@memberjunction/server 5.51.3 → 5.51.4

package/src/agentSessions/SessionRunIDVerifier.ts

@@ -0,0 +1,179 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { IMetadataProvider, LogError, RunView, RunViewParams, UserInfo } from '@memberjunction/core';
+import { IsValidUUID, UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+
+const AGENT_RUN_ENTITY = 'MJ: AI Agent Runs';
+const AGENT_RUN_STEP_ENTITY = 'MJ: AI Agent Run Steps';
+
+/**
+ * Escapes a value for a single-quoted SQL literal: drops null bytes and doubles quotes. A copy of
+ * `EscapeSQLString` from `@memberjunction/global` on next, which lts/5 does not have.
+ */
+function EscapeSQLString(value: string): string {
+    return value.replace(/\0/g, '').replace(/'/g, "''");
+}
+
+/**
+ * The run ids a realtime voice session keeps in its `Config` JSON. Server code reads and writes the
+ * records they point at, often as an elevated user.
+ */
+export interface SessionRunIDs {
+    /** The co-agent observability run (`MJ: AI Agent Runs`). */
+    CoAgentRunID?: string;
+    /** The co-agent prompt run (`MJ: AI Prompt Runs`), linked through the co-agent run's prompt step. */
+    PromptRunID?: string;
+    /** The co-agent run's system-prompt step (`MJ: AI Agent Run Steps`). */
+    CoAgentRunStepID?: string;
+    /** A delegated run (`MJ: AI Agent Runs`) that paused for the user's answer. */
+    PendingFeedbackRunID?: string;
+}
+
+/** A row of the run-step lookup. */
+interface RunStepRow {
+    ID: string;
+    StepType: string;
+    TargetLogID: string | null;
+}
+
+/** A row of either lookup; the run lookup returns only `ID`. */
+type LookupRow = Partial<RunStepRow> & { ID: string };
+
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    public async Verify(
+        sessionID: string,
+        claimed: SessionRunIDs,
+        contextUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<SessionRunIDs> {
+        const candidates = this.keepUUIDs(claimed);
+        if (!candidates.CoAgentRunID && !candidates.PendingFeedbackRunID) {
+            return {};
+        }
+        return (await this.lookUpOwned(sessionID.trim(), candidates, contextUser, provider)) ?? {};
+    }
+
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    private keepUUIDs(claimed: SessionRunIDs): SessionRunIDs {
+        const coAgentRunID = this.uuidOrUndefined(claimed.CoAgentRunID);
+        return {
+            CoAgentRunID: coAgentRunID,
+            PromptRunID: coAgentRunID ? this.uuidOrUndefined(claimed.PromptRunID) : undefined,
+            CoAgentRunStepID: coAgentRunID ? this.uuidOrUndefined(claimed.CoAgentRunStepID) : undefined,
+            PendingFeedbackRunID: this.uuidOrUndefined(claimed.PendingFeedbackRunID),
+        };
+    }
+
+    private uuidOrUndefined(value: string | undefined): string | undefined {
+        return value && IsValidUUID(value) ? value.trim() : undefined;
+    }
+
+    /** Runs the lookups; `null` when one of them fails. */
+    private async lookUpOwned(
+        sessionID: string,
+        candidates: SessionRunIDs,
+        contextUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<SessionRunIDs | null> {
+        const stepsQuery = this.stepsQuery(candidates);
+        const queries = stepsQuery ? [this.runsQuery(sessionID, candidates), stepsQuery] : [this.runsQuery(sessionID, candidates)];
+        try {
+            const lookupUser = UserCache.Instance.GetSystemUser() ?? contextUser;
+            const [runs, steps] = await RunView.FromMetadataProvider(provider).RunViews<LookupRow>(queries, lookupUser);
+            const failed = [runs, steps].find((result) => result && !result.Success);
+            if (!runs || failed) {
+                LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${failed?.ErrorMessage ?? 'no result'}`);
+                return null;
+            }
+            return this.pickOwned(candidates, runs.Results, steps?.Results ?? []);
+        } catch (error) {
+            LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+
+    /** The claimed runs that carry this session's id. */
+    private runsQuery(sessionID: string, candidates: SessionRunIDs): RunViewParams {
+        const ids = [candidates.CoAgentRunID, candidates.PendingFeedbackRunID]
+            .filter((id): id is string => !!id)
+            .map((id) => `'${EscapeSQLString(id)}'`);
+        return {
+            EntityName: AGENT_RUN_ENTITY,
+            ExtraFilter: `AgentSessionID='${EscapeSQLString(sessionID)}' AND ID IN (${ids.join(', ')})`,
+            Fields: ['ID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    private stepsQuery(candidates: SessionRunIDs): RunViewParams | null {
+        const matches: string[] = [];
+        if (candidates.CoAgentRunStepID) {
+            matches.push(`ID='${EscapeSQLString(candidates.CoAgentRunStepID)}'`);
+        }
+        if (candidates.PromptRunID) {
+            matches.push(`TargetLogID='${EscapeSQLString(candidates.PromptRunID)}'`);
+        }
+        if (!candidates.CoAgentRunID || matches.length === 0) {
+            return null;
+        }
+        return {
+            EntityName: AGENT_RUN_STEP_ENTITY,
+            ExtraFilter: `AgentRunID='${EscapeSQLString(candidates.CoAgentRunID)}' AND (${matches.join(' OR ')})`,
+            Fields: ['ID', 'StepType', 'TargetLogID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+
+    private pickOwned(candidates: SessionRunIDs, runs: LookupRow[], steps: LookupRow[]): SessionRunIDs {
+        const isOwnedRun = (id: string | undefined): boolean => !!id && runs.some((row) => UUIDsEqual(row.ID, id));
+        const coAgentRunID = isOwnedRun(candidates.CoAgentRunID) ? candidates.CoAgentRunID : undefined;
+        const ownedSteps = coAgentRunID ? steps : [];
+        const stepID = candidates.CoAgentRunStepID;
+        const promptRunID = candidates.PromptRunID;
+        return {
+            CoAgentRunID: coAgentRunID,
+            CoAgentRunStepID: stepID && ownedSteps.some((row) => UUIDsEqual(row.ID, stepID)) ? stepID : undefined,
+            PromptRunID:
+                promptRunID && ownedSteps.some((row) => row.StepType === 'Prompt' && UUIDsEqual(row.TargetLogID, promptRunID))
+                    ? promptRunID
+                    : undefined,
+            PendingFeedbackRunID: isOwnedRun(candidates.PendingFeedbackRunID) ? candidates.PendingFeedbackRunID : undefined,
+        };
+    }
+}

package/src/agentSessions/index.ts

@@ -32,3 +32,4 @@ export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';

package/src/auth/actionAuthorization.ts

@@ -0,0 +1,119 @@
+import { AuthorizationInfo, AuthorizationRoleInfo, AuthorizationRoleType, IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { NormalizeUUID, UUIDsEqual } from '@memberjunction/global';
+
+/** Authorizations keyed by their normalized ID. */
+type AuthorizationsByID = Map<string, AuthorizationInfo>;
+
+/** The outcome of {@link EvaluateActionRunAuthorization}. */
+export interface ActionRunAuthorization {
+    /** True when the user may run the action. */
+    Allowed: boolean;
+    /** Why the run is allowed or refused. */
+    Reason: string;
+}
+
+/** One provider's authorization tree and the role grants on it. */
+export type AuthorizationMetadata = Pick<IMetadataProvider, 'Authorizations' | 'AuthorizationRoles'>;
+
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export function IsOwner(user: UserInfo): boolean {
+    return user.Type?.trim().toLowerCase() === 'owner';
+}
+
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export function EvaluateActionRunAuthorization(
+    user: UserInfo,
+    actionAuthorizationIDs: readonly string[],
+    metadata: AuthorizationMetadata,
+    actionAuthorizesCaller: boolean
+): ActionRunAuthorization {
+    if (IsOwner(user)) {
+        return { Allowed: true, Reason: 'The user is an Owner.' };
+    }
+    if (actionAuthorizationIDs.length === 0) {
+        return actionAuthorizesCaller
+            ? { Allowed: true, Reason: 'The action authorizes its caller itself.' }
+            : { Allowed: false, Reason: 'No Action Authorization grants this action to any role, and the action does not authorize its caller itself; only an Owner may run it.' };
+    }
+    const authorizationsByID: AuthorizationsByID = new Map(metadata.Authorizations.map((auth) => [NormalizeUUID(auth.ID), auth]));
+    const userGrants = grantsToUserRoles(user, metadata.AuthorizationRoles);
+    const granted = actionAuthorizationIDs
+        .map((id) => authorizationsByID.get(NormalizeUUID(id)))
+        .filter((auth): auth is AuthorizationInfo => auth !== undefined)
+        .find((auth) => holdsLinkedAuthorization(auth, authorizationsByID, userGrants));
+    return granted
+        ? { Allowed: true, Reason: `The user holds the "${granted.Name}" authorization.` }
+        : { Allowed: false, Reason: 'None of your roles holds an authorization this action requires.' };
+}
+
+/** The role grants that name one of the user's roles. */
+function grantsToUserRoles(user: UserInfo, grants: readonly AuthorizationRoleInfo[]): AuthorizationRoleInfo[] {
+    const userRoleIDs = new Set((user.UserRoles ?? []).map((userRole) => NormalizeUUID(userRole.RoleID)));
+    return grants.filter((grant) => userRoleIDs.has(NormalizeUUID(grant.RoleID)));
+}
+
+/**
+ * True when the user holds a linked authorization: it is active, none of the user's roles is denied
+ * it, and the user holds it directly or through an ancestor. The first two are checked on the linked
+ * authorization itself, because the ancestor walk would otherwise grant it through the parent.
+ */
+function holdsLinkedAuthorization(auth: AuthorizationInfo, authorizationsByID: AuthorizationsByID, userGrants: readonly AuthorizationRoleInfo[]): boolean {
+    if (!auth.IsActive || grantTypes(auth, userGrants).includes(AuthorizationRoleType.Deny)) {
+        return false;
+    }
+    return holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants);
+}
+
+/**
+ * True when the user holds the authorization or one of its ancestors, following `ParentID` within
+ * `authorizationsByID`. This is the walk `AuthorizationEvaluator.UserCanExecuteWithAncestors` does,
+ * with the role grants taken from the same provider as the authorizations.
+ */
+function holdsDirectlyOrThroughAncestor(auth: AuthorizationInfo, authorizationsByID: AuthorizationsByID, userGrants: readonly AuthorizationRoleInfo[]): boolean {
+    const visited = new Set<string>();
+    let node: AuthorizationInfo | undefined = auth;
+    while (node && !visited.has(NormalizeUUID(node.ID))) {
+        if (holdsDirectly(node, userGrants)) {
+            return true;
+        }
+        visited.add(NormalizeUUID(node.ID));
+        node = node.ParentID ? authorizationsByID.get(NormalizeUUID(node.ParentID)) : undefined;
+    }
+    return false;
+}
+
+/** True when the authorization is active and the user's roles have an Allow and no Deny on it. */
+function holdsDirectly(auth: AuthorizationInfo, userGrants: readonly AuthorizationRoleInfo[]): boolean {
+    const types = grantTypes(auth, userGrants);
+    return auth.IsActive && types.includes(AuthorizationRoleType.Allow) && !types.includes(AuthorizationRoleType.Deny);
+}
+
+/** Allow or Deny, for each of the user's role grants on the authorization. */
+function grantTypes(auth: AuthorizationInfo, userGrants: readonly AuthorizationRoleInfo[]): AuthorizationRoleType[] {
+    return userGrants.filter((grant) => UUIDsEqual(grant.AuthorizationID, auth.ID)).map((grant) => grant.AuthorizationType());
+}

package/src/auth/index.ts

@@ -10,6 +10,7 @@ import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { initializeAuthProviders } from './initializeProviders.js';
 
 export * from './APIKeyScopeAuth.js';
+export * from './scopeLimitedPrincipal.js';
 
 // This is a hard-coded forever constant due to internal migrations
 

package/src/auth/scopeLimitedPrincipal.ts

@@ -0,0 +1,50 @@
+import { UserInfo } from '@memberjunction/core';
+
+/**
+ * True when a session's read authority is deliberately narrower than the role grant it
+ * authenticates with — i.e. the principal is confined by per-session scope rather than by
+ * its roles alone.
+ *
+ * Two such principals exist today, both from the magic-link surface:
+ *
+ * - **Anonymous magic-link guests** (`IsMagicLinkAnonymous`) authenticate as the *shared*
+ *   Anonymous principal, so their role grant is common to every guest. What separates one
+ *   guest from another is not the role — it is the per-session scope.
+ * - **Resource-scoped magic-link sessions** (`MagicLinkScope`) hold a normal role, pinned to
+ *   one shared resource (and its FK-reachable dependents) for the life of the session.
+ *
+ * In both cases the confinement is expressed as row-level-security filter tokens
+ * (`{{ScopeResourceID}}` / `{{ScopeResourceType}}`) that the entity-read path substitutes.
+ * That means the confinement only exists on code paths that go **through** entity
+ * permissions and RLS — `RunView`, `BaseEntity`, the generated resolvers. Any path that
+ * reaches the database *around* those layers (raw SQL on the read-only pool, for instance)
+ * sees no scope at all, so such a path must refuse these principals outright rather than
+ * assume a filter it never applies.
+ *
+ * Callers should treat a `true` result as "not permitted here", never as "apply a narrower
+ * filter" — a caller that could narrow correctly would not need this predicate.
+ *
+ * @param user the principal to classify. A missing principal returns `true`: an
+ *        unidentifiable session is the one case where the scope certainly cannot be
+ *        established, so it fails closed.
+ * @returns `true` when the principal is scope-limited (or unidentifiable), else `false`.
+ *
+ * @example
+ * ```typescript
+ * if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+ *     return this.buildErrorResult('Not permitted for scope-limited sessions.');
+ * }
+ * ```
+ */
+export function IsScopeLimitedPrincipal(user: UserInfo | undefined | null): boolean {
+    if (!user) {
+        return true; // no identifiable principal — fail closed
+    }
+    if (user.IsMagicLinkAnonymous) {
+        return true;
+    }
+    const scope = user.MagicLinkScope;
+    // An empty scope object carries no confinement; only a populated one does. (Truthiness
+    // of the object alone would classify `{}` as scoped and lock out a session that is not.)
+    return !!(scope?.ResourceID || scope?.ResourceType);
+}

package/src/config.ts

@@ -198,6 +198,29 @@ const cacheSettingsSchema = z.object({
   evictionSweepIntervalSeconds: z.number().optional().default(300),
   /** Enable verbose cache logging (hits, misses, evictions). Default: false. */
   verboseLogging: z.boolean().optional().default(false),
+  /**
+   * Entity names whose FULL ROW may ride along with a cache-invalidation broadcast.
+   *
+   * The cache-invalidation subscription is delivered to EVERY connected client with no per-user
+   * filter (see CacheInvalidationResolver), so any row named here is disclosed to every signed-in
+   * session, whatever row-level security or tenant scoping would otherwise apply to reading it.
+   *
+   * Defaults to `[]`: invalidation still carries the entity name and primary key, which is all a
+   * client needs to evict, and the client re-fetches through the normal read path where access
+   * control applies. Listing an entity re-enables the apply-in-place optimisation for it — correct
+   * only for reference data every signed-in user is allowed to read.
+   *
+   * What the re-fetch costs depends on the consumer. `ConversationEngine` re-reads the ONE record
+   * by primary key. `BaseEngine` (every engine subclass with `AutoRefresh`, the default) applies a
+   * remote save in place only when the row is present, so without it a remote save falls through to
+   * a full reload of each matching config — a `RunView` of that entity, not a keyed read. Remote
+   * deletes still apply in place from the primary key. Engine-cached reference entities that every
+   * signed-in user may read are the ones worth listing here.
+   *
+   * `['*']` opts every entity in, restoring the previous behaviour. Only safe on a deployment where
+   * every signed-in user may read every row of every entity.
+   */
+  recordDataBroadcastEntities: z.array(z.string()).optional().default([]),
 });
 
 const loggingSettingsSchema = z.object({
@@ -623,7 +646,17 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     autoCreateNewUsers: true,
     newUserLimitedToAuthorizedDomains: false,
     newUserAuthorizedDomains: [],
-    newUserRoles: ['UI', 'Developer'],
+    // 'UI' ONLY, deliberately (issue #4260). Auto-provisioning is on by default above, with no
+    // domain restriction, so this list is the standing authority of anyone the configured IdP will
+    // issue a token for. On the baseline seed 'Developer' and 'Integration' hold unfiltered
+    // CanUpdate on ~439 of the database's ~446 entities, so defaulting every such identity into
+    // either grants broad data-plane access no host should hand out by default. (The MJ: Users
+    // escalation this list also used to guard against — writing your own Type to 'Owner' — is now
+    // closed at the entity layer regardless of role: see MJUserEntityServer in
+    // @memberjunction/core-entities-server.) 'UI' carries the end-user surface (conversations,
+    // views, dashboards, settings) and no write on MJ: Users. Hosts that need more grant it
+    // per-deployment.
+    newUserRoles: ['UI'],
     updateCacheWhenNotFound: true,
     updateCacheWhenNotFoundDelay: 5000,
     contextUserForNewUserCreation: 'not.set@nowhere.com',

package/src/context.ts

@@ -8,7 +8,8 @@ import sql from 'mssql';
 import { getSigningKeys, getSystemUser, getValidationOptions, verifyUserRecord, extractUserInfoFromPayload } from './auth/index.js';
 import { TokenExpiredError, AuthProviderFactory } from '@memberjunction/auth-providers';
 import { authCache } from './cache.js';
-import { userEmailMap, apiKey, mj_core_schema } from './config.js';
+import { userEmailMap, apiKey, mj_core_schema, configInfo } from './config.js';
+import { BuildPostgreSQLConnectionConfig, PostgreSQLReadOnlyPool, ResolvePostgreSQLEndpoint, ResolvePostgreSQLReadOnlyCredentials } from './postgresqlPoolSettings.js';
 import { buildBoundaryLogPayload } from './logging/boundaryLogPayload.js';
 import { StartupLogger } from './logging/StartupLogger.js';
 import { DataSourceInfo, UserPayload } from './types.js';
@@ -748,36 +749,35 @@ async function createPerRequestProviders(
     { provider: p, type: 'Read-Write' }
   ];
 
-  if (isPostgres) {
-    const rp = await tryCreateReadOnlyPostgresProvider();
-    if (rp) {
-      providers.push({ provider: rp, type: 'Read-Only' });
-    }
-  } else {
-    const rp = await tryCreateReadOnlyProvider(dataSources);
-    if (rp) {
-      providers.push({ provider: rp, type: 'Read-Only' });
-    }
+  const rp = await CreateReadOnlyProvider(dataSources);
+  if (rp) {
+    providers.push({ provider: rp, type: 'Read-Only' });
   }
 
   return providers;
 }
 
+/**
+ * Opens a provider on the read-only database login, for the current platform. Resolves null when no
+ * read-only login is configured; it never falls back to the read-write pool.
+ * @param dataSources the data sources MJAPI opened at startup
+ */
+export async function CreateReadOnlyProvider(dataSources: DataSourceInfo[]): Promise<DatabaseProviderBase | null> {
+  return resolveDbPlatformFromEnv() === 'postgresql'
+    ? tryCreateReadOnlyPostgresProvider()
+    : tryCreateReadOnlyProvider(dataSources);
+}
+
 /**
  * Creates a PostgreSQL per-request provider, sharing the connection pool
  * from the primary provider to avoid pool exhaustion.
  */
 async function createPostgresProvider(): Promise<DatabaseProviderBase> {
   const { PostgreSQLDataProvider, PostgreSQLProviderConfigData } = await import('@memberjunction/postgresql-dataprovider');
-  const pgHost = process.env.PG_HOST || process.env.DB_HOST || 'localhost';
-  const pgPort = parseInt(process.env.PG_PORT || process.env.DB_PORT || '5432', 10);
-  const pgUser = process.env.PG_USERNAME || process.env.DB_USERNAME || 'postgres';
-  const pgPass = process.env.PG_PASSWORD || process.env.DB_PASSWORD || '';
-  const pgDatabase = process.env.PG_DATABASE || process.env.DB_DATABASE || '';
 
   const pgProvider = new PostgreSQLDataProvider();
   const pgConfig = new PostgreSQLProviderConfigData(
-    { Host: pgHost, Port: pgPort, Database: pgDatabase, User: pgUser, Password: pgPass },
+    BuildPostgreSQLConnectionConfig(ResolvePostgreSQLEndpoint(), configInfo.databaseSettings, 'api'),
     mj_core_schema,
     0,
     undefined,
@@ -797,39 +797,30 @@ async function createPostgresProvider(): Promise<DatabaseProviderBase> {
 }
 
 /**
- * Attempts to create a read-only PostgreSQL provider using DB_READ_ONLY_USERNAME/PASSWORD.
- * Shares the connection pool from the primary provider. Returns null if no read-only credentials are configured.
+ * Creates a read-only PostgreSQL per-request provider on the read-only pool MJAPI opened at
+ * startup with the read-only login. Returns null when no read-only login is configured, so the
+ * caller never falls back to the read-write pool.
  */
 async function tryCreateReadOnlyPostgresProvider(): Promise<DatabaseProviderBase | null> {
-  const roUser = process.env.PG_READ_ONLY_USERNAME || process.env.DB_READ_ONLY_USERNAME;
-  const roPass = process.env.PG_READ_ONLY_PASSWORD || process.env.DB_READ_ONLY_PASSWORD;
-  if (!roUser || !roPass) {
+  const readOnlyPool = PostgreSQLReadOnlyPool.Instance.Pool;
+  const credentials = ResolvePostgreSQLReadOnlyCredentials(configInfo);
+  if (!readOnlyPool || !credentials) {
     return null;
   }
 
   try {
     const { PostgreSQLDataProvider, PostgreSQLProviderConfigData } = await import('@memberjunction/postgresql-dataprovider');
-    const pgHost = process.env.PG_HOST || process.env.DB_HOST || 'localhost';
-    const pgPort = parseInt(process.env.PG_PORT || process.env.DB_PORT || '5432', 10);
-    const pgDatabase = process.env.PG_DATABASE || process.env.DB_DATABASE || '';
 
     const roProvider = new PostgreSQLDataProvider();
     const roConfig = new PostgreSQLProviderConfigData(
-      { Host: pgHost, Port: pgPort, Database: pgDatabase, User: roUser, Password: roPass },
+      BuildPostgreSQLConnectionConfig({ ...ResolvePostgreSQLEndpoint(), ...credentials }, configInfo.databaseSettings, 'read-only'),
       mj_core_schema,
       0,
       undefined,
       undefined,
       false,
     );
-
-    const primaryProvider = Metadata.Provider as unknown as { DatabaseConnection?: import('pg').Pool }; // global-provider-ok: bootstrap (share primary provider's PG pool with the read-only provider)
-    if (primaryProvider?.DatabaseConnection) {
-      await roProvider.ConfigWithSharedPool(roConfig, primaryProvider.DatabaseConnection);
-    } else {
-      await roProvider.Config(roConfig);
-    }
-
+    await roProvider.ConfigWithSharedPool(roConfig, readOnlyPool);
     return roProvider;
   } catch (_err) {
     return null;