@memberjunction/server 5.51.2 → 5.51.4

package/dist/generic/CacheInvalidationResolver.d.ts

@@ -1,4 +1,31 @@
 export declare const CACHE_INVALIDATION_TOPIC = "CACHE_INVALIDATION";
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export declare function ConfigureRecordDataBroadcast(entities: readonly string[] | undefined | null): void;
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export declare function MayBroadcastRecordData(entityName: string): boolean;
 export declare class CacheInvalidationNotification {
     EntityName: string;
     PrimaryKeyValues?: string;
@@ -21,12 +48,105 @@ export interface CacheInvalidationPayload {
     originSessionId?: string;
     recordData?: string;
 }
+/**
+ * What the subscription filter needs off the WS connection.
+ *
+ * Declared structurally rather than importing MJServer's `UserPayload`, which reaches `types.ts`
+ * and through it `auth/index.js` and config. Keeping this module's imports minimal is not fussiness
+ * — importing `configInfo` here is what previously broke every unit test that touched the resolver,
+ * and the import-surface test in this package exists to keep it that way.
+ */
+export interface CacheInvalidationFilterContext {
+    userPayload?: {
+        userRecord?: unknown;
+    };
+}
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export declare function cacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean;
+/** The part of a permission row and of a user this module reads, so the rule can be tested on plain objects. */
+export interface ReadPermissionRow {
+    RoleID: string;
+    CanRead: boolean | null;
+    /** `Deny` rows subtract; they never carry the read the rule looks at. */
+    IsDeny?: boolean;
+    Type?: string | null;
+    ReadRLSFilterID: string | null;
+}
+export interface RoleHolder {
+    UserRoles?: ReadonlyArray<{
+        RoleID: string;
+    }> | null;
+}
+/**
+ * Is this user's read of the entity row-filtered? True when every read the user holds on the entity comes through a permission
+ * row that carries a `ReadRLSFilterID`: there is a row-level security filter between them and the rows, so a record's key, its
+ * existence and when it changed are not theirs to learn unless the row passes the filter — which a subscription filter cannot
+ * evaluate per event. False when any of their read rows is unfiltered (they could read the row anyway), and false when they hold
+ * no read at all (the entity-level filter has already withheld the event).
+ *
+ * The same in-memory match `GetUserPermisions` does, with no I/O, so it can run per subscriber per event.
+ */
+export declare function ReadIsRowFiltered(entity: {
+    Permissions: ReadonlyArray<ReadPermissionRow>;
+}, user: RoleHolder): boolean;
+/**
+ * The event as one subscriber may see it. A subscriber whose read of the entity is row-filtered gets the entity, the action and
+ * the time, and neither the key nor the row: "something in this entity changed", which the client already takes as a
+ * whole-entity invalidation (a null key on `remote-invalidate`). Everyone else gets the event as published.
+ */
+export declare function ShapeCacheInvalidationEvent(payload: CacheInvalidationPayload, user: RoleHolder | undefined, entity: {
+    Permissions: ReadonlyArray<ReadPermissionRow>;
+} | null | undefined): CacheInvalidationNotification;
 export declare class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link cacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept for a subscriber who could read the row anyway, because consumers need it to
+     * re-read the record they were told about (see `ResolveEntityEventKey` in @memberjunction/core),
+     * and the coarse "something in this entity changed" forces whole-entity invalidation on the
+     * hottest write paths. It is withheld, with the row, from a subscriber whose every read of the
+     * entity goes through a row-level security filter ({@link ReadIsRowFiltered}): a filter the
+     * subscription cannot evaluate per event stands between them and the row, so they learn only
+     * that a row of the entity changed, and their caches refresh the entity as a whole. That is the
+     * same in-memory role match as the entity-level filter, once more per subscriber per event.
      */
-    cacheInvalidation(payload: CacheInvalidationPayload): CacheInvalidationNotification;
+    cacheInvalidation(// case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+    payload: CacheInvalidationPayload, context: CacheInvalidationFilterContext | undefined): CacheInvalidationNotification;
 }
 //# sourceMappingURL=CacheInvalidationResolver.d.ts.map

package/dist/generic/CacheInvalidationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBACa,yBAAyB;IAClC;;;;OAIG;IAIH,iBAAiB,CACL,OAAO,EAAE,wBAAwB,GAC1C,6BAA6B;CAWnC"}
+{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAS7D;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CASjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC3C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CA2BV;AAED,gHAAgH;AAChH,MAAM,WAAW,iBAAiB;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AACD,MAAM,WAAW,UAAU;IACvB,SAAS,CAAC,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAAE,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAYtH;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,MAAM,EAAE;IAAE,WAAW,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC7E,6BAA6B,CAW/B;AAED,qBACa,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAMH,iBAAiB,CAAG,mIAAmI;IAC3I,OAAO,EAAE,wBAAwB,EAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,GAC3D,6BAA6B;CAMnC"}

package/dist/generic/CacheInvalidationResolver.js

@@ -10,8 +10,57 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { Ctx, Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { Metadata } from '@memberjunction/core';
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
+/**
+ * Entities whose rows may ride along with an invalidation event. Empty until the server entry point
+ * supplies the configured list, so the default — including in any process that never configures it
+ * — is to broadcast nothing.
+ */
+let allowedRecordDataEntities = [];
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export function ConfigureRecordDataBroadcast(entities) {
+    // Normalised HERE, once, rather than at each comparison. The wildcard used to be matched raw
+    // (`includes('*')`) while entity names were trimmed and lowercased two lines below, so a
+    // hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+    // looks like it disables the gate while leaving it fully on. Empty entries are dropped so a
+    // stray `''` cannot match an entity whose name is somehow blank.
+    allowedRecordDataEntities = (entities ?? [])
+        .map((e) => e.trim().toLowerCase())
+        .filter((e) => e.length > 0);
+}
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export function MayBroadcastRecordData(entityName) {
+    if (allowedRecordDataEntities.length === 0)
+        return false;
+    if (allowedRecordDataEntities.includes('*'))
+        return true;
+    return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
+}
 let CacheInvalidationNotification = class CacheInvalidationNotification {
 };
 __decorate([
@@ -46,31 +95,137 @@ CacheInvalidationNotification = __decorate([
     ObjectType()
 ], CacheInvalidationNotification);
 export { CacheInvalidationNotification };
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export function cacheInvalidationFilter(data) {
+    const user = data.context?.userPayload?.userRecord;
+    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
+    // token does not validate, so a subscriber with no user record should not exist; if one does,
+    // it is the case least deserving of an unfiltered firehose.
+    if (!user) {
+        return false;
+    }
+    const entityName = data.payload?.entityName;
+    if (!entityName) {
+        return false;
+    }
+    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
+    // own metadata, which is the one place the entity's permission rows can be answered from.
+    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
+    // A name absent from metadata cannot be permission-checked, and withholding would silently
+    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
+    // disclosure one. All it discloses is the name and key of something this server cannot
+    // describe.
+    if (!entity) {
+        return true;
+    }
+    return entity.GetUserPermisions(user).CanRead;
+}
+/**
+ * Is this user's read of the entity row-filtered? True when every read the user holds on the entity comes through a permission
+ * row that carries a `ReadRLSFilterID`: there is a row-level security filter between them and the rows, so a record's key, its
+ * existence and when it changed are not theirs to learn unless the row passes the filter — which a subscription filter cannot
+ * evaluate per event. False when any of their read rows is unfiltered (they could read the row anyway), and false when they hold
+ * no read at all (the entity-level filter has already withheld the event).
+ *
+ * The same in-memory match `GetUserPermisions` does, with no I/O, so it can run per subscriber per event.
+ */
+export function ReadIsRowFiltered(entity, user) {
+    const roles = new Set((user.UserRoles ?? []).map((role) => (role.RoleID ?? '').trim().toLowerCase()));
+    let filteredReads = 0;
+    for (const row of entity.Permissions) {
+        if (!row.CanRead)
+            continue;
+        const isDeny = row.IsDeny ?? (row.Type ?? 'Allow').trim().toLowerCase() === 'deny';
+        if (isDeny)
+            continue;
+        if (!roles.has((row.RoleID ?? '').trim().toLowerCase()))
+            continue;
+        if (!row.ReadRLSFilterID)
+            return false;
+        filteredReads += 1;
+    }
+    return filteredReads > 0;
+}
+/**
+ * The event as one subscriber may see it. A subscriber whose read of the entity is row-filtered gets the entity, the action and
+ * the time, and neither the key nor the row: "something in this entity changed", which the client already takes as a
+ * whole-entity invalidation (a null key on `remote-invalidate`). Everyone else gets the event as published.
+ */
+export function ShapeCacheInvalidationEvent(payload, user, entity) {
+    const withholdKey = !!user && !!entity && ReadIsRowFiltered(entity, user);
+    return {
+        EntityName: payload.entityName,
+        PrimaryKeyValues: withholdKey ? undefined : (payload.primaryKeyValues ?? undefined),
+        Action: payload.action,
+        SourceServerID: payload.sourceServerId,
+        Timestamp: payload.timestamp,
+        OriginSessionID: payload.originSessionId ?? undefined,
+        RecordData: withholdKey ? undefined : (payload.recordData ?? undefined),
+    };
+}
 let CacheInvalidationResolver = class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link cacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept for a subscriber who could read the row anyway, because consumers need it to
+     * re-read the record they were told about (see `ResolveEntityEventKey` in @memberjunction/core),
+     * and the coarse "something in this entity changed" forces whole-entity invalidation on the
+     * hottest write paths. It is withheld, with the row, from a subscriber whose every read of the
+     * entity goes through a row-level security filter ({@link ReadIsRowFiltered}): a filter the
+     * subscription cannot evaluate per event stands between them and the row, so they learn only
+     * that a row of the entity changed, and their caches refresh the entity as a whole. That is the
+     * same in-memory role match as the entity-level filter, once more per subscriber per event.
      */
-    cacheInvalidation(payload) {
-        return {
-            EntityName: payload.entityName,
-            PrimaryKeyValues: payload.primaryKeyValues ?? undefined,
-            Action: payload.action,
-            SourceServerID: payload.sourceServerId,
-            Timestamp: payload.timestamp,
-            OriginSessionID: payload.originSessionId ?? undefined,
-            RecordData: payload.recordData ?? undefined,
-        };
+    cacheInvalidation(payload, context) {
+        const user = context?.userPayload?.userRecord;
+        // The same server-wide metadata the filter read; an entity unknown here was delivered whole by the filter's own choice
+        const entity = payload?.entityName ? new Metadata().EntityByName(payload.entityName) : null; // global-provider-ok: subscription resolver — server-wide metadata, no request-scoped provider exists here
+        return ShapeCacheInvalidationEvent(payload, user, entity);
     }
 };
 __decorate([
     Subscription(() => CacheInvalidationNotification, {
         topics: CACHE_INVALIDATION_TOPIC,
+        filter: (data) => cacheInvalidationFilter(data),
     }),
     __param(0, Root()),
+    __param(1, Ctx()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", CacheInvalidationNotification)
 ], CacheInvalidationResolver.prototype, "cacheInvalidation", null);
 CacheInvalidationResolver = __decorate([

package/dist/generic/CacheInvalidationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAGtD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AApBX,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AAiBM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;OAIG;IAIH,iBAAiB,CACL,OAAiC;QAEzC,OAAO;YACH,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;YACvD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;YACrD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC9C,CAAC;IACN,CAAC;CACJ,CAAA;AAbG;IAHC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;KACnC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;;;oCACR,6BAA6B;kEAU/B;AArBQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CAsBrC"}
+{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,IAAI,yBAAyB,GAAsB,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA8C;IACzF,6FAA6F;IAC7F,yFAAyF;IACzF,6FAA6F;IAC7F,4FAA4F;IAC5F,iEAAiE;IACjE,yBAAyB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7E,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AApBX,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AA4BD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;IAC3E,8FAA8F;IAC9F,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,yGAAyG;IACjK,4FAA4F;IAC5F,2FAA2F;IAC3F,8FAA8F;IAC9F,uFAAuF;IACvF,YAAY;IACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyD,EAAE,IAAgB;IACzG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACnF,IAAI,MAAM;YAAE,SAAS;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACvC,aAAa,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,aAAa,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACvC,OAAiC,EACjC,IAA4B,EAC5B,MAA4E;IAE5E,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1E,OAAO;QACH,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;QACnF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;QACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;KAC1E,CAAC;AACN,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAMH,iBAAiB,CACL,OAAiC,EAClC,OAAmD;QAE1D,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;QACtE,uHAAuH;QACvH,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,2GAA2G;QACxM,OAAO,2BAA2B,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;CACJ,CAAA;AATG;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,CAAC,IAAgG,EAAE,EAAE,CACzG,uBAAuB,CAAC,IAAI,CAAC;KACpC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,EAAE,CAAA;;;oCACP,6BAA6B;kEAK/B;AA3CQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CA4CrC"}

package/dist/generic/FireAndForgetHeartbeat.d.ts

@@ -25,6 +25,11 @@ export interface LivenessPulseOptions {
     pubSub: PubSubEngine;
     /** Session the client is subscribed on (used by the subscription filter). */
     sessionId: string;
+    /**
+     * Authenticated user the operation belongs to (B49). Stamped on every pulse so the
+     * subscription filter binds delivery to identity, not just the client-chosen sessionId.
+     */
+    ownerUserId: string;
     /** Resolver label echoed in the message envelope (e.g. 'RunAIAgentResolver'). */
     resolver: string;
     /** Pulse cadence in ms. Defaults to {@link DEFAULT_PULSE_INTERVAL_MS}. */

package/dist/generic/FireAndForgetHeartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA2BrF"}
+{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA4BrF"}

package/dist/generic/FireAndForgetHeartbeat.js

@@ -1,5 +1,5 @@
 import { LogError } from '@memberjunction/core';
-import { PUSH_STATUS_UPDATES_TOPIC } from './PushStatusResolver.js';
+import { publishStatusUpdate } from './PushStatusResolver.js';
 /** Default cadence for fire-and-forget liveness pulses (5 minutes). */
 export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
 /** The `type` discriminator carried by liveness pulse messages. */
@@ -16,7 +16,7 @@ export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
  * so the client receives it through the same subscription with no special parsing.
  */
 export function startLivenessPulse(options) {
-    const { pubSub, sessionId, resolver, readStatus } = options;
+    const { pubSub, sessionId, ownerUserId, resolver, readStatus } = options;
     const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
     const timer = setInterval(() => {
         let data;
@@ -27,14 +27,15 @@ export function startLivenessPulse(options) {
             // A status read failure must not break the liveness loop.
             LogError(`[LivenessPulse:${resolver}] readStatus failed: ${e.message}`);
         }
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
+        publishStatusUpdate(pubSub, {
+            sessionId,
+            ownerUserId,
             message: JSON.stringify({
                 resolver,
                 type: HEARTBEAT_MESSAGE_TYPE,
                 status: 'ok',
                 data: data ?? {},
             }),
-            sessionId,
         });
     }, intervalMs);
     return {

package/dist/generic/FireAndForgetHeartbeat.js.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAsClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;YACtC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;YACF,SAAS;SACZ,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC"}
+{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA2ClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE;YACxB,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;SACL,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC"}

package/dist/generic/PushStatusResolver.d.ts

@@ -1,14 +1,72 @@
+import { PubSubEngine } from 'type-graphql';
+import { UserPayload } from '../types.js';
 export declare const PUSH_STATUS_UPDATES_TOPIC = "PUSH_STATUS_UPDATES";
 export declare class PushStatusNotification {
     message?: string;
     date: Date;
     sessionId: string;
 }
+/**
+ * Internal wire payload for a push-status update. Carries `ownerUserId` — the authenticated user
+ * the update belongs to — used ONLY server-side by the subscription filter and deliberately NOT
+ * exposed on the client-facing {@link PushStatusNotification} (we never leak user IDs to subscribers).
+ *
+ * `ownerUserId` is REQUIRED: it is the load-bearing security property (see
+ * {@link statusUpdatesFilter}), so making it required means the compiler rejects any publish that
+ * omits identity. Always publish through {@link publishStatusUpdate} (or the
+ * `ResolverBase.PublishStatusUpdate` ergonomic wrapper) rather than calling `pubSub.publish` on
+ * this topic directly, so a new publisher can never forget it.
+ */
 export interface PushStatusNotificationPayload {
     message?: string;
     sessionId: string;
+    /** Authenticated user the update belongs to. Server-side filter key; never sent to the client. */
+    ownerUserId: string;
 }
+interface PushStatusNotificationArgs {
+    sessionId: string;
+}
+/** Parameters for {@link publishStatusUpdate} — identity (`ownerUserId`) is required by design. */
+export interface StatusUpdateParams {
+    /** Session the target client subscribed on (routes the push to the right browser tab). */
+    sessionId: string;
+    /** Authenticated user the operation belongs to (the trust anchor the filter enforces). */
+    ownerUserId: string;
+    /** Message envelope (plain string, or the resolvers' JSON `{resolver,type,status,data}` shape). */
+    message?: string;
+}
+/**
+ * The single, centralized vehicle for publishing on {@link PUSH_STATUS_UPDATES_TOPIC}. Every
+ * publisher — resolver or service — routes through here (resolvers via the
+ * `ResolverBase.PublishStatusUpdate` wrapper; non-resolvers by calling this directly), so the
+ * payload shape and the required-identity guarantee live in exactly one place. Adding a field to
+ * the push is a one-line change here; a new publisher physically cannot omit `ownerUserId`.
+ */
+export declare function publishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdateParams): void;
+/** Minimal shape of the subscription's connection context needed by the filter. */
+export interface StatusUpdatesFilterContext {
+    userPayload?: UserPayload;
+}
+/**
+ * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
+ * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
+ *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
+ *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *
+ * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
+ * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
+ * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
+ * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
+ * matches.
+ */
+export declare function statusUpdatesFilter(data: {
+    payload: PushStatusNotificationPayload;
+    args: PushStatusNotificationArgs;
+    context: StatusUpdatesFilterContext | undefined;
+}): boolean;
 export declare class PushStatusResolver {
     statusUpdates({ message }: PushStatusNotificationPayload, sessionId: string): PushStatusNotification;
 }
+export {};
 //# sourceMappingURL=PushStatusResolver.d.ts.map

package/dist/generic/PushStatusResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,qBACa,kBAAkB;IAO7B,aAAa,CACH,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAG1B"}
+{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAoD,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAO1F;AAED,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAUV;AAED,qBACa,kBAAkB;IAM7B,aAAa,CACH,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAI1B"}

package/dist/generic/PushStatusResolver.js

@@ -11,6 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Arg, Field, ID, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { UUIDsEqual } from '@memberjunction/global';
 export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 let PushStatusNotification = class PushStatusNotification {
 };
@@ -30,17 +31,55 @@ PushStatusNotification = __decorate([
     ObjectType()
 ], PushStatusNotification);
 export { PushStatusNotification };
+/**
+ * The single, centralized vehicle for publishing on {@link PUSH_STATUS_UPDATES_TOPIC}. Every
+ * publisher — resolver or service — routes through here (resolvers via the
+ * `ResolverBase.PublishStatusUpdate` wrapper; non-resolvers by calling this directly), so the
+ * payload shape and the required-identity guarantee live in exactly one place. Adding a field to
+ * the push is a one-line change here; a new publisher physically cannot omit `ownerUserId`.
+ */
+export function publishStatusUpdate(pubSub, params) {
+    const payload = {
+        sessionId: params.sessionId,
+        ownerUserId: params.ownerUserId,
+        message: params.message,
+    };
+    pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, payload);
+}
+/**
+ * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
+ * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
+ *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
+ *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *
+ * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
+ * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
+ * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
+ * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
+ * matches.
+ */
+export function statusUpdatesFilter(data) {
+    const { payload, args, context } = data;
+    if (payload.sessionId !== args.sessionId) {
+        return false;
+    }
+    const connectionUserId = context?.userPayload?.userRecord?.ID;
+    if (!connectionUserId || !payload.ownerUserId) {
+        return false; // fail closed — no identity on either side means no delivery
+    }
+    return UUIDsEqual(payload.ownerUserId, connectionUserId);
+}
 let PushStatusResolver = class PushStatusResolver {
     statusUpdates({ message }, sessionId) {
+        // NOTE: ownerUserId is intentionally NOT returned — it is a server-side filter key only.
         return { message, date: new Date(), sessionId };
     }
 };
 __decorate([
     Subscription(() => PushStatusNotification, {
         topics: PUSH_STATUS_UPDATES_TOPIC,
-        filter: ({ payload, args, context }) => {
-            return payload.sessionId === args.sessionId;
-        },
+        filter: (data) => statusUpdatesFilter(data),
     }),
     __param(0, Root()),
     __param(1, Arg('sessionId', () => String)),

package/dist/generic/PushStatusResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5G,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AAYM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAO7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AANC;IANC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAsF,EAAE,EAAE;YACzH,OAAO,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;QAC9C,CAAC;KACF,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAExB;AAZU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAa9B"}
+{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAgB,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AAkCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,gBAAgB,GAAuB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,6DAA6D;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAM7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,yFAAyF;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAPC;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,CAAC,IAA+G,EAAE,EAAE,CAC1H,mBAAmB,CAAC,IAAI,CAAC;KAC5B,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAGxB;AAZU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAa9B"}