@memberjunction/server 5.51.3 → 5.51.4

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -11,9 +11,9 @@
  * and **executes** every tool call the browser relays back. The three mutations here cover the MVP:
  *
  * 1. {@link RealtimeClientSessionResolver.StartRealtimeClientSession} — authorize, create the
- *    session (storing the target agent id server-side, authoritatively), mint the ephemeral config.
- * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call,
- *    reading the target agent id from the session (NOT the client) so the browser can't swap targets.
+ *    session (storing the target agent id on it), mint the ephemeral config.
+ * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call
+ *    for the target agent stored on the session, re-authorized for the caller on every call.
  * 3. {@link RealtimeClientSessionResolver.RelayRealtimeTranscript} — persist a transcript turn as a
  *    `Conversation Detail`.
  *
@@ -21,6 +21,9 @@
  * - **Start**: the caller must have `CanRun` on the *target* agent (the Realtime Co-Agent is an internal
  *   orchestration agent, so the meaningful gate is the agent doing the real work).
  * - **Execute / Relay**: inbound ownership — the session's `UserID` must equal `contextUser.ID`.
+ * - **Session `Config`**: the owner can edit it through the generic entity API, so nothing in it is
+ *   trusted. Execute re-checks `CanRun` on its target, and its run ids are used only when
+ *   {@link SessionRunIDVerifier} finds them to be records of the session.
  *
  * @module @memberjunction/server
  */
@@ -60,6 +63,7 @@ import { ResolverBase } from '../generic/ResolverBase.js';
 import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { GetReadWriteProvider } from '../util.js';
 import { SessionManager } from '../agentSessions/index.js';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
 import { resolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 
 /**
@@ -135,9 +139,9 @@ const MAX_PRIOR_TRANSCRIPT_CHARS = 8_000;
 const MAX_PRIOR_TRANSCRIPT_LEGS = 5;
 
 /**
- * Authoritative shape persisted in `AIAgentSession.Config_` for a client-direct voice session.
- * The target agent id is stored here at start and read back on every relay — the browser never
- * re-supplies it, so it cannot swap targets mid-session.
+ * Shape persisted in `AIAgentSession.Config_` for a client-direct voice session. The server writes
+ * it, but the session owner can also edit it through the generic entity API, so relays re-check
+ * what they read from it (see the authorization model above).
  */
 interface RealtimeSessionConfig {
     /** The top-level target agent the co-agent voices on behalf of. */
@@ -351,6 +355,7 @@ export class UploadRealtimeRecordingResult {
 export class RealtimeClientSessionResolver extends ResolverBase {
     private readonly sessionManager = new SessionManager();
     private readonly clientSessionService = new RealtimeClientSessionService();
+    private readonly runIDVerifier = new SessionRunIDVerifier();
 
     /**
      * Start a client-direct realtime voice session targeting `targetAgentId`.
@@ -362,7 +367,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      *    agent's `DefaultCoAgentID` → type-level `AIAgentCoAgent` default row → global Realtime Co-Agent) —
      *    see {@link RealtimeClientSessionResolver.resolveCoAgentID} for the full contract.
      * 3. Create the durable `AIAgentSession` (run by the co-agent), storing `targetAgentID` in its
-     *    config server-side — this is the authoritative target for all later relays.
+     *    config — the target later relays use, re-authorized for the caller on each relay.
      * 4. Mint the {@link import('@memberjunction/ai').ClientRealtimeSessionConfig} via the service.
      *    On failure the just-created session is closed so no half-open session leaks.
      *
@@ -477,8 +482,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      * Execute a single tool call the browser relayed from its provider socket and return the
      * serialized result for the browser to relay back to the model.
      *
-     * Ownership-gated; the target agent id is read from the **session config** (authoritative), never
-     * from the client. Heartbeats the session on success.
+     * Ownership-gated. The target agent id is read from the session config and `CanRun` on it is
+     * checked for the caller on every call, because the owner can edit the config. A direct-action
+     * call from a scope-limited caller is refused before any elevation. Heartbeats the session on
+     * success.
      *
      * @returns The serialized tool result JSON.
      */
@@ -494,13 +501,20 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
         const config = this.readSessionConfig(session);
+        await this.assertCanRunTarget(config.targetAgentID, contextUser, provider);
 
         // SCOPED-ANONYMOUS ELEVATION (issue #3371): once ownership is proven above, the delegated
         // run + its AI-run-entity writes execute as the system user for a scoped anonymous caller
         // (the caller's role deliberately holds no grants on the run entities). The lead
-        // targetAgentID comes from the session config and was CanRun-gated at start; the colleague
-        // union is gated just below, against the CALLER, so elevation never widens agent authority.
+        // targetAgentID is CanRun-gated against the CALLER just above, and the colleague union
+        // just below, so elevation never widens agent authority.
         const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const runIDs = await this.runIDVerifier.Verify(
+            session.ID,
+            { CoAgentRunID: config.coAgentRunID, PendingFeedbackRunID: config.pendingFeedbackRunID },
+            runUser,
+            provider,
+        );
         if (runUser !== contextUser) {
             LogStatus(
                 `ExecuteRealtimeSessionTool: dispatching relayed tool '${toolName}' for session ${agentSessionId} ` +
@@ -518,11 +532,11 @@ export class RealtimeClientSessionResolver extends ResolverBase {
                 // row and its context-memory scope must stay the person's, not the system user's.
                 AttributionUserID: contextUser.ID,
                 // Nest the delegated target-agent run under the co-agent observability run (when present).
-                ParentRunID: config.coAgentRunID,
+                ParentRunID: runIDs.CoAgentRunID,
                 Call: { CallID: callId, ToolName: toolName, Arguments: argsJson },
                 OnProgress: this.buildDelegationProgressCallback(pubSub, userPayload, agentSessionId, callId),
                 // Resume a previously-paused delegated run (if any) with the user's answer.
-                ResumeRunID: config.pendingFeedbackRunID,
+                ResumeRunID: runIDs.PendingFeedbackRunID,
             },
             runUser,
             provider,
@@ -558,21 +572,19 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             if (!SIGNIFICANT_PROGRESS_STEPS.includes(progress.step)) {
                 return;
             }
-            pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                message: JSON.stringify({
-                    resolver: 'RealtimeClientSessionResolver',
-                    type: 'RealtimeDelegationProgress',
-                    agentSessionID,
-                    callID,
-                    step: progress.step,
-                    message: progress.message,
-                    percentage: progress.percentage,
-                }),
-                sessionId: userPayload.sessionId,
-            });
+            this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+                resolver: 'RealtimeClientSessionResolver',
+                type: 'RealtimeDelegationProgress',
+                agentSessionID,
+                callID,
+                step: progress.step,
+                message: progress.message,
+                percentage: progress.percentage,
+            }), userPayload);
         };
     }
 
+
     /**
      * Rolls the session's `pendingFeedbackRunID` forward after a relayed tool call. The id we just
      * consumed (resumed or none) is dropped; a new paused run id is stored only when the run paused
@@ -643,14 +655,15 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         // conversation (run-viewer observability parity). Best-effort — never fails the transcript relay.
         // The prompt-run write runs as the scoped-anonymous elevated user (issue #3371) — the visible
         // Conversation Detail above deliberately stays on the caller.
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (promptRunID) {
             await this.clientSessionService.AppendPromptRunMessage(
                 promptRunID,
                 this.mapTranscriptRoleToChatRole(role),
                 text,
                 replacesPrevious ?? false,
-                ResolveScopedAnonymousRunUser(contextUser),
+                runUser,
                 provider,
             );
         }
@@ -831,7 +844,8 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false;
         }
@@ -840,7 +854,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             'assistant',
             this.formatToolTurn(toolName, argsJson, resultJson),
             false,
-            ResolveScopedAnonymousRunUser(contextUser),
+            runUser,
             provider,
         );
     }
@@ -932,16 +946,15 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             return true; // nothing to add — a no-op flush is a success, not a failure
         }
 
-        const promptRunID = this.readPromptRunID(session);
+        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false; // no observability prompt run for this session — logged in the helper
         }
         // Delegate to the service so usage writes share the per-run serialization with transcript-message
         // appends — otherwise the frequent usage save clobbers freshly-appended Messages (and vice-versa).
-        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
-        return this.clientSessionService.AccumulatePromptRunUsage(
-            promptRunID, inputDelta, outputDelta, ResolveScopedAnonymousRunUser(contextUser), provider,
-        );
+        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, runUser, provider);
     }
 
     /** Clamps a relayed token delta: negative / non-finite values become 0. */
@@ -968,24 +981,40 @@ export class RealtimeClientSessionResolver extends ResolverBase {
 
     /**
      * Reads the co-agent `AIPromptRun` id from the session config WITHOUT the relay path's
-     * throw-on-missing-target semantics — usage relay is best-effort, so a missing/malformed
-     * config or absent id just logs and returns `null`.
+     * throw-on-missing-target semantics, and keeps it only when it is the prompt run of the
+     * session's co-agent run (the owner can edit the config). Usage relay is best-effort, so a
+     * missing/malformed config, an absent id, or an id of another session just logs and returns `null`.
+     *
+     * @param runUser The user the prompt-run write runs as; the check runs as the same user.
      */
-    private readPromptRunID(session: MJAIAgentSessionEntity): string | null {
-        try {
-            const config = this.readSessionConfig(session);
-            if (config.promptRunID) {
-                return config.promptRunID;
-            }
+    private async readPromptRunID(
+        session: MJAIAgentSessionEntity,
+        runUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<string | null> {
+        const config = this.tryReadSessionConfig(session);
+        if (!config) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+            return null;
+        }
+        if (!config.promptRunID) {
             LogStatus(
                 `RelayRealtimeUsage: session ${session.ID} has no co-agent promptRunID (observability run ` +
                     'creation was skipped or failed) — usage delta dropped.',
             );
             return null;
-        } catch {
-            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+        }
+        const verified = await this.runIDVerifier.Verify(
+            session.ID,
+            { CoAgentRunID: config.coAgentRunID, PromptRunID: config.promptRunID },
+            runUser,
+            provider,
+        );
+        if (!verified.PromptRunID) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} names a promptRunID that is not its co-agent prompt run — ignored.`);
             return null;
         }
+        return verified.PromptRunID;
     }
 
     /**
@@ -1135,8 +1164,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     }
 
     /**
-     * Authorization gate for {@link RealtimeClientSessionResolver.StartRealtimeClientSession}: the
-     * caller must be able to run the **target** agent. Denial throws (no session is created).
+     * Authorization gate for the **target** agent: the caller must be able to run it. Denial throws.
+     * {@link RealtimeClientSessionResolver.StartRealtimeClientSession} runs it before any session is
+     * created, and {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} runs it on every
+     * relayed call, because the owner can edit the target in the session config.
      */
     private async assertCanRunTarget(
         targetAgentId: string,
@@ -1683,7 +1714,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
 
     /**
      * Writes the co-agent observability run ids into the session's `Config_` alongside the
-     * authoritative `targetAgentID`, then saves the session. These ids are read back on close to
+     * `targetAgentID`, then saves the session. These ids are read back on close to
      * finalize the runs (and on relay to nest delegated runs). Best-effort: a save failure is logged,
      * not thrown — the voice session still proceeds, it just won't carry the run ids.
      */
@@ -2416,9 +2447,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     }
 
     /**
-     * Parses the session's persisted config, returning the authoritative `targetAgentID` plus any
-     * observability run ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed
-     * or carries no target — a relay cannot proceed without a target.
+     * Parses the session's persisted config, returning its `targetAgentID` plus any observability run
+     * ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed or carries no
+     * target — a relay cannot proceed without a target. The owner can edit the config, so callers
+     * re-check what they act on.
      */
     private readSessionConfig(session: MJAIAgentSessionEntity): RealtimeSessionConfig {
         const raw = session.Config_;

package/src/resolvers/RemoteBrowserActionResolver.ts

@@ -24,6 +24,7 @@ import { MJAIAgentSessionEntity, MJAIAgentEntity } from '@memberjunction/core-en
 import { RemoteBrowserEngine } from '@memberjunction/remote-browser-server';
 import { beginBrowserGoalStep, finalizeBrowserGoalStep, extractCoAgentRunID } from '../agentSessions/remoteBrowserGoalEngine.js';
 import { RemoteBrowserGoalRegistry } from '../agentSessions/remoteBrowserGoalRegistry.js';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
 import { randomUUID } from 'node:crypto';
 import {
   RemoteBrowserAction,
@@ -240,6 +241,9 @@ export class RemoteBrowserActionResolver extends ResolverBase {
    */
   private startedScreencasts = new Set<string>();
 
+  /** Checks the co-agent run id read from a session's owner-editable `Config_` before a step is attached to it. */
+  private readonly runIDVerifier = new SessionRunIDVerifier();
+
   /**
    * Agent-session ids whose live tab-audio stream this resolver has already started. Keyed by
    * `agentSessionID` so a re-issued {@link RemoteBrowserActionResolver.StartRemoteBrowserAudioStream}
@@ -327,7 +331,13 @@ export class RemoteBrowserActionResolver extends ResolverBase {
     const providerName = await this.resolveProviderName(session, contextUser, provider);
     // Observability: nest this goal's many prompt runs under ONE "Browser goal" step on the realtime
     // co-agent run (when the session has one). Best-effort — a null step just means the goal runs unlinked.
-    const coAgentRunID = extractCoAgentRunID(session.Config_);
+    // The owner can edit Config_, so its run id is used only when it is a run of this session.
+    const { CoAgentRunID: coAgentRunID } = await this.runIDVerifier.Verify(
+      session.ID,
+      { CoAgentRunID: extractCoAgentRunID(session.Config_) },
+      contextUser,
+      provider,
+    );
     const goalStep = await beginBrowserGoalStep(provider, contextUser, coAgentRunID, goal);
 
     // ASYNC START: a goal loop can run for minutes; do NOT hold this request open for it (browser
@@ -750,18 +760,15 @@ export class RemoteBrowserActionResolver extends ResolverBase {
     agentSessionID: string,
     frame: { DataBase64: string; Width: number; Height: number; SequenceNumber: number },
   ): void {
-    pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-      message: JSON.stringify({
-        resolver: 'RemoteBrowserActionResolver',
-        type: 'RemoteBrowserScreencastFrame',
-        agentSessionID,
-        dataBase64: frame.DataBase64,
-        width: frame.Width,
-        height: frame.Height,
-        seq: frame.SequenceNumber,
-      }),
-      sessionId: userPayload.sessionId,
-    });
+    this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+      resolver: 'RemoteBrowserActionResolver',
+      type: 'RemoteBrowserScreencastFrame',
+      agentSessionID,
+      dataBase64: frame.DataBase64,
+      width: frame.Width,
+      height: frame.Height,
+      seq: frame.SequenceNumber,
+    }), userPayload);
   }
 
   /**
@@ -775,19 +782,16 @@ export class RemoteBrowserActionResolver extends ResolverBase {
    * @param chunk The encoded audio chunk.
    */
   private publishAudioChunk(pubSub: PubSubEngine, userPayload: UserPayload, agentSessionID: string, chunk: RemoteBrowserAudioChunk): void {
-    pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-      message: JSON.stringify({
-        resolver: 'RemoteBrowserActionResolver',
-        type: 'RemoteBrowserAudioChunk',
-        agentSessionID,
-        dataBase64: chunk.DataBase64,
-        codec: chunk.Codec,
-        sampleRate: chunk.SampleRate,
-        channels: chunk.Channels,
-        seq: chunk.SequenceNumber,
-      }),
-      sessionId: userPayload.sessionId,
-    });
+    this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+      resolver: 'RemoteBrowserActionResolver',
+      type: 'RemoteBrowserAudioChunk',
+      agentSessionID,
+      dataBase64: chunk.DataBase64,
+      codec: chunk.Codec,
+      sampleRate: chunk.SampleRate,
+      channels: chunk.Channels,
+      seq: chunk.SequenceNumber,
+    }), userPayload);
   }
 
   /**

package/src/resolvers/RunAIAgentResolver.ts

@@ -8,7 +8,6 @@ import { MJAIAgentEntityExtended, MJAIAgentRunEntityExtended, ExecuteAgentResult
 import { AIEngine } from '@memberjunction/aiengine';
 import { ChatMessage, ChatMessageContent } from '@memberjunction/ai';
 import { ResolverBase } from '../generic/ResolverBase.js';
-import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { startLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadWriteProvider } from '../util.js';
@@ -306,28 +305,22 @@ export class RunAIAgentResolver extends ResolverBase {
     }
 
     private PublishProgressUpdate(pubSub: PubSubEngine, data: any, userPayload: UserPayload) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, { 
-            message: JSON.stringify({
-                resolver: 'RunAIAgentResolver',
-                type: 'ExecutionProgress',
-                status: 'ok',
-                data,
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunAIAgentResolver',
+            type: 'ExecutionProgress',
+            status: 'ok',
+            data,
+        }), userPayload);
     }
 
 
     private PublishStreamingUpdate(pubSub: PubSubEngine, data: any, userPayload: UserPayload) {
-        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, { 
-            message: JSON.stringify({
-                resolver: 'RunAIAgentResolver',
-                type: 'StreamingContent',
-                status: 'ok',
-                data,
-            }),
-            sessionId: userPayload.sessionId,
-        });
+        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+            resolver: 'RunAIAgentResolver',
+            type: 'StreamingContent',
+            status: 'ok',
+            data,
+        }), userPayload);
     }
 
     /**
@@ -814,17 +807,15 @@ export class RunAIAgentResolver extends ResolverBase {
                 LogStatus(`📬 Notification sent via ${channelList} (ID: ${result.inAppNotificationId})`);
 
                 // Publish real-time notification event so client updates immediately
-                pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                    userPayload: JSON.stringify(userPayload),
-                    message: JSON.stringify({
-                        type: 'notification',
-                        notificationId: result.inAppNotificationId,
-                        action: 'create',
-                        title: `${agentName} completed your request`,
-                        message: message,
-                        conversationId: conversationId
-                    })
-                });
+                // NOTE (B49): normalized from a malformed no-sessionId payload
+                this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+                    type: 'notification',
+                    notificationId: result.inAppNotificationId,
+                    action: 'create',
+                    title: `${agentName} completed your request`,
+                    message: message,
+                    conversationId: conversationId
+                }), userPayload);
 
                 LogStatus(`📡 Published notification event to client`);
             } else if (!result.success) {
@@ -926,16 +917,14 @@ export class RunAIAgentResolver extends ResolverBase {
                 LogStatus(`📬 Feedback request notification sent (ID: ${notifResult.inAppNotificationId})`);
 
                 // Publish real-time notification event
-                pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
-                    userPayload: JSON.stringify(userPayload),
-                    message: JSON.stringify({
-                        type: 'notification',
-                        notificationId: notifResult.inAppNotificationId,
-                        action: 'create',
-                        title: `${agentName} needs your input`,
-                        message: truncatedMessage
-                    })
-                });
+                // NOTE (B49): normalized from a malformed no-sessionId payload
+                this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
+                    type: 'notification',
+                    notificationId: notifResult.inAppNotificationId,
+                    action: 'create',
+                    title: `${agentName} needs your input`,
+                    message: truncatedMessage
+                }), userPayload);
             } else if (!notifResult.success) {
                 LogError(`Feedback request notification failed: ${notifResult.errors?.join(', ')}`);
             }
@@ -1294,6 +1283,7 @@ export class RunAIAgentResolver extends ResolverBase {
         const pulse = startLivenessPulse({
             pubSub,
             sessionId,
+            ownerUserId: userPayload.userRecord.ID,
             resolver: 'RunAIAgentResolver',
             readStatus: () => runRef.current
                 ? { runId: runRef.current.ID, status: runRef.current.Status }

package/src/resolvers/RunTemplateResolver.ts

@@ -2,7 +2,7 @@ import { Resolver, Mutation, Arg, Ctx, ObjectType, Field } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, Metadata, RunView } from '@memberjunction/core';
 import { MJTemplateContentEntity, MJTemplateEntityExtended } from '@memberjunction/core-entities';
-import { TemplateEngineServer } from '@memberjunction/templates';
+import { GetTemplateRunRefusal, TemplateEngineServer } from '@memberjunction/templates';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
 
@@ -45,6 +45,18 @@ export class RunTemplateResolver extends ResolverBase {
         try {
             LogStatus(`=== RUNNING TEMPLATE FOR ID: ${templateId} ===`);
 
+            // Same rule as the Template.Run remote operation, checked before anything is loaded
+            const currentUser = this.GetUserFromPayload(userPayload);
+            const p = GetReadWriteProvider(providers);
+            const refusal = GetTemplateRunRefusal(currentUser, p);
+            if (refusal) {
+                return {
+                    success: false,
+                    error: refusal,
+                    executionTimeMs: Date.now() - startTime
+                };
+            }
+
             // Parse context data (JSON string)
             let data = {};
             if (contextData) {
@@ -59,17 +71,6 @@ export class RunTemplateResolver extends ResolverBase {
                 }
             }
 
-            // Get current user from payload
-            const currentUser = this.GetUserFromPayload(userPayload);
-            if (!currentUser) {
-                return {
-                    success: false,
-                    error: 'Unable to determine current user',
-                    executionTimeMs: Date.now() - startTime
-                };
-            }
-            
-            const p = GetReadWriteProvider(providers);
             // Load the template entity
             const templateEntity = await p.GetEntityObject<MJTemplateEntityExtended>('MJ: Templates', currentUser);
             await templateEntity.Load(templateId);