddleware.d.ts.map

package/dist/logging/variablesLoggingMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variablesLoggingMiddleware.d.ts","sourceRoot":"","sources":["../../src/logging/variablesLoggingMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAKjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2E9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,EAAE,YAAY,CAAC,UAAU,CAsE/D,CAAC"}

package/dist/logging/variablesLoggingMiddleware.js

@@ -0,0 +1,127 @@
+import { getMetadataStorage } from 'type-graphql';
+import { getNamedType } from 'graphql';
+import { configInfo } from '../config.js';
+import { redactArg } from './secretRedactor.js';
+import { hasNoLogParameter, getNoLogFields } from './NoLog.js';
+let resolverLookup;
+function getResolverLookup() {
+    if (resolverLookup !== undefined) {
+        return resolverLookup;
+    }
+    const storage = getMetadataStorage();
+    const lookup = new Map();
+    const collect = (entries) => {
+        for (const entry of entries) {
+            lookup.set(entry.schemaName, {
+                target: entry.target,
+                methodName: entry.methodName,
+                params: entry.params ?? [],
+            });
+        }
+    };
+    collect(storage.queries);
+    collect(storage.mutations);
+    collect(storage.subscriptions);
+    resolverLookup = lookup;
+    return lookup;
+}
+function findInputClass(typeName) {
+    const storage = getMetadataStorage();
+    const found = storage.inputTypes.find((t) => t.name === typeName);
+    return found?.target;
+}
+/** Type guard for `MinimalArgParamMeta`. */
+function isArgParam(p) {
+    return p.kind === 'arg';
+}
+const warnedResolverSignatures = new Set();
+/**
+ * Variables-logging middleware. Default-off; gated on `loggingSettings.graphql.logVariables`.
+ *
+ * NOTE: this middleware is NOT the primary leak defense. The primary defense is the removal
+ * of the `variables` field from the always-on log line in `context.ts`. This middleware
+ * provides an opt-in, redacted verbose-echo path for developers debugging locally.
+ *
+ * When enabled, fires once per root resolver call (skips field resolvers via
+ * `info.path.prev === undefined`). For each `@Arg`:
+ *   - Derives the GraphQL input type name from the schema (NOT from `args[i].constructor.name`,
+ *     because type-graphql v2.0.0-beta.3 passes raw plain-object args to middleware).
+ *   - Looks up `@NoLog` marks (parameter-level on the resolver, field-level on the input class).
+ *   - Delegates redaction to `redactArg`.
+ *
+ * Emits a single `console.dir` line with shape `{ operation, args }`. Note: the key names
+ * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
+ * — operators with log-grep automation should update their patterns.
+ */
+export const variablesLoggingMiddleware = async (action, next) => {
+    // Field resolvers (info.path.prev !== undefined) are skipped — only root @Query/@Mutation/@Subscription.
+    if (action.info.path.prev !== undefined) {
+        return next();
+    }
+    // Hot-path zero-cost short-circuit when the flag is off.
+    if (!configInfo.loggingSettings.graphql.logVariables) {
+        return next();
+    }
+    const provider = action.context.providers?.[0]?.provider;
+    if (!provider) {
+        return next();
+    }
+    const fieldDef = action.info.parentType.getFields()[action.info.fieldName];
+    if (!fieldDef) {
+        return next();
+    }
+    const resolverEntry = getResolverLookup().get(action.info.fieldName);
+    const argParams = (resolverEntry?.params ?? []).filter(isArgParam);
+    const redactedArgs = {};
+    let hasUndecoratedCustomArg = false;
+    for (const argDef of fieldDef.args) {
+        const inputTypeName = getNamedType(argDef.type).name;
+        const rawValue = action.args[argDef.name];
+        const paramMeta = argParams.find((p) => p.name === argDef.name);
+        const noLogParameter = paramMeta && resolverEntry
+            ? hasNoLogParameter(resolverEntry.target, resolverEntry.methodName, paramMeta.index)
+            : false;
+        const inputClass = findInputClass(inputTypeName);
+        const noLogFields = inputClass ? getNoLogFields(inputClass) : new Set();
+        redactedArgs[argDef.name] = redactArg({
+            inputTypeName,
+            rawValue,
+            provider,
+            noLogParameter,
+            noLogFields,
+        });
+        if (!noLogParameter && isCustomArg(inputTypeName, noLogFields, provider)) {
+            hasUndecoratedCustomArg = true;
+        }
+    }
+    // eslint-disable-next-line no-console
+    console.dir({ operation: action.info.fieldName, args: redactedArgs }, { depth: null, breakLength: 200 });
+    if (hasUndecoratedCustomArg && resolverEntry) {
+        const signature = `${resolverEntry.target.name}.${resolverEntry.methodName}`;
+        if (!warnedResolverSignatures.has(signature)) {
+            warnedResolverSignatures.add(signature);
+            console.warn(`[mj:NoLog] Resolver ${signature} has un-decorated, non-metadata-bound argument(s). ` +
+                `Variables for this resolver were logged in plaintext while logVariables=true is active. ` +
+                `Apply @NoLog to sensitive arguments to suppress this.`);
+        }
+    }
+    return next();
+};
+/**
+ * Heuristic: an arg is "custom" (i.e. needs `@NoLog` discipline because metadata can't redact it)
+ * when its GraphQL input type is not a known `Create<X>Input` / `Update<X>Input` for an entity
+ * in the provider, AND no field-level `@NoLog` marks are present on the input class.
+ */
+function isCustomArg(inputTypeName, noLogFields, provider) {
+    if (noLogFields.size > 0) {
+        return false;
+    }
+    const match = /^(Create|Update)(?<name>.+)Input$/.exec(inputTypeName);
+    if (!match || !match.groups?.name) {
+        return true;
+    }
+    const className = match.groups.name;
+    const found = provider.Entities.find((e) => e.ClassName === className);
+    return !found;
+}
+//# sourceMappingURL=variablesLoggingMiddleware.js.map

package/dist/logging/variablesLoggingMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variablesLoggingMiddleware.js","sourceRoot":"","sources":["../../src/logging/variablesLoggingMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA+B/D,IAAI,cAAsD,CAAC;AAE3D,SAAS,iBAAiB;IACxB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,EAKjC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,OAA2C,EAAQ,EAAE;QACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,cAAc,GAAG,MAAM,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,OAAO,GAAG,kBAAkB,EAA0E,CAAC;IAC7G,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClE,OAAO,KAAK,EAAE,MAAM,CAAC;AACvB,CAAC;AAED,4CAA4C;AAC5C,SAAS,UAAU,CAAC,CAAmB;IACrC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AAC1B,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA6B,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACzF,yGAAyG;IACzG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,SAAS,GAAuC,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvG,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,IAAsC,EAAE,CAAC;QACrE,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,SAAS,IAAI,aAAa;YAC/C,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QAEhF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACpC,aAAa;YACb,QAAQ;YACR,QAAQ;YACR,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,uBAAuB,GAAG,IAAI,CAAC;QACjC,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EACxD,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAClC,CAAC;IAEF,IAAI,uBAAuB,IAAI,aAAa,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QAC7E,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CACV,uBAAuB,SAAS,qDAAqD;gBACrF,0FAA0F;gBAC1F,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,WAAW,CAClB,aAAqB,EACrB,WAAgC,EAChC,QAA4D;IAE5D,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC;AAChB,CAAC"}

package/dist/resolvers/CurrentUserContextResolver.d.ts

@@ -1,9 +1,15 @@
 /**
  * Resolver for the `CurrentUserTenantContext` GraphQL query.
  *
- * Returns the server-set `TenantContext` from the authenticated user's `UserInfo`.
- * This is populated by post-auth middleware (e.g., BCSaaS's `bcTenantContextMiddleware`)
- * and serialized as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ * Returns the server-set `TenantContext` for the authenticated user, serialized
+ * as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ *
+ * **Resolution order:**
+ * 1. Request-scoped context (`userPayload.__bcResolvedTenantContext`) — set by
+ *    post-auth middleware on the per-request UserPayload. Immune to race conditions
+ *    when concurrent requests share the same cached UserInfo object.
+ * 2. Fallback to `userRecord.TenantContext` — for middleware that stamps UserInfo
+ *    directly (vanilla MJ deployments or non-BCSaaS middleware).
  *
  * On the client, `GraphQLDataProvider.GetCurrentUser()` batches this query alongside
  * `CurrentUser` — making plugins stack-layer agnostic without any client-side code.

package/dist/resolvers/CurrentUserContextResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CurrentUserContextResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/CurrentUserContextResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,qBACa,0BAA2B,SAAQ,YAAY;IAKpD,wBAAwB,CACrB,OAAO,EAAE,UAAU,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAY3C"}
+{"version":3,"file":"CurrentUserContextResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/CurrentUserContextResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAK1D,qBACa,0BAA2B,SAAQ,YAAY;IAKpD,wBAAwB,CACrB,OAAO,EAAE,UAAU,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAmB3C"}

package/dist/resolvers/CurrentUserContextResolver.js

@@ -1,9 +1,15 @@
 /**
  * Resolver for the `CurrentUserTenantContext` GraphQL query.
  *
- * Returns the server-set `TenantContext` from the authenticated user's `UserInfo`.
- * This is populated by post-auth middleware (e.g., BCSaaS's `bcTenantContextMiddleware`)
- * and serialized as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ * Returns the server-set `TenantContext` for the authenticated user, serialized
+ * as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ *
+ * **Resolution order:**
+ * 1. Request-scoped context (`userPayload.__bcResolvedTenantContext`) — set by
+ *    post-auth middleware on the per-request UserPayload. Immune to race conditions
+ *    when concurrent requests share the same cached UserInfo object.
+ * 2. Fallback to `userRecord.TenantContext` — for middleware that stamps UserInfo
+ *    directly (vanilla MJ deployments or non-BCSaaS middleware).
  *
  * On the client, `GraphQLDataProvider.GetCurrentUser()` batches this query alongside
  * `CurrentUser` — making plugins stack-layer agnostic without any client-side code.
@@ -25,15 +31,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Query, Resolver, Ctx } from 'type-graphql';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { ResolverBase } from '../generic/ResolverBase.js';
+/** Well-known key for request-scoped TenantContext on UserPayload */
+const RESOLVED_TENANT_CONTEXT_KEY = '__bcResolvedTenantContext';
 let CurrentUserContextResolver = class CurrentUserContextResolver extends ResolverBase {
     async CurrentUserTenantContext(context) {
         await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
+        // Prefer request-scoped context (set by BCSaaS middleware on userPayload).
+        // This avoids race conditions with concurrent requests mutating the shared
+        // UserInfo.TenantContext on the same cached UserInfo object from UserCache.
+        const requestScoped = context.userPayload[RESOLVED_TENANT_CONTEXT_KEY];
+        if (requestScoped && typeof requestScoped === 'object') {
+            return { ...requestScoped };
+        }
+        // Fallback: read from the shared UserInfo (vanilla MJ / non-BCSaaS middleware)
         const userRecord = context.userPayload.userRecord;
         if (!userRecord?.TenantContext) {
             return null;
         }
-        // Serialize the full TenantContext (which may be an extended type like BCTenantContext).
-        // JSON serialization captures all enumerable properties including those from subtypes.
         return { ...userRecord.TenantContext };
     }
 };

package/dist/resolvers/CurrentUserContextResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CurrentUserContextResolver.js","sourceRoot":"","sources":["../../src/resolvers/CurrentUserContextResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGnD,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,YAAY;IAKpD,AAAN,KAAK,CAAC,wBAAwB,CACrB,OAAmB;QAE1B,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,OAAO,EAAE,GAAG,UAAU,CAAC,aAAa,EAA6B,CAAC;IACpE,CAAC;CACF,CAAA;AAdO;IAJL,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE;QAC9B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,4GAA4G;KAC1H,CAAC;IAEC,WAAA,GAAG,EAAE,CAAA;;;;0EAYP;AAlBU,0BAA0B;IADtC,QAAQ,EAAE;GACE,0BAA0B,CAmBtC"}
+{"version":3,"file":"CurrentUserContextResolver.js","sourceRoot":"","sources":["../../src/resolvers/CurrentUserContextResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,qEAAqE;AACrE,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAGzD,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,YAAY;IAKpD,AAAN,KAAK,CAAC,wBAAwB,CACrB,OAAmB;QAE1B,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,aAAa,GAAI,OAAO,CAAC,WAAuC,CAAC,2BAA2B,CAAC,CAAC;QACpG,IAAI,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,GAAI,aAAyC,EAAE,CAAC;QAC3D,CAAC;QAED,+EAA+E;QAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,GAAG,UAAU,CAAC,aAAa,EAA6B,CAAC;IACpE,CAAC;CACF,CAAA;AArBO;IAJL,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE;QAC9B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,4GAA4G;KAC1H,CAAC;IAEC,WAAA,GAAG,EAAE,CAAA;;;;0EAmBP;AAzBU,0BAA0B;IADtC,QAAQ,EAAE;GACE,0BAA0B,CA0BtC"}

package/dist/resolvers/EntityResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EntityResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/EntityResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAa,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAI5E,qBACa,cAAe,SAAQ,oBAAoB;IAEhD,iBAAiB,CACd,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACc,cAAc,CAAC,EAAE,MAAM,EAAE,EACzB,cAAc,CAAC,EAAE,MAAM,EAAE;CAiCvF"}
+{"version":3,"file":"EntityResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/EntityResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAa,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAgB5E,qBACa,cAAe,SAAQ,oBAAoB;IAEhD,iBAAiB,CACd,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACc,cAAc,CAAC,EAAE,MAAM,EAAE,EACzB,cAAc,CAAC,EAAE,MAAM,EAAE;CAiCvF"}

package/dist/resolvers/EntityResolver.js

@@ -14,13 +14,24 @@ import { EntityPermissionType } from '@memberjunction/core';
 import { Arg, Ctx, Query, Resolver } from 'type-graphql';
 import { MJEntity_, MJEntityResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';
+const VALID_SCHEMA_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function sanitizeSchemaNames(names) {
+    return names.filter((s) => VALID_SCHEMA_NAME.test(s));
+}
+function buildSchemaInClause(columnName, schemas, negate) {
+    const sanitized = sanitizeSchemaNames(schemas);
+    if (sanitized.length === 0)
+        return '';
+    const operator = negate ? 'NOT IN' : 'IN';
+    return `${columnName} ${operator} (${sanitized.map((s) => `'${s}'`).join(',')})`;
+}
 let EntityResolver = class EntityResolver extends MJEntityResolverBase {
     async EntitiesBySchemas({ providers, userPayload }, IncludeSchemas, ExcludeSchemas) {
         this.CheckUserReadPermissions('Entities', userPayload);
         const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
         const rlsWhere = this.getRowLevelSecurityWhereClause(provider, 'Entities', userPayload, EntityPermissionType.Read, ' WHERE');
-        const includeSchemaSQL = IncludeSchemas && IncludeSchemas.length > 0 ? `SchemaName IN (${IncludeSchemas.map((s) => `'${s}'`).join(',')})` : '';
-        const excludeSchemaSQL = ExcludeSchemas && ExcludeSchemas.length > 0 ? `SchemaName NOT IN (${ExcludeSchemas.map((s) => `'${s}'`).join(',')})` : '';
+        const includeSchemaSQL = IncludeSchemas && IncludeSchemas.length > 0 ? buildSchemaInClause('SchemaName', IncludeSchemas, false) : '';
+        const excludeSchemaSQL = ExcludeSchemas && ExcludeSchemas.length > 0 ? buildSchemaInClause('SchemaName', ExcludeSchemas, true) : '';
         let schemaSQL = '';
         if (includeSchemaSQL)
             schemaSQL = includeSchemaSQL;

package/dist/resolvers/EntityResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"EntityResolver.js","sourceRoot":"","sources":["../../src/resolvers/EntityResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,oBAAoB,EAAoB,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAoB,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAG1C,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,oBAAoB;IAEhD,AAAN,KAAK,CAAC,iBAAiB,CACd,EAAE,SAAS,EAAE,WAAW,EAAc,EACc,cAAyB,EACzB,cAAyB;QAEpF,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GACpB,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,gBAAgB,GACpB,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5H,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,gBAAgB;YAAE,SAAS,GAAG,gBAAgB,CAAC;QACnD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,SAAS;gBAAE,SAAS,GAAG,GAAG,SAAS,QAAQ,gBAAgB,EAAE,CAAC;;gBAC7D,SAAS,GAAG,gBAAgB,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,SAAS;YAAE,UAAU,GAAG,GAAG,SAAS,EAAE,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,UAAU;gBAAE,UAAU,GAAG,GAAG,UAAU,QAAQ,QAAQ,EAAE,CAAC;;gBACxD,UAAU,GAAG,IAAI,QAAQ,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,QAAmC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC9B,UAAU,EAAE,cAAc;YAC1B,WAAW,EAAE,UAAU;SACxB,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;aACI,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;CACF,CAAA;AApCO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAEtB,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,WAAA,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;uDAgC3D;AArCU,cAAc;IAD1B,QAAQ,CAAC,SAAS,CAAC;GACP,cAAc,CAsC1B"}
+{"version":3,"file":"EntityResolver.js","sourceRoot":"","sources":["../../src/resolvers/EntityResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,oBAAoB,EAAoB,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,OAAiB,EAAE,MAAe;IACjF,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,OAAO,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACnF,CAAC;AAGM,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,oBAAoB;IAEhD,AAAN,KAAK,CAAC,iBAAiB,CACd,EAAE,SAAS,EAAE,WAAW,EAAc,EACc,cAAyB,EACzB,cAAyB;QAEpF,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GACpB,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,gBAAgB,GACpB,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,gBAAgB;YAAE,SAAS,GAAG,gBAAgB,CAAC;QACnD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,SAAS;gBAAE,SAAS,GAAG,GAAG,SAAS,QAAQ,gBAAgB,EAAE,CAAC;;gBAC7D,SAAS,GAAG,gBAAgB,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,SAAS;YAAE,UAAU,GAAG,GAAG,SAAS,EAAE,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,UAAU;gBAAE,UAAU,GAAG,GAAG,UAAU,QAAQ,QAAQ,EAAE,CAAC;;gBACxD,UAAU,GAAG,IAAI,QAAQ,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,QAA4B,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC9B,UAAU,EAAE,cAAc;YAC1B,WAAW,EAAE,UAAU;SACxB,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;aACI,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;CACF,CAAA;AApCO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAEtB,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,WAAA,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;uDAgC3D;AArCU,cAAc;IAD1B,QAAQ,CAAC,SAAS,CAAC;GACP,cAAc,CAsC1B"}