@memberjunction/server 6.1.5 → 6.1.6

package/src/resolvers/RunTemplateResolver.ts

@@ -2,7 +2,7 @@ import { Resolver, Mutation, Arg, Ctx, ObjectType, Field } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, Metadata, RunView } from '@memberjunction/core';
 import { MJTemplateContentEntity, MJTemplateEntityExtended } from '@memberjunction/core-entities';
-import { TemplateEngineServer } from '@memberjunction/templates';
+import { GetTemplateRunRefusal, TemplateEngineServer } from '@memberjunction/templates';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
 
@@ -45,6 +45,18 @@ export class RunTemplateResolver extends ResolverBase {
         try {
             LogStatus(`=== RUNNING TEMPLATE FOR ID: ${templateId} ===`);
 
+            // Same rule as the Template.Run remote operation, checked before anything is loaded
+            const currentUser = this.GetUserFromPayload(userPayload);
+            const p = GetReadWriteProvider(providers);
+            const refusal = GetTemplateRunRefusal(currentUser, p);
+            if (refusal) {
+                return {
+                    success: false,
+                    error: refusal,
+                    executionTimeMs: Date.now() - startTime
+                };
+            }
+
             // Parse context data (JSON string)
             let data = {};
             if (contextData) {
@@ -59,17 +71,6 @@ export class RunTemplateResolver extends ResolverBase {
                 }
             }
 
-            // Get current user from payload
-            const currentUser = this.GetUserFromPayload(userPayload);
-            if (!currentUser) {
-                return {
-                    success: false,
-                    error: 'Unable to determine current user',
-                    executionTimeMs: Date.now() - startTime
-                };
-            }
-            
-            const p = GetReadWriteProvider(providers);
             // Load the template entity
             const templateEntity = await p.GetEntityObject<MJTemplateEntityExtended>('MJ: Templates', currentUser);
             await templateEntity.Load(templateId);

package/src/resolvers/SearchKnowledgeResolver.ts

@@ -32,6 +32,9 @@ export class SearchKnowledgeResultItem {
     @Field()
     EntityName: string;
 
+    @Field({ nullable: true })
+    EntityDisplayName?: string;
+
     @Field()
     RecordID: string;
 
@@ -461,6 +464,7 @@ export class SearchKnowledgeResolver extends ResolverBase {
             Results: result.Results.map((r: SearchEngineResultItem) => ({
                 ID: r.ID,
                 EntityName: r.EntityName,
+                EntityDisplayName: r.EntityDisplayName,
                 RecordID: r.RecordID,
                 SourceType: r.SourceType,
                 ResultType: r.ResultType,

package/src/resolvers/SearchKnowledgeSystemUserResolver.ts

@@ -88,6 +88,7 @@ export class SearchKnowledgeSystemUserResolver extends ResolverBase {
             Results: result.Results.map((r: SearchEngineResultItem) => ({
                 ID: r.ID,
                 EntityName: r.EntityName,
+                EntityDisplayName: r.EntityDisplayName,
                 RecordID: r.RecordID,
                 SourceType: r.SourceType,
                 ResultType: r.ResultType,

package/src/resolvers/SyncDataResolver.ts

@@ -3,6 +3,7 @@ import { AppContext, UserPayload } from '../types.js';
 import { BaseEntity, CompositeKey, DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, IMetadataProvider, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadWriteProvider } from '../util.js';
+import { CreateIsolatedProvider } from '../isolatedProvider.js';
 import { CompositeKeyInputType, CompositeKeyOutputType } from '../generic/KeyInputOutputTypes.js';
 import { MJDatasetItemEntity } from '@memberjunction/core-entities';
 
@@ -216,7 +217,11 @@ export class SyncDataResolver {
         try {
             // Run the view to find matching records, then delete them all atomically —
             // any single failure rolls back the entire batch so the dataset stays consistent.
-            const rv = new RunView();
+            // The rows are loaded FROM the transaction's provider so each Delete() runs inside it;
+            // with no request provider, an isolated one, never the shared Metadata.Provider, whose
+            // transaction would swallow every concurrent caller's writes (see CreateIsolatedProvider).
+            const provider = (providerOverride as unknown as DatabaseProviderBase) ?? await CreateIsolatedProvider();
+            const rv = RunView.FromMetadataProvider(provider);
             const data = await rv.RunView<BaseEntity>({
                 EntityName: entityName,
                 ExtraFilter: filter,
@@ -234,7 +239,6 @@ export class SyncDataResolver {
                 return;
             }
 
-            const provider = (providerOverride ?? Metadata.Provider) as unknown as DatabaseProviderBase;
             await provider.BeginTransaction();
             try {
                 for (const entityObject of data.Results) {

package/src/resolvers/VectorizeEntityResolver.ts

@@ -1,26 +1,27 @@
 import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
+import { IMetadataProvider, LogError, LogStatus, UserInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { EntityVectorSyncer, VectorizeEntityParams, VectorizeProgressUpdate } from '@memberjunction/ai-vector-sync';
 import { PubSubManager } from '../generic/PubSubManager.js';
 import { PipelineProgressNotification } from './PipelineProgressResolver.js';
 import { v4 as uuidv4 } from 'uuid';
+import { GetReadWriteProvider } from '../util.js';
 
 const PIPELINE_PROGRESS_TOPIC = 'PIPELINE_PROGRESS';
 
 @ObjectType()
 export class VectorizeEntityResult {
-    @Field()
+    @Field(() => Boolean)
     Success: boolean;
 
-    @Field({ nullable: true })
+    @Field(() => String, { nullable: true })
     Status?: string;
 
-    @Field({ nullable: true })
+    @Field(() => String, { nullable: true })
     ErrorMessage?: string;
 
-    @Field({ nullable: true })
+    @Field(() => String, { nullable: true })
     PipelineRunID?: string;
 }
 
@@ -28,10 +29,10 @@ export class VectorizeEntityResult {
 export class VectorizeEntityResolver extends ResolverBase {
     @Mutation(() => VectorizeEntityResult)
     async VectorizeEntity(
-        @Arg('entityDocumentID') entityDocumentID: string,
-        @Arg('entityID') entityID: string,
+        @Arg('entityDocumentID', () => String) entityDocumentID: string,
+        @Arg('entityID', () => String) entityID: string,
         @Arg('batchSize', () => Float, { nullable: true }) batchSize?: number,
-        @Ctx() { userPayload }: AppContext = {} as AppContext
+        @Ctx() { userPayload, providers }: AppContext = {} as AppContext
     ): Promise<VectorizeEntityResult> {
         try {
             const currentUser = this.GetUserFromPayload(userPayload);
@@ -39,12 +40,15 @@ export class VectorizeEntityResolver extends ResolverBase {
                 return { Success: false, Status: 'Error', ErrorMessage: 'Unable to determine current user' };
             }
 
+            // Capture the request's provider before returning, so the background run writes through the
+            // same connection the caller used. It is also the colocated vector host (#4910).
+            const provider = GetReadWriteProvider(providers, { allowFallbackToReadOnly: true }) ?? undefined;
             const pipelineRunID = uuidv4();
             LogStatus(`VectorizeEntity: starting pipeline ${pipelineRunID} for entity document ${entityDocumentID}`);
 
             // Fire-and-forget: start the pipeline in the background and return immediately.
             // Progress is delivered to the client via the PipelineProgress GraphQL subscription.
-            this.runPipelineInBackground(pipelineRunID, entityDocumentID, entityID, batchSize, currentUser);
+            this.runPipelineInBackground(pipelineRunID, entityDocumentID, entityID, batchSize, currentUser, provider);
 
             return {
                 Success: true,
@@ -71,10 +75,11 @@ export class VectorizeEntityResolver extends ResolverBase {
         entityDocumentID: string,
         entityID: string,
         batchSize: number | undefined,
-        currentUser: UserInfo
+        currentUser: UserInfo,
+        provider?: IMetadataProvider
     ): Promise<void> {
         try {
-            const syncer = new EntityVectorSyncer();
+            const syncer = new EntityVectorSyncer(provider);
             await syncer.Config(true, currentUser);
 
             const params: VectorizeEntityParams = {

package/src/resolvers/__tests__/GetDataResolver.validation.test.ts

@@ -0,0 +1,95 @@
+// type-graphql decorators on the resolver class need the reflect-metadata polyfill.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { MockInstance } from 'vitest';
+import { SQLExpressionValidator } from '@memberjunction/global';
+
+const { executedSQL } = vi.hoisted(() => ({ executedSQL: [] as string[] }));
+
+// GetData's server bootstrap, provider, auth and driver imports are replaced so the resolver runs
+// offline. The fake driver records every text it is asked to run.
+vi.mock('../../index.js', () => ({ getDbType: () => 'sqlserver' }));
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  QueryCompositionEngine: class {
+    HasCompositionTokens(): boolean {
+      return false;
+    }
+  },
+}));
+vi.mock('../../util.js', () => ({ GetReadOnlyDataSource: () => ({}), GetReadOnlyProvider: () => null }));
+vi.mock('../../auth/index.js', () => ({ getSystemUser: async () => ({}) }));
+vi.mock('mssql', () => ({
+  default: {
+    Request: class {
+      async query(text: string): Promise<{ recordset: Array<Record<string, unknown>> }> {
+        executedSQL.push(text);
+        return { recordset: [] };
+      }
+    },
+  },
+}));
+
+import { GetDataResolver, GetDataInputType, GetDataOutputType, registerAccessToken } from '../GetDataResolver.js';
+import type { AppContext } from '../../types.js';
+
+const CONTEXT = { dataSources: [] } as unknown as AppContext;
+
+let tokenSeq = 0;
+
+/** Calls GetData with a fresh valid token. */
+async function runGetData(queries: string[]): Promise<GetDataOutputType> {
+  const token = `getdata-validation-${Date.now()}-${++tokenSeq}`;
+  registerAccessToken(token, 60_000);
+  const input = Object.assign(new GetDataInputType(), { Token: token, Queries: queries });
+  return new GetDataResolver().GetData(input, CONTEXT);
+}
+
+/** The text of every call to the validator's `validate` method. */
+function validatedTexts(spy: MockInstance<SQLExpressionValidator['validate']>): string[] {
+  return spy.mock.calls.map(([text]) => text);
+}
+
+describe('GetData runs exactly the SQL it validated', () => {
+  beforeEach(() => {
+    executedSQL.length = 0;
+  });
+
+  it('validates and runs the same text when the query contains backslash sequences', async () => {
+    const query = String.raw`SELECT Name FROM __mj.vwFiles WHERE Path = 'C:\new\temp'`;
+    const validateSpy = vi.spyOn(SQLExpressionValidator.Instance, 'validate');
+
+    const output = await runGetData([query]);
+
+    expect(output.ErrorMessages).toEqual([null]);
+    expect(executedSQL).toEqual(validatedTexts(validateSpy));
+    expect(executedSQL).toEqual([query]);
+    expect(validateSpy).toHaveBeenCalledWith(query, { context: 'full_query', Dialect: 'sqlserver' });
+  });
+
+  it('runs the trimmed text that the validator reads', async () => {
+    const validateSpy = vi.spyOn(SQLExpressionValidator.Instance, 'validate');
+
+    const output = await runGetData(['\n  SELECT 1 AS One  \n']);
+
+    expect(output.ErrorMessages).toEqual([null]);
+    expect(executedSQL).toEqual(['SELECT 1 AS One']);
+    expect(validatedTexts(validateSpy)).toEqual(executedSQL);
+  });
+
+  it('refuses a query whose text, as written, does not open with SELECT or WITH', async () => {
+    const output = await runGetData(["-- note\\n SELECT 1\nPRINT 'hello'"]);
+
+    expect(executedSQL).toEqual([]);
+    expect(output.Success).toBe(false);
+    expect(output.ErrorMessages[0]).toMatch(/must start with SELECT or WITH/);
+  });
+
+  it('does not run a refused query and still runs the others', async () => {
+    const output = await runGetData(['SELECT 1; SELECT 2', 'SELECT 1 AS One']);
+
+    expect(executedSQL).toEqual(['SELECT 1 AS One']);
+    expect(output.ErrorMessages[0]).toMatch(/Semicolons are not allowed/);
+    expect(output.ErrorMessages[1]).toBeNull();
+  });
+});

package/src/rest/ViewOperationsHandler.ts

@@ -1,7 +1,8 @@
 import { 
-    LogError, Metadata, RunView, RunViewParams, 
-    RunViewResult, UserInfo 
+    BaseEntity, LogError, Metadata, RunView, RunViewParams, 
+    RunViewResult, UserInfo, type IRunViewProvider 
 } from '@memberjunction/core';
+import { ClientClauseScreen } from '@memberjunction/generic-database-provider';
 
 /**
  * View Operations Implementation for REST endpoints
@@ -32,11 +33,11 @@ export class ViewOperationsHandler {
                 };
             }
             
-            // Sanitize and validate parameters
-            this.sanitizeRunViewParams(params);
+            // Sanitize and validate parameters against the provider that runs the view
+            const runView = new RunView();
+            this.sanitizeRunViewParams(params, md, runView.ProviderToUse, user);
             
             // Execute the view
-            const runView = new RunView();
             const result = await runView.RunView(params, user);
             
             return { success: true, result };
@@ -51,8 +52,9 @@ export class ViewOperationsHandler {
      */
     static async runViews(paramsArray: RunViewParams[], user: UserInfo): Promise<{ success: boolean, results?: RunViewResult[], error?: string }> {
         try {
-            // Validate and sanitize each set of parameters
+            // Validate and sanitize each set of parameters against the provider that runs the views
             const md = new Metadata(); // global-provider-ok: REST endpoint — no per-request provider injection in REST middleware yet
+            const runView = new RunView();
             for (const params of paramsArray) {
                 // Validate entity exists
                 const entity = md.Entities.find(e => e.Name === params.EntityName);
@@ -73,11 +75,10 @@ export class ViewOperationsHandler {
                 }
                 
                 // Sanitize parameters
-                this.sanitizeRunViewParams(params);
+                this.sanitizeRunViewParams(params, md, runView.ProviderToUse, user);
             }
             
             // Execute the views
-            const runView = new RunView();
             const results = await runView.RunViews(paramsArray, user);
             
             return { success: true, results };
@@ -104,11 +105,11 @@ export class ViewOperationsHandler {
                 throw new Error(`User ${user.Name} does not have permission to read ${params.EntityName} records`);
             }
             
-            // Sanitize and validate parameters
-            this.sanitizeRunViewParams(params);
+            // Sanitize and validate parameters against the provider that runs the view
+            const runView = new RunView();
+            this.sanitizeRunViewParams(params, md, runView.ProviderToUse, user);
             
             // Execute the view
-            const runView = new RunView();
             return await runView.RunView(params, user);
         } catch (error) {
             LogError(error);
@@ -173,35 +174,53 @@ export class ViewOperationsHandler {
     }
     
     /**
-     * Sanitize and validate RunViewParams
+     * Sanitize and validate RunViewParams. Client filter and sort text passes the same clause
+     * screen as the GraphQL RunView resolvers, parsed in the dialect of `provider`, the provider
+     * that runs the view.
      */
-    private static sanitizeRunViewParams(params: RunViewParams): void {
+    private static sanitizeRunViewParams(params: RunViewParams, md: Metadata, provider: IRunViewProvider, user: UserInfo): void {
         // Ensure EntityName is provided
         if (!params.EntityName) {
             throw new Error('EntityName is required');
         }
+
+        // A loaded view entity cannot arrive over JSON; the provider would trust a plain object's
+        // fields (its ID is spliced into view SQL). REST callers name a saved view by ViewID or ViewName.
+        if (params.ViewEntity != null && !(params.ViewEntity instanceof BaseEntity)) {
+            throw new Error('ViewEntity is not accepted over REST; use ViewID or ViewName');
+        }
         
         // Convert string arrays if they came in as comma-separated strings
         if (params.Fields && typeof params.Fields === 'string') {
             params.Fields = (params.Fields as string).split(',');
         }
         
-        // Sanitize numeric values
+        // Sanitize numeric values: base-10, integral, and clamped to a sane range so a
+        // negative/garbage value can never reach the SQL layer.
         if (params.MaxRows !== undefined) {
-            params.MaxRows = typeof params.MaxRows === 'string' 
-                ? parseInt(params.MaxRows as string) 
+            const parsed = typeof params.MaxRows === 'string'
+                ? parseInt(params.MaxRows as string, 10)
                 : params.MaxRows;
+            params.MaxRows = Number.isFinite(parsed) ? Math.max(0, Math.floor(parsed as number)) : undefined;
         }
         
         if (params.StartRow !== undefined) {
-            params.StartRow = typeof params.StartRow === 'string' 
-                ? parseInt(params.StartRow as string) 
+            const parsed = typeof params.StartRow === 'string'
+                ? parseInt(params.StartRow as string, 10)
                 : params.StartRow;
+            params.StartRow = Number.isFinite(parsed) ? Math.max(0, Math.floor(parsed as number)) : undefined;
         }
         
         // Default ResultType if not provided
         if (!params.ResultType) {
             params.ResultType = 'simple';
         }
+
+        ClientClauseScreen.ScreenViewClauses(
+            { ExtraFilter: params.ExtraFilter, OrderBy: params.OrderBy, OverrideExcludeFilter: params.OverrideExcludeFilter },
+            md.Entities,
+            ClientClauseScreen.DialectFor(provider),
+            user,
+        );
     }
 }

package/src/services/TaskGraphActionRunner.ts

@@ -35,9 +35,19 @@ export class TaskGraphActionRunner implements TaskActionRunner {
                 Filters: [],
             });
 
+            const output = this.buildOutput(result.Params);
+            const unstorable = this.findUnstorableOutput(output);
+            if (unstorable) {
+                const message =
+                    `Action "${action.Name}" returned output param "${unstorable.Name}", which cannot be stored ` +
+                    `as the step's result: ${unstorable.Reason}. Output params of a durable step must be plain data.`;
+                LogError(`[TaskGraphActionRunner] Task ${params.TaskID}: ${message}`);
+                return { Success: false, ErrorMessage: message, ActionLogID: result.LogEntry?.ID };
+            }
+
             return {
                 Success: result.Success,
-                Output: this.buildOutput(result.Params),
+                Output: output,
                 ErrorMessage: result.Success ? undefined : result.Message,
                 // The engine already wrote the log; this is the only place its id is in hand. Without
                 // carrying it out, a workflow's action step has no path back to its own execution
@@ -51,6 +61,24 @@ export class TaskGraphActionRunner implements TaskActionRunner {
         }
     }
 
+    /**
+     * The first output param that cannot be written to the Task row as JSON, or null.
+     *
+     * Checked here because this is the last place that knows the action's and the param's NAMES: the
+     * dispatcher serializes the whole Output later and, for a live object (an entity, an observable),
+     * fails with a bare "Converting circular structure to JSON" that names neither.
+     */
+    private findUnstorableOutput(output: Record<string, unknown>): { Name: string; Reason: string } | null {
+        for (const [Name, value] of Object.entries(output)) {
+            try {
+                JSON.stringify(value);
+            } catch (e) {
+                return { Name, Reason: e instanceof Error ? e.message.split('\n')[0] : String(e) };
+            }
+        }
+        return null;
+    }
+
     /**
      * Projects the action's parameters onto the flat result a workflow step is expected to produce.
      *