@memberjunction/server 5.51.2 → 5.51.4

package/src/resolvers/ActionResolver.ts

@@ -1,14 +1,17 @@
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError } from "@memberjunction/core";
-import { ActionParam, ActionResult } from "@memberjunction/actions-base";
+import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase } from "@memberjunction/core";
+import { ActionParam, ActionResult, MJActionEntityExtended } from "@memberjunction/actions-base";
+import { UserCache } from "@memberjunction/sqlserver-dataprovider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
 import { AppContext, ProviderInfo } from "../types.js";
-import { CopyScalarsAndArrays, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
+import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
 
 /**
  * Input type for action parameters
@@ -55,8 +58,8 @@ export class RunActionInput {
   Params?: ActionParamInput[];
 
   /**
-   * Whether to skip logging the action execution
-   * Defaults to false
+   * Ignored. A run started through this API always writes an action execution log row; the field
+   * remains so that clients which send it still validate.
    */
   @Field(() => Boolean, { nullable: true })
   SkipActionLog?: boolean;
@@ -174,7 +177,13 @@ export class ActionResultOutput {
 @Resolver()
 export class ActionResolver extends ResolverBase {
   /**
-   * Mutation for running an action
+   * Mutation for running an action.
+   *
+   * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+   * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+   * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+   * action has no such link, an action class that authorizes its caller itself. The run is always
+   * logged.
    * @param input The input parameters for running the action
    * @param ctx The GraphQL context containing user authentication information
    * @returns The result of running the action
@@ -185,26 +194,22 @@ export class ActionResolver extends ResolverBase {
     @Ctx() ctx: AppContext
   ): Promise<ActionResultOutput> {
     try {
+      const user = this.getRunActionPrincipal(ctx);
+
       // Check API key scope authorization for action execution
       await this.CheckAPIKeyScopeAuthorization('action:execute', input.ActionID, ctx.userPayload);
 
-      // Get the user from context
-      const user = ctx.userPayload.userRecord;
-      if (!user) {
-        throw new Error("User is not authenticated");
-      }
-
       // Initialize the action engine
       await ActionEngineServer.Instance.Config(false, user);
 
-      // Get the action by ID
       const action = this.findActionById(input.ActionID);
+      await this.assertCanRunAction(action, user, ctx.providers);
 
       // Parse the parameters
       const params = this.parseActionParameters(input.Params);
 
       // Run the action
-      const result = await this.executeAction(action, user, params, input.SkipActionLog);
+      const result = await this.executeAction(action, user, params);
 
       // Return the result
       return this.createActionResult(result);
@@ -213,6 +218,66 @@ export class ActionResolver extends ResolverBase {
     }
   }
 
+  /**
+   * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+   * only as row-level-security filters, and an action can reach data and services those filters never
+   * cover.
+   * @throws Error when there is no user or the session is scope-limited
+   */
+  private getRunActionPrincipal(ctx: AppContext): UserInfo {
+    const user = ctx.userPayload?.userRecord;
+    if (!user) {
+      throw new Error("User is not authenticated");
+    }
+    if (IsScopeLimitedPrincipal(user)) {
+      throw new Error("RunAction is not permitted for scope-limited sessions");
+    }
+    return user;
+  }
+
+  /**
+   * Refuses the run unless the caller is authorized for the action — see
+   * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+   * tree and the role grants all come from the request's provider, or all from the global provider
+   * when the request carries none.
+   * @throws Error when the caller may not run the action
+   */
+  private async assertCanRunAction(action: MJActionEntityExtended, user: UserInfo, providers: Array<ProviderInfo>): Promise<void> {
+    if (IsOwner(user)) {
+      return; // an Owner may run any action, so nothing needs to be read
+    }
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+    const actionAuthorizationIDs = await this.loadActionAuthorizationIDs(action.ID, provider);
+    const metadata = provider ?? Metadata.Provider; // global-provider-ok: fallback only when the request carries no provider
+    const actionAuthorizesCaller = ActionEngineServer.Instance.ActionAuthorizesCaller(action);
+    const decision = EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller);
+    if (!decision.Allowed) {
+      throw new Error(`Not authorized to run action ${action.ID}: ${decision.Reason}`);
+    }
+  }
+
+  /**
+   * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+   * user: this is the server's own authorization decision, so it must not depend on whether the
+   * caller can read that entity.
+   */
+  private async loadActionAuthorizationIDs(actionID: string, provider: DatabaseProviderBase | null): Promise<string[]> {
+    const systemUser = UserCache.Instance.GetSystemUser();
+    if (!systemUser) {
+      throw new Error("System user not found");
+    }
+    const result = await new RunView(provider).RunView<{ AuthorizationID: string }>({
+      EntityName: 'MJ: Action Authorizations',
+      ExtraFilter: `ActionID='${EscapeSQLString(actionID)}'`,
+      Fields: ['AuthorizationID'],
+      ResultType: 'simple'
+    }, systemUser);
+    if (!result.Success) {
+      throw new Error(`Could not read the authorizations for action ${actionID}: ${result.ErrorMessage}`);
+    }
+    return result.Results.map(row => row.AuthorizationID);
+  }
+
   /**
    * Finds an action by its ID
    * @param actionID The ID of the action to find
@@ -220,7 +285,7 @@ export class ActionResolver extends ResolverBase {
    * @throws Error if the action is not found
    * @private
    */
-  private findActionById(actionID: string): any {
+  private findActionById(actionID: string): MJActionEntityExtended {
     const action = ActionEngineServer.Instance.Actions.find(a => UUIDsEqual(a.ID, actionID));
     if (!action) {
       throw new Error(`Action with ID ${actionID} not found`);
@@ -262,25 +327,23 @@ export class ActionResolver extends ResolverBase {
   }
 
   /**
-   * Executes an action
+   * Executes an action. The run is always logged: a client cannot switch off the action execution log.
    * @param action The action to execute
    * @param user The user context
    * @param params The action parameters
-   * @param skipActionLog Whether to skip action logging
    * @returns The action result
    * @private
    */
   private async executeAction(
-    action: any, 
-    user: UserInfo, 
-    params: ActionParam[], 
-    skipActionLog?: boolean
+    action: MJActionEntityExtended,
+    user: UserInfo,
+    params: ActionParam[]
   ): Promise<ActionResult> {
     return await ActionEngineServer.Instance.RunAction({
       Action: action,
       ContextUser: user,
       Params: params,
-      SkipActionLog: skipActionLog,
+      SkipActionLog: false,
       Filters: []
     });
   }

package/src/resolvers/AdhocQueryResolver.ts

@@ -1,13 +1,15 @@
 import { Arg, Ctx, Query, Resolver, Field, Int, InputType } from 'type-graphql';
-import { DatabasePlatform, LogError } from '@memberjunction/core';
-import { SQLExpressionValidator } from '@memberjunction/global';
+import { LogError } from '@memberjunction/core';
+import type { DatabaseProviderBase, RunQueryResult, UserInfo } from '@memberjunction/core';
 import { RenderPipeline } from '@memberjunction/generic-database-provider';
+import type { AdhocSQLAuthorizer } from '@memberjunction/actions';
 import { AppContext } from '../types.js';
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
+import { configInfo } from '../config.js';
+import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
-import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
-import sql from 'mssql';
+import { ClampAdhocTimeoutSeconds } from './adhocTimeout.js';
 
 /**
  * Input type for executing ad-hoc SQL queries directly.
@@ -31,11 +33,24 @@ class AdhocQueryInput {
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
  *
  * Auto-discovered by MJServer's dynamic resolver import.
  */
@@ -47,191 +62,94 @@ export class AdhocQueryResolver extends ResolverBase {
         @Ctx() context: AppContext
     ): Promise<RunQueryResultType> {
         const startTime = Date.now();
-
+        // SECURITY: refuse principals whose read authority is narrower than their role grant.
+        // Ad-hoc SQL does not go through RunView, entity permissions or row-level security, so the
+        // RLS scope tokens that confine a magic-link session are never substituted. There is no
+        // filter to narrow, so the only correct answer for such a principal is no.
+        if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+            return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+        const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
+        if (!provider) {
+            return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
+        }
+        const contextUser = context.userPayload?.userRecord;
+        const refusal = this.AuthorizeRenderedSQL(input.SQL, provider, contextUser);
+        if (refusal) {
+            return this.buildErrorResult(refusal, Date.now() - startTime);
+        }
+        const timeoutSeconds = ClampAdhocTimeoutSeconds(input.TimeoutSeconds, configInfo.databaseSettings.requestTimeout);
+        // A negative offset must not reach paging, where it would turn paging off.
+        const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow! : 0);
         try {
-            // 1. Security: validate SQL using SQLExpressionValidator
-            const validator = SQLExpressionValidator.Instance;
-            const validation = validator.validateFullQuery(input.SQL);
-            if (!validation.valid) {
-                return this.buildErrorResult(validation.error || 'SQL validation failed');
-            }
-
-            // 2. Get READ-ONLY data source (no fallback to read-write)
-            let readOnlyDS: sql.ConnectionPool;
-            try {
-                readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
-            } catch {
-                return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
-            }
-
-            // 3. Resolve platform from the read-only provider for the render pipeline.
-            let platform: DatabasePlatform = 'sqlserver';
-            try {
-                const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
-                if (provider?.PlatformKey) platform = provider.PlatformKey;
-            } catch {
-                // Provider not configured — keep the default platform.
-            }
-            const contextUser = context.userPayload?.userRecord;
-
-            // 4. Route the SQL through RenderPipeline so composition tokens
-            // resolve, comments and templates are processed, and the row cap
-            // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
-            //
-            // Page whenever a positive MaxRows is requested — INCLUDING the first
-            // page (StartRow 0). This yields OFFSET/FETCH data SQL *and* a
-            // COUNT(*) query so the response reports the true total row count
-            // rather than just the returned page size. It mirrors the saved-query
-            // path (GenericDatabaseProvider.InternalRunQuery → WrapWithPaging).
-            // (Previously paging was gated on StartRow > 0, so page 1 fell back to
-            // a TOP-N cap with TotalRowCount = page size — hiding the pager.)
-            // Clamp StartRow to a non-negative integer. A negative offset must not slip
-            // past the paging gate (which would then run the query with no row cap at all).
-            const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow! : 0);
-            const maxRows = input.MaxRows;
-            const usePaging = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
-
-            let dataSQL: string;
-            let countSQL: string | null = null;
-            try {
-                const rendered = RenderPipeline.Run(input.SQL, {
-                    Platform: platform,
-                    ContextUser: contextUser,
-                    ...(usePaging ? { Paging: { StartRow: startRow, MaxRows: maxRows! } } : {}),
-                });
-                dataSQL = rendered.FinalSQL;
-                countSQL = rendered.PagingResult?.CountSQL ?? null;
-            } catch (renderErr) {
-                const renderMsg = renderErr instanceof Error ? renderErr.message : String(renderErr);
-                return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
-            }
-
-            // 5. Execute the page (and, only when a full page needs it, the count) under
-            // a shared wall-clock deadline derived from the request's timeout budget.
-            const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
-            const { recordset, totalRowCount } = await this.executeDataAndCount(
-                readOnlyDS, dataSQL, countSQL, startRow, usePaging ? maxRows! : null, deadline
-            );
-            const executionTimeMs = Date.now() - startTime;
-
-            // 6. Return as RunQueryResultType
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: true,
-                Results: JSON.stringify(recordset),
-                RowCount: recordset.length,
-                TotalRowCount: totalRowCount,
-                PageNumber: usePaging ? Math.floor(startRow / maxRows!) + 1 : undefined,
-                PageSize: usePaging ? maxRows! : undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: ''
-            };
+            const result = await provider.RunQuery({
+                SQL: input.SQL,
+                MaxRows: input.MaxRows,
+                StartRow: startRow,
+                TimeoutSeconds: timeoutSeconds,
+            }, contextUser);
+            return this.toResultType(result, startRow, input.MaxRows, timeoutSeconds, Date.now() - startTime);
         } catch (err: unknown) {
-            const executionTimeMs = Date.now() - startTime;
             const errorMessage = err instanceof Error ? err.message : String(err);
-
-            // Handle timeout
-            if (errorMessage.includes('timeout') || errorMessage.includes('Timeout')) {
-                return {
-                    QueryID: '',
-                    QueryName: 'Ad-Hoc Query',
-                    Success: false,
-                    Results: '[]',
-                    RowCount: 0,
-                    TotalRowCount: 0,
-                    PageNumber: undefined,
-                    PageSize: undefined,
-                    ExecutionTime: executionTimeMs,
-                    ErrorMessage: `Query execution exceeded ${input.TimeoutSeconds ?? 30} second timeout`
-                };
-            }
-
             LogError(`Ad-hoc query execution failed: ${errorMessage}`);
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: false,
-                Results: '[]',
-                RowCount: 0,
-                TotalRowCount: 0,
-                PageNumber: undefined,
-                PageSize: undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: `Query execution failed: ${errorMessage}`
-            };
+            return this.buildErrorResult(`Query execution failed: ${errorMessage}`, Date.now() - startTime);
         }
     }
 
     /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
      *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
      */
-    private async executeDataAndCount(
-        ds: sql.ConnectionPool,
-        dataSQL: string,
-        countSQL: string | null,
-        startRow: number,
-        maxRows: number | null,
-        deadline: number,
-    ): Promise<{ recordset: Record<string, unknown>[]; totalRowCount: number }> {
-        const dataResult = await this.runSqlWithDeadline<Record<string, unknown>>(ds, dataSQL, deadline);
-        const recordset = (dataResult.recordset ?? []) as Record<string, unknown>[];
-
-        // Total already known from the page alone (unpaged, or a short page)? Skip the count.
-        const exact = exactTotalFromPage(startRow, recordset.length, maxRows);
-        if (exact != null || !countSQL) {
-            return { recordset, totalRowCount: exact ?? recordset.length };
-        }
-
-        // Full page — a COUNT(*) is required to know the true total.
-        const lowerBound = startRow + recordset.length;
+    public AuthorizeRenderedSQL(sqlText: string, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null {
         try {
-            const countResult = await this.runSqlWithDeadline<{ TotalRowCount: number }>(ds, countSQL, deadline);
-            return { recordset, totalRowCount: resolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
-        } catch (countErr) {
-            const msg = countErr instanceof Error ? countErr.message : String(countErr);
-            LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);
-            return { recordset, totalRowCount: lowerBound };
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: contextUser, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'ad-hoc SQL');
+            return null;
+        } catch (err) {
+            return err instanceof Error ? err.message : String(err);
         }
     }
 
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
-     */
-    private async runSqlWithDeadline<T>(
-        ds: sql.ConnectionPool,
-        sqlText: string,
-        deadline: number,
-    ): Promise<sql.IResult<T>> {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            throw new Error('Query timeout exceeded');
-        }
-        let timer: ReturnType<typeof setTimeout> | undefined;
-        try {
-            return await Promise.race([
-                new sql.Request(ds).query<T>(sqlText),
-                new Promise<never>((_, reject) => {
-                    timer = setTimeout(() => reject(new Error('Query timeout exceeded')), remaining);
-                }),
-            ]);
-        } finally {
-            if (timer) {
-                clearTimeout(timer);
-            }
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    private toResultType(
+        result: RunQueryResult,
+        startRow: number,
+        maxRows: number | undefined,
+        timeoutSeconds: number,
+        executionTimeMs: number,
+    ): RunQueryResultType {
+        if (!result.Success) {
+            const message = result.ErrorMessage ?? 'Ad-hoc query failed';
+            return this.buildErrorResult(
+                /timeout/i.test(message) ? `Query execution exceeded ${timeoutSeconds} second timeout` : message,
+                executionTimeMs,
+            );
         }
+        const paged = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
+        return {
+            QueryID: '',
+            QueryName: 'Ad-Hoc Query',
+            Success: true,
+            Results: JSON.stringify(result.Results),
+            RowCount: result.RowCount,
+            TotalRowCount: result.TotalRowCount,
+            PageNumber: paged ? Math.floor(startRow / maxRows!) + 1 : undefined,
+            PageSize: paged ? maxRows : undefined,
+            ExecutionTime: executionTimeMs,
+            ErrorMessage: ''
+        };
     }
 
-    private buildErrorResult(errorMessage: string): RunQueryResultType {
+    private buildErrorResult(errorMessage: string, executionTimeMs = 0): RunQueryResultType {
         return {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
@@ -241,8 +159,23 @@ export class AdhocQueryResolver extends ResolverBase {
             TotalRowCount: 0,
             PageNumber: undefined,
             PageSize: undefined,
-            ExecutionTime: 0,
+            ExecutionTime: executionTimeMs,
             ErrorMessage: errorMessage
         };
     }
 }
+
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export function CreateAdhocSQLAuthorizer(requestTimeoutMs: number): AdhocSQLAuthorizer {
+    const resolver = new AdhocQueryResolver();
+    return {
+        Authorize: (sql, provider, contextUser) => resolver.AuthorizeRenderedSQL(sql, provider, contextUser),
+        ClampTimeoutSeconds: (requestedSeconds) => ClampAdhocTimeoutSeconds(requestedSeconds, requestTimeoutMs),
+    };
+}

package/src/resolvers/DatasetResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
-import { AppContext } from '../types.js';
-import { LogError, Metadata } from '@memberjunction/core';
+import { AppContext, UserPayload } from '../types.js';
+import { DatabaseProviderBase, DatasetItemFilterType, DatasetItemResultType, LogError, Metadata, UserInfo } from '@memberjunction/core';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
@@ -34,9 +34,64 @@ export class DatasetItemFilterTypeGQL {
   Filter: string;
 }
 
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export abstract class DatasetResolverBase extends ResolverBase {
+  /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+  protected RequireDatasetUser(userPayload: UserPayload): UserInfo {
+    const user = this.GetUserFromPayload(userPayload);
+    if (!user) {
+      throw new Error('Dataset request refused: the session resolves to no user');
+    }
+    return user;
+  }
+
+  /**
+   * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+   * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+   */
+  protected ScreenItemFilters(
+    itemFilters: DatasetItemFilterTypeGQL[] | undefined,
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): DatasetItemFilterType[] | undefined {
+    if (!itemFilters) return undefined;
+    itemFilters.forEach((itemFilter, index) => {
+      if (itemFilter) {
+        this.assertClientClauseUsesEntityBaseViews(itemFilter.Filter, `ItemFilters[${index}].Filter`, provider, user);
+      }
+    });
+    return itemFilters.filter((itemFilter) => itemFilter != null);
+  }
+
+  /**
+   * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+   * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+   * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+   */
+  protected async ProtectEncryptedFields(
+    items: DatasetItemResultType[],
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): Promise<DatasetItemResultType[]> {
+    return Promise.all(
+      items.map(async (item) => {
+        const entity = provider.EntityByName(item.EntityName);
+        if (!item.Results?.length || !entity?.EncryptedFields.some((field) => !field.AllowDecryptInAPI)) {
+          return item;
+        }
+        const rows = item.Results.map((row: Record<string, unknown>) => ({ ...row }));
+        return { ...item, Results: await this.ArrayFilterEncryptedFieldsForAPI(item.EntityName, rows, user, provider, 'Name') };
+      }),
+    );
+  }
+}
 
 @Resolver(DatasetResultType)
-export class DatasetResolverExtended extends ResolverBase {
+export class DatasetResolverExtended extends DatasetResolverBase {
   @Query(() => DatasetResultType)
   async GetDatasetByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -45,10 +100,12 @@ export class DatasetResolverExtended extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -56,7 +113,7 @@ export class DatasetResolverExtended extends ResolverBase {
           Success: result.Success,
           Status: result.Status,
           LatestUpdateDate: result.LatestUpdateDate,
-          Results: JSON.stringify(result.Results),
+          Results: JSON.stringify(await this.ProtectEncryptedFields(result.Results, md, user)),
         };
       } else {
         throw new Error('Error retrieving Dataset: ' + DatasetName);
@@ -90,7 +147,7 @@ export class DatasetStatusResultType {
 }
 
 @Resolver(DatasetStatusResultType)
-export class DatasetStatusResolver extends ResolverBase {
+export class DatasetStatusResolver extends DatasetResolverBase {
   @Query(() => DatasetStatusResultType)
   async GetDatasetStatusByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -99,10 +156,12 @@ export class DatasetStatusResolver extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetStatusByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetStatusByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -131,12 +190,13 @@ export class DatasetStatusResolver extends ResolverBase {
     @Ctx() { providers, userPayload }: AppContext,
   ): Promise<DatasetStatusResultType[]> {
     const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
     const results: DatasetStatusResultType[] = [];
 
     // Execute all status checks in parallel
     const statusPromises = DatasetNames.map(async (name) => {
       await this.CheckAPIKeyScopeAuthorization('dataset:read', name, userPayload);
-      return md.GetDatasetStatusByName(name);
+      return md.GetDatasetStatusByName(name, undefined, user);
     });
 
     const statuses = await Promise.all(statusPromises);