@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/dist/resolvers/ActionResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AACH,qBACa,gBAAgB;IAC3B;;OAEG;IAEH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IAEH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IAEH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBACa,cAAc;IACzB;;OAEG;IAEH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IAEH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,aAAa,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IAEH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAE/B;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,qBACa,kBAAkB;IAC7B;;OAEG;IAEH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBACa,cAAe,SAAQ,YAAY;IAC9C;;;;;OAKG;IAEG,SAAS,CACC,KAAK,EAAE,cAAc,EAC5B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAgC9B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA2B7B;;;;;;;;OAQG;YACW,aAAa;IAqB3B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;OAKG;IAEG,eAAe,CACL,KAAK,EAAE,iBAAiB,EAC/B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAsD9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;YACW,eAAe;IA4B7B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAUhC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;CAQpB"}
+{"version":3,"file":"ActionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI1D;;;GAGG;AACH,qBACa,gBAAgB;IAC3B;;OAEG;IAEH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IAEH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IAEH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBACa,cAAc;IACzB;;OAEG;IAEH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IAEH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,aAAa,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IAEH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAE/B;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,qBACa,kBAAkB;IAC7B;;OAEG;IAEH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBACa,cAAe,SAAQ,YAAY;IAC9C;;;;;;;;;;;OAWG;IAEG,SAAS,CACC,KAAK,EAAE,cAAc,EAC5B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IA4B9B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAW7B;;;;;;OAMG;YACW,kBAAkB;IAchC;;;;OAIG;YACW,0BAA0B;IAiBxC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA2B7B;;;;;;;OAOG;YACW,aAAa;IAoB3B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;OAKG;IAEG,eAAe,CACL,KAAK,EAAE,iBAAiB,EAC/B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAsD9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;YACW,eAAe;IA4B7B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAUhC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;CAQpB"}

package/dist/resolvers/ActionResolver.js

@@ -13,12 +13,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { CompositeKey, KeyValuePair, LogError } from "@memberjunction/core";
+import { Metadata, CompositeKey, KeyValuePair, LogError, RunView } from "@memberjunction/core";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
-import { CopyScalarsAndArrays, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
+import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
 /**
  * Input type for action parameters
  * Used to pass parameters to actions when invoking them
@@ -149,30 +152,32 @@ export { ActionResultOutput };
  */
 let ActionResolver = class ActionResolver extends ResolverBase {
     /**
-     * Mutation for running an action
+     * Mutation for running an action.
+     *
+     * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+     * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+     * action has no such link, an action class that authorizes its caller itself. The run is always
+     * logged.
      * @param input The input parameters for running the action
      * @param ctx The GraphQL context containing user authentication information
      * @returns The result of running the action
      */
     async RunAction(input, ctx) {
         try {
+            const user = this.getRunActionPrincipal(ctx);
             // Check API key scope authorization for action execution
             await this.CheckAPIKeyScopeAuthorization('action:execute', input.ActionID, ctx.userPayload);
-            // Get the user from context
-            const user = ctx.userPayload.userRecord;
-            if (!user) {
-                throw new Error("User is not authenticated");
-            }
             // Initialize the action engine
             await ActionEngineServer.Instance.Config(false, user);
-            // Get the action by ID
             const action = this.findActionById(input.ActionID);
+            await this.assertCanRunAction(action, user, ctx.providers);
             // Parse the parameters
             const params = this.parseActionParameters(input.Params);
             // Run the action — thread the request-scoped provider so provider-bound
             // actions (e.g. the semantic find-* / Search Entity actions, which call
             // params.Provider.SearchEntity) run against the caller's metadata layer.
-            const result = await this.executeAction(action, user, params, ctx.providers, input.SkipActionLog);
+            const result = await this.executeAction(action, user, params, ctx.providers);
             // Return the result
             return this.createActionResult(result);
         }
@@ -180,6 +185,63 @@ let ActionResolver = class ActionResolver extends ResolverBase {
             return this.handleActionError(e);
         }
     }
+    /**
+     * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+     * only as row-level-security filters, and an action can reach data and services those filters never
+     * cover.
+     * @throws Error when there is no user or the session is scope-limited
+     */
+    getRunActionPrincipal(ctx) {
+        const user = ctx.userPayload?.userRecord;
+        if (!user) {
+            throw new Error("User is not authenticated");
+        }
+        if (IsScopeLimitedPrincipal(user)) {
+            throw new Error("RunAction is not permitted for scope-limited sessions");
+        }
+        return user;
+    }
+    /**
+     * Refuses the run unless the caller is authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+     * tree and the role grants all come from the request's provider, or all from the global provider
+     * when the request carries none.
+     * @throws Error when the caller may not run the action
+     */
+    async assertCanRunAction(action, user, providers) {
+        if (IsOwner(user)) {
+            return; // an Owner may run any action, so nothing needs to be read
+        }
+        const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+        const actionAuthorizationIDs = await this.loadActionAuthorizationIDs(action.ID, provider);
+        const metadata = provider ?? Metadata.Provider; // global-provider-ok: fallback only when the request carries no provider
+        const actionAuthorizesCaller = ActionEngineServer.Instance.ActionAuthorizesCaller(action);
+        const decision = EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller);
+        if (!decision.Allowed) {
+            throw new Error(`Not authorized to run action ${action.ID}: ${decision.Reason}`);
+        }
+    }
+    /**
+     * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+     * user: this is the server's own authorization decision, so it must not depend on whether the
+     * caller can read that entity.
+     */
+    async loadActionAuthorizationIDs(actionID, provider) {
+        const systemUser = UserCache.Instance.GetSystemUser();
+        if (!systemUser) {
+            throw new Error("System user not found");
+        }
+        const result = await new RunView(provider).RunView({
+            EntityName: 'MJ: Action Authorizations',
+            ExtraFilter: `ActionID='${EscapeSQLString(actionID)}'`,
+            Fields: ['AuthorizationID'],
+            ResultType: 'simple'
+        }, systemUser);
+        if (!result.Success) {
+            throw new Error(`Could not read the authorizations for action ${actionID}: ${result.ErrorMessage}`);
+        }
+        return result.Results.map(row => row.AuthorizationID);
+    }
     /**
      * Finds an action by its ID
      * @param actionID The ID of the action to find
@@ -225,15 +287,14 @@ let ActionResolver = class ActionResolver extends ResolverBase {
         });
     }
     /**
-     * Executes an action
+     * Executes an action. The run is always logged: a client cannot switch off the action execution log.
      * @param action The action to execute
      * @param user The user context
      * @param params The action parameters
-     * @param skipActionLog Whether to skip action logging
      * @returns The action result
      * @private
      */
-    async executeAction(action, user, params, providers, skipActionLog) {
+    async executeAction(action, user, params, providers) {
         // Resolve the request-scoped provider. Prefer read-write (actions may mutate);
         // fall back to read-only, then to the engine's global-Metadata default when no
         // request providers are present (preserves prior behavior).
@@ -242,7 +303,7 @@ let ActionResolver = class ActionResolver extends ResolverBase {
             Action: action,
             ContextUser: user,
             Params: params,
-            SkipActionLog: skipActionLog,
+            SkipActionLog: false,
             Filters: [],
             Provider: provider
         });

package/dist/resolvers/ActionResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActionResolver.js","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAkC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAoB5B,CAAA;AAfC;IADC,KAAK,EAAE;;8CACK;AAOb;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACZ;AAOd;IADC,KAAK,EAAE;;8CACK;AAnBF,gBAAgB;IAD5B,SAAS,EAAE;GACC,gBAAgB,CAoB5B;;AAED;;GAEG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;CAmB1B,CAAA;AAdC;IADC,KAAK,EAAE;;gDACS;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACxB;AAO5B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACjB;AAlBb,cAAc;IAD1B,SAAS,EAAE;GACC,cAAc,CAmB1B;;AAED;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;;wDACE;AALxB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAM7B;;AAED;;GAEG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAsD7B,CAAA;AAjDC;IADC,KAAK,EAAE;;yDACe;AAMvB;IADC,KAAK,EAAE;;yDACe;AAOvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpB;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACtB;AAOlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACtC,iBAAiB;qDAAC;AAO/B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAOhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAMhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AArDjB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAsD7B;;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAyB9B,CAAA;AApBC;IADC,KAAK,EAAE;;mDACS;AAMjB;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACT;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAOpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAxBT,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAyB9B;;AAED;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,YAAY;IAC9C;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,SAAS,CACC,KAAqB,EAC5B,GAAe;QAEtB,IAAI,CAAC;YACH,yDAAyD;YACzD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAE5F,4BAA4B;YAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,+BAA+B;YAC/B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEtD,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEnD,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAExD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAElG,oBAAoB;YACpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,QAAgB;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAAgC;QAC5D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;YAEzB,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;oBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,4CAA4C;gBAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;gBACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;aACtE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CACzB,MAAW,EACX,IAAc,EACd,MAAqB,EACrB,SAA8B,EAC9B,aAAuB;QAEvB,+EAA+E;QAC/E,+EAA+E;QAC/E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QACjG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC;YACjD,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,aAAa;YAC5B,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,MAAoB;QAC7C,MAAM,CAAC,GAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAM;QACpE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU;YACrC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,CAAU;QAClC,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2BAA2B,KAAK,CAAC,OAAO,EAAE;SACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,eAAe,CACL,KAAwB,EAC/B,GAAe;QAEtB,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAElG,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,sCAAsC;YACtC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAE5D,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEhE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAE/E,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEtC,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2FAA2F;gBAC3F,4FAA4F;gBAC5F,uFAAuF;gBACvF,2FAA2F;gBAC3F,iDAAiD;gBACjD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,4EAA4E;oBACrF,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YAED,oBAAoB;YACpB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,QAAgB;QACtC,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,YAAiB,EAAE,kBAA0B,EAAE,IAAc;QACpF,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5C,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,SAA8B,EAAE,MAAW,EAAE,KAAwB,EAAE,IAAc;QACjH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE1C,gCAAgC;QAChC,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,oDAAoD;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,MAAW,EAAE,UAA6B;QACnE,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC3C,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAQ,GAAG,CAAC,KAAK,CAAC;YAE3B,uDAAuD;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;YAC3B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,KAAU,EAAE,KAAU;QACrD,uDAAuD;QACvD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAW,EAAE,KAAwB;QAC7D,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,CAAmB;QAC/C,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;QAEzB,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;YACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;SACtE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,CAAU;QAC5B,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kCAAkC,KAAK,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;CACF,CAAA;AApYO;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,cAAc;;+CAgCpC;AAwHK;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,iBAAiB;;qDAsDvC;AAxNU,cAAc;IAD1B,QAAQ,EAAE;GACE,cAAc,CA4Y1B"}
+{"version":3,"file":"ActionResolver.js","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAwB,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAwB,MAAM,sBAAsB,CAAC;AAE3I,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAEzF;;;GAGG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAoB5B,CAAA;AAfC;IADC,KAAK,EAAE;;8CACK;AAOb;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACZ;AAOd;IADC,KAAK,EAAE;;8CACK;AAnBF,gBAAgB;IAD5B,SAAS,EAAE;GACC,gBAAgB,CAoB5B;;AAED;;GAEG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;CAmB1B,CAAA;AAdC;IADC,KAAK,EAAE;;gDACS;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACxB;AAO5B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACjB;AAlBb,cAAc;IAD1B,SAAS,EAAE;GACC,cAAc,CAmB1B;;AAED;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;;wDACE;AALxB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAM7B;;AAED;;GAEG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAsD7B,CAAA;AAjDC;IADC,KAAK,EAAE;;yDACe;AAMvB;IADC,KAAK,EAAE;;yDACe;AAOvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpB;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACtB;AAOlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACtC,iBAAiB;qDAAC;AAO/B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAOhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAMhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AArDjB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAsD7B;;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAyB9B,CAAA;AApBC;IADC,KAAK,EAAE;;mDACS;AAMjB;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACT;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAOpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAxBT,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAyB9B;;AAED;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,YAAY;IAC9C;;;;;;;;;;;OAWG;IAEG,AAAN,KAAK,CAAC,SAAS,CACC,KAAqB,EAC5B,GAAe;QAEtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAE7C,yDAAyD;YACzD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAE5F,+BAA+B;YAC/B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAE3D,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAExD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAE7E,oBAAoB;YACpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,GAAe;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAA8B,EAAE,IAAc,EAAE,SAA8B;QAC7G,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,2DAA2D;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,yEAAyE;QACzH,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAChH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,0BAA0B,CAAC,QAAgB,EAAE,QAAqC;QAC9F,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAA8B;YAC9E,UAAU,EAAE,2BAA2B;YACvC,WAAW,EAAE,aAAa,eAAe,CAAC,QAAQ,CAAC,GAAG;YACtD,MAAM,EAAE,CAAC,iBAAiB,CAAC;YAC3B,UAAU,EAAE,QAAQ;SACrB,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,QAAgB;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAAgC;QAC5D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;YAEzB,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;oBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,4CAA4C;gBAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;gBACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;aACtE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,MAA8B,EAC9B,IAAc,EACd,MAAqB,EACrB,SAA8B;QAE9B,+EAA+E;QAC/E,+EAA+E;QAC/E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QACjG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC;YACjD,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,MAAoB;QAC7C,MAAM,CAAC,GAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAM;QACpE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU;YACrC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,CAAU;QAClC,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2BAA2B,KAAK,CAAC,OAAO,EAAE;SACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,eAAe,CACL,KAAwB,EAC/B,GAAe;QAEtB,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAElG,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,sCAAsC;YACtC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAE5D,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEhE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAE/E,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEtC,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2FAA2F;gBAC3F,4FAA4F;gBAC5F,uFAAuF;gBACvF,2FAA2F;gBAC3F,iDAAiD;gBACjD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,4EAA4E;oBACrF,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YAED,oBAAoB;YACpB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,QAAgB;QACtC,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,YAAiB,EAAE,kBAA0B,EAAE,IAAc;QACpF,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5C,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,SAA8B,EAAE,MAAW,EAAE,KAAwB,EAAE,IAAc;QACjH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE1C,gCAAgC;QAChC,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,oDAAoD;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,MAAW,EAAE,UAA6B;QACnE,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC3C,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAQ,GAAG,CAAC,KAAK,CAAC;YAE3B,uDAAuD;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;YAC3B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,KAAU,EAAE,KAAU;QACrD,uDAAuD;QACvD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAW,EAAE,KAAwB;QAC7D,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,CAAmB;QAC/C,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;QAEzB,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;YACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;SACtE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,CAAU;QAC5B,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kCAAkC,KAAK,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;CACF,CAAA;AA1bO;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,cAAc;;+CA4BpC;AAkLK;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,iBAAiB;;qDAsDvC;AApRU,cAAc;IAD1B,QAAQ,EAAE;GACE,cAAc,CAwc1B"}

package/dist/resolvers/AdhocQueryResolver.d.ts

@@ -1,3 +1,5 @@
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import type { AdhocSQLAuthorizer } from '@memberjunction/actions';
 import { AppContext } from '../types.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { RunQueryResultType } from './QueryResolver.js';
@@ -14,10 +16,19 @@ declare class AdhocQueryInput {
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
  * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
  *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
@@ -29,23 +40,30 @@ declare class AdhocQueryInput {
 export declare class AdhocQueryResolver extends ResolverBase {
     ExecuteAdhocQuery(input: AdhocQueryInput, context: AppContext): Promise<RunQueryResultType>;
     /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
      *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
-     */
-    private executeDataAndCount;
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
      */
-    private runSqlWithDeadline;
+    AuthorizeRenderedSQL(sqlText: string, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null;
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    private toResultType;
     private buildErrorResult;
 }
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export declare function CreateAdhocSQLAuthorizer(requestTimeoutMs: number): AdhocSQLAuthorizer;
 export {};
 //# sourceMappingURL=AdhocQueryResolver.d.ts.map

package/dist/resolvers/AdhocQueryResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAgI9B;;;;;;;;;OASG;YACW,mBAAmB;IA6BjC;;;;OAIG;YACW,kBAAkB;IAwBhC,OAAO,CAAC,gBAAgB;CAc3B"}
+{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAkB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAU9H,iFAAiF;IACjF,OAAO,CAAC,YAAY;IA6BpB,OAAO,CAAC,gBAAgB;CAc3B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,MAAM,GAAG,kBAAkB,CAMrF"}

package/dist/resolvers/AdhocQueryResolver.js

@@ -12,14 +12,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Arg, Ctx, Query, Resolver, Field, Int, InputType } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { SQLExpressionValidator } from '@memberjunction/global';
 import { RenderPipeline } from '@memberjunction/generic-database-provider';
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
+import { configInfo } from '../config.js';
+import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
-import { ExactTotalFromPage, ResolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
-import sql from 'mssql';
+import { ClampAdhocTimeoutSeconds } from './adhocTimeout.js';
 /**
  * Input type for executing ad-hoc SQL queries directly.
  * The SQL is validated server-side to ensure it's a safe SELECT/WITH statement.
@@ -48,10 +47,19 @@ AdhocQueryInput = __decorate([
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
  * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
  *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
@@ -63,180 +71,84 @@ AdhocQueryInput = __decorate([
 let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
     async ExecuteAdhocQuery(input, context) {
         const startTime = Date.now();
+        // SECURITY: refuse principals whose read authority is narrower than their role grant.
+        // Ad-hoc SQL does not go through RunView, entity permissions or row-level security, so the
+        // RLS scope tokens that confine a magic-link session are never substituted. There is no
+        // filter to narrow, so the only correct answer for such a principal is no.
+        if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+            return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+        const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
+        if (!provider) {
+            return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
+        }
+        const contextUser = context.userPayload?.userRecord;
+        const refusal = this.AuthorizeRenderedSQL(input.SQL, provider, contextUser);
+        if (refusal) {
+            return this.buildErrorResult(refusal, Date.now() - startTime);
+        }
+        const timeoutSeconds = ClampAdhocTimeoutSeconds(input.TimeoutSeconds, configInfo.databaseSettings.requestTimeout);
+        // A negative offset must not reach paging, where it would turn paging off.
+        const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
         try {
-            // 1. SECURITY: refuse principals whose read authority is narrower than their role
-            // grant. This resolver runs a raw SELECT on the read-only pool — it does NOT go
-            // through RunView, entity permissions or row-level security, so the RLS scope tokens
-            // that confine a magic-link session are never substituted here. There is no filter
-            // to narrow, so the only correct answer for such a principal is no. Checked before
-            // the SQL is even validated: authorization gates the work, it does not race it.
-            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
-                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
-            }
-            // 2. Security: validate SQL using SQLExpressionValidator
-            const validator = SQLExpressionValidator.Instance;
-            const validation = validator.validateFullQuery(input.SQL);
-            if (!validation.valid) {
-                return this.buildErrorResult(validation.error || 'SQL validation failed');
-            }
-            // 3. Get READ-ONLY data source (no fallback to read-write)
-            let readOnlyDS;
-            try {
-                readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
-            }
-            catch {
-                return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
-            }
-            // 4. Resolve platform from the read-only provider for the render pipeline.
-            let platform = 'sqlserver';
-            try {
-                const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
-                if (provider?.PlatformKey)
-                    platform = provider.PlatformKey;
-            }
-            catch {
-                // Provider not configured — keep the default platform.
-            }
-            const contextUser = context.userPayload?.userRecord;
-            // 5. Route the SQL through RenderPipeline so composition tokens
-            // resolve, comments and templates are processed, and the row cap
-            // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
-            //
-            // Page whenever a positive MaxRows is requested — INCLUDING the first
-            // page (StartRow 0). This yields OFFSET/FETCH data SQL *and* a
-            // COUNT(*) query so the response reports the true total row count
-            // rather than just the returned page size. It mirrors the saved-query
-            // path (GenericDatabaseProvider.InternalRunQuery → WrapWithPaging).
-            // (Previously paging was gated on StartRow > 0, so page 1 fell back to
-            // a TOP-N cap with TotalRowCount = page size — hiding the pager.)
-            // Clamp StartRow to a non-negative integer. A negative offset must not slip
-            // past the paging gate (which would then run the query with no row cap at all).
-            const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
-            const maxRows = input.MaxRows;
-            const usePaging = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
-            let dataSQL;
-            let countSQL = null;
-            try {
-                const rendered = RenderPipeline.Run(input.SQL, {
-                    Platform: platform,
-                    ContextUser: contextUser,
-                    ...(usePaging ? { Paging: { StartRow: startRow, MaxRows: maxRows } } : {}),
-                });
-                dataSQL = rendered.FinalSQL;
-                countSQL = rendered.PagingResult?.CountSQL ?? null;
-            }
-            catch (renderErr) {
-                const renderMsg = renderErr instanceof Error ? renderErr.message : String(renderErr);
-                return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
-            }
-            // 6. Execute the page (and, only when a full page needs it, the count) under
-            // a shared wall-clock deadline derived from the request's timeout budget.
-            const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
-            const { recordset, totalRowCount } = await this.executeDataAndCount(readOnlyDS, dataSQL, countSQL, startRow, usePaging ? maxRows : null, deadline);
-            const executionTimeMs = Date.now() - startTime;
-            // 7. Return as RunQueryResultType
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: true,
-                Results: JSON.stringify(recordset),
-                RowCount: recordset.length,
-                TotalRowCount: totalRowCount,
-                PageNumber: usePaging ? Math.floor(startRow / maxRows) + 1 : undefined,
-                PageSize: usePaging ? maxRows : undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: ''
-            };
+            const result = await provider.RunQuery({
+                SQL: input.SQL,
+                MaxRows: input.MaxRows,
+                StartRow: startRow,
+                TimeoutSeconds: timeoutSeconds,
+            }, contextUser);
+            return this.toResultType(result, startRow, input.MaxRows, timeoutSeconds, Date.now() - startTime);
         }
         catch (err) {
-            const executionTimeMs = Date.now() - startTime;
             const errorMessage = err instanceof Error ? err.message : String(err);
-            // Handle timeout
-            if (errorMessage.includes('timeout') || errorMessage.includes('Timeout')) {
-                return {
-                    QueryID: '',
-                    QueryName: 'Ad-Hoc Query',
-                    Success: false,
-                    Results: '[]',
-                    RowCount: 0,
-                    TotalRowCount: 0,
-                    PageNumber: undefined,
-                    PageSize: undefined,
-                    ExecutionTime: executionTimeMs,
-                    ErrorMessage: `Query execution exceeded ${input.TimeoutSeconds ?? 30} second timeout`
-                };
-            }
             LogError(`Ad-hoc query execution failed: ${errorMessage}`);
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: false,
-                Results: '[]',
-                RowCount: 0,
-                TotalRowCount: 0,
-                PageNumber: undefined,
-                PageSize: undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: `Query execution failed: ${errorMessage}`
-            };
+            return this.buildErrorResult(`Query execution failed: ${errorMessage}`, Date.now() - startTime);
         }
     }
     /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
      *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
      */
-    async executeDataAndCount(ds, dataSQL, countSQL, startRow, maxRows, deadline) {
-        const dataResult = await this.runSqlWithDeadline(ds, dataSQL, deadline);
-        const recordset = (dataResult.recordset ?? []);
-        // Total already known from the page alone (unpaged, or a short page)? Skip the count.
-        const exact = ExactTotalFromPage(startRow, recordset.length, maxRows);
-        if (exact != null || !countSQL) {
-            return { recordset, totalRowCount: exact ?? recordset.length };
-        }
-        // Full page — a COUNT(*) is required to know the true total.
-        const lowerBound = startRow + recordset.length;
+    AuthorizeRenderedSQL(sqlText, provider, contextUser) {
         try {
-            const countResult = await this.runSqlWithDeadline(ds, countSQL, deadline);
-            return { recordset, totalRowCount: ResolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: contextUser, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'ad-hoc SQL');
+            return null;
         }
-        catch (countErr) {
-            const msg = countErr instanceof Error ? countErr.message : String(countErr);
-            LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);
-            return { recordset, totalRowCount: lowerBound };
+        catch (err) {
+            return err instanceof Error ? err.message : String(err);
         }
     }
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
-     */
-    async runSqlWithDeadline(ds, sqlText, deadline) {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            throw new Error('Query timeout exceeded');
-        }
-        let timer;
-        try {
-            return await Promise.race([
-                new sql.Request(ds).query(sqlText),
-                new Promise((_, reject) => {
-                    timer = setTimeout(() => reject(new Error('Query timeout exceeded')), remaining);
-                }),
-            ]);
-        }
-        finally {
-            if (timer) {
-                clearTimeout(timer);
-            }
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    toResultType(result, startRow, maxRows, timeoutSeconds, executionTimeMs) {
+        if (!result.Success) {
+            const message = result.ErrorMessage ?? 'Ad-hoc query failed';
+            return this.buildErrorResult(/timeout/i.test(message) ? `Query execution exceeded ${timeoutSeconds} second timeout` : message, executionTimeMs);
         }
+        const paged = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
+        return {
+            QueryID: '',
+            QueryName: 'Ad-Hoc Query',
+            Success: true,
+            Results: JSON.stringify(result.Results),
+            RowCount: result.RowCount,
+            TotalRowCount: result.TotalRowCount,
+            PageNumber: paged ? Math.floor(startRow / maxRows) + 1 : undefined,
+            PageSize: paged ? maxRows : undefined,
+            ExecutionTime: executionTimeMs,
+            ErrorMessage: ''
+        };
     }
-    buildErrorResult(errorMessage) {
+    buildErrorResult(errorMessage, executionTimeMs = 0) {
         return {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
@@ -246,7 +158,7 @@ let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
             TotalRowCount: 0,
             PageNumber: undefined,
             PageSize: undefined,
-            ExecutionTime: 0,
+            ExecutionTime: executionTimeMs,
             ErrorMessage: errorMessage
         };
     }
@@ -263,4 +175,18 @@ AdhocQueryResolver = __decorate([
     Resolver()
 ], AdhocQueryResolver);
 export { AdhocQueryResolver };
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export function CreateAdhocSQLAuthorizer(requestTimeoutMs) {
+    const resolver = new AdhocQueryResolver();
+    return {
+        Authorize: (sql, provider, contextUser) => resolver.AuthorizeRenderedSQL(sql, provider, contextUser),
+        ClampTimeoutSeconds: (requestedSeconds) => ClampAdhocTimeoutSeconds(requestedSeconds, requestTimeoutMs),
+    };
+}
 //# sourceMappingURL=AdhocQueryResolver.js.map