@memberjunction/server 5.51.0 → 6.1.0-edge.0

package/src/resolvers/ReportResolver.ts

@@ -3,7 +3,6 @@ import { Arg, Ctx, Field, Int, Mutation, ObjectType, Query, Resolver } from 'typ
 import { AppContext } from '../types.js';
 import { MJConversationDetailEntity, MJReportEntity } from '@memberjunction/core-entities';
 import { DataContext } from '@memberjunction/data-context';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
 import { z } from 'zod';
 import mssql from 'mssql';
 import { GetReadOnlyProvider, GetReadWriteProvider } from '../util.js';
@@ -80,7 +79,15 @@ export class ReportResolverExtended extends ResolverBase {
     try {
       const md = GetReadWriteProvider(providers);
 
-      const u = UserCache.Users.find((u) => u.Email?.trim().toLowerCase() === userPayload?.email?.trim().toLowerCase());
+      // Resolve via the stamped payload user (GetUserFromPayload), NOT a fresh UserCache
+      // lookup by email. UserCache.Users returns the shared, unstamped instance — re-fetching
+      // by email here would silently drop any per-request API-key row-filter binding
+      // (APIKeyRowFilters / APIKeyActingContext) already stamped onto userPayload.userRecord,
+      // so a filtered key's report-creation work would run unfiltered. GetUserFromPayload
+      // prefers userPayload.userRecord and only falls back to a UserCache email lookup when
+      // no payload user is present (e.g. non-request-scoped callers), matching every other
+      // resolver's contextUser resolution.
+      const u = this.GetUserFromPayload(userPayload);
       if (!u) throw new Error('Unable to find user');
 
       const cde = md.Entities.find((e) => e.Name === 'MJ: Conversation Details');
@@ -98,9 +105,10 @@ export class ReportResolverExtended extends ResolverBase {
                    ON
                       cd.ConversationID = c.ID
                    WHERE
-                      cd.ID='${ConversationDetailID}'`;
+                      cd.ID=@ConversationDetailID`;
 
       const request = new mssql.Request(dataSource);
+      request.input('ConversationDetailID', mssql.UniqueIdentifier, ConversationDetailID);
       const result = await request.query(sql);
       if (!result || !result.recordset || result.recordset.length === 0) throw new Error('Unable to retrieve converation details');
       const skipData: { title?: string; reportTitle?: string; userExplanation?: string; messages?: unknown[] } = JSON.parse(result.recordset[0].Message);

package/src/resolvers/RunAIAgentResolver.ts

@@ -8,7 +8,6 @@ import { MJAIAgentEntityExtended, MJAIAgentRunEntityExtended, ExecuteAgentResult
 import { AIEngine } from '@memberjunction/aiengine';
 import { ChatMessage, ChatMessageContent } from '@memberjunction/ai';
 import { ResolverBase } from '../generic/ResolverBase.js';
-import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { startLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadWriteProvider } from '../util.js';
@@ -306,28 +305,22 @@ export class RunAIAgentResolver extends ResolverBase {
     }
 
     private PublishProgressUpdate(pubSub: PubSubEngine, data: any, userPayload: UserPayload) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, { 
-            message: JSON.stringify({
-                resolver: 'RunAIAgentResolver',
-                type: 'ExecutionProgress',
-                status: 'ok',
-                data,
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunAIAgentResolver',
+            type: 'ExecutionProgress',
+            status: 'ok',
+            data,
+        }), userPayload);
     }
 
 
     private PublishStreamingUpdate(pubSub: PubSubEngine, data: any, userPayload: UserPayload) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, { 
-            message: JSON.stringify({
-                resolver: 'RunAIAgentResolver',
-                type: 'StreamingContent',
-                status: 'ok',
-                data,
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunAIAgentResolver',
+            type: 'StreamingContent',
+            status: 'ok',
+            data,
+        }), userPayload);
     }
 
     /**
@@ -814,17 +807,15 @@ export class RunAIAgentResolver extends ResolverBase {
                 LogStatus(`📬 Notification sent via ${channelList} (ID: ${result.inAppNotificationId})`);
 
                 // Publish real-time notification event so client updates immediately
-                pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                    userPayload: JSON.stringify(userPayload),
-                    message: JSON.stringify({
-                        type: 'notification',
-                        notificationId: result.inAppNotificationId,
-                        action: 'create',
-                        title: `${agentName} completed your request`,
-                        message: message,
-                        conversationId: conversationId
-                    })
-                });
+                // NOTE (B49): normalized from a malformed no-sessionId payload
+                this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+                    type: 'notification',
+                    notificationId: result.inAppNotificationId,
+                    action: 'create',
+                    title: `${agentName} completed your request`,
+                    message: message,
+                    conversationId: conversationId
+                }), userPayload);
 
                 LogStatus(`📡 Published notification event to client`);
             } else if (!result.success) {
@@ -926,16 +917,14 @@ export class RunAIAgentResolver extends ResolverBase {
                 LogStatus(`📬 Feedback request notification sent (ID: ${notifResult.inAppNotificationId})`);
 
                 // Publish real-time notification event
-                pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                    userPayload: JSON.stringify(userPayload),
-                    message: JSON.stringify({
-                        type: 'notification',
-                        notificationId: notifResult.inAppNotificationId,
-                        action: 'create',
-                        title: `${agentName} needs your input`,
-                        message: truncatedMessage
-                    })
-                });
+                // NOTE (B49): normalized from a malformed no-sessionId payload
+                this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+                    type: 'notification',
+                    notificationId: notifResult.inAppNotificationId,
+                    action: 'create',
+                    title: `${agentName} needs your input`,
+                    message: truncatedMessage
+                }), userPayload);
             } else if (!notifResult.success) {
                 LogError(`Feedback request notification failed: ${notifResult.errors?.join(', ')}`);
             }
@@ -1294,6 +1283,7 @@ export class RunAIAgentResolver extends ResolverBase {
         const pulse = startLivenessPulse({
             pubSub,
             sessionId,
+            ownerUserId: userPayload.userRecord.ID,
             resolver: 'RunAIAgentResolver',
             readStatus: () => runRef.current
                 ? { runId: runRef.current.ID, status: runRef.current.Status }

package/src/resolvers/RunTestResolver.ts

@@ -15,7 +15,6 @@ import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
 import { TestEngine } from '@memberjunction/testing-engine';
 import { ResolverBase } from '../generic/ResolverBase.js';
-import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { startLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { TestRunVariables, TestLogMessage, TestRunResult as EngineTestRunResult } from '@memberjunction/testing-engine-base';
 
@@ -257,7 +256,7 @@ export class RunTestResolver extends ResolverBase {
     ): void {
         // Keep-alive pulse so a long-running test never trips the client idle timeout.
         // The client captures the testRunId from progress events for reconciliation.
-        const pulse = startLivenessPulse({ pubSub, sessionId: userPayload.sessionId, resolver: 'RunTestResolver' });
+        const pulse = startLivenessPulse({ pubSub, sessionId: userPayload.sessionId, ownerUserId: userPayload.userRecord.ID, resolver: 'RunTestResolver' });
 
         this.executeTest(testId, verbose, environment, tags, variables, pubSub, userPayload, user)
             .catch((error: unknown) => {
@@ -353,7 +352,7 @@ export class RunTestResolver extends ResolverBase {
         // (Suite reconciliation isn't wired: suite progress carries the per-test run id, not the
         // Test Suite Run id, so the client has no handle to reconcile against — the pulse is the
         // protection here.)
-        const pulse = startLivenessPulse({ pubSub, sessionId: userPayload.sessionId, resolver: 'RunTestResolver' });
+        const pulse = startLivenessPulse({ pubSub, sessionId: userPayload.sessionId, ownerUserId: userPayload.userRecord.ID, resolver: 'RunTestResolver' });
 
         this.executeSuite(
             suiteId, verbose, environment, parallel, tags, variables,
@@ -494,51 +493,42 @@ export class RunTestResolver extends ResolverBase {
     // ===== PubSub Publishing =====
 
     private publishProgress(pubSub: PubSubEngine, data: TestExecutionStreamMessage, userPayload: UserPayload) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'TestExecutionProgress',
-                status: 'ok',
-                data,
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'TestExecutionProgress',
+            status: 'ok',
+            data,
+        }), userPayload);
     }
 
     private publishComplete(pubSub: PubSubEngine, userPayload: UserPayload, result: EngineTestRunResult) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'TestExecutionComplete',
-                status: 'ok',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    testRunId: result.testRunId,
-                    type: 'complete',
-                    result: JSON.stringify(result),
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'TestExecutionComplete',
+            status: 'ok',
+            data: {
+                sessionId: userPayload.sessionId,
+                testRunId: result.testRunId,
+                type: 'complete',
+                result: JSON.stringify(result),
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 
     private publishError(pubSub: PubSubEngine, userPayload: UserPayload, testId: string, errorMsg: string) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'TestExecutionError',
-                status: 'error',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    testRunId: testId,
-                    type: 'error',
-                    errorMessage: errorMsg,
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'TestExecutionError',
+            status: 'error',
+            data: {
+                sessionId: userPayload.sessionId,
+                testRunId: testId,
+                type: 'error',
+                errorMessage: errorMsg,
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 
     /**
@@ -551,24 +541,21 @@ export class RunTestResolver extends ResolverBase {
         testId: string,
         testRunResult: TestRunResult
     ) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'FireAndForgetComplete',
-                status: 'ok',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    testId,
-                    type: 'complete',
-                    success: testRunResult.success,
-                    errorMessage: testRunResult.errorMessage,
-                    executionTimeMs: testRunResult.executionTimeMs,
-                    result: testRunResult.result,
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'FireAndForgetComplete',
+            status: 'ok',
+            data: {
+                sessionId: userPayload.sessionId,
+                testId,
+                type: 'complete',
+                success: testRunResult.success,
+                errorMessage: testRunResult.errorMessage,
+                executionTimeMs: testRunResult.executionTimeMs,
+                result: testRunResult.result,
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 
     /**
@@ -580,23 +567,20 @@ export class RunTestResolver extends ResolverBase {
         testId: string,
         errorMessage: string
     ) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'FireAndForgetComplete',
-                status: 'ok',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    testId,
-                    type: 'complete',
-                    success: false,
-                    errorMessage,
-                    result: JSON.stringify({ success: false, errorMessage }),
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'FireAndForgetComplete',
+            status: 'ok',
+            data: {
+                sessionId: userPayload.sessionId,
+                testId,
+                type: 'complete',
+                success: false,
+                errorMessage,
+                result: JSON.stringify({ success: false, errorMessage }),
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 
     /**
@@ -609,24 +593,21 @@ export class RunTestResolver extends ResolverBase {
         suiteId: string,
         suiteRunResult: TestSuiteRunResult
     ) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'FireAndForgetSuiteComplete',
-                status: 'ok',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    suiteId,
-                    type: 'complete',
-                    success: suiteRunResult.success,
-                    errorMessage: suiteRunResult.errorMessage,
-                    executionTimeMs: suiteRunResult.executionTimeMs,
-                    result: suiteRunResult.result,
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'FireAndForgetSuiteComplete',
+            status: 'ok',
+            data: {
+                sessionId: userPayload.sessionId,
+                suiteId,
+                type: 'complete',
+                success: suiteRunResult.success,
+                errorMessage: suiteRunResult.errorMessage,
+                executionTimeMs: suiteRunResult.executionTimeMs,
+                result: suiteRunResult.result,
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 
     /**
@@ -638,22 +619,19 @@ export class RunTestResolver extends ResolverBase {
         suiteId: string,
         errorMessage: string
     ) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify({
-                resolver: 'RunTestResolver',
-                type: 'FireAndForgetSuiteComplete',
-                status: 'ok',
-                data: {
-                    sessionId: userPayload.sessionId,
-                    suiteId,
-                    type: 'complete',
-                    success: false,
-                    errorMessage,
-                    result: JSON.stringify({ success: false, errorMessage }),
-                    timestamp: new Date()
-                },
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunTestResolver',
+            type: 'FireAndForgetSuiteComplete',
+            status: 'ok',
+            data: {
+                sessionId: userPayload.sessionId,
+                suiteId,
+                type: 'complete',
+                success: false,
+                errorMessage,
+                result: JSON.stringify({ success: false, errorMessage }),
+                timestamp: new Date()
+            },
+        }), userPayload);
     }
 }

package/src/resolvers/SearchKnowledgeResolver.ts

@@ -3,7 +3,7 @@ import { GraphQLJSON } from 'graphql-type-json';
 import { AppContext } from '../types.js';
 import { LogError, LogStatus, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
-import { SearchEngine, SearchResult as SearchEngineResult, SearchResultItem as SearchEngineResultItem, SearchProviderInfo, SearchContext, SearchScopePermissionResolver } from '@memberjunction/search-engine';
+import { SearchEngine, SearchResult as SearchEngineResult, SearchResultItem as SearchEngineResultItem, SearchProviderInfo, SearchContext, GetSearchScopePermissionResolver } from '@memberjunction/search-engine';
 import { SearchEngineBase, MJAIAgentEntity } from '@memberjunction/core-entities';
 import { UUIDsEqual } from '@memberjunction/global';
 
@@ -284,7 +284,7 @@ export class SearchKnowledgeResolver extends ResolverBase {
         agentID: string | undefined,
     ): Promise<string | undefined> {
         const agent = await this.loadAgent(agentID, user);
-        const resolver = new SearchScopePermissionResolver();
+        const resolver = GetSearchScopePermissionResolver();
         for (const scopeID of scopeIDs) {
             const verdict = await resolver.ResolveEffectivePermission({
                 User: user,
@@ -351,7 +351,7 @@ export class SearchKnowledgeResolver extends ResolverBase {
 
             const ownedOrUnowned = scopes.filter(s => !s.OwnerUserID || UUIDsEqual(s.OwnerUserID, userID));
             const agent = await this.loadAgent(agentID, currentUser);
-            const resolver = new SearchScopePermissionResolver();
+            const resolver = GetSearchScopePermissionResolver();
 
             const visible: SearchScopeInfo[] = [];
             for (const s of ownedOrUnowned) {

package/src/resolvers/SearchKnowledgeStreamResolver.ts

@@ -28,7 +28,7 @@ import { ResolverBase } from '../generic/ResolverBase.js';
 import {
     SearchEngine,
     SearchContext,
-    SearchScopePermissionResolver,
+    GetSearchScopePermissionResolver,
     SearchStreamEvent,
 } from '@memberjunction/search-engine';
 import { MJAIAgentEntity } from '@memberjunction/core-entities';
@@ -299,7 +299,7 @@ export class SearchKnowledgeStreamResolver extends ResolverBase {
         agentID: string | undefined,
     ): Promise<string | undefined> {
         const agent = await this.loadAgent(agentID, user);
-        const resolver = new SearchScopePermissionResolver();
+        const resolver = GetSearchScopePermissionResolver();
         for (const scopeID of scopeIDs) {
             const verdict = await resolver.ResolveEffectivePermission({
                 User: user,

package/src/resolvers/VersionHistoryResolver.ts

@@ -1,11 +1,10 @@
 import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Int, InputType, PubSub, PubSubEngine } from 'type-graphql';
-import { AppContext } from '../types.js';
+import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, CompositeKey, KeyValuePair } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { VersionHistoryEngine } from '@memberjunction/version-history';
 import { CreateLabelParams, CreateLabelProgressUpdate, VersionLabelScope } from '@memberjunction/version-history';
 import { KeyValuePairInput } from '../generic/KeyValuePairInput.js';
-import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 
 // =========================================================================
 // GraphQL types
@@ -115,7 +114,7 @@ export class VersionHistoryResolver extends ResolverBase {
 
             // Build progress callback that publishes to PubSub
             const resolvedSessionId = sessionId ?? context.userPayload.sessionId;
-            const onProgress = this.buildProgressCallback(pubSub, resolvedSessionId);
+            const onProgress = this.buildProgressCallback(pubSub, resolvedSessionId, context.userPayload);
 
             const params: CreateLabelParams = {
                 Name: input.Name,
@@ -160,18 +159,16 @@ export class VersionHistoryResolver extends ResolverBase {
      */
     private buildProgressCallback(
         pubSub: PubSubEngine,
-        sessionId: string
+        sessionId: string,
+        userPayload: UserPayload
     ): (progress: CreateLabelProgressUpdate) => void {
         return (progress: CreateLabelProgressUpdate) => {
-            pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                message: JSON.stringify({
-                    resolver: 'VersionHistoryResolver',
-                    type: 'CreateLabelProgress',
-                    status: 'ok',
-                    data: progress,
-                }),
-                sessionId,
-            });
+            this.PublishStatusUpdate(pubSub, sessionId, JSON.stringify({
+                resolver: 'VersionHistoryResolver',
+                type: 'CreateLabelProgress',
+                status: 'ok',
+                data: progress,
+            }), userPayload);
         };
     }
 }