@memberjunction/server 5.38.0 → 5.40.0

package/src/logging/bootAudit.ts

@@ -0,0 +1,117 @@
+import { getMetadataStorage } from 'type-graphql';
+import { configInfo } from '../config.js';
+import { hasNoLogParameter } from './NoLog.js';
+
+// Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
+// metadata-bound and don't flood the audit with false positives (their args are PK + Options
+// only — no encrypted values by construction). Must stay in sync with the redactor's
+// INPUT_TYPE_REGEX in secretRedactor.ts. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
+
+/**
+ * Structural shape of an `@Arg` parameter as seen from outside type-graphql's internals.
+ * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
+ */
+export type AuditArgParam = {
+  kind: 'arg';
+  index: number;
+  name: string;
+  target: Function;
+  methodName: string;
+  getType: () => unknown;
+};
+
+/**
+ * Structural shape of a resolver metadata entry from outside type-graphql's internals.
+ * Includes `@Query`, `@Mutation`, `@Subscription` entries.
+ */
+export type AuditResolver = {
+  target: Function;
+  methodName: string;
+  params?: ReadonlyArray<{ kind: string; index: number } & Partial<AuditArgParam>>;
+};
+
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export function auditResolversForUndecoratedArgs(): void {
+  if (!configInfo.loggingSettings.graphql.logVariables) {
+    return;
+  }
+
+  const storage = getMetadataStorage() as unknown as {
+    queries: AuditResolver[];
+    mutations: AuditResolver[];
+    subscriptions: AuditResolver[];
+  };
+  auditResolverList([
+    ...storage.queries,
+    ...storage.mutations,
+    ...storage.subscriptions,
+  ]);
+}
+
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+  for (const resolver of resolvers) {
+    auditResolver(resolver);
+  }
+}
+
+function auditResolver(resolver: AuditResolver): void {
+  for (const param of resolver.params ?? []) {
+    if (param.kind !== 'arg') {
+      continue;
+    }
+    auditArg(resolver, param as AuditArgParam);
+  }
+}
+
+function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
+  const typeName = readArgTypeName(argParam);
+  if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
+    return;
+  }
+  if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+    return;
+  }
+  const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+  console.warn(
+    `[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
+    `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
+    `not carry sensitive material; if it does, apply @NoLog. Variables for this resolver will ` +
+    `be logged in plaintext while logVariables=true is active.`,
+  );
+}
+
+/**
+ * Reads the declared input type name from an `@Arg` parameter's `getType()` thunk.
+ * Returns the class/scalar name when the thunk resolves to a class or named scalar; otherwise
+ * returns `undefined` (e.g. for array literals or complex generics we don't unwrap).
+ */
+function readArgTypeName(argParam: AuditArgParam): string | undefined {
+  try {
+    const type = argParam.getType();
+    if (typeof type === 'function') {
+      return (type as { name?: string }).name;
+    }
+    if (type && typeof type === 'object' && 'name' in type && typeof (type as { name: unknown }).name === 'string') {
+      return (type as { name: string }).name;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}

package/src/logging/boundaryLogPayload.ts

@@ -0,0 +1,19 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export function buildBoundaryLogPayload(
+  operationName: string | undefined,
+): { operationName: string | undefined } {
+  return { operationName };
+}

package/src/logging/secretRedactor.ts

@@ -0,0 +1,82 @@
+import type { IMetadataProvider } from '@memberjunction/core';
+import { shortenForLog } from './shortenForLog.js';
+
+/**
+ * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
+ *
+ * - `inputTypeName` is the GraphQL input type name from the schema (e.g. `"CreateMJCredentialInput"`),
+ *   derived from `info.parentType.getFields()[info.fieldName].args[i].type` — NOT from any
+ *   `args[i].constructor.name`, because type-graphql v2.0.0-beta.3 passes raw plain-object args
+ *   to middleware (conversion to typed instances happens after the middleware chain unwinds).
+ * - `provider` is the per-request metadata provider (`context.providers[0].provider`).
+ * - `noLogParameter` indicates the `@Arg` itself was decorated `@NoLog` at the parameter level.
+ * - `noLogFields` lists field names that were decorated `@NoLog` at the `@Field()` level on the
+ *   input class. The redactor honors both `EntityFieldInfo.Encrypt=true` (metadata-driven) and
+ *   this set (decorator-driven) when walking top-level keys.
+ */
+export type RedactionContext = {
+  inputTypeName: string;
+  rawValue: unknown;
+  provider: IMetadataProvider;
+  noLogParameter: boolean;
+  noLogFields: ReadonlySet<string>;
+};
+
+// Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
+// or value-free encrypted-field walk) instead of falling to the fail-open shortenForLog path —
+// keeps the boot audit quiet on them. Security is identical either way: Delete inputs carry
+// PK + Options only, no encrypted values. Must stay in sync with bootAudit.ts's INPUT_TYPE_REGEX.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
+
+// Assumes EntityFieldInfo.Name === GraphQLFieldName for input-type fields.
+// True today for all codegen output (323 Create*Input + 323 Update*Input).
+// type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
+// GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
+// encrypted field at the GraphQL layer would silently miss redaction.
+export function redactArg(ctx: RedactionContext): unknown {
+  if (ctx.noLogParameter) {
+    return '<redacted>';
+  }
+
+  if (ctx.provider.Entities.length === 0) {
+    return '<metadata-not-ready>';
+  }
+
+  // Determine the encrypted-field set from entity metadata IF this input maps to a known entity.
+  // Custom / non-CRUD inputs (e.g. GetDataInput) have no entity binding — that's fine; field-level
+  // @NoLog still applies below. The entity path only adds metadata-driven encrypted-field names.
+  let encryptedFieldNames: ReadonlySet<string> = EMPTY_SET;
+  const match = INPUT_TYPE_REGEX.exec(ctx.inputTypeName);
+  if (match?.groups?.name) {
+    const entity = ctx.provider.Entities.find((e) => e.ClassName === match.groups!.name);
+    if (entity) {
+      encryptedFieldNames = new Set(entity.EncryptedFields.map((f) => f.Name));
+    }
+  }
+
+  // Walk top-level keys whenever we have BOTH a redaction source (encrypted fields or @NoLog fields)
+  // AND a plain-object value. This honors field-level @NoLog even on non-entity-bound inputs — the
+  // exact case @NoLog exists for (custom resolvers, e.g. GetDataInputType.Token). Without a redaction
+  // source, or for non-object values, fall through to shortenForLog as before.
+  const canWalk =
+    (encryptedFieldNames.size > 0 || ctx.noLogFields.size > 0) &&
+    ctx.rawValue !== null &&
+    typeof ctx.rawValue === 'object' &&
+    !Array.isArray(ctx.rawValue);
+
+  if (!canWalk) {
+    return shortenForLog(ctx.rawValue);
+  }
+
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(ctx.rawValue as Record<string, unknown>)) {
+    if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
+      result[key] = '<redacted>';
+    } else {
+      result[key] = shortenForLog(value);
+    }
+  }
+  return result;
+}
+
+const EMPTY_SET: ReadonlySet<string> = new Set<string>();

package/src/logging/shortenForLog.ts

@@ -0,0 +1,17 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export function shortenForLog(value: unknown, maxLen = 300): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  if (Array.isArray(value)) return value.map((v) => shortenForLog(v, maxLen));
+  const json = JSON.stringify(value);
+  if (json.length <= maxLen) return json;
+  const result: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    result[k] = shortenForLog(v, maxLen);
+  }
+  return result;
+}

package/src/logging/variablesLoggingMiddleware.ts

@@ -0,0 +1,191 @@
+import type { MiddlewareFn } from 'type-graphql';
+import { getMetadataStorage } from 'type-graphql';
+import { getNamedType } from 'graphql';
+import type { GraphQLArgument } from 'graphql';
+import { configInfo } from '../config.js';
+import type { AppContext } from '../types.js';
+import { redactArg } from './secretRedactor.js';
+import { hasNoLogParameter, getNoLogFields } from './NoLog.js';
+
+/**
+ * Structural shape of a type-graphql `@Arg` parameter metadata entry. Mirrors the
+ * subset of `ArgParamMetadata` we read (`kind`, `index`, `name`, `target`, `methodName`)
+ * without depending on type-graphql's internal type exports (which are not part of its
+ * public API).
+ */
+type MinimalArgParamMeta = {
+  kind: 'arg';
+  index: number;
+  name: string;
+  target: Function;
+  methodName: string;
+};
+
+type MinimalParamMeta = MinimalArgParamMeta | { kind: 'args' | 'context' | 'root' | 'info' | 'pubSub' | 'custom'; index: number };
+
+type MinimalResolverMeta = {
+  schemaName: string;
+  target: Function;
+  methodName: string;
+  params?: MinimalParamMeta[];
+};
+
+type ResolverEntry = {
+  target: Function;
+  methodName: string;
+  params: ReadonlyArray<MinimalParamMeta>;
+};
+
+let resolverLookup: Map<string, ResolverEntry> | undefined;
+
+function getResolverLookup(): Map<string, ResolverEntry> {
+  if (resolverLookup !== undefined) {
+    return resolverLookup;
+  }
+  const storage = getMetadataStorage() as unknown as {
+    queries: MinimalResolverMeta[];
+    mutations: MinimalResolverMeta[];
+    subscriptions: MinimalResolverMeta[];
+    inputTypes: Array<{ name: string; target: Function }>;
+  };
+  const lookup = new Map<string, ResolverEntry>();
+  const collect = (entries: ReadonlyArray<MinimalResolverMeta>): void => {
+    for (const entry of entries) {
+      lookup.set(entry.schemaName, {
+        target: entry.target,
+        methodName: entry.methodName,
+        params: entry.params ?? [],
+      });
+    }
+  };
+  collect(storage.queries);
+  collect(storage.mutations);
+  collect(storage.subscriptions);
+  resolverLookup = lookup;
+  return lookup;
+}
+
+function findInputClass(typeName: string): Function | undefined {
+  const storage = getMetadataStorage() as unknown as { inputTypes: Array<{ name: string; target: Function }> };
+  const found = storage.inputTypes.find((t) => t.name === typeName);
+  return found?.target;
+}
+
+/** Type guard for `MinimalArgParamMeta`. */
+function isArgParam(p: MinimalParamMeta): p is MinimalArgParamMeta {
+  return p.kind === 'arg';
+}
+
+const warnedResolverSignatures = new Set<string>();
+
+/**
+ * Variables-logging middleware. Default-off; gated on `loggingSettings.graphql.logVariables`.
+ *
+ * NOTE: this middleware is NOT the primary leak defense. The primary defense is the removal
+ * of the `variables` field from the always-on log line in `context.ts`. This middleware
+ * provides an opt-in, redacted verbose-echo path for developers debugging locally.
+ *
+ * When enabled, fires once per root resolver call (skips field resolvers via
+ * `info.path.prev === undefined`). For each `@Arg`:
+ *   - Derives the GraphQL input type name from the schema (NOT from `args[i].constructor.name`,
+ *     because type-graphql v2.0.0-beta.3 passes raw plain-object args to middleware).
+ *   - Looks up `@NoLog` marks (parameter-level on the resolver, field-level on the input class).
+ *   - Delegates redaction to `redactArg`.
+ *
+ * Emits a single `console.dir` line with shape `{ operation, args }`. Note: the key names
+ * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
+ * — operators with log-grep automation should update their patterns.
+ */
+export const variablesLoggingMiddleware: MiddlewareFn<AppContext> = async (action, next) => {
+  // Field resolvers (info.path.prev !== undefined) are skipped — only root @Query/@Mutation/@Subscription.
+  if (action.info.path.prev !== undefined) {
+    return next();
+  }
+
+  // Hot-path zero-cost short-circuit when the flag is off.
+  if (!configInfo.loggingSettings.graphql.logVariables) {
+    return next();
+  }
+
+  const provider = action.context.providers?.[0]?.provider;
+  if (!provider) {
+    return next();
+  }
+
+  const fieldDef = action.info.parentType.getFields()[action.info.fieldName];
+  if (!fieldDef) {
+    return next();
+  }
+
+  const resolverEntry = getResolverLookup().get(action.info.fieldName);
+  const argParams: ReadonlyArray<MinimalArgParamMeta> = (resolverEntry?.params ?? []).filter(isArgParam);
+
+  const redactedArgs: Record<string, unknown> = {};
+  let hasUndecoratedCustomArg = false;
+  for (const argDef of fieldDef.args as ReadonlyArray<GraphQLArgument>) {
+    const inputTypeName = getNamedType(argDef.type).name;
+    const rawValue = action.args[argDef.name];
+
+    const paramMeta = argParams.find((p) => p.name === argDef.name);
+    const noLogParameter = paramMeta && resolverEntry
+      ? hasNoLogParameter(resolverEntry.target, resolverEntry.methodName, paramMeta.index)
+      : false;
+
+    const inputClass = findInputClass(inputTypeName);
+    const noLogFields = inputClass ? getNoLogFields(inputClass) : new Set<string>();
+
+    redactedArgs[argDef.name] = redactArg({
+      inputTypeName,
+      rawValue,
+      provider,
+      noLogParameter,
+      noLogFields,
+    });
+
+    if (!noLogParameter && isCustomArg(inputTypeName, noLogFields, provider)) {
+      hasUndecoratedCustomArg = true;
+    }
+  }
+
+  // eslint-disable-next-line no-console
+  console.dir(
+    { operation: action.info.fieldName, args: redactedArgs },
+    { depth: null, breakLength: 200 },
+  );
+
+  if (hasUndecoratedCustomArg && resolverEntry) {
+    const signature = `${resolverEntry.target.name}.${resolverEntry.methodName}`;
+    if (!warnedResolverSignatures.has(signature)) {
+      warnedResolverSignatures.add(signature);
+      console.warn(
+        `[mj:NoLog] Resolver ${signature} has un-decorated, non-metadata-bound argument(s). ` +
+        `Variables for this resolver were logged in plaintext while logVariables=true is active. ` +
+        `Apply @NoLog to sensitive arguments to suppress this.`,
+      );
+    }
+  }
+
+  return next();
+};
+
+/**
+ * Heuristic: an arg is "custom" (i.e. needs `@NoLog` discipline because metadata can't redact it)
+ * when its GraphQL input type is not a known `Create<X>Input` / `Update<X>Input` for an entity
+ * in the provider, AND no field-level `@NoLog` marks are present on the input class.
+ */
+function isCustomArg(
+  inputTypeName: string,
+  noLogFields: ReadonlySet<string>,
+  provider: { Entities: ReadonlyArray<{ ClassName: string }> },
+): boolean {
+  if (noLogFields.size > 0) {
+    return false;
+  }
+  const match = /^(Create|Update)(?<name>.+)Input$/.exec(inputTypeName);
+  if (!match || !match.groups?.name) {
+    return true;
+  }
+  const className = match.groups.name;
+  const found = provider.Entities.find((e) => e.ClassName === className);
+  return !found;
+}

package/src/resolvers/CurrentUserContextResolver.ts

@@ -1,9 +1,15 @@
 /**
  * Resolver for the `CurrentUserTenantContext` GraphQL query.
  *
- * Returns the server-set `TenantContext` from the authenticated user's `UserInfo`.
- * This is populated by post-auth middleware (e.g., BCSaaS's `bcTenantContextMiddleware`)
- * and serialized as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ * Returns the server-set `TenantContext` for the authenticated user, serialized
+ * as JSON so the client can auto-stamp `UserInfo.TenantContext`.
+ *
+ * **Resolution order:**
+ * 1. Request-scoped context (`userPayload.__bcResolvedTenantContext`) — set by
+ *    post-auth middleware on the per-request UserPayload. Immune to race conditions
+ *    when concurrent requests share the same cached UserInfo object.
+ * 2. Fallback to `userRecord.TenantContext` — for middleware that stamps UserInfo
+ *    directly (vanilla MJ deployments or non-BCSaaS middleware).
  *
  * On the client, `GraphQLDataProvider.GetCurrentUser()` batches this query alongside
  * `CurrentUser` — making plugins stack-layer agnostic without any client-side code.
@@ -16,6 +22,9 @@ import { GraphQLJSONObject } from 'graphql-type-json';
 import { AppContext } from '../types.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
+/** Well-known key for request-scoped TenantContext on UserPayload */
+const RESOLVED_TENANT_CONTEXT_KEY = '__bcResolvedTenantContext';
+
 @Resolver()
 export class CurrentUserContextResolver extends ResolverBase {
   @Query(() => GraphQLJSONObject, {
@@ -27,13 +36,20 @@ export class CurrentUserContextResolver extends ResolverBase {
   ): Promise<Record<string, unknown> | null> {
     await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
 
+    // Prefer request-scoped context (set by BCSaaS middleware on userPayload).
+    // This avoids race conditions with concurrent requests mutating the shared
+    // UserInfo.TenantContext on the same cached UserInfo object from UserCache.
+    const requestScoped = (context.userPayload as Record<string, unknown>)[RESOLVED_TENANT_CONTEXT_KEY];
+    if (requestScoped && typeof requestScoped === 'object') {
+      return { ...(requestScoped as Record<string, unknown>) };
+    }
+
+    // Fallback: read from the shared UserInfo (vanilla MJ / non-BCSaaS middleware)
     const userRecord = context.userPayload.userRecord;
     if (!userRecord?.TenantContext) {
       return null;
     }
 
-    // Serialize the full TenantContext (which may be an extended type like BCTenantContext).
-    // JSON serialization captures all enumerable properties including those from subtypes.
     return { ...userRecord.TenantContext } as Record<string, unknown>;
   }
 }

package/src/resolvers/EntityResolver.ts

@@ -1,10 +1,22 @@
 import { EntityPermissionType, IRunViewProvider } from '@memberjunction/core';
 import { AppContext } from '../types.js';
-import { Arg, Ctx, Query, Resolver, InputType, Field } from 'type-graphql';
+import { Arg, Ctx, Query, Resolver } from 'type-graphql';
 import { MJEntity_, MJEntityResolverBase } from '../generated/generated.js';
-import sql from 'mssql';
 import { GetReadOnlyProvider } from '../util.js';
 
+const VALID_SCHEMA_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
+function sanitizeSchemaNames(names: string[]): string[] {
+  return names.filter((s) => VALID_SCHEMA_NAME.test(s));
+}
+
+function buildSchemaInClause(columnName: string, schemas: string[], negate: boolean): string {
+  const sanitized = sanitizeSchemaNames(schemas);
+  if (sanitized.length === 0) return '';
+  const operator = negate ? 'NOT IN' : 'IN';
+  return `${columnName} ${operator} (${sanitized.map((s) => `'${s}'`).join(',')})`;
+}
+
 @Resolver(MJEntity_)
 export class EntityResolver extends MJEntityResolverBase {
   @Query(() => [MJEntity_])
@@ -17,9 +29,9 @@ export class EntityResolver extends MJEntityResolverBase {
     const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
     const rlsWhere = this.getRowLevelSecurityWhereClause(provider, 'Entities', userPayload, EntityPermissionType.Read, ' WHERE');
     const includeSchemaSQL =
-      IncludeSchemas && IncludeSchemas.length > 0 ? `SchemaName IN (${IncludeSchemas.map((s) => `'${s}'`).join(',')})` : '';
+      IncludeSchemas && IncludeSchemas.length > 0 ? buildSchemaInClause('SchemaName', IncludeSchemas, false) : '';
     const excludeSchemaSQL =
-      ExcludeSchemas && ExcludeSchemas.length > 0 ? `SchemaName NOT IN (${ExcludeSchemas.map((s) => `'${s}'`).join(',')})` : '';
+      ExcludeSchemas && ExcludeSchemas.length > 0 ? buildSchemaInClause('SchemaName', ExcludeSchemas, true) : '';
     let schemaSQL = '';
     if (includeSchemaSQL) schemaSQL = includeSchemaSQL;
     if (excludeSchemaSQL) {
@@ -32,7 +44,7 @@ export class EntityResolver extends MJEntityResolverBase {
       if (totalWhere) totalWhere = `${totalWhere} AND ${rlsWhere}`;
       else totalWhere = ` ${rlsWhere}`;
     }
-    const rv = provider as any as IRunViewProvider;
+    const rv = provider as IRunViewProvider;
     const result = await rv.RunView({
       EntityName: 'MJ: Entities',
       ExtraFilter: totalWhere,

package/src/resolvers/GenerateSeedTaxonomyResolver.ts

@@ -0,0 +1,90 @@
+import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Int } from 'type-graphql';
+import { AppContext } from '../types.js';
+import { LogError, LogStatus } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { TagEngine, SeedTaxonomyResult } from '@memberjunction/tag-engine';
+
+/* ───── GraphQL output ───── */
+
+@ObjectType()
+export class GenerateSeedTaxonomyResult {
+    @Field()
+    Success: boolean;
+
+    @Field({ nullable: true })
+    ErrorMessage?: string;
+
+    /** How the taxonomy was produced: 'clustering' or 'prompt-fallback'. */
+    @Field({ nullable: true })
+    Method?: string;
+
+    /** Number of content items sampled / considered. */
+    @Field(() => Int)
+    SampleSize: number;
+
+    /**
+     * JSON-serialized array of SeedTaxonomyNode (the proposed, NON-persisted tree).
+     * Kept as a JSON string to keep the GraphQL schema simple, mirroring
+     * RunClusterAnalysis's *JSON fields.
+     */
+    @Field()
+    NodesJSON: string;
+}
+
+/* ───── Resolver ───── */
+
+@Resolver()
+export class GenerateSeedTaxonomyResolver extends ResolverBase {
+    /**
+     * Propose a hierarchical tag taxonomy for a content source WITHOUT persisting
+     * anything. Thin wrapper over {@link TagEngine.generateSeedTaxonomy}.
+     *
+     * @param sourceID   The ContentSource ID whose items seed the taxonomy.
+     * @param sampleSize Max number of content items to consider (defaults to 200 when <= 0).
+     */
+    @Mutation(() => GenerateSeedTaxonomyResult)
+    async GenerateSeedTaxonomy(
+        @Arg('sourceID', () => String) sourceID: string,
+        @Arg('sampleSize', () => Int, { nullable: true }) sampleSize: number,
+        @Ctx() { userPayload }: AppContext = {} as AppContext
+    ): Promise<GenerateSeedTaxonomyResult> {
+        try {
+            const currentUser = this.GetUserFromPayload(userPayload);
+            if (!currentUser) {
+                return this.errorResult('Unable to determine current user');
+            }
+            if (!sourceID || sourceID.trim().length === 0) {
+                return this.errorResult('sourceID is required');
+            }
+
+            LogStatus(`GenerateSeedTaxonomy: sourceID=${sourceID} sampleSize=${sampleSize ?? 'default'}`);
+
+            const result: SeedTaxonomyResult = await TagEngine.Instance.generateSeedTaxonomy(
+                sourceID,
+                sampleSize ?? 0,
+                currentUser
+            );
+
+            return {
+                Success: true,
+                Method: result.Method,
+                SampleSize: result.SampleSize,
+                NodesJSON: JSON.stringify(result.Nodes),
+                ErrorMessage: result.Message,
+            };
+        } catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            LogError(`GenerateSeedTaxonomy mutation failed: ${msg}`);
+            return this.errorResult(msg);
+        }
+    }
+
+    private errorResult(message: string): GenerateSeedTaxonomyResult {
+        return {
+            Success: false,
+            ErrorMessage: message,
+            SampleSize: 0,
+            NodesJSON: '[]',
+        };
+    }
+}

package/src/resolvers/GetDataResolver.ts

@@ -1,17 +1,19 @@
 import { Arg, Ctx, Field, InputType, ObjectType, Query } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, LogStatus, Metadata } from '@memberjunction/core';
+import { LogError, LogStatus, LogStatusEx, Metadata } from '@memberjunction/core';
 import { QueryCompositionEngine } from '@memberjunction/generic-database-provider';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
+import { NoLog } from '../logging/NoLog.js';
 import { v4 as uuidv4 } from 'uuid';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { getDbType } from '../index.js';
 import { getSystemUser } from '../auth/index.js';
 import sql from 'mssql';
  
-@InputType() 
+@InputType()
 export class GetDataInputType {
     @Field(() => String)
+    @NoLog
     Token: string;
 
     @Field(() => [String])
@@ -116,9 +118,11 @@ export class GetDataResolver {
     @Ctx() context: AppContext
     ): Promise<GetDataOutputType> {
         try { 
-            LogStatus(`GetDataResolver.GetData() ---- IMPORTANT - temporarily using the same connection as rest of the server, we need to separately create a READ ONLY CONNECTION and pass that in 
-                       the AppContext so we can use that special connection here to ensure we are using a lower privileged connection for this operation to prevent mutation from being possible.`);
-            LogStatus(`${JSON.stringify(input)}`);
+            LogStatusEx({
+                message: `GetDataResolver.GetData() ---- IMPORTANT - temporarily using the same connection as rest of the server, we need to separately create a READ ONLY CONNECTION and pass that in the AppContext so we can use that special connection here to ensure we are using a lower privileged connection for this operation to prevent mutation from being possible.`,
+                verboseOnly: true,
+            });
+            LogStatus(`GetData invoked: ${input.Queries.length} queries`);
 
             // validate the token
             if (!isTokenValid(input.Token)) {