@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.3

package/src/resolvers/QueryResolver.ts

@@ -43,6 +43,9 @@ export class RunQueryInput {
 
   @Field(() => GraphQLJSONObject, { nullable: true, description: 'Optional runtime-only directive to post-process result rows through a registered query result enricher ({ EnricherKey, Config })' })
   Enrichment?: RunQueryEnrichment;
+
+  @Field(() => String, { nullable: true, description: "Read source: 'Live' (default) or 'Materialized' (serve from a fresh RowFilterBroad materialization when available; falls back to live otherwise)" })
+  DataSource?: 'Live' | 'Materialized';
 }
 
 @ObjectType()
@@ -195,7 +198,8 @@ export class RunQueryResolver extends ResolverBase {
                      @Arg('StartRow', () => Int, {nullable: true}) StartRow?: number,
                      @Arg('ForceAuditLog', () => Boolean, {nullable: true}) ForceAuditLog?: boolean,
                      @Arg('AuditLogDescription', () => String, {nullable: true}) AuditLogDescription?: string,
-                     @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment): Promise<RunQueryResultType> {
+                     @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment,
+                     @Arg('DataSource', () => String, {nullable: true, description: "Read source: 'Live' (default) or 'Materialized' (serve from a fresh RowFilterBroad materialization when available; falls back to live otherwise)"}) DataSource?: 'Live' | 'Materialized'): Promise<RunQueryResultType> {
     // Check API key scope authorization for query execution
     await this.CheckAPIKeyScopeAuthorization('query:run', QueryID, context.userPayload);
 
@@ -212,7 +216,8 @@ export class RunQueryResolver extends ResolverBase {
         StartRow: StartRow,
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
-        Enrichment: Enrichment
+        Enrichment: Enrichment,
+        DataSource: DataSource
       },
       context.userPayload.userRecord);
 
@@ -256,7 +261,8 @@ export class RunQueryResolver extends ResolverBase {
                            @Arg('StartRow', () => Int, {nullable: true}) StartRow?: number,
                            @Arg('ForceAuditLog', () => Boolean, {nullable: true}) ForceAuditLog?: boolean,
                            @Arg('AuditLogDescription', () => String, {nullable: true}) AuditLogDescription?: string,
-                           @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment): Promise<RunQueryResultType> {
+                           @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment,
+                           @Arg('DataSource', () => String, {nullable: true, description: "Read source: 'Live' (default) or 'Materialized' (serve from a fresh RowFilterBroad materialization when available; falls back to live otherwise)"}) DataSource?: 'Live' | 'Materialized'): Promise<RunQueryResultType> {
     // Check API key scope authorization for query execution
     await this.CheckAPIKeyScopeAuthorization('query:run', QueryName, context.userPayload);
 
@@ -272,7 +278,8 @@ export class RunQueryResolver extends ResolverBase {
         StartRow: StartRow,
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
-        Enrichment: Enrichment
+        Enrichment: Enrichment,
+        DataSource: DataSource
       },
       context.userPayload.userRecord);
       
@@ -304,7 +311,8 @@ export class RunQueryResolver extends ResolverBase {
                                @Arg('StartRow', () => Int, {nullable: true}) StartRow?: number,
                                @Arg('ForceAuditLog', () => Boolean, {nullable: true}) ForceAuditLog?: boolean,
                                @Arg('AuditLogDescription', () => String, {nullable: true}) AuditLogDescription?: string,
-                               @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment): Promise<RunQueryResultType> {
+                               @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment,
+                               @Arg('DataSource', () => String, {nullable: true, description: "Read source: 'Live' (default) or 'Materialized' (serve from a fresh RowFilterBroad materialization when available; falls back to live otherwise)"}) DataSource?: 'Live' | 'Materialized'): Promise<RunQueryResultType> {
     const provider = GetReadOnlyProvider(context.providers, {allowFallbackToReadWrite: true});
     const md = provider as unknown as IMetadataProvider;
     const rq = new RunQuery(provider as unknown as IRunQueryProvider);
@@ -319,10 +327,11 @@ export class RunQueryResolver extends ResolverBase {
         StartRow: StartRow,
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
-        Enrichment: Enrichment
+        Enrichment: Enrichment,
+        DataSource: DataSource
       },
       context.userPayload.userRecord);
-    
+
     // If QueryName is not populated by the provider, use efficient lookup
     let queryName = result.QueryName;
     if (!queryName) {
@@ -364,7 +373,8 @@ export class RunQueryResolver extends ResolverBase {
                                      @Arg('StartRow', () => Int, {nullable: true}) StartRow?: number,
                                      @Arg('ForceAuditLog', () => Boolean, {nullable: true}) ForceAuditLog?: boolean,
                                      @Arg('AuditLogDescription', () => String, {nullable: true}) AuditLogDescription?: string,
-                                     @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment): Promise<RunQueryResultType> {
+                                     @Arg('Enrichment', () => GraphQLJSONObject, {nullable: true}) Enrichment?: RunQueryEnrichment,
+                                     @Arg('DataSource', () => String, {nullable: true, description: "Read source: 'Live' (default) or 'Materialized' (serve from a fresh RowFilterBroad materialization when available; falls back to live otherwise)"}) DataSource?: 'Live' | 'Materialized'): Promise<RunQueryResultType> {
     const provider = GetReadOnlyProvider(context.providers, {allowFallbackToReadWrite: true});
     const rq = new RunQuery(provider as unknown as IRunQueryProvider);
 
@@ -378,7 +388,8 @@ export class RunQueryResolver extends ResolverBase {
         StartRow: StartRow,
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
-        Enrichment: Enrichment
+        Enrichment: Enrichment,
+        DataSource: DataSource
       },
       context.userPayload.userRecord);
     
@@ -426,7 +437,8 @@ export class RunQueryResolver extends ResolverBase {
       StartRow: i.StartRow,
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
-      Enrichment: i.Enrichment
+      Enrichment: i.Enrichment,
+      DataSource: i.DataSource
     }));
 
     // Execute all queries in parallel using the batch method
@@ -476,7 +488,8 @@ export class RunQueryResolver extends ResolverBase {
       StartRow: i.StartRow,
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
-      Enrichment: i.Enrichment
+      Enrichment: i.Enrichment,
+      DataSource: i.DataSource
     }));
 
     // Execute all queries in parallel using the batch method
@@ -540,6 +553,7 @@ export class RunQueryResolver extends ResolverBase {
           ForceAuditLog: item.params.ForceAuditLog,
           AuditLogDescription: item.params.AuditLogDescription,
           Enrichment: item.params.Enrichment,
+          DataSource: item.params.DataSource,
         },
         cacheStatus: item.cacheStatus ? {
           maxUpdatedAt: item.cacheStatus.maxUpdatedAt,

package/src/resolvers/QuerySystemUserResolver.ts

@@ -182,8 +182,13 @@ export class UpdateQuerySystemUserInput {
  * Composes the CodeGen-generated MJQuery_ type so that new entity fields
  * are automatically available in the GraphQL schema without manual sync.
  *
- * On success, Query contains the full query data (scalars + related entities).
- * On failure, Query is null and ErrorMessage describes the problem.
+ * Child collections live on this result type (not as generated `*Array`
+ * FieldResolvers on MJQuery_) so the mutation can return the graph it already
+ * loaded without a per-parent SELECT *.
+ *
+ * On success, Query contains the query scalars and Fields/Parameters/Entities/
+ * Permissions hold the related rows. On failure, Query is null and
+ * ErrorMessage describes the problem.
  */
 @ObjectType()
 export class QueryMutationResultType {
@@ -195,6 +200,18 @@ export class QueryMutationResultType {
 
     @Field(() => MJQuery_, { nullable: true })
     Query?: MJQuery_;
+
+    @Field(() => [MJQueryField_], { nullable: true })
+    Fields?: MJQueryField_[];
+
+    @Field(() => [MJQueryParameter_], { nullable: true })
+    Parameters?: MJQueryParameter_[];
+
+    @Field(() => [MJQueryEntity_], { nullable: true })
+    Entities?: MJQueryEntity_[];
+
+    @Field(() => [MJQueryPermission_], { nullable: true })
+    Permissions?: MJQueryPermission_[];
 }
 
 @ObjectType()
@@ -306,7 +323,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 }
 
 
-                return this.buildSuccessResult(record);
+                return await this.buildSuccessResult(record);
             }
             else {
                 // Save failed - check if another request created the same query (race condition)
@@ -319,7 +336,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                     LogStatus(`[CreateQuery] Unique constraint detected for query '${input.Name}'. Using existing query (ID: ${existingQuery.ID}) created by concurrent request.`);
                     const existingEntity = await provider.GetEntityObject<MJQueryEntityServer>('MJ: Queries', context.userPayload.userRecord);
                     if (await existingEntity.Load(existingQuery.ID)) {
-                        return this.buildSuccessResult(existingEntity);
+                        return await this.buildSuccessResult(existingEntity);
                     }
                     // Entity load failed after confirming the row exists — extremely rare
                     return {
@@ -350,16 +367,14 @@ export class MJQueryResolverExtended extends MJQueryResolver {
      * Uses entity.GetAll() for scalar fields so that new CodeGen-generated fields are included
      * automatically without manual updates. Related entity arrays are mapped explicitly.
      */
-    private buildSuccessResult(entity: MJQueryEntityServer): QueryMutationResultType {
+    private async buildSuccessResult(entity: MJQueryEntityServer): Promise<QueryMutationResultType> {
         return {
             Success: true,
-            Query: {
-                ...entity.GetAll(),
-                MJQueryFields_QueryIDArray: this.mapFields(entity.QueryFields),
-                MJQueryParameters_QueryIDArray: this.mapParameters(entity.QueryParameters),
-                MJQueryEntities_QueryIDArray: this.mapEntities(entity.QueryEntities),
-                MJQueryPermissions_QueryIDArray: this.mapPermissions(entity.QueryPermissions),
-            } as MJQuery_
+            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll()) as MJQuery_,
+            Fields: this.mapFields(entity.QueryFields),
+            Parameters: this.mapParameters(entity.QueryParameters),
+            Entities: this.mapEntities(entity.QueryEntities),
+            Permissions: this.mapPermissions(entity.QueryPermissions),
         };
     }
 
@@ -538,7 +553,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
             }
 
-            return this.buildSuccessResult(queryEntity);
+            return await this.buildSuccessResult(queryEntity);
 
         } catch (err) {
             LogError(err);

package/src/resolvers/RunAIAgentResolver.ts

@@ -387,7 +387,9 @@ export class RunAIAgentResolver extends ResolverBase {
         planMode?: boolean,
         /** Skill IDs the user requested (via `/skill-name`) — threaded into ExecuteAgentParams.requestedSkillIDs.
          *  The framework intersects them with the agent's accepted skills AND the user's Run permission. */
-        requestedSkillIDs?: string[]
+        requestedSkillIDs?: string[],
+        /** JSON `{ paused?: boolean }` — seeds `$.debug` on a submitted task graph at insert. */
+        taskGraphDebug?: string
     ): Promise<AIAgentRunResult> {
         const startTime = Date.now();
         
@@ -441,6 +443,7 @@ export class RunAIAgentResolver extends ResolverBase {
                 configurationId: configurationId,
                 planMode: planMode,
                 requestedSkillIDs: requestedSkillIDs,
+                taskGraphDebug: parseTaskGraphDebug(taskGraphDebug),
                 data: parsedData,
                 context: {
                     dataSource: dataSource
@@ -632,7 +635,9 @@ export class RunAIAgentResolver extends ResolverBase {
         @Arg('planMode', { nullable: true }) planMode?: boolean,
         /** Skill IDs the user requested — symmetric with RunAIAgentFromConversationDetail. Intersected
          *  server-side with the agent's accepted skills AND the user's Run permission. */
-        @Arg('requestedSkillIDs', () => [String], { nullable: true }) requestedSkillIDs?: string[]
+        @Arg('requestedSkillIDs', () => [String], { nullable: true }) requestedSkillIDs?: string[],
+        /** JSON `{ paused?: boolean }` — start-paused for a Flow agent that submits a graph. */
+        @Arg('taskGraphDebug', { nullable: true }) taskGraphDebug?: string
     ): Promise<AIAgentRunResult> {
         // Check API key scope authorization for agent execution
         await this.CheckAPIKeyScopeAuthorization('agent:execute', agentId, userPayload);
@@ -646,7 +651,7 @@ export class RunAIAgentResolver extends ResolverBase {
                 p, dataSource, agentId, userPayload, messagesJson, sessionId, pubSub,
                 data, payload, lastRunId, autoPopulateLastRunPayload, configurationId,
                 conversationDetailId, createArtifacts || false, createNotification || false,
-                sourceArtifactId, sourceArtifactVersionId, undefined /*conversationId*/, planMode, requestedSkillIDs
+                sourceArtifactId, sourceArtifactVersionId, undefined /*conversationId*/, planMode, requestedSkillIDs, taskGraphDebug
             );
 
             LogStatus(`🔥 Fire-and-forget: Agent ${agentId} execution started in background for session ${sessionId}`);
@@ -680,7 +685,8 @@ export class RunAIAgentResolver extends ResolverBase {
             undefined, // conversationId (not pre-resolved on this path)
             undefined, // runRef
             planMode,
-            requestedSkillIDs
+            requestedSkillIDs,
+            taskGraphDebug
         );
     }
 
@@ -1276,7 +1282,8 @@ export class RunAIAgentResolver extends ResolverBase {
         /** Per-request Plan Mode toggle — threaded through to ExecuteAgentParams.planMode. */
         planMode?: boolean,
         /** Skill IDs the user requested — threaded through to ExecuteAgentParams.requestedSkillIDs. */
-        requestedSkillIDs?: string[]
+        requestedSkillIDs?: string[],
+        taskGraphDebug?: string
     ): void {
         // Ref the liveness pulse reads to enrich heartbeats once the run is created.
         const runRef: { current: MJAIAgentRunEntityExtended | null } = { current: null };
@@ -1295,7 +1302,7 @@ export class RunAIAgentResolver extends ResolverBase {
             p, dataSource, agentId, userPayload, messagesJson, sessionId, pubSub,
             data, payload, undefined, lastRunId, autoPopulateLastRunPayload,
             configurationId, conversationDetailId, createArtifacts, createNotification,
-            sourceArtifactId, sourceArtifactVersionId, conversationId, runRef, planMode, requestedSkillIDs
+            sourceArtifactId, sourceArtifactVersionId, conversationId, runRef, planMode, requestedSkillIDs, taskGraphDebug
         ).catch((error: unknown) => {
             // Background execution failed unexpectedly (executeAIAgent has its own try-catch,
             // so this would only fire for truly unexpected errors).
@@ -1587,4 +1594,12 @@ export class RunAIAgentResolver extends ResolverBase {
         }
     }
 
+}
+
+function parseTaskGraphDebug(raw?: string): { paused?: boolean } | undefined {
+    if (!raw) return undefined;
+    const parsed: unknown = SafeJSONParse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
+    const paused = (parsed as { paused?: unknown }).paused;
+    return paused === true ? { paused: true } : undefined;
 }

package/src/resolvers/TaskGraphFrameResolver.ts

@@ -52,6 +52,58 @@ export class TaskGraphFrameNotification {
   @Field(() => Number, { nullable: true })
   totalCount?: number;
 
+  // ── GateDecision ──────────────────────────────────────────────────────────
+  @Field(() => ID, { nullable: true })
+  edgeId?: string;
+
+  @Field(() => ID, { nullable: true })
+  dependsOnTaskId?: string;
+
+  /** 'satisfied' | 'notTaken' | 'held' */
+  @Field(() => String, { nullable: true })
+  verdict?: string;
+
+  @Field(() => String, { nullable: true })
+  conditionText?: string;
+
+  @Field(() => String, { nullable: true })
+  reason?: string;
+
+  // ── ClaimChanged ──────────────────────────────────────────────────────────
+  /** 'claimed' | 'heartbeat-lost' | 'reclaimed' */
+  @Field(() => String, { nullable: true })
+  claimEvent?: string;
+
+  @Field(() => String, { nullable: true })
+  claimedBy?: string;
+
+  @Field(() => String, { nullable: true })
+  claimExpiresAt?: string;
+
+  // ── PassCompleted ─────────────────────────────────────────────────────────
+  @Field(() => Number, { nullable: true })
+  passNumber?: number;
+
+  @Field(() => Number, { nullable: true })
+  eligibleCount?: number;
+
+  @Field(() => Number, { nullable: true })
+  heldCount?: number;
+
+  @Field(() => Number, { nullable: true })
+  claimedCount?: number;
+
+  /** The dispatcher instance's own load across every graph — not this graph's in-flight count. */
+  @Field(() => Number, { nullable: true })
+  instanceInFlightCount?: number;
+
+  // ── NodeProgress ──────────────────────────────────────────────────────────
+  @Field(() => String, { nullable: true })
+  progressMessage?: string;
+
+  @Field(() => Number, { nullable: true })
+  progressPercent?: number;
+
   @Field(() => Date)
   date!: Date;
 }
@@ -154,6 +206,21 @@ export class TaskGraphFrameResolver {
       assignedUserId: payload.AssignedUserID,
       completedCount: payload.CompletedCount,
       totalCount: payload.TotalCount,
+      edgeId: payload.EdgeID,
+      dependsOnTaskId: payload.DependsOnTaskID,
+      verdict: payload.Verdict,
+      conditionText: payload.ConditionText,
+      reason: payload.Reason,
+      claimEvent: payload.ClaimEvent,
+      claimedBy: payload.ClaimedBy,
+      claimExpiresAt: payload.ClaimExpiresAt,
+      passNumber: payload.PassNumber,
+      eligibleCount: payload.EligibleCount,
+      heldCount: payload.HeldCount,
+      claimedCount: payload.ClaimedCount,
+      instanceInFlightCount: payload.InstanceInFlightCount,
+      progressMessage: payload.ProgressMessage,
+      progressPercent: payload.ProgressPercent,
       date: new Date(),
     };
   }

package/src/resolvers/UserResolver.ts

@@ -1,54 +1,46 @@
-import { AppContext, Arg, Ctx, FieldResolver, Int, PubSub, PubSubEngine, Query, Resolver, Root } from '@memberjunction/server';
+import { AppContext, Arg, Ctx, Field, Int, ObjectType, PubSub, PubSubEngine, Query, Resolver } from '@memberjunction/server';
+import { IMetadataProvider, RunView, UserInfo } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import { MJUser_, MJUserRole_, MJUserResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';
+import {
+  AssertRoleLoadSucceeded,
+  RequireContextUser,
+  RequireLoadedUser,
+  RequireRoleProvider,
+  UserIdExtraFilter,
+} from './currentUserRoles.js';
+
+/**
+ * CurrentUser payload. Extends the generated user type with a first-class `Roles`
+ * field — child-array FieldResolvers (`MJUserRoles_UserIDArray`) are no longer
+ * generated. Roles come from the request's `UserInfo` (so magic-link anonymous
+ * sessions keep their synthesized roles) or from a RunView on `MJ: User Roles`.
+ */
+@ObjectType()
+export class CurrentUserType extends MJUser_ {
+  @Field(() => [MJUserRole_])
+  Roles: MJUserRole_[];
+}
+
+type RoleSource = {
+  ID?: string;
+  UserID: string;
+  RoleID: string;
+  RoleName?: string;
+  Role?: string;
+  __mj_CreatedAt?: Date;
+  __mj_UpdatedAt?: Date;
+};
 
 @Resolver(MJUser_)
 export class UserResolver extends MJUserResolverBase {
 
-  /**
-   * Roles for the current user row.
-   *
-   * Overrides the generated field resolver to support ANONYMOUS magic-link sessions: those
-   * resolve to a shared Anonymous principal that holds NO roles in the database (by design —
-   * persisting them would let anonymous sessions accrete privileges across links). The roles
-   * are synthesized per-request in {@link buildMagicLinkSessionUser} and live only on the
-   * request's `UserInfo`. For the session's OWN user row we serve those synthesized roles
-   * directly, skipping the generated DB query (which returns empty) and its `MJ: User Roles`
-   * read-permission check (which the restricted anon role wouldn't pass). Every other case —
-   * named users, named magic-link users, listing other users' roles — falls through to the
-   * generated resolver unchanged, so there is no behavioral or security change off this path.
-   */
-  @FieldResolver(() => [MJUserRole_])
-  async MJUserRoles_UserIDArray(@Root() mjuser_: MJUser_, @Ctx() context: AppContext, @PubSub() pubSub: PubSubEngine) {
-    const sessionUser = context.userPayload?.userRecord;
-    if (sessionUser?.IsMagicLinkAnonymous && UUIDsEqual(mjuser_.ID, sessionUser.ID)) {
-      const now = new Date();
-      // Build rows with the entity's RAW field names, then run them through the same
-      // name→code-name mapping the generated resolver uses (e.g. __mj_CreatedAt →
-      // _mj__CreatedAt). Returning raw names directly trips GraphQL's non-nullable check.
-      const rows = (sessionUser.UserRoles ?? []).map((r: { UserID: string; RoleID: string; RoleName?: string; Role?: string }) => ({
-        ID: sessionUser.ID,
-        UserID: r.UserID,
-        RoleID: r.RoleID,
-        User: sessionUser.Name,
-        Role: r.RoleName ?? r.Role,
-        __mj_CreatedAt: now,
-        __mj_UpdatedAt: now,
-      }));
-      return this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, sessionUser);
-    }
-    return super.MJUserRoles_UserIDArray(mjuser_, context, pubSub);
-  }
-  @Query(() => MJUser_)
-  async CurrentUser(@Ctx() context: AppContext) {
-    // Check API key scope authorization for user read (self)
+  @Query(() => CurrentUserType)
+  async CurrentUser(@Ctx() context: AppContext): Promise<CurrentUserType> {
     await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
 
-    // If userRecord is already available (e.g., from API key auth or system auth),
-    // use it directly instead of looking up by email again
     if (context.userPayload.userRecord) {
-      // Convert UserInfo to the GraphQL response format
       const userRecord = context.userPayload.userRecord;
       const userData = {
         ID: userRecord.ID,
@@ -65,30 +57,29 @@ export class UserResolver extends MJUserResolverBase {
         LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
         __mj_CreatedAt: userRecord.__mj_CreatedAt,
         __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
-        // Include the UserRoles sub-array for the GraphQL response
-        MJUserRoles_UserIDArray: userRecord.UserRoles?.map((r: { ID: string; UserID: string; RoleID: string; RoleName?: string; __mj_CreatedAt?: Date; __mj_UpdatedAt?: Date }) => ({
-          ID: r.ID,
-          UserID: r.UserID,
-          RoleID: r.RoleID,
-          User: userRecord.Name,
-          Role: r.RoleName,
-          __mj_CreatedAt: r.__mj_CreatedAt,
-          __mj_UpdatedAt: r.__mj_UpdatedAt,
-        })) || [],
       };
       console.log('CurrentUser (from userRecord)', userData.Email);
-      return this.MapFieldNamesToCodeNames('MJ: Users', userData);
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      const mapped = await this.MapFieldNamesToCodeNames('MJ: Users', userData, userRecord, provider) as MJUser_;
+      return {
+        ...mapped,
+        Roles: await this.mapRolesFromUserInfo(userRecord.UserRoles ?? [], userRecord, userRecord, provider),
+      };
     }
 
-    // Fall back to email lookup for JWT-based auth
-    const result = await this.UserByEmail(context.userPayload.email, context);
-    console.log('CurrentUser (from email lookup)', result?.Email);
-    return result;
+    const result = RequireLoadedUser(
+      await this.UserByEmail(context.userPayload.email, context),
+      context.userPayload.email,
+    );
+    console.log('CurrentUser (from email lookup)', result.Email);
+    return {
+      ...result,
+      Roles: await this.loadRolesForUser(result, context),
+    };
   }
 
   @Query(() => MJUser_)
   async UserByID(@Arg('ID', () => Int) ID: number, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', ID.toString(), userPayload);
 
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
@@ -98,7 +89,6 @@ export class UserResolver extends MJUserResolverBase {
 
   @Query(() => MJUser_)
   async UserByEmployeeID(@Arg('EmployeeID', () => Int) EmployeeID: number, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', EmployeeID.toString(), userPayload);
 
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
@@ -108,14 +98,63 @@ export class UserResolver extends MJUserResolverBase {
 
   @Query(() => MJUser_)
   async UserByEmail(@Arg('Email', () => String) Email: string, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', Email, userPayload);
 
-    // const searchEmail = userEmailMap[Email] ?? Email;
     const searchEmail = Email;
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
     const returnVal = super.safeFirstArrayElement(await this.findBy(provider, 'MJ: Users', { Email: searchEmail }, userPayload.userRecord));
     return this.MapFieldNamesToCodeNames('MJ: Users', returnVal);
   }
+
+  /**
+   * Magic-link anonymous sessions hold synthesized roles on UserInfo that are
+   * not persisted. Always prefer those when the requested row is the session
+   * user. Everyone else loads `MJ: User Roles` via RunView.
+   */
+  private async loadRolesForUser(user: MJUser_, context: AppContext): Promise<MJUserRole_[]> {
+    const contextUser = RequireContextUser(this.GetUserFromPayload(context.userPayload));
+
+    if (contextUser.IsMagicLinkAnonymous && UUIDsEqual(user.ID, contextUser.ID)) {
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      return await this.mapRolesFromUserInfo(contextUser.UserRoles ?? [], contextUser, contextUser, provider);
+    }
+
+    const provider = RequireRoleProvider(
+      GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true }),
+    );
+    const rv = RunView.FromMetadataProvider(provider);
+    const result = await rv.RunView<RoleSource>({
+      EntityName: 'MJ: User Roles',
+      ExtraFilter: UserIdExtraFilter(user.ID),
+      ResultType: 'simple',
+    }, contextUser);
+
+    AssertRoleLoadSucceeded(result, user.ID);
+    return await this.ArrayMapFieldNamesToCodeNames(
+      'MJ: User Roles',
+      result.Results ?? [],
+      contextUser,
+      provider,
+    ) as MJUserRole_[];
+  }
+
+  private async mapRolesFromUserInfo(
+    roles: RoleSource[],
+    user: { ID: string; Name?: string },
+    contextUser?: UserInfo,
+    provider?: IMetadataProvider,
+  ): Promise<MJUserRole_[]> {
+    const now = new Date();
+    const rows = roles.map((r) => ({
+      ID: r.ID ?? user.ID,
+      UserID: r.UserID,
+      RoleID: r.RoleID,
+      User: user.Name,
+      Role: r.RoleName ?? r.Role,
+      __mj_CreatedAt: r.__mj_CreatedAt ?? now,
+      __mj_UpdatedAt: r.__mj_UpdatedAt ?? now,
+    }));
+    return await this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, contextUser, provider) as MJUserRole_[];
+  }
 }
 export default UserResolver;

package/src/resolvers/currentUserRoles.ts

@@ -0,0 +1,47 @@
+import { LogError } from '@memberjunction/core';
+
+/**
+ * Guards and filter builders for CurrentUser role loading.
+ * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
+ * without importing generated GraphQL types or the Apollo config bootstrap.
+ */
+
+export function RequireLoadedUser<T extends { ID?: string }>(
+  user: T | null | undefined,
+  email: string | undefined,
+): T & { ID: string } {
+  if (!user?.ID) {
+    throw new Error(`CurrentUser: no user found for email '${email ?? ''}'`);
+  }
+  return user as T & { ID: string };
+}
+
+export function RequireContextUser<T>(user: T | null | undefined): T {
+  if (!user) {
+    throw new Error('CurrentUser: authenticated context user is required to load roles');
+  }
+  return user;
+}
+
+export function RequireRoleProvider<T>(provider: T | null | undefined): T {
+  if (!provider) {
+    throw new Error('CurrentUser: no data provider available to load roles');
+  }
+  return provider;
+}
+
+/** Quote-escape a server-resolved user id for an ExtraFilter literal. */
+export function UserIdExtraFilter(userId: string): string {
+  return `UserID='${userId.replace(/'/g, "''")}'`;
+}
+
+export function AssertRoleLoadSucceeded(
+  result: { Success: boolean; ErrorMessage?: string | null },
+  userId: string,
+): void {
+  if (!result.Success) {
+    const message = result.ErrorMessage ?? 'unknown error';
+    LogError(`CurrentUser: failed to load roles for user ${userId}: ${message}`);
+    throw new Error(`CurrentUser: failed to load roles: ${message}`);
+  }
+}