@memberjunction/server 6.1.5 → 6.1.6

package/src/isolatedProvider.ts

@@ -0,0 +1,22 @@
+import { DatabaseProviderBase, Metadata } from '@memberjunction/core';
+
+/**
+ * A fresh Read-Write provider with its OWN transaction state, sharing the server's connection pool.
+ *
+ * A provider's ambient transaction (`BeginTransaction` / `CommitTransaction` / `RollbackTransaction`)
+ * is a field on the provider INSTANCE. Two units of work that open transactions on one instance nest
+ * into each other, and every write anyone else makes through that instance while one is open lands
+ * inside it (MJ#2140; `entityTransactionScope.ts`). The process-global `Metadata.Provider` is shared
+ * by every request, scheduled job and background service, so transactional work must never run on
+ * it: one transaction left open there silently swallows every later global-provider write until the
+ * process restarts.
+ *
+ * GraphQL resolvers already get a per-request provider from `AppContext.providers`. Code that runs
+ * outside one, such as the auth flow before the context exists, calls this.
+ *
+ * Cheap: it is the global provider's `CreateIndependentInstance()` (SQL Server and PostgreSQL), which
+ * reuses the already-loaded metadata and the shared pool.
+ */
+export async function CreateIsolatedProvider(): Promise<DatabaseProviderBase> {
+  return (Metadata.Provider as DatabaseProviderBase).CreateIndependentInstance(); // global-provider-ok: borrows only its pool and metadata, never its transaction state
+}

package/src/multiTenancy/index.ts

@@ -9,7 +9,9 @@
 
 import type { RequestHandler } from 'express';
 import type { PreRunViewHook, PreSaveHook } from '@memberjunction/core';
-import { Metadata, type UserInfo, type TenantContext } from '@memberjunction/core';
+import { DatabaseProviderBase, Metadata, type UserInfo, type TenantContext } from '@memberjunction/core';
+import { PostgreSQLDialect, SQLServerDialect, type SQLParserDialect } from '@memberjunction/sql-dialect';
+import { IsBalancedSQLFragment } from '@memberjunction/sql-parser';
 import type { MultiTenancyConfig } from '../config.js';
 import type { UserPayload } from '../types.js';
 import { CloneUserForSessionContext } from '../auth/sessionUserClone.js';
@@ -147,6 +149,25 @@ function isAdminUser(user: UserInfo, adminRoles: string[]): boolean {
   );
 }
 
+/** Dialects to read an ExtraFilter with when the active provider's dialect cannot be resolved. */
+const ALL_FILTER_DIALECTS: SQLParserDialect[] = [new SQLServerDialect(), new PostgreSQLDialect()];
+
+/**
+ * Throws unless the caller's ExtraFilter stays inside the parentheses the tenant predicate is
+ * ANDed after. A filter such as `1=1) OR (1=1` would close them early and leave the tenant
+ * predicate on one side of an OR the caller controls.
+ */
+function assertExtraFilterBalanced(extraFilter: string): void {
+  const provider = Metadata.Provider; // global-provider-ok: same rationale as isEntityScoped above — hooks carry no per-request provider
+  const dialects = provider instanceof DatabaseProviderBase ? [provider.Dialect] : ALL_FILTER_DIALECTS;
+  for (const dialect of dialects) {
+    const check = IsBalancedSQLFragment(extraFilter, dialect);
+    if (!check.IsBalanced) {
+      throw new Error(`[MultiTenancy] Invalid ExtraFilter: ${check.Reason}`);
+    }
+  }
+}
+
 /**
  * Creates a PreRunViewHook that auto-injects tenant WHERE clauses
  * into RunView queries for scoped entities.
@@ -192,7 +213,8 @@ export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunVi
 
     // Inject the tenant filter
     if (params.ExtraFilter && typeof params.ExtraFilter === 'string' && params.ExtraFilter.trim().length > 0) {
-      params.ExtraFilter = `(${params.ExtraFilter}) AND ${tenantFilter}`;
+      assertExtraFilterBalanced(params.ExtraFilter);
+      params.ExtraFilter = `(${params.ExtraFilter}) AND (${tenantFilter})`;
     } else {
       params.ExtraFilter = tenantFilter;
     }

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -85,8 +85,10 @@ export async function resolveWidgetGuestRunContext(
  * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
  * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
  * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
- * required: on the realtime path the agent authority is already server-side (the session config's
- * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ * required: the realtime target is the session config's `targetAgentID`, which the owner can edit, so
+ * the relay re-checks `CanRun` on it for the CALLER before this elevation. Direct actions are refused
+ * for these callers before elevation, so only the delegated agent run and the run-entity writes
+ * execute as the system user.
  *
  * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
  * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter

package/src/resolvers/ActionResolver.ts

@@ -1,14 +1,17 @@
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError } from "@memberjunction/core";
-import { ActionParam, ActionResult } from "@memberjunction/actions-base";
+import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase } from "@memberjunction/core";
+import { ActionParam, ActionResult, MJActionEntityExtended } from "@memberjunction/actions-base";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
 import { AppContext, ProviderInfo } from "../types.js";
-import { CopyScalarsAndArrays, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
+import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
 
 /**
  * Input type for action parameters
@@ -55,8 +58,8 @@ export class RunActionInput {
   Params?: ActionParamInput[];
 
   /**
-   * Whether to skip logging the action execution
-   * Defaults to false
+   * Ignored. A run started through this API always writes an action execution log row; the field
+   * remains so that clients which send it still validate.
    */
   @Field(() => Boolean, { nullable: true })
   SkipActionLog?: boolean;
@@ -174,7 +177,13 @@ export class ActionResultOutput {
 @Resolver()
 export class ActionResolver extends ResolverBase {
   /**
-   * Mutation for running an action
+   * Mutation for running an action.
+   *
+   * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+   * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+   * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+   * action has no such link, an action class that authorizes its caller itself. The run is always
+   * logged.
    * @param input The input parameters for running the action
    * @param ctx The GraphQL context containing user authentication information
    * @returns The result of running the action
@@ -185,20 +194,16 @@ export class ActionResolver extends ResolverBase {
     @Ctx() ctx: AppContext
   ): Promise<ActionResultOutput> {
     try {
+      const user = this.getRunActionPrincipal(ctx);
+
       // Check API key scope authorization for action execution
       await this.CheckAPIKeyScopeAuthorization('action:execute', input.ActionID, ctx.userPayload);
 
-      // Get the user from context
-      const user = ctx.userPayload.userRecord;
-      if (!user) {
-        throw new Error("User is not authenticated");
-      }
-
       // Initialize the action engine
       await ActionEngineServer.Instance.Config(false, user);
 
-      // Get the action by ID
       const action = this.findActionById(input.ActionID);
+      await this.assertCanRunAction(action, user, ctx.providers);
 
       // Parse the parameters
       const params = this.parseActionParameters(input.Params);
@@ -206,7 +211,7 @@ export class ActionResolver extends ResolverBase {
       // Run the action — thread the request-scoped provider so provider-bound
       // actions (e.g. the semantic find-* / Search Entity actions, which call
       // params.Provider.SearchEntity) run against the caller's metadata layer.
-      const result = await this.executeAction(action, user, params, ctx.providers, input.SkipActionLog);
+      const result = await this.executeAction(action, user, params, ctx.providers);
 
       // Return the result
       return this.createActionResult(result);
@@ -215,6 +220,66 @@ export class ActionResolver extends ResolverBase {
     }
   }
 
+  /**
+   * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+   * only as row-level-security filters, and an action can reach data and services those filters never
+   * cover.
+   * @throws Error when there is no user or the session is scope-limited
+   */
+  private getRunActionPrincipal(ctx: AppContext): UserInfo {
+    const user = ctx.userPayload?.userRecord;
+    if (!user) {
+      throw new Error("User is not authenticated");
+    }
+    if (IsScopeLimitedPrincipal(user)) {
+      throw new Error("RunAction is not permitted for scope-limited sessions");
+    }
+    return user;
+  }
+
+  /**
+   * Refuses the run unless the caller is authorized for the action — see
+   * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+   * tree and the role grants all come from the request's provider, or all from the global provider
+   * when the request carries none.
+   * @throws Error when the caller may not run the action
+   */
+  private async assertCanRunAction(action: MJActionEntityExtended, user: UserInfo, providers: Array<ProviderInfo>): Promise<void> {
+    if (IsOwner(user)) {
+      return; // an Owner may run any action, so nothing needs to be read
+    }
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+    const actionAuthorizationIDs = await this.loadActionAuthorizationIDs(action.ID, provider);
+    const metadata = provider ?? Metadata.Provider; // global-provider-ok: fallback only when the request carries no provider
+    const actionAuthorizesCaller = ActionEngineServer.Instance.ActionAuthorizesCaller(action);
+    const decision = EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller);
+    if (!decision.Allowed) {
+      throw new Error(`Not authorized to run action ${action.ID}: ${decision.Reason}`);
+    }
+  }
+
+  /**
+   * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+   * user: this is the server's own authorization decision, so it must not depend on whether the
+   * caller can read that entity.
+   */
+  private async loadActionAuthorizationIDs(actionID: string, provider: DatabaseProviderBase | null): Promise<string[]> {
+    const systemUser = UserCache.Instance.GetSystemUser();
+    if (!systemUser) {
+      throw new Error("System user not found");
+    }
+    const result = await new RunView(provider).RunView<{ AuthorizationID: string }>({
+      EntityName: 'MJ: Action Authorizations',
+      ExtraFilter: `ActionID='${EscapeSQLString(actionID)}'`,
+      Fields: ['AuthorizationID'],
+      ResultType: 'simple'
+    }, systemUser);
+    if (!result.Success) {
+      throw new Error(`Could not read the authorizations for action ${actionID}: ${result.ErrorMessage}`);
+    }
+    return result.Results.map(row => row.AuthorizationID);
+  }
+
   /**
    * Finds an action by its ID
    * @param actionID The ID of the action to find
@@ -222,7 +287,7 @@ export class ActionResolver extends ResolverBase {
    * @throws Error if the action is not found
    * @private
    */
-  private findActionById(actionID: string): any {
+  private findActionById(actionID: string): MJActionEntityExtended {
     const action = ActionEngineServer.Instance.Actions.find(a => UUIDsEqual(a.ID, actionID));
     if (!action) {
       throw new Error(`Action with ID ${actionID} not found`);
@@ -264,20 +329,18 @@ export class ActionResolver extends ResolverBase {
   }
 
   /**
-   * Executes an action
+   * Executes an action. The run is always logged: a client cannot switch off the action execution log.
    * @param action The action to execute
    * @param user The user context
    * @param params The action parameters
-   * @param skipActionLog Whether to skip action logging
    * @returns The action result
    * @private
    */
   private async executeAction(
-    action: any,
+    action: MJActionEntityExtended,
     user: UserInfo,
     params: ActionParam[],
-    providers: Array<ProviderInfo>,
-    skipActionLog?: boolean
+    providers: Array<ProviderInfo>
   ): Promise<ActionResult> {
     // Resolve the request-scoped provider. Prefer read-write (actions may mutate);
     // fall back to read-only, then to the engine's global-Metadata default when no
@@ -287,7 +350,7 @@ export class ActionResolver extends ResolverBase {
       Action: action,
       ContextUser: user,
       Params: params,
-      SkipActionLog: skipActionLog,
+      SkipActionLog: false,
       Filters: [],
       Provider: provider
     });

package/src/resolvers/AdhocQueryResolver.ts

@@ -1,6 +1,8 @@
 import { Arg, Ctx, Query, Resolver, Field, Int, InputType } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import type { RunQueryResult } from '@memberjunction/core';
+import type { DatabaseProviderBase, RunQueryResult, UserInfo } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
+import type { AdhocSQLAuthorizer } from '@memberjunction/actions';
 import { AppContext } from '../types.js';
 import { configInfo } from '../config.js';
 import { GetReadOnlyProvider } from '../util.js';
@@ -38,6 +40,10 @@ class AdhocQueryInput {
  *
  * Security:
  * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
  * - Read-only provider only (no fallback to read-write)
  * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
@@ -68,6 +74,10 @@ export class AdhocQueryResolver extends ResolverBase {
             return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
         }
         const contextUser = context.userPayload?.userRecord;
+        const refusal = this.AuthorizeRenderedSQL(input.SQL, provider, contextUser);
+        if (refusal) {
+            return this.buildErrorResult(refusal, Date.now() - startTime);
+        }
         const timeoutSeconds = ClampAdhocTimeoutSeconds(input.TimeoutSeconds, configInfo.databaseSettings.requestTimeout);
         // A negative offset must not reach paging, where it would turn paging off.
         const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow! : 0);
@@ -86,6 +96,29 @@ export class AdhocQueryResolver extends ResolverBase {
         }
     }
 
+    /**
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
+     *
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
+     */
+    public AuthorizeRenderedSQL(sqlText: string, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null {
+        try {
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: contextUser, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'ad-hoc SQL');
+            return null;
+        } catch (err) {
+            return err instanceof Error ? err.message : String(err);
+        }
+    }
+
     /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
     private toResultType(
         result: RunQueryResult,
@@ -131,3 +164,18 @@ export class AdhocQueryResolver extends ResolverBase {
         };
     }
 }
+
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export function CreateAdhocSQLAuthorizer(requestTimeoutMs: number): AdhocSQLAuthorizer {
+    const resolver = new AdhocQueryResolver();
+    return {
+        Authorize: (sql, provider, contextUser) => resolver.AuthorizeRenderedSQL(sql, provider, contextUser),
+        ClampTimeoutSeconds: (requestedSeconds) => ClampAdhocTimeoutSeconds(requestedSeconds, requestTimeoutMs),
+    };
+}

package/src/resolvers/DatasetResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
-import { AppContext } from '../types.js';
-import { LogError, Metadata } from '@memberjunction/core';
+import { AppContext, UserPayload } from '../types.js';
+import { DatabaseProviderBase, DatasetItemFilterType, DatasetItemResultType, LogError, Metadata, UserInfo } from '@memberjunction/core';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
@@ -34,9 +34,64 @@ export class DatasetItemFilterTypeGQL {
   Filter: string;
 }
 
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export abstract class DatasetResolverBase extends ResolverBase {
+  /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+  protected RequireDatasetUser(userPayload: UserPayload): UserInfo {
+    const user = this.GetUserFromPayload(userPayload);
+    if (!user) {
+      throw new Error('Dataset request refused: the session resolves to no user');
+    }
+    return user;
+  }
+
+  /**
+   * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+   * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+   */
+  protected ScreenItemFilters(
+    itemFilters: DatasetItemFilterTypeGQL[] | undefined,
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): DatasetItemFilterType[] | undefined {
+    if (!itemFilters) return undefined;
+    itemFilters.forEach((itemFilter, index) => {
+      if (itemFilter) {
+        this.assertClientClauseUsesEntityBaseViews(itemFilter.Filter, `ItemFilters[${index}].Filter`, provider, user);
+      }
+    });
+    return itemFilters.filter((itemFilter) => itemFilter != null);
+  }
+
+  /**
+   * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+   * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+   * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+   */
+  protected async ProtectEncryptedFields(
+    items: DatasetItemResultType[],
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): Promise<DatasetItemResultType[]> {
+    return Promise.all(
+      items.map(async (item) => {
+        const entity = provider.EntityByName(item.EntityName);
+        if (!item.Results?.length || !entity?.EncryptedFields.some((field) => !field.AllowDecryptInAPI)) {
+          return item;
+        }
+        const rows = item.Results.map((row: Record<string, unknown>) => ({ ...row }));
+        return { ...item, Results: await this.ArrayFilterEncryptedFieldsForAPI(item.EntityName, rows, user, provider, 'Name') };
+      }),
+    );
+  }
+}
 
 @Resolver(DatasetResultType)
-export class DatasetResolverExtended extends ResolverBase {
+export class DatasetResolverExtended extends DatasetResolverBase {
   @Query(() => DatasetResultType)
   async GetDatasetByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -45,10 +100,12 @@ export class DatasetResolverExtended extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -56,7 +113,7 @@ export class DatasetResolverExtended extends ResolverBase {
           Success: result.Success,
           Status: result.Status,
           LatestUpdateDate: result.LatestUpdateDate,
-          Results: JSON.stringify(result.Results),
+          Results: JSON.stringify(await this.ProtectEncryptedFields(result.Results, md, user)),
         };
       } else {
         throw new Error('Error retrieving Dataset: ' + DatasetName);
@@ -90,7 +147,7 @@ export class DatasetStatusResultType {
 }
 
 @Resolver(DatasetStatusResultType)
-export class DatasetStatusResolver extends ResolverBase {
+export class DatasetStatusResolver extends DatasetResolverBase {
   @Query(() => DatasetStatusResultType)
   async GetDatasetStatusByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -99,10 +156,12 @@ export class DatasetStatusResolver extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetStatusByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetStatusByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -131,12 +190,13 @@ export class DatasetStatusResolver extends ResolverBase {
     @Ctx() { providers, userPayload }: AppContext,
   ): Promise<DatasetStatusResultType[]> {
     const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
     const results: DatasetStatusResultType[] = [];
 
     // Execute all status checks in parallel
     const statusPromises = DatasetNames.map(async (name) => {
       await this.CheckAPIKeyScopeAuthorization('dataset:read', name, userPayload);
-      return md.GetDatasetStatusByName(name);
+      return md.GetDatasetStatusByName(name, undefined, user);
     });
 
     const statuses = await Promise.all(statusPromises);

package/src/resolvers/EntityRecordNameResolver.ts

@@ -1,4 +1,4 @@
-import { CompositeKey, DatabaseProviderBase, EntityInfo, LogDebug, UserInfo } from '@memberjunction/core';
+import { CompositeKey, DatabaseProviderBase } from '@memberjunction/core';
 import { Arg, Ctx, Field, InputType, ObjectType, Query, Resolver } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { CompositeKeyInputType, CompositeKeyOutputType } from '../generic/KeyInputOutputTypes.js';
@@ -36,20 +36,14 @@ export class EntityRecordNameResult {
  * Resolves a record's display NAME from its primary key — the lookup behind every foreign-key
  * link, breadcrumb and picker label in the UI.
  *
- * **This is a read of entity data and is gated like one.** It historically took no user context
- * at all, which made it an open side channel: a caller denied READ on an entity's name field
- * could still obtain that name here, because the name never travelled through the resolver that
- * strips denied fields. Field-level security turned that latent gap into a live bypass — the
- * form-field FK control falls through to this query precisely WHEN the joined display column is
- * denied, so the one case the fallback exists for was the case that leaked.
+ * Entity-level read permission is checked here ({@link ResolverBase.CheckUserReadPermissions}).
+ * Field- and row-level security are applied by the provider's lookup, for the acting user passed
+ * to it: when any field the name is built from is withheld, it answers with no name, and it reads
+ * only rows the user's read row filter allows. Without an acting user there is no lookup.
  *
- * Two gates now apply, matching what the generated single-record resolvers do:
- *   1. entity-level read permission ({@link ResolverBase.CheckUserReadPermissions});
- *   2. field-level read permission on the entity's own name field.
- *
- * A field-level denial answers `Success: false` with no name rather than throwing. Callers
- * already treat "no name" as "show the primary key", which is the intended degradation — and it
- * keeps this query from becoming a probe that distinguishes "restricted" from "missing".
+ * A withheld name answers `Success: false` with the same status as a record that does not exist.
+ * Callers already treat "no name" as "show the primary key", and the identical answer keeps this
+ * query from becoming a probe that distinguishes "restricted" from "missing".
  */
 @Resolver(EntityRecordNameResult)
 export class EntityRecordNameResolver extends ResolverBase {
@@ -91,53 +85,18 @@ export class EntityRecordNameResolver extends ResolverBase {
     const e = md.Entities.find((e) => e.Name === EntityName);
     if (e) {
       const contextUser = userPayload ? this.GetUserFromPayload(userPayload) : undefined;
-      if (this.IsNameFieldDeniedToUser(e, contextUser)) {
-        LogDebug(
-          `[FieldSecurity] Suppressed GetEntityRecordName for '${EntityName}': ` +
-          `the name field is not readable by this user`
-        );
-        return {
-          Success: false,
-          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue`,
-          CompositeKey: pk,
-          EntityName,
-        };
-      }
-      // Pass the acting user through: the provider signature accepts it, and omitting it ran the
-      // underlying lookup with no identity at all — so row-level security had nothing to filter on
-      // either. The field-level gate above is the column half; this is the row half.
-      const recordName = await md.GetEntityRecordName(e.Name, pk, contextUser);
+      // The acting user is what field- and row-level security are applied for.
+      const recordName = contextUser ? await md.GetEntityRecordName(e.Name, pk, contextUser) : '';
       if (recordName) return { Success: true, Status: 'OK', CompositeKey: pk, RecordName: recordName, EntityName };
       else
         return {
           Success: false,
-          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue if user doesn't have Row Level Access (RLS) if RLS is enabled for this entity`,
+          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue`,
           CompositeKey: pk,
           EntityName,
         };
     } else return { Success: false, Status: `Entity ${EntityName} not found`, CompositeKey: pk, EntityName };
   }
-
-  /**
-   * Whether field security withholds this entity's NAME field from the user.
-   *
-   * Resolves the name field the same way the provider's own lookup does — the designated
-   * `IsNameField`, else a field literally called `Name` — so the check cannot drift from the
-   * value it is guarding. Fails OPEN only where field security does not apply at all (flag off,
-   * no user, no name field), matching every other FLS gate.
-   */
-  protected IsNameFieldDeniedToUser(entity: EntityInfo, contextUser?: UserInfo): boolean {
-    if (!entity?.EnableFieldLevelSecurity || !contextUser) {
-      return false;
-    }
-    const nameField =
-      entity.Fields?.find(f => f.IsNameField) ??
-      entity.Fields?.find(f => f.Name?.trim().toLowerCase() === 'name');
-    if (!nameField) {
-      return false;
-    }
-    return entity.GetDeniedReadFields(contextUser).has(nameField.Name.trim().toLowerCase());
-  }
 }
 
 export default EntityRecordNameResolver;

package/src/resolvers/FetchEntityVectorsResolver.ts

@@ -5,7 +5,7 @@ import { MJEntityDocumentEntity, MJVectorIndexEntity, MJVectorDatabaseEntity } f
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetAIAPIKey } from '@memberjunction/ai';
 import { VectorDBBase } from '@memberjunction/ai-vectordb';
-import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
+import { EscapeSQLString, MJGlobal, UUIDsEqual } from '@memberjunction/global';
 
 /* ───── GraphQL types ───── */
 
@@ -144,7 +144,7 @@ export class FetchEntityVectorsResolver extends ResolverBase {
         const rv = new RunView();
         const result = await rv.RunView<MJEntityDocumentEntity>({
             EntityName: 'MJ: Entity Documents',
-            ExtraFilter: `ID='${entityDocumentID}'`,
+            ExtraFilter: `ID='${EscapeSQLString(entityDocumentID)}'`,
             ResultType: 'entity_object',
         }, contextUser);