@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/src/resolvers/CacheStatsResolver.ts

@@ -1,5 +1,6 @@
-import { Field, Float, Int, ObjectType, Query, Resolver } from 'type-graphql';
-import { LocalCacheManager, CacheStats, CacheEntryType } from '@memberjunction/core';
+import { Arg, Field, Float, Int, ObjectType, Query, Resolver } from 'type-graphql';
+import { BaseEngine, BaseEngineRegistry, LocalCacheManager, CacheStats, CacheEntryType } from '@memberjunction/core';
+import type { EngineStateCensus } from '@memberjunction/core';
 import { RequireSystemUser } from '../directives/index.js';
 
 // ============================================================================
@@ -66,10 +67,83 @@ class CacheStatsDetailGQL extends CacheStatsGQL {
     EntityBreakdown: CacheEntityBreakdownGQL[];
 }
 
+@ObjectType()
+class EnginePropertyCensusGQL {
+    @Field(() => String)
+    PropertyName: string;
+
+    @Field(() => String, { nullable: true })
+    EntityName?: string;
+
+    @Field(() => String, { nullable: true })
+    DatasetName?: string;
+
+    @Field(() => Int)
+    RowCount: number;
+
+    @Field(() => String, { nullable: true })
+    MaxUpdatedAt: string | null;
+
+    @Field(() => String, { nullable: true })
+    IdentityHash: string | null;
+
+    @Field(() => Boolean)
+    LoadedSuccessfully: boolean;
+
+    @Field(() => Boolean)
+    PermissionDenied: boolean;
+}
+
+@ObjectType()
+class EngineDerivedCountGQL {
+    @Field(() => String)
+    Name: string;
+
+    @Field(() => Int)
+    Value: number;
+}
+
+@ObjectType()
+class EngineStateCensusGQL {
+    @Field(() => String)
+    EngineClass: string;
+
+    @Field(() => Boolean)
+    Loaded: boolean;
+
+    @Field(() => Boolean)
+    PermissionConstrained: boolean;
+
+    @Field(() => [EnginePropertyCensusGQL])
+    Properties: EnginePropertyCensusGQL[];
+
+    @Field(() => [EngineDerivedCountGQL])
+    Derived: EngineDerivedCountGQL[];
+}
+
 // ============================================================================
 // Helpers (pure core)
 // ============================================================================
 
+function censusToGQL(census: EngineStateCensus): EngineStateCensusGQL {
+    const gql = new EngineStateCensusGQL();
+    gql.EngineClass = census.EngineClass;
+    gql.Loaded = census.Loaded;
+    gql.PermissionConstrained = census.PermissionConstrained;
+    gql.Properties = census.Properties.map(p => Object.assign(new EnginePropertyCensusGQL(), p));
+    gql.Derived = Object.entries(census.Derived).map(([Name, Value]) => Object.assign(new EngineDerivedCountGQL(), { Name, Value }));
+    return gql;
+}
+
+/** Census of every registered engine in this process, optionally narrowed to one class name. */
+function buildEngineCensus(engineClass?: string): EngineStateCensusGQL[] {
+    return BaseEngineRegistry.Instance.GetAllEngines()
+        .filter((engine): engine is BaseEngine<unknown> => engine instanceof BaseEngine)
+        .filter(engine => !engineClass || engine.constructor.name === engineClass)
+        .map(engine => censusToGQL(engine.GetStateCensus()))
+        .sort((a, b) => a.EngineClass.localeCompare(b.EngineClass));
+}
+
 function toGQL(stats: CacheStats): CacheStatsGQL {
     const gql = new CacheStatsGQL();
     gql.TotalEntries = stats.totalEntries;
@@ -139,4 +213,17 @@ export class CacheStatsResolver {
         result.EntityBreakdown = buildEntityBreakdown();
         return result;
     }
+
+    /**
+     * What each engine in this server process holds — row counts, newest timestamps, a row-version
+     * hash, and engine-specific derived-state counts. Comparing the hashes across servers shows
+     * whether they converged; a derived count of zero next to a full array shows lost derived state.
+     */
+    @RequireSystemUser()
+    @Query(() => [EngineStateCensusGQL])
+    EngineStateCensus(
+        @Arg('EngineClass', () => String, { nullable: true }) engineClass?: string
+    ): EngineStateCensusGQL[] {
+        return buildEngineCensus(engineClass);
+    }
 }

package/src/resolvers/ClientToolRequestResolver.ts

@@ -14,6 +14,7 @@ import { AppContext } from '../types.js';
 import { LogStatus, LogError } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { ClientToolRequestManager, CLIENT_TOOL_REQUEST_TOPIC, ClientToolRequestNotificationPayload } from '@memberjunction/ai-agents';
+import { ParseClientToolMedia } from '@memberjunction/ai-core-plus';
 
 @ObjectType()
 export class ClientToolRequestNotification {
@@ -71,7 +72,9 @@ export class ClientToolRequestResolver extends ResolverBase {
     /**
      * Client sends the result of executing a client tool back to the server.
      * This resolves the pending Promise in ClientToolRequestManager so the
-     * agent loop can continue.
+     * agent loop can continue. `media` is an optional JSON array of images.
+     * When `media` fails validation or `result` is not valid JSON, the request
+     * resolves as a failed result.
      */
     @Mutation(() => Boolean)
     async RespondToClientToolRequest(
@@ -79,15 +82,25 @@ export class ClientToolRequestResolver extends ResolverBase {
         @Arg('success') success: boolean,
         @Arg('result', { nullable: true }) result: string | undefined,
         @Arg('errorMessage', { nullable: true }) errorMessage: string | undefined,
+        @Arg('media', { nullable: true }) media: string | undefined,
         @Ctx() _context: AppContext = {} as AppContext
     ): Promise<boolean> {
         try {
-            const found = ClientToolRequestManager.Instance.ReceiveResponse({
-                RequestID: requestID,
-                Success: success,
-                Result: result ? JSON.parse(result) : undefined,
-                ErrorMessage: errorMessage
-            });
+            const parsedMedia = ParseClientToolMedia(media);
+            // `=== true` narrows the union; this package compiles without strictNullChecks.
+            const found = ClientToolRequestManager.Instance.ReceiveResponse(parsedMedia.ok === true
+                ? {
+                    RequestID: requestID,
+                    Success: success,
+                    Result: result ? JSON.parse(result) : undefined,
+                    ErrorMessage: errorMessage,
+                    Media: parsedMedia.media.length ? parsedMedia.media : undefined
+                }
+                : {
+                    RequestID: requestID,
+                    Success: false,
+                    ErrorMessage: `Client tool media rejected: ${parsedMedia.error}`
+                });
 
             if (!found) {
                 LogError(`RespondToClientToolRequest: no pending request for ${requestID} (may have timed out)`);
@@ -96,6 +109,11 @@ export class ClientToolRequestResolver extends ResolverBase {
         } catch (error) {
             const msg = error instanceof Error ? error.message : String(error);
             LogError(`RespondToClientToolRequest error: ${msg}`);
+            ClientToolRequestManager.Instance.ReceiveResponse({
+                RequestID: requestID,
+                Success: false,
+                ErrorMessage: `Client tool response rejected: ${msg}`
+            });
             return false;
         }
     }

package/src/resolvers/EntityRecordNameResolver.ts

@@ -1,4 +1,4 @@
-import { CompositeKey, DatabaseProviderBase, EntityInfo, LogDebug, UserInfo } from '@memberjunction/core';
+import { CompositeKey, DatabaseProviderBase } from '@memberjunction/core';
 import { Arg, Ctx, Field, InputType, ObjectType, Query, Resolver } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { CompositeKeyInputType, CompositeKeyOutputType } from '../generic/KeyInputOutputTypes.js';
@@ -36,20 +36,13 @@ export class EntityRecordNameResult {
  * Resolves a record's display NAME from its primary key — the lookup behind every foreign-key
  * link, breadcrumb and picker label in the UI.
  *
- * **This is a read of entity data and is gated like one.** It historically took no user context
- * at all, which made it an open side channel: a caller denied READ on an entity's name field
- * could still obtain that name here, because the name never travelled through the resolver that
- * strips denied fields. Field-level security turned that latent gap into a live bypass — the
- * form-field FK control falls through to this query precisely WHEN the joined display column is
- * denied, so the one case the fallback exists for was the case that leaked.
+ * Entity-level read permission is checked here ({@link ResolverBase.CheckUserReadPermissions}).
+ * Field- and row-level security are applied by the provider's lookup, for the acting user passed
+ * to it: when any field the name is built from is withheld, it answers with no name.
  *
- * Two gates now apply, matching what the generated single-record resolvers do:
- *   1. entity-level read permission ({@link ResolverBase.CheckUserReadPermissions});
- *   2. field-level read permission on the entity's own name field.
- *
- * A field-level denial answers `Success: false` with no name rather than throwing. Callers
- * already treat "no name" as "show the primary key", which is the intended degradation — and it
- * keeps this query from becoming a probe that distinguishes "restricted" from "missing".
+ * A withheld name answers `Success: false` with the same status as a record that does not exist.
+ * Callers already treat "no name" as "show the primary key", and the identical answer keeps this
+ * query from becoming a probe that distinguishes "restricted" from "missing".
  */
 @Resolver(EntityRecordNameResult)
 export class EntityRecordNameResolver extends ResolverBase {
@@ -91,53 +84,18 @@ export class EntityRecordNameResolver extends ResolverBase {
     const e = md.Entities.find((e) => e.Name === EntityName);
     if (e) {
       const contextUser = userPayload ? this.GetUserFromPayload(userPayload) : undefined;
-      if (this.IsNameFieldDeniedToUser(e, contextUser)) {
-        LogDebug(
-          `[FieldSecurity] Suppressed GetEntityRecordName for '${EntityName}': ` +
-          `the name field is not readable by this user`
-        );
-        return {
-          Success: false,
-          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue`,
-          CompositeKey: pk,
-          EntityName,
-        };
-      }
-      // Pass the acting user through: the provider signature accepts it, and omitting it ran the
-      // underlying lookup with no identity at all — so row-level security had nothing to filter on
-      // either. The field-level gate above is the column half; this is the row half.
+      // The acting user is what field- and row-level security are applied for.
       const recordName = await md.GetEntityRecordName(e.Name, pk, contextUser);
       if (recordName) return { Success: true, Status: 'OK', CompositeKey: pk, RecordName: recordName, EntityName };
       else
         return {
           Success: false,
-          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue if user doesn't have Row Level Access (RLS) if RLS is enabled for this entity`,
+          Status: `Name for record, or record ${pk.ToString()} itself not found, could be an access issue`,
           CompositeKey: pk,
           EntityName,
         };
     } else return { Success: false, Status: `Entity ${EntityName} not found`, CompositeKey: pk, EntityName };
   }
-
-  /**
-   * Whether field security withholds this entity's NAME field from the user.
-   *
-   * Resolves the name field the same way the provider's own lookup does — the designated
-   * `IsNameField`, else a field literally called `Name` — so the check cannot drift from the
-   * value it is guarding. Fails OPEN only where field security does not apply at all (flag off,
-   * no user, no name field), matching every other FLS gate.
-   */
-  protected IsNameFieldDeniedToUser(entity: EntityInfo, contextUser?: UserInfo): boolean {
-    if (!entity?.EnableFieldLevelSecurity || !contextUser) {
-      return false;
-    }
-    const nameField =
-      entity.Fields?.find(f => f.IsNameField) ??
-      entity.Fields?.find(f => f.Name?.trim().toLowerCase() === 'name');
-    if (!nameField) {
-      return false;
-    }
-    return entity.GetDeniedReadFields(contextUser).has(nameField.Name.trim().toLowerCase());
-  }
 }
 
 export default EntityRecordNameResolver;

package/src/resolvers/FetchEntityVectorsResolver.ts

@@ -1,8 +1,9 @@
 import { Resolver, Query, Arg, Ctx, ObjectType, Field, Float, Int } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, LogStatus, Metadata, RunView, UserInfo } from '@memberjunction/core';
+import { CompositeKey, EntityInfo, IMetadataProvider, LogError, LogStatus, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { MJEntityDocumentEntity, MJVectorIndexEntity, MJVectorDatabaseEntity } from '@memberjunction/core-entities';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { GetReadOnlyProvider } from '../util.js';
 import { GetAIAPIKey } from '@memberjunction/ai';
 import { VectorDBBase } from '@memberjunction/ai-vectordb';
 import { AIEngine } from '@memberjunction/aiengine';
@@ -50,7 +51,7 @@ export class FetchEntityVectorsResolver extends ResolverBase {
         @Arg('entityDocumentID') entityDocumentID: string,
         @Arg('maxRecords', () => Int, { nullable: true }) maxRecords: number | undefined,
         @Arg('filter', { nullable: true }) filter: string | undefined,
-        @Ctx() { userPayload }: AppContext = {} as AppContext
+        @Ctx() { userPayload, providers }: AppContext = {} as AppContext
     ): Promise<FetchEntityVectorsResult> {
         const startTime = Date.now();
         try {
@@ -85,6 +86,17 @@ export class FetchEntityVectorsResolver extends ResolverBase {
                 );
             }
 
+            // Providers that keep their vectors in MJ, keyed by EntityDocumentID (the in-process
+            // SimpleVectorServiceProvider), can't be listed through QueryIndex: they key by the
+            // document ID rather than the index name, aren't handed the context user, and return
+            // matches without vector values. Read the stored Entity Record Document rows instead.
+            if (vectorDBInstance.QueryKeyIsEntityDocumentID) {
+                const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true }) ?? Metadata.Provider;
+                const results = await this.fetchStoredVectors(entityDoc, limit, filter, currentUser, md);
+                LogStatus(`FetchEntityVectors: Loaded ${results.length} stored vectors for entity "${entityDoc.Entity}" in ${Date.now() - startTime}ms`);
+                return { Success: true, Results: results, TotalCount: results.length, ElapsedMs: Date.now() - startTime };
+            }
+
             // Step 4: Query with zero vector + Entity metadata filter.
             // Pinecone's list API doesn't support metadata filtering, but query does.
             // A zero vector returns results in arbitrary order (similarity is meaningless),
@@ -227,6 +239,89 @@ export class FetchEntityVectorsResolver extends ResolverBase {
         return instance;
     }
 
+    /**
+     * Load the vectors an EntityDocument stored in MJ (`MJ: Entity Record Documents.VectorJSON`),
+     * restricted to the entity records that pass `filter`. Each item's metadata carries the entity
+     * name, the record ID and the record's name fields, which is what the cluster view labels from.
+     */
+    private async fetchStoredVectors(
+        entityDoc: MJEntityDocumentEntity,
+        limit: number,
+        filter: string | undefined,
+        contextUser: UserInfo,
+        md: IMetadataProvider
+    ): Promise<EntityVectorItem[]> {
+        const entityInfo = md.EntityByName(entityDoc.Entity);
+        if (!entityInfo) {
+            throw new Error(`Entity "${entityDoc.Entity}" not found in metadata`);
+        }
+        const labelsByRecordID = await this.loadRecordLabels(entityInfo, filter, contextUser);
+
+        const rv = new RunView();
+        const docResult = await rv.RunView<{ ID: string; RecordID: string; VectorJSON: string }>({
+            EntityName: 'MJ: Entity Record Documents',
+            ExtraFilter: `EntityDocumentID='${EscapeSQLString(entityDoc.ID)}' AND VectorJSON IS NOT NULL`,
+            Fields: ['ID', 'RecordID', 'VectorJSON'],
+            IgnoreMaxRows: true,
+            ResultType: 'simple',
+        }, contextUser);
+        if (!docResult.Success) {
+            throw new Error(`Failed to load stored vectors: ${docResult.ErrorMessage}`);
+        }
+
+        const results: EntityVectorItem[] = [];
+        for (const row of docResult.Results) {
+            const labels = labelsByRecordID.get(row.RecordID.toLowerCase());
+            if (!labels) continue; // filtered out, not readable by this user, or the record no longer exists
+            results.push({
+                ID: row.ID,
+                Values: JSON.parse(row.VectorJSON) as number[],
+                Metadata: JSON.stringify({ Entity: entityDoc.Entity, RecordID: row.RecordID, ...labels }),
+            });
+            if (results.length >= limit) break;
+        }
+        return results;
+    }
+
+    /**
+     * Map each record that passes `filter` to its name-field values, keyed by the same compact
+     * record-ID form the vector sync writes to `MJ: Entity Record Documents.RecordID` (lower-cased).
+     */
+    private async loadRecordLabels(
+        entityInfo: EntityInfo,
+        filter: string | undefined,
+        contextUser: UserInfo
+    ): Promise<Map<string, Record<string, string>>> {
+        const nameFields = entityInfo.Fields.filter(f => f.IsNameField).map(f => f.Name);
+        if (nameFields.length === 0 && entityInfo.NameField) {
+            nameFields.push(entityInfo.NameField.Name);
+        }
+        const keyFields = entityInfo.PrimaryKeys.map(pk => pk.Name);
+
+        const rv = new RunView();
+        const result = await rv.RunView<Record<string, unknown>>({
+            EntityName: entityInfo.Name,
+            ExtraFilter: filter || undefined,
+            Fields: [...new Set([...keyFields, ...nameFields])],
+            IgnoreMaxRows: true,
+            ResultType: 'simple',
+        }, contextUser);
+        if (!result.Success) {
+            throw new Error(`Failed to load "${entityInfo.Name}" records: ${result.ErrorMessage}`);
+        }
+
+        const map = new Map<string, Record<string, string>>();
+        for (const row of result.Results) {
+            const key = CompositeKey.FromEntityRecord(entityInfo, row).ToCompactURLSegment().toLowerCase();
+            const labels: Record<string, string> = {};
+            for (const name of nameFields) {
+                if (row[name] != null) labels[name] = String(row[name]);
+            }
+            map.set(key, labels);
+        }
+        return map;
+    }
+
     private errorResult(message: string, startTime: number): FetchEntityVectorsResult {
         return {
             Success: false,

package/src/resolvers/GetDataResolver.ts

@@ -1,4 +1,5 @@
 import { Arg, Ctx, Field, InputType, ObjectType, Query } from 'type-graphql';
+import { SQLExpressionValidator } from '@memberjunction/global';
 import { AppContext } from '../types.js';
 import { LogError, LogStatus, LogStatusEx, Metadata } from '@memberjunction/core';
 import { QueryCompositionEngine } from '@memberjunction/generic-database-provider';
@@ -154,6 +155,15 @@ export class GetDataResolver {
                             resolvedSQL = compositionResult.ResolvedSQL;
                         }
 
+                        // Defense-in-depth: even system-token holders get SELECT-only SQL here.
+                        // The read-only pool is the primary control, but if it is ever
+                        // misconfigured to a read-write login this validator still refuses DML/DDL
+                        // (mirrors AdhocQueryResolver).
+                        const validation = SQLExpressionValidator.Instance.validateFullQuery(resolvedSQL);
+                        if (!validation.valid) {
+                            return { result: null, error: validation.error || 'SQL validation failed' };
+                        }
+
                         const request = new sql.Request(readOnlyDataSource);
                         const result = await request.query(resolvedSQL);
                         return { result: result.recordset, error: null };