@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.6

package/src/generic/ResolverBase.ts

@@ -32,6 +32,8 @@ import { RunViewGenericParams, UserPayload } from '../types.js';
 import { RunDynamicViewInput, RunViewByIDInput, RunViewByNameInput } from './RunViewResolver.js';
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
 import { MJEvent, MJEventType, MJGlobal, ENCRYPTED_SENTINEL, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
+import { SQLParser } from '@memberjunction/sql-parser';
+import { PostgreSQLDialect, SQLServerDialect, type SQLParserDialect } from '@memberjunction/sql-dialect';
 import { EncryptionEngine } from '@memberjunction/encryption';
 import { PUSH_STATUS_UPDATES_TOPIC, publishStatusUpdate } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC } from './CacheInvalidationResolver.js';
@@ -798,6 +800,129 @@ export class ResolverBase {
     }
   }
 
+  /**
+   * SECURITY — GraphQL-boundary screen for one client-supplied SQL clause fragment.
+   *
+   * `ValidateUserProvidedSQLClause` still blocks stacked statements, DML, comments, UNION
+   * and WAITFOR, and still permits SELECT (server-internal engines pass richer filters).
+   * A keyword ban on SELECT/EXISTS at this boundary (#4253) broke first-party clients that
+   * use `IN (SELECT … FROM <entity base view>)` — that is a legitimate ExtraFilter.
+   *
+   * This screen uses `@memberjunction/sql-parser` (same wrap as EDS `assertReadOnlyClause`):
+   * wrap the fragment as a single SELECT, fail closed if it does not parse as a read, then
+   * allow a FROM only when it is an entity **BaseView**. Base tables (`Meeting`, `__mj.User`)
+   * and catalogs are rejected. Server-internal RunView callers never hit this.
+   *
+   * RLS is applied by RunView as an outer WHERE around the entity being queried, not compiled
+   * into the view. Subqueries against another entity's BaseView therefore do not inherit that
+   * entity's RLS; they are still restricted to the view (not the table).
+   */
+  protected assertClientClauseUsesEntityBaseViews(
+    clause: string | undefined | null,
+    label: string,
+    provider?: IMetadataProvider,
+  ): void {
+    if (!clause?.trim()) return;
+
+    const dialect = this.dialectForProvider(provider);
+    if (SQLParser.HasStackedStatements(clause, dialect)) {
+      throw new Error(`Invalid ${label}: multiple statements are not permitted in client-supplied filters`);
+    }
+
+    const wrapped =
+      label === 'OrderBy'
+        ? `SELECT 1 FROM __mj_clause_screen ORDER BY ${clause}`
+        : `SELECT 1 FROM __mj_clause_screen WHERE (${clause})`;
+    const parser = new SQLParser(wrapped, dialect);
+    if (!parser.IsValid || parser.HasWriteStatement || parser.StatementKind !== 'select') {
+      throw new Error(
+        `Invalid ${label}: not a safe read-only filter fragment — refusing under uncertainty`,
+      );
+    }
+    if (this.astContainsWriteNode(parser.AST)) {
+      throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
+    }
+
+    const allowed = this.entityBaseViewAllowList(provider);
+    const tables = SQLParser.ExtractTableRefs(wrapped, dialect);
+    for (const t of tables) {
+      const table = this.stripSqlIdent(t.TableName);
+      const schema = this.stripSqlIdent(t.SchemaName);
+      if (table.toLowerCase() === '__mj_clause_screen') continue;
+      const qualified = `${schema}.${table}`.toLowerCase();
+      const bare = table.toLowerCase();
+      if (allowed.qualified.has(qualified) || allowed.bare.has(bare)) continue;
+      throw new Error(
+        `Invalid ${label}: subquery must use an entity base view, not '${schema}.${table}'`,
+      );
+    }
+  }
+
+  /**
+   * Applies {@link assertClientClauseUsesEntityBaseViews} to every client-supplied clause
+   * a view request can carry. GraphQL entry points (RunViewByName, RunViewByID,
+   * RunDynamicView, RunViews) funnel through RunViewGenericInternal / RunViewsGenericInternal.
+   */
+  protected screenClientViewClauses(
+    clauses: {
+      extraFilter?: string | null;
+      orderBy?: string | null;
+      userSearchString?: string | null;
+      overrideExcludeFilter?: string | null;
+    },
+    provider?: IMetadataProvider,
+  ): void {
+    this.assertClientClauseUsesEntityBaseViews(clauses.extraFilter, 'ExtraFilter', provider);
+    this.assertClientClauseUsesEntityBaseViews(clauses.orderBy, 'OrderBy', provider);
+    this.assertClientClauseUsesEntityBaseViews(clauses.userSearchString, 'UserSearchString', provider);
+    this.assertClientClauseUsesEntityBaseViews(clauses.overrideExcludeFilter, 'OverrideExcludeFilter', provider);
+  }
+
+  /** Same write-node walk as EDS `sqlReadOnlyScreen.astContainsWriteNode`. */
+  private astContainsWriteNode(node: unknown): boolean {
+    if (!node || typeof node !== 'object') return false;
+    if (Array.isArray(node)) return node.some((n) => this.astContainsWriteNode(n));
+    const obj = node as Record<string, unknown>;
+    const type = obj.type;
+    if (typeof type === 'string' && ResolverBase.WRITE_NODE_TYPES.has(type.toLowerCase())) {
+      return true;
+    }
+    return Object.values(obj).some((v) => this.astContainsWriteNode(v));
+  }
+
+  private static readonly WRITE_NODE_TYPES = new Set<string>([
+    'insert', 'update', 'delete', 'merge', 'replace', 'drop', 'create', 'alter', 'truncate',
+    'rename', 'call', 'exec', 'execute', 'grant', 'revoke', 'use', 'load', 'copy', 'do',
+  ]);
+
+  private dialectForProvider(provider?: IMetadataProvider): SQLParserDialect {
+    const name = provider?.constructor?.name ?? '';
+    if (/postgres/i.test(name)) return new PostgreSQLDialect();
+    return new SQLServerDialect();
+  }
+
+  private stripSqlIdent(name: string | null | undefined): string {
+    if (!name) return '';
+    return name.replace(/^\[|\]$/g, '').replace(/^"|"$/g, '').replace(/^`|`$/g, '');
+  }
+
+  private entityBaseViewAllowList(provider?: IMetadataProvider): {
+    qualified: Set<string>;
+    bare: Set<string>;
+  } {
+    const qualified = new Set<string>();
+    const bare = new Set<string>();
+    const entities = provider?.Entities ?? [];
+    for (const e of entities) {
+      const view = this.stripSqlIdent(e.BaseView);
+      if (!view) continue;
+      const schema = this.stripSqlIdent(e.SchemaName);
+      bare.add(view.toLowerCase());
+      if (schema) qualified.add(`${schema}.${view}`.toLowerCase());
+    }
+    return { qualified, bare };
+  }
+
   /**
    * Optimized RunViewGenericInternal implementation with:
    * - Field filtering at source (Fix #7)
@@ -829,6 +954,13 @@ export class ResolverBase {
     try {
       if (!viewInfo || !userPayload) return null;
 
+      // SECURITY: GraphQL ExtraFilter may contain IN (SELECT … FROM <base view>).
+      // Screen at this boundary: parse, reject writes, allow only entity BaseViews.
+      this.screenClientViewClauses(
+        { extraFilter, orderBy, userSearchString, overrideExcludeFilter },
+        provider as unknown as IMetadataProvider,
+      );
+
       // Check API key scope authorization for view operations
       await this.CheckAPIKeyScopeAuthorization('view:run', viewInfo.Entity, userPayload);
 
@@ -990,6 +1122,17 @@ export class ResolverBase {
 
       // Transform parameters
       for (const param of params) {
+        // SECURITY: same GraphQL-boundary BaseView screen as RunViewGenericInternal.
+        this.screenClientViewClauses(
+          {
+            extraFilter: param.extraFilter,
+            orderBy: param.orderBy,
+            userSearchString: param.userSearchString,
+            overrideExcludeFilter: param.overrideExcludeFilter,
+          },
+          md,
+        );
+
         if (param.viewInfo) {
           // Validate entity only once per entity type
           const entityName = param.viewInfo.Entity;
@@ -1384,7 +1527,15 @@ export class ResolverBase {
         // MapFieldNamesToCodeNames now handles encryption filtering as well
         return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), userInfo);
       } else {
-        throw new GraphQLError(entityObject.LatestResult?.Message ?? 'Unknown error', {
+        // CompleteMessage, not Message. A validation refusal puts its reasons in `Errors` and leaves
+        // `Message` unset, so reading `Message` here fell through to 'Unknown error' and discarded
+        // every field-named explanation the entity had just produced. CreateRecord already read
+        // CompleteMessage; this path did not, which is why the SAME rule on the SAME entity explained
+        // itself on a create and said nothing on an update. CompleteMessage is a strict superset — it
+        // starts from `Message`, then appends `Error` and `Errors` — so nothing previously reported is
+        // lost, and it still yields undefined when there is genuinely nothing to say, leaving the
+        // fallback below to fire rather than showing the user a blank error.
+        throw new GraphQLError(entityObject.LatestResult?.CompleteMessage ?? 'Unknown error', {
           extensions: { code: 'SAVE_ENTITY_ERROR', entityName },
         });
       }
@@ -1614,7 +1765,11 @@ export class ResolverBase {
         // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
         return returnValue;
       } else {
-        throw new GraphQLError(entityObject.LatestResult?.Message ?? 'Unknown error', {
+        // CompleteMessage, for the same reason as the update path above. It matters more going
+        // forward: apps already refuse deletes by overriding Delete() and returning false with the
+        // reason on LatestResult, and #3971 proposes a first-class delete-validation seam. Every one
+        // of those reasons was being replaced by 'Unknown error' at the API boundary.
+        throw new GraphQLError(entityObject.LatestResult?.CompleteMessage ?? 'Unknown error', {
           extensions: { code: 'DELETE_ENTITY_ERROR', entityName },
         });
       }

package/src/index.ts

@@ -127,6 +127,14 @@ export {
 } from './auth/index.js';
 export * from './auth/APIKeyScopeAuth.js';
 export * from './auth/actingContextResolver.js';
+// The context-user ladder (#4209). Public because `auth/exampleNewUserSubClass.ts` — the template
+// integrators are told to copy into their OWN package — resolves through it, and `package.json`
+// publishes only "."; without this the example compiles here and cannot be reused anywhere else.
+// `ReportedMisconfigurationCount` / `MAX_REPORTED_MISCONFIGURATIONS` are deliberately NOT here:
+// they exist so the LRU's bound is assertable, the tests import them from the module directly, and
+// a published export is a maintenance commitment no caller asked for.
+export { ResolveConfiguredPrincipal, resolvePrincipalFrom } from './auth/principals.js';
+export type { ResolvablePrincipal, PrincipalResolution, PrincipalResolutionReason } from './auth/principals.js';
 export { CloneUserForSessionContext } from './auth/sessionUserClone.js';
 
 export * from './generic/PushStatusResolver.js';
@@ -1265,17 +1273,24 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
   // because they lack Access-Control-Allow-Origin headers, preventing the
   // client from reading the error code and triggering token refresh.
   const corsAllowed = configInfo.cors?.allowedOrigins ?? ['*'];
+  const corsWildcard = corsAllowed.includes('*');
+  // SECURITY: never combine credentials with a wildcard/reflect-any-origin policy. When
+  // allowedOrigins is ['*'] the origin callback reflects the caller's Origin, and pairing that
+  // with Access-Control-Allow-Credentials: true lets any site a signed-in user visits make
+  // credentialed cross-origin reads. MJ's primary auth is a Bearer token (not auto-sent
+  // cross-origin), so dropping credentials under the wildcard default is safe; deployments that
+  // genuinely need credentialed CORS must configure an explicit allowedOrigins list.
   app.use(cors<cors.CorsRequest>({
     origin: (origin, callback) => {
       // Allow all origins when ['*'] (default/backward-compatible),
       // or when no Origin header (server-to-server calls).
-      if (corsAllowed.includes('*') || !origin || corsAllowed.includes(origin)) {
+      if (corsWildcard || !origin || corsAllowed.includes(origin)) {
         callback(null, true);
       } else {
         callback(new Error(`Origin ${origin} not allowed by CORS`));
       }
     },
-    credentials: configInfo.cors?.allowCredentials ?? true,
+    credentials: corsWildcard ? false : (configInfo.cors?.allowCredentials ?? true),
     maxAge: configInfo.cors?.maxAge ?? 86400,
   }));
 

package/src/realtimeWidget/WidgetSessionService.ts

@@ -17,7 +17,7 @@
 import { Metadata, RunView, UserInfo, LogError, LogStatus } from '@memberjunction/core';
 import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
 import type { MJConversationWidgetInstanceEntity, MJConversationEntity } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/generic-database-provider';
+import { ResolveConfiguredPrincipal } from '../auth/principals.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { generateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
@@ -694,19 +694,7 @@ export class WidgetSessionService {
 
   /** Resolves the server-side context user used to READ widget config (not the guest principal). */
   private resolveLookupUser(): UserInfo | null {
-    const candidate = this.config.contextUserForLookup;
-    if (candidate) {
-      const byName = UserCache.Instance.UserByName(candidate);
-      if (byName) {
-        return byName;
-      }
-      LogError(`[Widget] Configured lookup user '${candidate}' not found; falling back to system/Owner.`);
-    }
-    return (
-      UserCache.Instance.GetSystemUser() ??
-      UserCache.Users.find((u) => u.IsActive && u.Type?.trim().toLowerCase() === 'owner') ??
-      null
-    );
+    return ResolveConfiguredPrincipal(this.config.contextUserForLookup, 'Widget');
   }
 
   /**

package/src/realtimeWidget/visitorIdentity.ts

@@ -24,7 +24,7 @@
  * @module @memberjunction/server/widget
  */
 
-import { RunView, UserInfo, LogError, LogStatus, type IMetadataProvider } from '@memberjunction/core';
+import { CompositeKey, RunView, UserInfo, LogError, LogStatus, type IMetadataProvider } from '@memberjunction/core';
 import type { MJConversationEntity, MJAIAgentNoteEntity } from '@memberjunction/core-entities';
 
 const CONVERSATIONS_ENTITY = 'MJ: Conversations';
@@ -60,17 +60,24 @@ export async function resolveIdentityByEmail(
     }
     const entityName = target?.entityName?.trim() || 'Users';
     const emailField = target?.emailField?.trim() || 'Email';
-    const entityId = provider.EntityByName(entityName)?.ID;
-    if (!entityId) {
+    const entityInfo = provider.EntityByName(entityName);
+    if (!entityInfo) {
       LogError(`[VisitorIdentity] identity-resolution entity '${entityName}' not found in metadata.`);
       return undefined;
     }
+    const entityId = entityInfo.ID;
+    // The identity entity is configurable, so its key column(s) can have any name — and may be
+    // composite. Select every key column and carry the record id in the compact record-id form
+    // (the bare value for a single-column key, "F1|v1||F2|v2" for a composite one) that
+    // CompositeKey.FromURLSegment reads back, so LinkedRecordID / PrimaryScopeRecordID round-trip
+    // for any key shape instead of being truncated to the first column.
+    const pkNames = entityInfo.PrimaryKeys.map(pk => pk.Name);
     const rv = new RunView();
-    const result = await rv.RunView<{ ID: string }>(
+    const result = await rv.RunView<Record<string, unknown>>(
       {
         EntityName: entityName,
         ExtraFilter: `${emailField} = '${trimmed.replace(/'/g, "''")}'`,
-        Fields: ['ID'],
+        Fields: pkNames,
         MaxRows: 1,
         ResultType: 'simple',
       },
@@ -80,7 +87,15 @@ export async function resolveIdentityByEmail(
       LogError(`[VisitorIdentity] identity lookup failed for '${entityName}.${emailField}': ${result.ErrorMessage}`);
       return undefined;
     }
-    const recordId = result.Results?.[0]?.ID;
+    const row = result.Results?.[0];
+    if (!row) {
+      return undefined;
+    }
+    const key = CompositeKey.FromEntityRecord(entityInfo, row);
+    if (key.KeyValuePairs.length === 0 || key.KeyValuePairs.some(kv => kv.Value == null)) {
+      return undefined;
+    }
+    const recordId = key.ToCompactURLSegment();
     return recordId ? { entityId, recordId } : undefined;
   } catch (e) {
     LogError(`[VisitorIdentity] resolveIdentityByEmail failed: ${e instanceof Error ? e.message : String(e)}`);

package/src/resolvers/FileCategoryResolver.ts

@@ -14,9 +14,8 @@ export class FileCategoryResolver extends FileCategoryResolverBase {
     @Arg('options___', () => DeleteOptionsInput) options: DeleteOptionsInput,
     @Ctx() { providers, userPayload }: AppContext
   ) {
-    const key = new CompositeKey();
-    key.LoadFromSingleKeyValuePair('ID', ID);
-    const p = GetReadWriteProvider(providers);    
+    const key = CompositeKey.FromID(ID); // first-pk-ok: this mutation deletes from MJ: File Categories (core entity keyed by ID) — see the GetEntityObject below
+    const p = GetReadWriteProvider(providers);
 
     if (!(await this.BeforeDelete(p, key))) {
       return null;

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -3,6 +3,7 @@ import { CompositeKey, DatabaseProviderBase, EntityInfo, LocalCacheManager, Meta
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { NoLog } from "../logging/NoLog.js";
 import { UUIDsEqual } from "@memberjunction/global";
+import { DrainResponseBody } from "@memberjunction/network-utils";
 import { CronExpressionHelper } from "@memberjunction/scheduling-engine";
 import {
     MJCompanyIntegrationEntity,
@@ -6472,6 +6473,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 body: JSON.stringify(payload)
             });
             if (!response.ok) {
+                await DrainResponseBody(response);
                 console.error(`[Integration] Webhook POST to ${url} returned ${response.status}`);
             }
         } catch (e) {

package/src/resolvers/QuerySystemUserResolver.ts

@@ -590,7 +590,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             }
 
             const provider = GetReadWriteProvider(context.providers);    
-            const key = new CompositeKey([{FieldName: 'ID', Value: ID}]);
+            const key = CompositeKey.FromID(ID); // first-pk-ok: deletes from MJ: Queries (core entity keyed by ID) — see DeleteRecord below
             
             // Provide default options if none provided
             const deleteOptions = options || {

package/src/resolvers/RemoteBrowserActionResolver.ts

@@ -230,6 +230,20 @@ interface VisualInterpreterPayload {
  * (the process-wide singleton) backs every request; ownership is enforced per call against the session's
  * `UserID`.
  */
+/**
+ * Safety cap on how long a {@link RemoteBrowserActionResolver.startedScreencasts} /
+ * {@link RemoteBrowserActionResolver.startedAudioStreams} entry is trusted without confirmation.
+ *
+ * `RemoteBrowserActionResolver` is instantiated once per process by type-graphql's default resolver
+ * container, so these idempotency maps live as long as the server does. `StopRemoteBrowserScreencast` /
+ * `StopRemoteBrowserAudioStream` are the only code paths that ever delete an entry — a session that
+ * crashes, disconnects, or times out before calling Stop (a normal occurrence: tab close, network drop,
+ * agent timeout) leaves its entry behind forever. This TTL bounds that growth the same way
+ * {@link RemoteBrowserGoalRegistry}'s own sweep bounds its run records, without requiring a dedicated
+ * session-end hook that doesn't otherwise exist for this resolver.
+ */
+const MAX_STREAM_ENTRY_AGE_MS = 4 * 60 * 60 * 1000; // 4 hours — generous vs. SessionJanitor's 15-minute idle threshold
+
 @Resolver()
 export class RemoteBrowserActionResolver extends ResolverBase {
   /**
@@ -237,20 +251,43 @@ export class RemoteBrowserActionResolver extends ResolverBase {
    * {@link RemoteBrowserActionResolver.streamKey} (agent session **plus** instance) so a re-issued
    * {@link RemoteBrowserActionResolver.StartRemoteBrowserScreencast} — the surface re-binding after a
    * tab collapse — is idempotent and never stacks two screencasts on the one browser. Entries are
-   * removed by {@link RemoteBrowserActionResolver.StopRemoteBrowserScreencast}.
+   * normally removed by {@link RemoteBrowserActionResolver.StopRemoteBrowserScreencast}; the value is
+   * the entry's start time (ms epoch) so {@link RemoteBrowserActionResolver.sweepStreamEntries} can
+   * reclaim ones whose session never called Stop.
    *
    * Keyed by agent session ALONE (#3531) this was the idempotency guard turning into a lockout: the
    * first surface's entry made the SECOND surface's bind a silent `Streaming: true` no-op, so a second
    * browser could be started and driven but never watched.
    */
-  private startedScreencasts = new Set<string>();
+  private startedScreencasts = new Map<string, number>();
 
   /**
    * Surfaces whose live tab-audio stream this resolver has already started, keyed by
-   * {@link RemoteBrowserActionResolver.streamKey} for the same reason the screencast set is. Entries
-   * are removed by {@link RemoteBrowserActionResolver.StopRemoteBrowserAudioStream}.
+   * {@link RemoteBrowserActionResolver.streamKey} for the same reason the screencast map is. Entries
+   * are normally removed by {@link RemoteBrowserActionResolver.StopRemoteBrowserAudioStream}; see
+   * {@link RemoteBrowserActionResolver.startedScreencasts} for why the value is a timestamp.
+   */
+  private startedAudioStreams = new Map<string, number>();
+
+  /**
+   * Drops any {@link startedScreencasts} / {@link startedAudioStreams} entry older than
+   * {@link MAX_STREAM_ENTRY_AGE_MS} — the reclaim path for sessions that never called
+   * `StopRemoteBrowserScreencast`/`StopRemoteBrowserAudioStream` (crash, disconnect, timeout). Called
+   * on every Start mutation, mirroring {@link RemoteBrowserGoalRegistry.Begin}'s sweep-on-access pattern.
    */
-  private startedAudioStreams = new Set<string>();
+  private sweepStreamEntries(): void {
+    const cutoff = Date.now() - MAX_STREAM_ENTRY_AGE_MS;
+    for (const [key, startedAt] of this.startedScreencasts) {
+      if (startedAt < cutoff) {
+        this.startedScreencasts.delete(key);
+      }
+    }
+    for (const [key, startedAt] of this.startedAudioStreams) {
+      if (startedAt < cutoff) {
+        this.startedAudioStreams.delete(key);
+      }
+    }
+  }
 
   /**
    * Execute ONE browser action relayed from the client-direct realtime session, returning the outcome +
@@ -569,6 +606,7 @@ export class RemoteBrowserActionResolver extends ResolverBase {
 
     // Idempotent PER SURFACE: a re-bind must not stack a second screencast on the one live browser,
     // but a SECOND surface binding for the first time is not a re-bind (#3531).
+    this.sweepStreamEntries();
     const streamKey = this.streamKey(agentSessionID, instanceKey);
     if (this.startedScreencasts.has(streamKey)) {
       return { Streaming: true };
@@ -580,7 +618,7 @@ export class RemoteBrowserActionResolver extends ResolverBase {
       await liveSession.StartScreencast((frame) =>
         this.publishFrame(pubSub, userPayload, agentSessionID, instanceKey, frame, liveSession.GetCurrentUrl()),
       );
-      this.startedScreencasts.add(streamKey);
+      this.startedScreencasts.set(streamKey, Date.now());
       return { Streaming: true };
     } catch (err) {
       if (err instanceof RemoteBrowserCapabilityNotSupportedError) {
@@ -647,7 +685,8 @@ export class RemoteBrowserActionResolver extends ResolverBase {
     const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
     const session = await this.loadOwnedSession(agentSessionID, contextUser, provider);
 
-    // Idempotent PER SURFACE — same reasoning as the screencast set (#3531).
+    // Idempotent PER SURFACE — same reasoning as the screencast map (#3531).
+    this.sweepStreamEntries();
     const streamKey = this.streamKey(agentSessionID, instanceKey);
     if (this.startedAudioStreams.has(streamKey)) {
       return { Streaming: true };
@@ -657,7 +696,7 @@ export class RemoteBrowserActionResolver extends ResolverBase {
     try {
       const liveSession = await RemoteBrowserEngine.Instance.StartSessionForAgentSession(agentSessionID, contextUser, providerName, instanceKey);
       await liveSession.StartAudioStream((chunk) => this.publishAudioChunk(pubSub, userPayload, agentSessionID, instanceKey, chunk));
-      this.startedAudioStreams.add(streamKey);
+      this.startedAudioStreams.set(streamKey, Date.now());
       return { Streaming: true };
     } catch (err) {
       if (err instanceof RemoteBrowserCapabilityNotSupportedError) {

package/src/resolvers/SyncRolesUsersResolver.ts

@@ -385,8 +385,17 @@ export class SyncRolesAndUsersResolver {
         if (await user.Delete()) {
             return;
         }
-        // FK constraint fallback: when the user has dependent records that block hard delete,
-        // we mark the user inactive instead. A failure to soft-delete IS a real error and rolls back.
+        // Fallback when the hard delete does not happen. TWO distinct causes reach here, and this
+        // path deliberately treats them the same way:
+        //   1. FK constraints — the user has dependent records that block a hard delete.
+        //   2. Authorization — `MJUserEntityServer` (issue #4260) refuses a delete outright for any
+        //      caller whose `Type` is not 'Owner'. This mutation carries `@RequireSystemUser()` and
+        //      `getSystemUser()` resolves the seeded Owner, so cause 2 does not arise on a default
+        //      install; it does on a deployment whose system user is not an Owner.
+        // Soft-deleting is the right response to (1) and an acceptable one to (2) — but note the
+        // subsequent Save() is subject to the SAME guard, so under cause 2 it fails too and the
+        // error below is what the operator sees. Read `LatestResult` rather than assuming FK.
+        // A failure to soft-delete IS a real error and rolls back.
         user.IsActive = false;
         if (!await user.Save()) {
             throw new Error(`Failed to delete or deactivate user '${user.Email}': ${user.LatestResult?.CompleteMessage ?? 'unknown error'}`);

package/src/resolvers/UserViewResolver.ts

@@ -4,7 +4,7 @@ import { AppContext, Arg, Ctx, Int, Query, Resolver, UserPayload } from '@member
 import { MJUserView_, MJUserViewResolverBase } from '../generated/generated.js';
 import { UserResolver } from './UserResolver.js';
 import { MJUserViewEntity, MJUserViewEntityExtended } from '@memberjunction/core-entities';
-import { GetReadOnlyProvider } from '../util.js';
+import { GetReadOnlyProvider, GetReadWriteProvider } from '../util.js';
 
 @Resolver(MJUserView_)
 export class UserViewResolver extends MJUserViewResolverBase {
@@ -52,11 +52,15 @@ export class UserViewResolver extends MJUserViewResolverBase {
     // this should normally not be a factor but we have this exposed in the GraphQL API so that
     // a dev can force the update if desired from the client. The normal path is just to update
     // filter state which in turn will be used to update the where clause in the entity sub-class.
-    const p = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    // This endpoint WRITES (Save below), so it must use the read-write provider — on a read-replica
+    // deployment the read-only provider would route the save to the replica.
+    const p = GetReadWriteProvider(providers, {allowFallbackToReadOnly: true});
     const u = this.GetUserFromPayload(userPayload);
     const viewEntity = <MJUserViewEntityExtended>await p.GetEntityObject('MJ: User Views', u);
-    await viewEntity.Load(ID);
-    viewEntity.UpdateWhereClause();
+    if (!await viewEntity.Load(ID)) {
+      throw new Error(`User View ${ID} not found or access denied`);
+    }
+    await viewEntity.UpdateWhereClause(true); // force regeneration regardless of dirty state — that is the whole point of this endpoint
 
     if (await viewEntity.Save()) {
       return viewEntity.GetAll();

package/src/rest/EntityCRUDHandler.ts

@@ -254,26 +254,10 @@ export class EntityCRUDHandler {
     }
     
     /**
-     * Helper method to create a composite key from an ID
+     * Build the record key from the `:id` path segment. A single-column key (any column name) is
+     * the bare value; a composite key is the URL-encoded `Field1|Value1||Field2|Value2` segment.
      */
     private static createCompositeKeyFromId(entity: BaseEntity, id: string | number): CompositeKey {
-        if (entity.EntityInfo.PrimaryKeys.length === 1) {
-            // Single primary key
-            const primaryKeyField = entity.EntityInfo.PrimaryKeys[0].Name;
-            const compositeKey = new CompositeKey();
-            const strId = id.toString();
-            
-            // Use key-value pairs instead of SetValue
-            compositeKey.KeyValuePairs = [
-                { FieldName: primaryKeyField, Value: strId }
-            ];
-            
-            return compositeKey;
-        } else {
-            // Composite primary key - this is a simplification
-            // In a real implementation, you would need to parse a composite ID string
-            // or accept an object with all primary key values
-            throw new Error('Composite primary keys are not supported in this simplified implementation');
-        }
+        return CompositeKey.FromURLSegment(entity.EntityInfo, id.toString());
     }
 }

package/src/rest/RESTEndpointHandler.ts

@@ -794,25 +794,11 @@ export class RESTEndpointHandler {
     }
 
     /**
-     * Helper method to create a composite key from an ID
+     * Build the record key from the `:id` path segment. A single-column key (any column name) is
+     * the bare value; a composite key is the URL-encoded `Field1|Value1||Field2|Value2` segment.
      */
     private createCompositeKey(entityInfo: EntityInfo, id: string): CompositeKey {
-        if (entityInfo.PrimaryKeys.length === 1) {
-            // Single primary key
-            const primaryKeyField = entityInfo.PrimaryKeys[0].Name;
-            const compositeKey = new CompositeKey();
-            
-            // Use key-value pairs instead of SetValue
-            compositeKey.KeyValuePairs = [
-                { FieldName: primaryKeyField, Value: id }
-            ];
-            
-            return compositeKey;
-        } else {
-            // Composite primary key
-            // This is a simplification - in a real implementation, we would need to handle composite keys properly
-            throw new Error('Composite primary keys are not supported in this implementation');
-        }
+        return CompositeKey.FromURLSegment(entityInfo, id);
     }
 
     /**

package/src/telephony/TeamsMeetingsRouter.ts

@@ -74,14 +74,22 @@ function handleGraphNotification(
     res: Response,
 ): void {
     const validationToken = readValidationToken(req);
+    if (validationToken !== undefined && validationToken.length > 0 && !isWellFormedValidationToken(validationToken)) {
+        // Graph's token is a short ASCII sentence plus a request id. Anything else is not Graph, and the
+        // echo below must never reflect arbitrary bytes.
+        LogStatus('[Meetings][Teams] notification rejected: malformed-validation-token');
+        res.status(400).type('text/plain').send('Rejected.');
+        return;
+    }
     const batch = (req.body ?? {}) as GraphNotificationBatch;
     const notifications = Array.isArray(batch.value) ? batch.value : [];
     const clientStates = notifications.map((n) => n.clientState);
 
     const verdict = validateGraphNotification(validationToken, config.notificationClientState ?? '', clientStates);
     if (verdict.Kind === 'validation') {
-        // The subscription-validation handshake: echo the token verbatim as text/plain 200.
-        res.status(200).type('text/plain').send(verdict.ValidationToken);
+        // The subscription-validation handshake: echo the token verbatim as text/plain 200. The token was
+        // checked by isWellFormedValidationToken above; nosniff makes sure no client reinterprets the echo.
+        res.status(200).type('text/plain').set('X-Content-Type-Options', 'nosniff').send(verdict.ValidationToken);
         return;
     }
     if (verdict.Kind === 'reject') {
@@ -111,6 +119,17 @@ function dispatchNotifications(service: TeamsMeetingsService, notifications: Gra
     }
 }
 
+/** Upper bound for a Graph validation token; the real one is roughly a hundred characters. */
+const MAX_VALIDATION_TOKEN_LENGTH = 1024;
+
+/** Graph validation tokens are printable ASCII only. */
+const PRINTABLE_ASCII = /^[\x20-\x7E]+$/;
+
+/** True when the token is something Graph could have sent: bounded length, printable ASCII. */
+function isWellFormedValidationToken(token: string): boolean {
+    return token.length <= MAX_VALIDATION_TOKEN_LENGTH && PRINTABLE_ASCII.test(token);
+}
+
 /** Reads the `?validationToken=…` query param (Graph URL-encodes it), when present. */
 function readValidationToken(req: Request): string | undefined {
     const raw = req.query?.validationToken;