@memberjunction/server 6.1.0-edge.3 → 6.1.0-edge.4

package/src/integration/InactiveRowWarnings.ts

@@ -0,0 +1,85 @@
+/**
+ * Apply-time warnings for DECLARED integration rows that an apply silently leaves out.
+ *
+ * An IntegrationObject / IntegrationObjectField is never deleted — a comprehensive rediscovery
+ * that does not observe a declared row sets it `Status='Disabled'` instead (reversible on a later
+ * discovery), and a schema-limit breach can do the same. The apply path then rebuilds its source
+ * schema from ACTIVE rows only, so those rows simply are not in the schema it materializes: the
+ * table appears without the column, or a requested object is not created at all, and nothing in
+ * the apply output says why.
+ *
+ * The decision is kept pure here — the resolver supplies the rows and surfaces the strings — so it
+ * is testable without standing up the resolver or the metadata provider, matching how
+ * `decideAbsentDeactivations` and `ComputeRemovedDependencyWarnings` are factored.
+ */
+
+/** A row reduced to what the warning needs: its name and its lifecycle status. */
+export type NamedStatusRow = { Name: string; Status: string | null };
+
+export type InactiveRowWarningInput = {
+    /**
+     * The object names this apply asked for, exactly as requested. `null`/empty means "everything
+     * active", in which case deactivated OBJECTS are not reported: a large catalog can legitimately
+     * carry hundreds of them and announcing those on every apply is noise, not signal. Requested
+     * objects are always reported, because the caller named them and got nothing.
+     */
+    RequestedNames?: string[] | null;
+    /** Every object on the integration, active or not. */
+    AllObjects: NamedStatusRow[];
+    /**
+     * Fields keyed by object name, for the objects this apply actually materializes. Only those
+     * objects need their fields: a non-materialized object's fields are reported by the object
+     * warning, not one line per field.
+     */
+    FieldsByObjectName: Record<string, NamedStatusRow[]>;
+};
+
+/**
+ * Renders a name list for an operator-facing warning: every name when the list is short, and a
+ * capped sample plus a count when it is not. Apply runs against catalogs with hundreds of objects,
+ * so an uncapped list turns a useful warning into a wall of text nobody reads.
+ */
+export function SummarizeNames(names: string[], max = 12): string {
+    if (names.length <= max) return names.join(', ');
+    return `${names.slice(0, max).join(', ')}, and ${names.length - max} more`;
+}
+
+const isActive = (row: NamedStatusRow): boolean => row.Status === 'Active';
+
+/**
+ * Builds the operator-facing warnings for declared rows this apply will not materialize.
+ * Returns an empty array when everything declared and in scope is Active.
+ */
+export function ComputeInactiveRowWarnings(input: InactiveRowWarningInput): string[] {
+    const warnings: string[] = [];
+    const requested = input.RequestedNames && input.RequestedNames.length > 0
+        ? new Set(input.RequestedNames.map(n => n.toLowerCase()))
+        : null;
+
+    if (requested) {
+        const inactiveRequested = input.AllObjects
+            .filter(o => requested.has(o.Name.toLowerCase()) && !isActive(o))
+            .map(o => `${o.Name} (${o.Status ?? 'no status'})`);
+        if (inactiveRequested.length > 0) {
+            warnings.push(
+                `${inactiveRequested.length} requested object(s) are not Active and were NOT materialized — ` +
+                `${SummarizeNames(inactiveRequested)}. An object is deactivated (never deleted) when an ` +
+                `authoritative rediscovery does not observe it, or when it exceeded a schema limit; re-run ` +
+                `discovery against a source that exposes it, or re-enable it on MJ: Integration Objects.`,
+            );
+        }
+    }
+
+    for (const [objectName, fields] of Object.entries(input.FieldsByObjectName)) {
+        const dropped = fields.filter(f => !isActive(f)).map(f => `${f.Name} (${f.Status ?? 'no status'})`);
+        if (dropped.length === 0) continue;
+        warnings.push(
+            `${objectName}: ${dropped.length} declared field(s) are not Active and were NOT materialized — ` +
+            `${SummarizeNames(dropped)}. A field is deactivated (never deleted) when an authoritative ` +
+            `rediscovery does not observe it; re-run discovery against a source that exposes it, or re-enable ` +
+            `it on MJ: Integration Object Fields.`,
+        );
+    }
+
+    return warnings;
+}

package/src/integration/SchemaRefreshLaunch.ts

@@ -75,3 +75,19 @@ export function BuildUpdateConnectionMessage(summary: SchemaRefreshSummaryLike):
 export function BuildDetachedRefreshMessage(runID: string): string {
     return `Updated, schema refresh running — tail run ${runID}`;
 }
+
+/**
+ * Builds the human-facing `Message` for IntegrationReactivateConnection.
+ *
+ * Reactivation is committed before any refresh starts, so every message here begins by saying so.
+ * That ordering is the whole point: whatever the refresh does or fails to do afterwards, the
+ * connection IS active, and the operator must not read a refresh problem as "resume didn't work".
+ *
+ * @param summary the refresh summary, or undefined when no refresh was requested
+ */
+export function BuildReactivateMessage(summary: SchemaRefreshSummaryLike | undefined): string {
+    if (!summary) return 'Reactivated';
+    // Never report a detached run's placeholder counts as findings — point at the run stream instead.
+    if (summary.InProgress) return `Reactivated, schema refresh running — tail run ${summary.RunID}`;
+    return `Reactivated, ${describeFinishedRefresh(summary)}`;
+}

package/src/resolvers/AdhocQueryResolver.ts

@@ -5,6 +5,7 @@ import { RenderPipeline } from '@memberjunction/generic-database-provider';
 import { AppContext } from '../types.js';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
 import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
 import sql from 'mssql';
@@ -36,6 +37,10 @@ class AdhocQueryInput {
  * - Executes on read-only connection pool only (no fallback to read-write)
  * - Configurable timeout (default 30s)
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
  *
  * Auto-discovered by MJServer's dynamic resolver import.
  */
@@ -49,14 +54,24 @@ export class AdhocQueryResolver extends ResolverBase {
         const startTime = Date.now();
 
         try {
-            // 1. Security: validate SQL using SQLExpressionValidator
+            // 1. SECURITY: refuse principals whose read authority is narrower than their role
+            // grant. This resolver runs a raw SELECT on the read-only pool — it does NOT go
+            // through RunView, entity permissions or row-level security, so the RLS scope tokens
+            // that confine a magic-link session are never substituted here. There is no filter
+            // to narrow, so the only correct answer for such a principal is no. Checked before
+            // the SQL is even validated: authorization gates the work, it does not race it.
+            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+            }
+
+            // 2. Security: validate SQL using SQLExpressionValidator
             const validator = SQLExpressionValidator.Instance;
             const validation = validator.validateFullQuery(input.SQL);
             if (!validation.valid) {
                 return this.buildErrorResult(validation.error || 'SQL validation failed');
             }
 
-            // 2. Get READ-ONLY data source (no fallback to read-write)
+            // 3. Get READ-ONLY data source (no fallback to read-write)
             let readOnlyDS: sql.ConnectionPool;
             try {
                 readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
@@ -64,7 +79,7 @@ export class AdhocQueryResolver extends ResolverBase {
                 return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
             }
 
-            // 3. Resolve platform from the read-only provider for the render pipeline.
+            // 4. Resolve platform from the read-only provider for the render pipeline.
             let platform: DatabasePlatform = 'sqlserver';
             try {
                 const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
@@ -74,7 +89,7 @@ export class AdhocQueryResolver extends ResolverBase {
             }
             const contextUser = context.userPayload?.userRecord;
 
-            // 4. Route the SQL through RenderPipeline so composition tokens
+            // 5. Route the SQL through RenderPipeline so composition tokens
             // resolve, comments and templates are processed, and the row cap
             // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
             //
@@ -106,7 +121,7 @@ export class AdhocQueryResolver extends ResolverBase {
                 return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
             }
 
-            // 5. Execute the page (and, only when a full page needs it, the count) under
+            // 6. Execute the page (and, only when a full page needs it, the count) under
             // a shared wall-clock deadline derived from the request's timeout budget.
             const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
             const { recordset, totalRowCount } = await this.executeDataAndCount(
@@ -114,7 +129,7 @@ export class AdhocQueryResolver extends ResolverBase {
             );
             const executionTimeMs = Date.now() - startTime;
 
-            // 6. Return as RunQueryResultType
+            // 7. Return as RunQueryResultType
             return {
                 QueryID: '',
                 QueryName: 'Ad-Hoc Query',

package/src/resolvers/IdentityClaimRedemptionResolver.ts

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview GraphQL redemption surface for MJ: Identity Claims.
+ *
+ * Exposes the server-side claim lifecycle (`IdentityClaimEngineServer`) to authenticated
+ * clients: list my pending claims, redeem one claim (optionally with the emailed verification
+ * token), and redeem everything pending for my email in one call. This is the surface the
+ * claim emails' `/claims/redeem?id=..&token=..` links land on (via the Explorer redeem page).
+ *
+ * Security posture:
+ * - Authentication is required (the engine refuses without a user); authorization is the
+ *   engine's own gate — email match or timing-safe token match, further constrained by the
+ *   claim type's Configuration and the IdP's `email_verified` assertion carried on
+ *   `UserPayload.emailVerified`.
+ * - A small in-memory fixed-window rate limit bounds redemption attempts per user, since
+ *   GraphQL mutations get no per-operation limit from the transport tier.
+ *
+ * @module @memberjunction/server/resolvers/IdentityClaimRedemptionResolver
+ */
+import { Arg, Ctx, Field, Mutation, ObjectType, Query, Resolver } from 'type-graphql';
+import { UserInfo } from '@memberjunction/core';
+import { IdentityClaimEngineServer } from '@memberjunction/core-entities-server';
+import { AppContext } from '../types.js';
+import { GetReadWriteProvider } from '../util.js';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+@ObjectType()
+export class IdentityClaimRedemptionResult {
+  @Field()
+  Success: boolean;
+
+  @Field({ nullable: true })
+  ErrorMessage?: string;
+
+  @Field({ nullable: true })
+  ClaimID?: string;
+
+  /** JSON-serialized driver result data (shape is driver-specific) */
+  @Field({ nullable: true })
+  Data?: string;
+}
+
+@ObjectType()
+export class PendingIdentityClaim {
+  @Field()
+  ID: string;
+
+  @Field()
+  ClaimTypeID: string;
+
+  @Field({ nullable: true })
+  ClaimTypeName?: string;
+
+  @Field({ nullable: true })
+  EntityID?: string;
+
+  @Field({ nullable: true })
+  RecordID?: string;
+
+  @Field()
+  Status: string;
+
+  @Field()
+  ExpiresAt: Date;
+}
+
+/**
+ * Fixed-window per-user attempt limiter for redemption mutations. Redemption is a
+ * human-interactive flow — a handful of attempts per minute is generous; dozens is
+ * token guessing.
+ */
+const REDEEM_WINDOW_MS = 60_000;
+const REDEEM_MAX_ATTEMPTS_PER_WINDOW = 10;
+const REDEEM_ATTEMPTS_CACHE_MAX = 10_000;
+const redeemAttempts = new Map<string, { windowStart: number; count: number }>();
+
+function redeemRateLimitExceeded(userId: string): boolean {
+  const now = Date.now();
+  const entry = redeemAttempts.get(userId);
+  if (!entry || now - entry.windowStart >= REDEEM_WINDOW_MS) {
+    if (redeemAttempts.size >= REDEEM_ATTEMPTS_CACHE_MAX) {
+      // Bounded map: evict the oldest insertion rather than growing without limit.
+      const oldest = redeemAttempts.keys().next().value;
+      if (oldest !== undefined) {
+        redeemAttempts.delete(oldest);
+      }
+    }
+    redeemAttempts.set(userId, { windowStart: now, count: 1 });
+    return false;
+  }
+  entry.count++;
+  return entry.count > REDEEM_MAX_ATTEMPTS_PER_WINDOW;
+}
+
+@Resolver()
+export class IdentityClaimRedemptionResolver extends ResolverBase {
+  /**
+   * Lists the caller's pending, unexpired identity claims (matched on their normalized email).
+   */
+  @Query(() => [PendingIdentityClaim])
+  async GetMyPendingIdentityClaims(@Ctx() ctx: AppContext): Promise<PendingIdentityClaim[]> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', 'read', ctx.userPayload);
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const claims = await engine.GetPendingClaimsForEmail(user.Email, user, provider);
+    return claims.map((c) => ({
+      ID: c.ID,
+      ClaimTypeID: c.ClaimTypeID,
+      ClaimTypeName: engine.GetClaimTypeByID(c.ClaimTypeID)?.Name,
+      EntityID: c.EntityID ?? undefined,
+      RecordID: c.RecordID ?? undefined,
+      Status: c.Status,
+      ExpiresAt: c.ExpiresAt,
+    }));
+  }
+
+  /**
+   * Redeems a single identity claim for the authenticated caller. The engine enforces the
+   * authorization gate: email match (subject to the IdP's email_verified assertion and the
+   * claim type's Configuration) OR the emailed verification token.
+   */
+  @Mutation(() => IdentityClaimRedemptionResult)
+  async RedeemIdentityClaim(
+    @Arg('ClaimID') claimID: string,
+    @Ctx() ctx: AppContext,
+    @Arg('Token', { nullable: true }) token?: string,
+  ): Promise<IdentityClaimRedemptionResult> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', claimID, ctx.userPayload);
+
+    if (redeemRateLimitExceeded(user.ID)) {
+      return { Success: false, ErrorMessage: 'Too many redemption attempts — please wait a minute and try again', ClaimID: claimID };
+    }
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const result = await engine.RedeemClaim(claimID, user, provider, token ?? undefined, {
+      EmailVerified: ctx.userPayload.emailVerified,
+    });
+    return {
+      Success: result.Success,
+      ErrorMessage: result.ErrorMessage,
+      ClaimID: claimID,
+      Data: result.Data ? JSON.stringify(result.Data) : undefined,
+    };
+  }
+
+  /**
+   * Discovers and redeems every pending claim addressed to the caller's email — the on-demand
+   * form of the automatic claim-on-login sweep. Each redemption runs through the full engine
+   * gate; failures are returned per-claim, never thrown.
+   */
+  @Mutation(() => [IdentityClaimRedemptionResult])
+  async AutoClaimPendingIdentityClaims(@Ctx() ctx: AppContext): Promise<IdentityClaimRedemptionResult[]> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', 'auto', ctx.userPayload);
+
+    if (redeemRateLimitExceeded(user.ID)) {
+      return [{ Success: false, ErrorMessage: 'Too many redemption attempts — please wait a minute and try again' }];
+    }
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const results = await engine.AutoClaimForUser(user, provider, { EmailVerified: ctx.userPayload.emailVerified });
+    return results.map((r) => ({
+      Success: r.Success,
+      ErrorMessage: r.ErrorMessage,
+      Data: r.Data ? JSON.stringify(r.Data) : undefined,
+    }));
+  }
+}

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -56,7 +56,8 @@ import type { IntegrationRunSnapshot, IntegrationRunKind } from "@memberjunction
 import { ResolverBase } from "../generic/ResolverBase.js";
 import { IntegrationCustomColumnPromoter } from "../integration/CustomColumnPromoter.js";
 import { ComputeCascadeRemovalSet, ComputeRemovedDependencyWarnings, DisableUnselectedEntityMaps, ReenableFieldMapsForEntityMap, ResetPullWatermarks, SetEntityMapEnabled } from "../integration/EntityMapLifecycle.js";
-import { BuildCreateConnectionMessage, BuildDetachedRefreshMessage, BuildUpdateConnectionMessage } from "../integration/SchemaRefreshLaunch.js";
+import { ComputeInactiveRowWarnings } from "../integration/InactiveRowWarnings.js";
+import { BuildCreateConnectionMessage, BuildDetachedRefreshMessage, BuildReactivateMessage, BuildUpdateConnectionMessage } from "../integration/SchemaRefreshLaunch.js";
 // Type-only: the registered runtime class for 'MJ: Company Integrations'. Lets the create path name the
 // server subclass it actually gets back from GetEntityObject with a real type rather than a cast.
 import type { MJCompanyIntegrationEntityServer } from "@memberjunction/core-entities-server";
@@ -2338,6 +2339,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
     private buildSourceSchemaFromPersistedRows(
         integrationID: string,
         requestedNames?: string[],
+        warningsOut?: string[],
     ): SourceSchemaInfo {
         const engine = IntegrationEngineBase.Instance;
         // ACTIVE-only materialization: an object/field a given tenant doesn't expose is marked
@@ -2356,10 +2358,15 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
         for (const io of ios) ioByID.set(io.ID, io.Name);
 
         const result: SourceSchemaInfo = { Objects: [] };
+        const fieldsByObjectName: Record<string, Array<{ Name: string; Status: string | null }>> = {};
         for (const io of ios) {
             if (filter && !filter.has(io.Name.toLowerCase())) continue;
             // Active fields only — an inactive (source-absent / deactivated) field is not materialized.
-            const iofs = engine.GetIntegrationObjectFields(io.ID).filter(iof => iof.Status === 'Active');
+            const allFields = engine.GetIntegrationObjectFields(io.ID);
+            const iofs = allFields.filter(iof => iof.Status === 'Active');
+            // Remember what this object declared, active or not — the caller's warning collector
+            // turns the difference into the one message that explains a column that never appeared.
+            if (warningsOut) fieldsByObjectName[io.Name] = allFields.map(f => ({ Name: f.Name, Status: f.Status }));
 
             const fields = iofs.map(iof => {
                 const targetIOName = iof.RelatedIntegrationObjectID
@@ -2400,6 +2407,18 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 IncrementalWatermarkField: io.IncrementalWatermarkField ?? undefined,
             });
         }
+
+        // Declared-but-inactive rows this rebuild left out. The caller decides what to do with the
+        // strings (the apply path puts them on its Warnings); computing them costs nothing when no
+        // collector was passed, since the field lists above are only gathered then.
+        if (warningsOut) {
+            warningsOut.push(...ComputeInactiveRowWarnings({
+                RequestedNames: requestedNames ?? null,
+                AllObjects: engine.GetIntegrationObjectsByIntegrationID(integrationID)
+                    .map(io => ({ Name: io.Name, Status: io.Status })),
+                FieldsByObjectName: fieldsByObjectName,
+            }));
+        }
         return result;
     }
 
@@ -3147,13 +3166,46 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
      *
      * Before #3738 this mutation inherited a full schema refresh from the
      * CompanyIntegration save hook, with no way to decline it.  The refresh is
-     * now this resolver's own, explicit step — same default behaviour, but
-     * visible in the API and suppressible with `runSchemaRefresh: false`.
+     * now this resolver's own, explicit step — visible in the API, suppressible
+     * with `runSchemaRefresh: false`, and (since it gained `awaitSchemaRefresh`)
+     * no longer something the caller has to sit through.
+     *
+     * WHY REACTIVATION NO LONGER SCANS THE SOURCE BY DEFAULT.  Resuming a
+     * connection and rescanning its schema are separate decisions that this
+     * mutation used to fuse. A one-click resume would spend minutes of a
+     * vendor's rate budget on an introspect nobody asked for, and the catalog is
+     * usually exactly as current as it was when the connection was paused.
+     * `IntegrationRefreshConnectorSchema` is the operation for "rescan now", and
+     * a caller that genuinely wants both passes `runSchemaRefresh: true`.
+     *
+     * WHY THAT REFRESH, WHEN REQUESTED, DEFAULTS TO DETACHED AND ITS SIBLINGS DO
+     * NOT.  Create and Update default to `awaitSchemaRefresh: true` because the
+     * caller is in a wizard, waiting on a form, and the counts ARE the answer
+     * they asked for. Reactivate is a one-click toggle on a connection row, and
+     * — unlike its siblings — its entire durable effect is already committed by
+     * the time any refresh begins: the `Save()` above returned. Blocking the
+     * response for the minutes a live introspect takes cannot make that
+     * reactivation any more true; it can only misreport it.
+     *
+     * And it did. The transport, not this resolver, is what breaks: a held
+     * request dies at the load balancer's fixed ceiling, which the app cannot
+     * configure and which differs by front end, and the client then shows a
+     * resumed connection as a failure. Note the shape of that bug — the two failure paths BELOW are both
+     * handled correctly, returning `Success: true` with the refresh problem
+     * appended, precisely because reactivation already happened. The gateway is
+     * the one caller of this mutation that never reaches them.
+     *
+     * So the default here optimises for the operation actually being requested
+     * (resume this connection) rather than for the operation that happens to be
+     * expensive (rescan the source). The refresh still runs — detached, on a
+     * durable, tailable run stream — and `awaitSchemaRefresh: true` restores the
+     * blocking behaviour for a caller that genuinely wants the counts inline.
      */
     @Mutation(() => MutationResultOutput)
     async IntegrationReactivateConnection(
         @Arg("companyIntegrationID") companyIntegrationID: string,
-        @Arg("runSchemaRefresh", () => Boolean, { defaultValue: true, description: "When true (default), re-runs IntegrationConnectorCreationPipeline after reactivating so the catalog reflects the source as it is now. Pass false to reactivate without a live scan — useful when the catalog is known-current, or when the source is large enough that discovery should be scheduled separately." }) runSchemaRefresh: boolean,
+        @Arg("runSchemaRefresh", () => Boolean, { defaultValue: false, description: "When false (default), reactivation ONLY reactivates — no live scan of the source. Resuming a connection and rescanning its schema are separate decisions, and a resume should not spend minutes of a vendor's rate budget nobody asked for; run IntegrationRefreshConnectorSchema when the catalog actually needs refreshing. Pass true to re-run IntegrationConnectorCreationPipeline as part of the reactivation." }) runSchemaRefresh: boolean,
+        @Arg("awaitSchemaRefresh", () => Boolean, { defaultValue: false, description: "When false (default), the schema refresh is launched detached and this mutation returns as soon as the connection is active, naming the run to tail. Reactivation is already committed at that point, so blocking on a minutes-long live introspect can only delay — or, at the load balancer's fixed request ceiling, misreport — an operation that has already succeeded. Pass true to block until the refresh finishes and get its counts in the message." }) awaitSchemaRefresh: boolean,
         @Ctx() ctx: AppContext
     ): Promise<MutationResultOutput> {
         try {
@@ -3165,13 +3217,15 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
             ci.IsActive = true;
             if (!await ci.Save()) return { Success: false, Message: `Failed to reactivate: ${ci.LatestResult?.Message ?? 'Unknown error'}` };
 
+            if (runSchemaRefresh && !awaitSchemaRefresh) {
+                const detached = this.startSchemaRefreshPipelineDetached(companyIntegrationID, user, md);
+                return { Success: true, Message: BuildReactivateMessage(detached) };
+            }
+
             if (runSchemaRefresh) {
                 try {
                     const refreshResult = await this.runSchemaRefreshPipeline(companyIntegrationID, user, md);
-                    return {
-                        Success: true,
-                        Message: `Reactivated, schema refresh: ${refreshResult.ObjectsCreated} created, ${refreshResult.ObjectsUpdated} updated, ${refreshResult.UnresolvedObjects.length} PK-unresolved`,
-                    };
+                    return { Success: true, Message: BuildReactivateMessage(refreshResult) };
                 } catch (refreshErr) {
                     // Refresh failure does NOT undo the reactivation — the
                     // connection is active, only discovery failed, and the
@@ -3181,7 +3235,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 }
             }
 
-            return { Success: true, Message: 'Reactivated' };
+            return { Success: true, Message: BuildReactivateMessage(undefined) };
         } catch (e) {
             LogError(`IntegrationReactivateConnection error: ${e}`);
             return { Success: false, Message: this.formatError(e) };
@@ -3338,15 +3392,22 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
             // the Phase 0 v5.39.x Save hook.  Fall back to live IntrospectSchema only
             // for direct-API callers bypassing the wizard (empty IO cache).
             const requestedNames = new Set(objects.map(o => o.SourceObjectName));
+            // Declared rows this apply will leave out (deactivated objects/fields) — surfaced on the
+            // mutation's Warnings so a column that never appears has a stated reason.
+            const inactiveWarnings: string[] = [];
             let sourceSchema: SourceSchemaInfo = this.buildSourceSchemaFromPersistedRows(
                 companyIntegration.IntegrationID,
                 Array.from(requestedNames),
+                inactiveWarnings,
             );
             if (sourceSchema.Objects.length === 0) {
                 LogError(`[IntegrationApplySchema] Persisted IO cache empty for ${companyIntegration.Integration}; falling back to live introspect.`);
                 const introspect = connector.IntrospectSchema.bind(connector) as
                     (ci: unknown, u: unknown) => Promise<SourceSchemaInfo>;
                 sourceSchema = await introspect(companyIntegration, user);
+                // The persisted rows are not what gets materialized on this path, so anything they
+                // said about deactivated rows describes a schema this apply is not using.
+                inactiveWarnings.length = 0;
             } else {
                 console.log(
                     `[IntegrationApplySchema] Reusing ${sourceSchema.Objects.length} persisted IOs for ${companyIntegration.Integration} ` +
@@ -3381,6 +3442,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 SkipGitCommit: skipGitCommit,
                 SkipRestart: skipRestart,
             });
+            if (inactiveWarnings.length > 0) SchemaOutput.Warnings.unshift(...inactiveWarnings);
 
             return {
                 Success: PipelineResult.Success,
@@ -4089,6 +4151,9 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
         // Intacct AND silently dropped selections when the second pass returned
         // fewer objects than the first (rate limits, transient errors).
         let sourceSchema: SourceSchemaInfo;
+        // Declared rows this apply will silently leave out (deactivated objects/fields). Collected
+        // during the rebuild and surfaced on the apply's Warnings, alongside the schema-limit ones.
+        const inactiveWarnings: string[] = [];
         if (prefetchedSourceSchema) {
             sourceSchema = prefetchedSourceSchema;
         } else {
@@ -4096,12 +4161,16 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
             sourceSchema = this.buildSourceSchemaFromPersistedRows(
                 companyIntegration.IntegrationID,
                 requestedNamesForReuse,
+                inactiveWarnings,
             );
             if (sourceSchema.Objects.length === 0) {
                 LogError(`[buildSchemaForConnector] Persisted IO cache empty for ${companyIntegration.Integration}; falling back to live introspect.`);
                 const introspect = connector.IntrospectSchema.bind(connector) as
                     (ci: unknown, u: unknown) => Promise<SourceSchemaInfo>;
                 sourceSchema = await introspect(companyIntegration, user);
+                // The persisted rows are not what gets materialized on this path, so anything they
+                // said about deactivated rows describes a schema this apply is not using.
+                inactiveWarnings.length = 0;
             } else {
                 console.log(
                     `[buildSchemaForConnector] Reusing ${sourceSchema.Objects.length} persisted IOs for ${companyIntegration.Integration} ` +
@@ -4144,8 +4213,10 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
 
         const builder = new SchemaBuilder();
         const schemaOutput = builder.BuildSchema(input);
-        // Surface the auto-disabled over-wide objects (if any) in the apply's Warnings → CLI output.
+        // Surface the auto-disabled over-wide objects (if any) in the apply's Warnings → CLI output,
+        // together with the declared-but-deactivated rows this apply left out.
         if (limitWarnings.length > 0) schemaOutput.Warnings.unshift(...limitWarnings);
+        if (inactiveWarnings.length > 0) schemaOutput.Warnings.unshift(...inactiveWarnings);
 
         if (schemaOutput.Errors.length > 0) {
             throw new Error(`Schema generation failed: ${schemaOutput.Errors.join('; ')}`);

package/src/resolvers/meetingRecordingRegistration.ts

@@ -43,6 +43,7 @@
  */
 
 import { IMetadataProvider, UserInfo, RunView, LogError, LogStatus } from '@memberjunction/core';
+import { EscapeSQLString } from '@memberjunction/global';
 import { MJConversationEntity, MJFileEntity } from '@memberjunction/core-entities';
 import { FileStorageEngine } from '@memberjunction/storage';
 
@@ -239,7 +240,7 @@ async function findConversationByEgressID(egressID: string, contextUser: UserInf
   const found = await rv.RunView<{ ID: string }>(
     {
       EntityName: CONVERSATION_ENTITY,
-      ExtraFilter: `EgressID='${escapeSql(egressID)}' AND Type='${escapeSql(MEETING_ROOM_CONVERSATION_TYPE)}' AND (IsArchived IS NULL OR IsArchived=0)`,
+      ExtraFilter: `EgressID='${EscapeSQLString(egressID)}' AND Type='${EscapeSQLString(MEETING_ROOM_CONVERSATION_TYPE)}' AND (IsArchived IS NULL OR IsArchived=0)`,
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
@@ -259,7 +260,7 @@ async function findConversationByRoomName(roomName: string, contextUser: UserInf
   const found = await rv.RunView<{ ID: string }>(
     {
       EntityName: CONVERSATION_ENTITY,
-      ExtraFilter: `ExternalID='${escapeSql(roomName)}' AND Type='${escapeSql(MEETING_ROOM_CONVERSATION_TYPE)}' AND (IsArchived IS NULL OR IsArchived=0)`,
+      ExtraFilter: `ExternalID='${EscapeSQLString(roomName)}' AND Type='${EscapeSQLString(MEETING_ROOM_CONVERSATION_TYPE)}' AND (IsArchived IS NULL OR IsArchived=0)`,
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
@@ -425,8 +426,3 @@ function resolveStorageAccountForProvider(providerID: string): string | null {
   const accounts = FileStorageEngine.Instance.GetAccountsByProviderID(providerID);
   return accounts.length > 0 ? accounts[0].ID : null;
 }
-
-/** Escapes single quotes for safe embedding in an `ExtraFilter` literal. */
-function escapeSql(value: string): string {
-  return value.replace(/'/g, "''");
-}

package/src/types.ts

@@ -25,6 +25,14 @@ export type UserPayload = {
   apiKeyId?: string;
   /** SHA-256 hash of the MJ API key (used for scope authorization) */
   apiKeyHash?: string;
+  /**
+   * The IdP's OIDC `email_verified` assertion from the verified JWT, when present.
+   * Three-state: `true` (IdP vouched for the email), `false` (IdP explicitly says the email is
+   * unverified — security-sensitive flows must not trust an email match), `undefined` (the IdP
+   * omits the claim, or auth was via API key / magic link). Consumed by identity-claim
+   * redemption; do not treat `undefined` as `false`.
+   */
+  emailVerified?: boolean;
 };
 
 /**