@memberjunction/server 5.51.0 → 6.1.0-edge.1

package/src/generic/FireAndForgetHeartbeat.ts

@@ -1,6 +1,6 @@
 import { PubSubEngine } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { PUSH_STATUS_UPDATES_TOPIC } from './PushStatusResolver.js';
+import { publishStatusUpdate } from './PushStatusResolver.js';
 
 /** Default cadence for fire-and-forget liveness pulses (5 minutes). */
 export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
@@ -32,6 +32,11 @@ export interface LivenessPulseOptions {
     pubSub: PubSubEngine;
     /** Session the client is subscribed on (used by the subscription filter). */
     sessionId: string;
+    /**
+     * Authenticated user the operation belongs to (B49). Stamped on every pulse so the
+     * subscription filter binds delivery to identity, not just the client-chosen sessionId.
+     */
+    ownerUserId: string;
     /** Resolver label echoed in the message envelope (e.g. 'RunAIAgentResolver'). */
     resolver: string;
     /** Pulse cadence in ms. Defaults to {@link DEFAULT_PULSE_INTERVAL_MS}. */
@@ -56,7 +61,7 @@ export interface LivenessPulseOptions {
  * so the client receives it through the same subscription with no special parsing.
  */
 export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
-    const { pubSub, sessionId, resolver, readStatus } = options;
+    const { pubSub, sessionId, ownerUserId, resolver, readStatus } = options;
     const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
 
     const timer = setInterval(() => {
@@ -68,14 +73,15 @@ export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulse
             LogError(`[LivenessPulse:${resolver}] readStatus failed: ${(e as Error).message}`);
         }
 
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
+        publishStatusUpdate(pubSub, {
+            sessionId,
+            ownerUserId,
             message: JSON.stringify({
                 resolver,
                 type: HEARTBEAT_MESSAGE_TYPE,
                 status: 'ok',
                 data: data ?? {},
             }),
-            sessionId,
         });
     }, intervalMs);
 

package/src/generic/PushStatusResolver.ts

@@ -1,4 +1,6 @@
-import { Arg, Field, ID, ObjectType, Resolver, ResolverFilterData, Root, Subscription } from 'type-graphql';
+import { Arg, Field, ID, ObjectType, PubSubEngine, Resolver, ResolverFilterData, Root, Subscription } from 'type-graphql';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserPayload } from '../types.js';
 
 export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 
@@ -14,27 +16,100 @@ export class PushStatusNotification {
   sessionId!: string;
 }
 
+/**
+ * Internal wire payload for a push-status update. Carries `ownerUserId` — the authenticated user
+ * the update belongs to — used ONLY server-side by the subscription filter and deliberately NOT
+ * exposed on the client-facing {@link PushStatusNotification} (we never leak user IDs to subscribers).
+ *
+ * `ownerUserId` is REQUIRED: it is the load-bearing security property (see
+ * {@link statusUpdatesFilter}), so making it required means the compiler rejects any publish that
+ * omits identity. Always publish through {@link publishStatusUpdate} (or the
+ * `ResolverBase.PublishStatusUpdate` ergonomic wrapper) rather than calling `pubSub.publish` on
+ * this topic directly, so a new publisher can never forget it.
+ */
 export interface PushStatusNotificationPayload {
   message?: string;
   sessionId: string;
+  /** Authenticated user the update belongs to. Server-side filter key; never sent to the client. */
+  ownerUserId: string;
 }
 
 interface PushStatusNotificationArgs {
   sessionId: string;
 }
 
+/** Parameters for {@link publishStatusUpdate} — identity (`ownerUserId`) is required by design. */
+export interface StatusUpdateParams {
+  /** Session the target client subscribed on (routes the push to the right browser tab). */
+  sessionId: string;
+  /** Authenticated user the operation belongs to (the trust anchor the filter enforces). */
+  ownerUserId: string;
+  /** Message envelope (plain string, or the resolvers' JSON `{resolver,type,status,data}` shape). */
+  message?: string;
+}
+
+/**
+ * The single, centralized vehicle for publishing on {@link PUSH_STATUS_UPDATES_TOPIC}. Every
+ * publisher — resolver or service — routes through here (resolvers via the
+ * `ResolverBase.PublishStatusUpdate` wrapper; non-resolvers by calling this directly), so the
+ * payload shape and the required-identity guarantee live in exactly one place. Adding a field to
+ * the push is a one-line change here; a new publisher physically cannot omit `ownerUserId`.
+ */
+export function publishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdateParams): void {
+  const payload: PushStatusNotificationPayload = {
+    sessionId: params.sessionId,
+    ownerUserId: params.ownerUserId,
+    message: params.message,
+  };
+  pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, payload);
+}
+
+/** Minimal shape of the subscription's connection context needed by the filter. */
+export interface StatusUpdatesFilterContext {
+  userPayload?: UserPayload;
+}
+
+/**
+ * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
+ * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
+ *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
+ *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *
+ * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
+ * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
+ * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
+ * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
+ * matches.
+ */
+export function statusUpdatesFilter(data: {
+  payload: PushStatusNotificationPayload;
+  args: PushStatusNotificationArgs;
+  context: StatusUpdatesFilterContext | undefined;
+}): boolean {
+  const { payload, args, context } = data;
+  if (payload.sessionId !== args.sessionId) {
+    return false;
+  }
+  const connectionUserId: string | undefined = context?.userPayload?.userRecord?.ID;
+  if (!connectionUserId || !payload.ownerUserId) {
+    return false; // fail closed — no identity on either side means no delivery
+  }
+  return UUIDsEqual(payload.ownerUserId, connectionUserId);
+}
+
 @Resolver()
 export class PushStatusResolver {
   @Subscription(() => PushStatusNotification, {
     topics: PUSH_STATUS_UPDATES_TOPIC,
-    filter: ({ payload, args, context }: ResolverFilterData<PushStatusNotificationPayload, PushStatusNotificationArgs, any>) => {
-      return payload.sessionId === args.sessionId;
-    },
+    filter: (data: ResolverFilterData<PushStatusNotificationPayload, PushStatusNotificationArgs, StatusUpdatesFilterContext>) =>
+      statusUpdatesFilter(data),
   })
   statusUpdates(
     @Root() { message }: PushStatusNotificationPayload,
     @Arg('sessionId', () => String) sessionId: string
   ): PushStatusNotification {
+    // NOTE: ownerUserId is intentionally NOT returned — it is a server-side filter key only.
     return { message, date: new Date(), sessionId };
   }
 }

package/src/generic/ResolverBase.ts

@@ -32,7 +32,7 @@ import { RunDynamicViewInput, RunViewByIDInput, RunViewByNameInput } from './Run
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
 import { MJEvent, MJEventType, MJGlobal, ENCRYPTED_SENTINEL, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
 import { EncryptionEngine } from '@memberjunction/encryption';
-import { PUSH_STATUS_UPDATES_TOPIC } from './PushStatusResolver.js';
+import { PUSH_STATUS_UPDATES_TOPIC, publishStatusUpdate } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC } from './CacheInvalidationResolver.js';
 import { PubSubManager } from './PubSubManager.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
@@ -691,7 +691,11 @@ export class ResolverBase {
       return;
     }
 
-    // Check specific scope
+    // Check specific scope. The acting context stamped on the session user (set
+    // server-side in context.ts, never client-supplied) rides along so filtered
+    // rules with {{Acting*}} tokens can validate their required values — without
+    // it, a filtered rule fails closed even for a session carrying valid context.
+    const sessionUser = this.GetUserFromPayload(userPayload);
     const result = await apiKeyEngine.Authorize(
       userPayload.apiKeyHash,
       'MJAPI',
@@ -701,6 +705,9 @@ export class ResolverBase {
       {
         endpoint: '/graphql',
         method: 'POST'
+      },
+      {
+        actingContext: sessionUser?.APIKeyActingContext
       }
     );
 
@@ -999,7 +1006,7 @@ export class ResolverBase {
       ?? UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
     if (!user) throw new Error(`User ${userPayload?.email} not found in metadata`);
 
-    return entityInfo.GetUserRowLevelSecurityWhereClause(user, type, returnPrefix);
+    return entityInfo.GetEffectiveRowFilterWhereClause(user, type, returnPrefix);
   }
 
   protected async createAuditLogRecord(
@@ -1101,6 +1108,22 @@ export class ResolverBase {
     });
   }
 
+  /**
+   * Publishes a push-status update to the client on {@link PUSH_STATUS_UPDATES_TOPIC}, stamping the
+   * authenticated owner's user ID from `userPayload` so the subscription filter can bind delivery
+   * to identity (see B49 / `statusUpdatesFilter`). The ergonomic wrapper every resolver should use
+   * instead of calling `pubSub.publish` on the topic directly — it makes omitting identity
+   * impossible. Non-resolver publishers (services, the liveness heartbeat) call the shared
+   * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
+   */
+  protected PublishStatusUpdate(pubSub: PubSubEngine, sessionId: string, message: string | undefined, userPayload: UserPayload): void {
+    publishStatusUpdate(pubSub, {
+      sessionId,
+      ownerUserId: userPayload?.userRecord?.ID ?? '',
+      message,
+    });
+  }
+
   protected ListenForEntityMessages(entityObject: BaseEntity, pubSub: PubSubEngine, userPayload: UserPayload) {
     // The unique key is set up for each entity object via it's primary key to ensure that we only have one listener at most for each unique
     // entity in the system. This is important because we don't want to have multiple listeners for the same entity as it could
@@ -1130,16 +1153,13 @@ export class ResolverBase {
             const baseEntityEvent = event.args as BaseEntityEvent;
             // message from our entity object, relay it to the client
             LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
-            pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-              message: JSON.stringify({
-                status: 'OK',
-                type: 'EntityObjectStatusMessage',
-                entityName: baseEntityEvent.baseEntity.EntityInfo.Name,
-                primaryKey: baseEntityEvent.baseEntity.PrimaryKey,
-                message: event.args.payload,
-              }),
-              sessionId: userPayload.sessionId,
-            });
+            this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+              status: 'OK',
+              type: 'EntityObjectStatusMessage',
+              entityName: baseEntityEvent.baseEntity.EntityInfo.Name,
+              primaryKey: baseEntityEvent.baseEntity.PrimaryKey,
+              message: event.args.payload,
+            }), userPayload);
           }
         }
       });

package/src/index.ts

@@ -66,6 +66,7 @@ import { IntegrationProgressEmitter } from '@memberjunction/integration-progress
 import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
 import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
 import { SessionJanitor } from './agentSessions/index.js';
+import { StartTaskGraphDispatcher } from './services/StartTaskGraphDispatcher.js';
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine, IntegrationSyncOptions } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
@@ -113,6 +114,8 @@ export {
     verifyUserRecord,
 } from './auth/index.js';
 export * from './auth/APIKeyScopeAuth.js';
+export * from './auth/actingContextResolver.js';
+export { CloneUserForSessionContext } from './auth/sessionUserClone.js';
 
 export * from './generic/PushStatusResolver.js';
 export * from './generic/PubSubManager.js';
@@ -134,7 +137,6 @@ export * from './resolvers/IntegrationProgressResolver.js';
 export * from './resolvers/ClientToolRequestResolver.js';
 export * from './resolvers/AutotagPipelineResolver.js';
 export * from './resolvers/TagGovernanceResolver.js';
-export * from './resolvers/TaskResolver.js';
 export * from './generic/KeyValuePairInput.js';
 export * from './generic/KeyInputOutputTypes.js';
 export * from './generic/DeleteOptionsInput.js';
@@ -147,8 +149,12 @@ export * from './resolvers/ComponentRegistryResolver.js';
 export * from './resolvers/DatasetResolver.js';
 export * from './resolvers/EntityRecordNameResolver.js';
 export * from './resolvers/MergeRecordsResolver.js';
-export * from './resolvers/ReportResolver.js';
 export * from './resolvers/QueryResolver.js';
+export * from './services/TaskGraphProviderFactory.js';
+export * from './services/TaskGraphAgentRunner.js';
+export * from './services/StartTaskGraphDispatcher.js';
+export * from './services/TaskGraphContinuationDeliverer.js';
+export * from './resolvers/TaskGraphFrameResolver.js';
 export * from './resolvers/TestQuerySQLResolver.js';
 export * from './resolvers/SqlLoggingConfigResolver.js';
 export * from './resolvers/SyncRolesUsersResolver.js';
@@ -481,7 +487,7 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       startupLog.LogIf('verbose', 'Read-only Connection Pool has been initialized.');
     }
 
-    const config = new SQLServerProviderConfigData(pool, mj_core_schema, cacheRefreshInterval);
+    const config = new SQLServerProviderConfigData(pool, mj_core_schema, cacheRefreshInterval / 1000); // convert ms to seconds (checkRefreshIntervalSeconds)
     // MJAPI is a long-running server, so entry-point default is 'full' engine pre-warm;
     // MJ_STARTUP_MODE / mj.config.cjs startup.mode can override per the shared precedence chain
     const startupMode = ResolveStartupMode({ configValue: configInfo.startup?.mode, defaultMode: 'full' });
@@ -516,7 +522,7 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
         await codegenPool.connect();
 
         const { RuntimeSchemaManager } = await import('@memberjunction/schema-engine');
-        const codegenConfig = new SQLServerProviderConfigData(codegenPool, mj_core_schema, cacheRefreshInterval);
+        const codegenConfig = new SQLServerProviderConfigData(codegenPool, mj_core_schema, cacheRefreshInterval / 1000); // convert ms to seconds (checkRefreshIntervalSeconds)
         const codegenProvider = new SQLServerDataProvider();
         await codegenProvider.Config(codegenConfig);
         RuntimeSchemaManager.Instance.SetDDLProvider(codegenProvider);
@@ -1339,6 +1345,17 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       .catch(err => console.warn(`[SessionJanitor] Startup failed: ${err}`));
   }
 
+  // Launch the durable task-graph dispatcher: claim Pending tasks, execute them with a fresh
+  // provider each, and reconcile claims orphaned by a crash. Without this nothing ever picks up a
+  // submitted graph — submission would be durable and inert, which is strictly worse than the old
+  // client-driven path it replaced. Gated on SQL Server because the provider factory mints
+  // SQLServerDataProvider; the PG branch lands with PG parity. Self-registers with ShutdownRegistry.
+  const taskGraphPool = dataSources[0]?.dataSource;
+  if (resumeUser && taskGraphPool instanceof sql.ConnectionPool) {
+    StartTaskGraphDispatcher(taskGraphPool, resumeUser)
+      .catch(err => console.warn(`[TaskGraphDispatcher] Startup failed: ${err}`));
+  }
+
   // Launch the calendar / scheduled-bridge loop (M2): poll agent calendars for meeting invites and
   // start due meeting bridges. Mirrors the SessionJanitor lifecycle (run-once + interval, timer
   // unref'd). Gated on Teams meetings being enabled (the provider whose scheduled-join is wired) and

package/src/multiTenancy/index.ts

@@ -12,6 +12,24 @@ import type { PreRunViewHook, PreSaveHook } from '@memberjunction/core';
 import { Metadata, type UserInfo, type TenantContext } from '@memberjunction/core';
 import type { MultiTenancyConfig } from '../config.js';
 import type { UserPayload } from '../types.js';
+import { CloneUserForSessionContext } from '../auth/sessionUserClone.js';
+
+/**
+ * Allowlist for tenant identifiers arriving from a request header: GUIDs and
+ * conservative identifiers only. Anything else is rejected AT THE BOUNDARY with
+ * a 400 — never silently dropped, because a dropped tenant header degrades to an
+ * UNSCOPED session, which is the fail-open case validation exists to prevent.
+ * Escaping at predicate construction is defense in depth behind this, not a
+ * substitute: `x' OR '1'='1` previously survived to the WHERE clause because the
+ * downstream keyword blocklist strips string literals before matching and has no
+ * rule for OR.
+ */
+const TENANT_ID_PATTERN = /^[A-Za-z0-9_.\-]{1,128}$/;
+
+/** True when the value is acceptable as a tenant identifier. Exported for tests. */
+export function IsValidTenantId(tenantId: string): boolean {
+  return TENANT_ID_PATTERN.test(tenantId);
+}
 
 /** Custom tenant context extractor signature */
 export type TenantContextExtractor = (
@@ -31,7 +49,7 @@ export type TenantContextExtractor = (
  * has TenantContext set — no deferred pickup via `req['__mj_tenantId']` needed.
  */
 export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandler {
-  return (req, _res, next) => {
+  return (req, res, next) => {
     const userPayload = (req as { userPayload?: UserPayload }).userPayload;
     if (!userPayload?.userRecord) {
       // No authenticated user — skip tenant resolution
@@ -40,9 +58,29 @@ export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandl
     }
 
     if (config.contextSource === 'header') {
-      const tenantId = req.headers[config.tenantHeader.toLowerCase()] as string | undefined;
+      const rawHeader = req.headers[config.tenantHeader.toLowerCase()];
+      // A repeated header arrives as string[] — ambiguous which value is authoritative, so
+      // reject rather than silently pick one (Array.prototype's coercion to a comma-joined
+      // string would otherwise sail past IsValidTenantId's regex unnoticed for some inputs).
+      if (Array.isArray(rawHeader)) {
+        res.status(400).json({ error: `Malformed ${config.tenantHeader} header: expected a single value.` });
+        return;
+      }
+      const tenantId = rawHeader;
       if (tenantId) {
-        attachTenantContext(userPayload.userRecord as UserInfo, tenantId, 'header');
+        if (!IsValidTenantId(tenantId)) {
+          // Reject the REQUEST, never degrade to an unscoped session: a malformed
+          // tenant header that silently attaches nothing produces a session with NO
+          // tenant filter at all — strictly worse than failing loudly.
+          res.status(400).json({ error: 'Invalid tenant identifier' });
+          return;
+        }
+        // Clone before stamping: userRecord is very often the SHARED UserCache
+        // instance, and stamping it in place races concurrent requests for the
+        // same user (one request's tenant becomes another's, same-instant).
+        const sessionUser = CloneUserForSessionContext(userPayload.userRecord as UserInfo);
+        attachTenantContext(sessionUser, tenantId, 'header');
+        userPayload.userRecord = sessionUser;
       }
     }
     next();
@@ -52,12 +90,22 @@ export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandl
 /**
  * Attaches TenantContext to a UserInfo object.
  * Called from the GraphQL context function after authentication.
+ *
+ * The caller is responsible for two invariants (createTenantMiddleware shows both):
+ * validate untrusted tenant ids with {@link IsValidTenantId} BEFORE calling, and
+ * never pass the shared cached UserInfo — clone it first
+ * (CloneUserForSessionContext). This function still validates as defense in depth
+ * so a future caller from a different source ('linkedEntity', 'custom') cannot
+ * reintroduce the injection path.
  */
 export function attachTenantContext(
   user: UserInfo,
   tenantId: string,
   source: TenantContext['Source']
 ): void {
+  if (!IsValidTenantId(tenantId)) {
+    throw new Error(`Invalid tenant identifier (must match ${TENANT_ID_PATTERN})`);
+  }
   user.TenantContext = { TenantID: tenantId, Source: source };
 }
 
@@ -118,9 +166,29 @@ export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunVi
     // Check if this entity should be scoped
     if (!isEntityScoped(entityName, config)) return params;
 
-    // Determine which column holds the tenant ID
+    // Determine which column holds the tenant ID. The column is operator config, not
+    // user input — but it is interpolated into an identifier position, so it must
+    // resolve to a real, non-virtual field on the entity (rejecting typos AND ruling
+    // out identifier injection through a compromised config), and it is quoted through
+    // the platform-appropriate helper rather than hardcoded T-SQL brackets, which are
+    // invalid on PostgreSQL.
     const tenantColumn = config.entityColumnMappings[entityName] ?? config.defaultTenantColumn;
-    const tenantFilter = `[${tenantColumn}] = '${contextUser.TenantContext.TenantID}'`;
+    const md = new Metadata(); // global-provider-ok: same rationale as isEntityScoped above — hooks carry no per-request provider
+    const entityInfo = md.EntityByName(entityName);
+    const field = entityInfo?.Fields.find(
+      f => !f.IsVirtual && f.Name.trim().toLowerCase() === tenantColumn.trim().toLowerCase()
+    );
+    if (!field) {
+      throw new Error(
+        `Multi-tenancy misconfiguration: tenant column '${tenantColumn}' does not resolve to a stored field on entity '${entityName}'`
+      );
+    }
+
+    // Escape the value at construction even though the boundary validated it —
+    // defense in depth for future callers that attach TenantContext from sources
+    // other than the validated header path.
+    const safeTenantId = contextUser.TenantContext.TenantID.replace(/'/g, "''");
+    const tenantFilter = `${QuoteFilterIdentifier(field.Name)} = '${safeTenantId}'`;
 
     // Inject the tenant filter
     if (params.ExtraFilter && typeof params.ExtraFilter === 'string' && params.ExtraFilter.trim().length > 0) {
@@ -133,6 +201,25 @@ export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunVi
   };
 }
 
+/**
+ * Quotes an identifier for use in a tenant predicate via the active provider's
+ * QuoteIdentifier (DatabaseProviderBase always exposes one server-side, yielding [x]
+ * on SQL Server and "x" on PostgreSQL). Throws — never falls back to hardcoded T-SQL
+ * bracket quoting — when no provider is available: a silent fallback would emit
+ * invalid SQL on PostgreSQL, and "fails to build a query" is a worse failure mode to
+ * debug than "refused to build one." A tenant filter must fail closed, loudly, at the
+ * point where it can no longer guarantee platform-correct SQL. Exported for tests.
+ */
+export function QuoteFilterIdentifier(name: string): string {
+  const provider = Metadata.Provider as unknown as { QuoteIdentifier?: (id: string) => string }; // global-provider-ok: hook-level code, single server provider
+  if (!provider || typeof provider.QuoteIdentifier !== 'function') {
+    throw new Error(
+      `[MultiTenancy] Cannot quote identifier '${name}': no database provider available to quote it — refusing to fall back to hardcoded bracket syntax, which is invalid on PostgreSQL.`
+    );
+  }
+  return provider.QuoteIdentifier(name);
+}
+
 /**
  * Creates a PreSaveHook that validates the tenant column on writes.
  *

package/src/resolvers/ActionResolver.ts

@@ -7,7 +7,7 @@ import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
 import { AppContext, ProviderInfo } from "../types.js";
 import { CopyScalarsAndArrays, UUIDsEqual } from "@memberjunction/global";
-import { GetReadOnlyProvider } from "../util.js";
+import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
 
 /**
@@ -203,8 +203,10 @@ export class ActionResolver extends ResolverBase {
       // Parse the parameters
       const params = this.parseActionParameters(input.Params);
 
-      // Run the action
-      const result = await this.executeAction(action, user, params, input.SkipActionLog);
+      // Run the action — thread the request-scoped provider so provider-bound
+      // actions (e.g. the semantic find-* / Search Entity actions, which call
+      // params.Provider.SearchEntity) run against the caller's metadata layer.
+      const result = await this.executeAction(action, user, params, ctx.providers, input.SkipActionLog);
 
       // Return the result
       return this.createActionResult(result);
@@ -271,17 +273,23 @@ export class ActionResolver extends ResolverBase {
    * @private
    */
   private async executeAction(
-    action: any, 
-    user: UserInfo, 
-    params: ActionParam[], 
+    action: any,
+    user: UserInfo,
+    params: ActionParam[],
+    providers: Array<ProviderInfo>,
     skipActionLog?: boolean
   ): Promise<ActionResult> {
+    // Resolve the request-scoped provider. Prefer read-write (actions may mutate);
+    // fall back to read-only, then to the engine's global-Metadata default when no
+    // request providers are present (preserves prior behavior).
+    const provider = GetReadWriteProvider(providers, { allowFallbackToReadOnly: true }) ?? undefined;
     return await ActionEngineServer.Instance.RunAction({
       Action: action,
       ContextUser: user,
       Params: params,
       SkipActionLog: skipActionLog,
-      Filters: []
+      Filters: [],
+      Provider: provider
     });
   }
 

package/src/resolvers/MCPResolver.ts

@@ -19,7 +19,7 @@ import {
 } from '@memberjunction/ai-mcp-client';
 import { AppContext } from '../types.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
-import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
+import { publishStatusUpdate } from '../generic/PushStatusResolver.js';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { configInfo } from '../config.js';
 
@@ -583,7 +583,7 @@ export class MCPResolver extends ResolverBase {
             await manager.initialize(user, { publicUrl });
 
             // Publish initial progress
-            this.publishProgress(pubSub, sessionId, ConnectionID, 'connecting', 'Connecting to MCP server...');
+            this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'connecting', 'Connecting to MCP server...');
 
             // Connect if not already connected
             const isConnected = manager.isConnected(ConnectionID);
@@ -595,18 +595,18 @@ export class MCPResolver extends ResolverBase {
                     // Check for OAuth authorization required
                     if (connectError instanceof OAuthAuthorizationRequiredError) {
                         const authError = connectError as OAuthAuthorizationRequiredError;
-                        this.publishProgress(pubSub, sessionId, ConnectionID, 'error',
+                        this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'error',
                             `OAuth authorization required. Please authorize at: ${authError.authorizationUrl}`);
                         return this.createOAuthRequiredResult(authError.authorizationUrl, authError.stateParameter);
                     }
                     if (connectError instanceof OAuthReauthorizationRequiredError) {
                         const reAuthError = connectError as OAuthReauthorizationRequiredError;
-                        this.publishProgress(pubSub, sessionId, ConnectionID, 'error',
+                        this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'error',
                             `OAuth re-authorization required: ${reAuthError.reason}`);
                         return this.createOAuthReauthorizationResult(reAuthError.reason, reAuthError.authorizationUrl, reAuthError.stateParameter);
                     }
                     const connectErrorMsg = connectError instanceof Error ? connectError.message : String(connectError);
-                    this.publishProgress(pubSub, sessionId, ConnectionID, 'error', `Connection failed: ${connectErrorMsg}`);
+                    this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'error', `Connection failed: ${connectErrorMsg}`);
                     return this.createErrorResult(`Failed to connect to MCP server: ${connectErrorMsg}`);
                 }
             }
@@ -617,7 +617,7 @@ export class MCPResolver extends ResolverBase {
             const connectionName = connectionInfo?.connectionName || 'Unknown Connection';
 
             // Publish listing progress
-            this.publishProgress(pubSub, sessionId, ConnectionID, 'listing', 'Discovering tools from MCP server...');
+            this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'listing', 'Discovering tools from MCP server...');
 
             // Perform the sync with event listening for granular progress
             LogStatus(`MCPResolver: Starting tool sync for connection ${ConnectionID}`);
@@ -626,7 +626,7 @@ export class MCPResolver extends ResolverBase {
             const eventHandler = (event: { type: string; data?: Record<string, unknown> }) => {
                 if (event.type === 'toolsSynced') {
                     const data = event.data as { added: number; updated: number; deprecated: number; total: number } | undefined;
-                    this.publishProgress(pubSub, sessionId, ConnectionID, 'complete', 'Tool sync complete', {
+                    this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'complete', 'Tool sync complete', {
                         added: data?.added || 0,
                         updated: data?.updated || 0,
                         deprecated: data?.deprecated || 0,
@@ -637,7 +637,7 @@ export class MCPResolver extends ResolverBase {
             manager.addEventListener('toolsSynced', eventHandler);
 
             // Publish syncing progress
-            this.publishProgress(pubSub, sessionId, ConnectionID, 'syncing', 'Synchronizing tools to database...');
+            this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'syncing', 'Synchronizing tools to database...');
 
             // Perform the sync
             const syncResult: MCPSyncToolsResult = await manager.syncTools(ConnectionID, { contextUser: user });
@@ -646,12 +646,12 @@ export class MCPResolver extends ResolverBase {
             manager.removeEventListener('toolsSynced', eventHandler);
 
             if (!syncResult.success) {
-                this.publishProgress(pubSub, sessionId, ConnectionID, 'error', `Sync failed: ${syncResult.error}`);
+                this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'error', `Sync failed: ${syncResult.error}`);
                 return this.createErrorResult(syncResult.error || 'Tool sync failed');
             }
 
             // Publish final completion
-            this.publishProgress(pubSub, sessionId, ConnectionID, 'complete',
+            this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'complete',
                 `Sync complete: ${syncResult.added} added, ${syncResult.updated} updated, ${syncResult.deprecated} deprecated`,
                 {
                     added: syncResult.added,
@@ -675,7 +675,7 @@ export class MCPResolver extends ResolverBase {
         } catch (error) {
             const errorMsg = error instanceof Error ? error.message : String(error);
             LogError(`MCPResolver: Error syncing tools for ${ConnectionID}: ${errorMsg}`);
-            this.publishProgress(pubSub, sessionId, ConnectionID, 'error', `Error: ${errorMsg}`);
+            this.publishProgress(pubSub, sessionId, user.ID, ConnectionID, 'error', `Error: ${errorMsg}`);
             return this.createErrorResult(errorMsg);
         }
     }
@@ -1345,6 +1345,7 @@ export class MCPResolver extends ResolverBase {
     private publishProgress(
         pubSub: PubSubEngine,
         sessionId: string,
+        ownerUserId: string,
         connectionId: string,
         phase: SyncProgressMessage['phase'],
         message: string,
@@ -1360,10 +1361,7 @@ export class MCPResolver extends ResolverBase {
             result
         };
 
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-            message: JSON.stringify(progressMessage),
-            sessionId
-        });
+        publishStatusUpdate(pubSub, { sessionId, ownerUserId, message: JSON.stringify(progressMessage) });
     }
 
     /**