@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/dist/resolvers/UserAvatarResolver.js

@@ -0,0 +1,124 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+/**
+ * @fileoverview Self-service avatar mutation: `UpdateMyAvatar(ImageURL, IconClass)`.
+ *
+ * WHY THIS EXISTS. Explorer's My Profile photo used to be a plain entity save of the caller's own
+ * `MJ: Users` row, which needs Update permission on `MJ: Users`. A deployment that locks its
+ * security model down cannot give ordinary users that permission: a row-level "own row only"
+ * filter restricts ROWS, not COLUMNS, so a user who may update their own row may also rewrite
+ * their own `Email` — and many read filters key on `{{UserEmail}}`, so the new value would match
+ * another person's memberships. MJ has no per-role field permissions (`MJUserEntityServer` in
+ * core-entities-server documents the same limit for `Type`). On such deployments every avatar save
+ * failed, and the login avatar sync failed silently.
+ *
+ * WHAT IT DOES. The caller comes ONLY from the request context — there is no user-ID argument. The
+ * input is validated at this trust boundary (`ValidateAvatarInput`). The caller's own row is then
+ * loaded AS THE SYSTEM USER, any state other than the two avatar columns is discarded, and only
+ * `UserImageURL` and `UserImageIconClass` are set before saving. Because the write is made as the
+ * system user, the caller's ID is logged. It works the same whether or not the caller holds Update
+ * on `MJ: Users`.
+ *
+ * Scope-limited sessions are refused (`IsScopeLimitedPrincipal`). An anonymous magic-link guest IS
+ * the shared Anonymous principal, so "their own row" belongs to every guest, and a system-user save
+ * goes around the entity permissions and RLS that confine any magic-link session.
+ *
+ * `MJUserEntityServer` accepts this save: the system user is the seeded `Type='Owner'` user, which
+ * is exempt from its invariants, and the save changes neither `Type` nor `Name` in any case.
+ *
+ * @module @memberjunction/server/resolvers/UserAvatarResolver
+ */
+import { Arg, Ctx, Field, Mutation, ObjectType, Resolver } from 'type-graphql';
+import { LogError, LogStatus } from '@memberjunction/core';
+import { GetReadWriteProvider } from '../util.js';
+import { GetSystemUser } from '../auth/index.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { ValidateAvatarInput } from './avatarInputValidation.js';
+/** What the browser sees when the save fails. The server's detail goes to the log only. */
+const SAVE_FAILED_MESSAGE = 'Could not save your avatar. Please try again or contact your administrator.';
+let UpdateMyAvatarResult = class UpdateMyAvatarResult {
+};
+__decorate([
+    Field(),
+    __metadata("design:type", Boolean)
+], UpdateMyAvatarResult.prototype, "Success", void 0);
+__decorate([
+    Field({ nullable: true }),
+    __metadata("design:type", String)
+], UpdateMyAvatarResult.prototype, "ErrorMessage", void 0);
+UpdateMyAvatarResult = __decorate([
+    ObjectType()
+], UpdateMyAvatarResult);
+export { UpdateMyAvatarResult };
+let UserAvatarResolver = class UserAvatarResolver extends ResolverBase {
+    /**
+     * Sets the CALLER's avatar. Null or empty clears a column; both null reverts to the default.
+     * Validation failures and save failures are returned as `Success: false` with a message.
+     */
+    async UpdateMyAvatar(ctx, imageURL, iconClass) {
+        const caller = ctx.userPayload?.userRecord;
+        if (!caller?.ID) {
+            throw new Error('User is not authenticated');
+        }
+        if (IsScopeLimitedPrincipal(caller)) {
+            return { Success: false, ErrorMessage: 'Changing your avatar is not permitted for scope-limited sessions.' };
+        }
+        await this.CheckAPIKeyScopeAuthorization('entity:update', 'MJ: Users', ctx.userPayload);
+        const input = ValidateAvatarInput(imageURL, iconClass);
+        if (!input.Valid) {
+            return { Success: false, ErrorMessage: input.ErrorMessage };
+        }
+        try {
+            return await this.saveAvatar(ctx, caller, input.ImageURL, input.IconClass);
+        }
+        catch (e) {
+            LogError(`UpdateMyAvatar: failed for user ${caller.ID}: ${e instanceof Error ? e.message : String(e)}`);
+            return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+        }
+    }
+    /** Loads the caller's own row as the system user and writes ONLY the two avatar columns. */
+    async saveAvatar(ctx, caller, imageURL, iconClass) {
+        const systemUser = await GetSystemUser();
+        const provider = GetReadWriteProvider(ctx.providers);
+        const user = await provider.GetEntityObject('MJ: Users', systemUser);
+        if (!(await user.Load(caller.ID))) {
+            LogError(`UpdateMyAvatar: could not load the MJ: Users row for user ${caller.ID}`);
+            return { Success: false, ErrorMessage: 'Could not load your user record.' };
+        }
+        user.Revert(); // nothing but the two avatar columns may reach the write
+        user.UserImageURL = imageURL;
+        user.UserImageIconClass = iconClass;
+        LogStatus(`UpdateMyAvatar: user ${caller.ID} requested an avatar change; saving as the system user`);
+        if (!(await user.Save())) {
+            const detail = user.LatestResult?.CompleteMessage ?? 'unknown error';
+            LogError(`UpdateMyAvatar: save failed for user ${caller.ID}: ${detail}`);
+            return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+        }
+        return { Success: true };
+    }
+};
+__decorate([
+    Mutation(() => UpdateMyAvatarResult),
+    __param(0, Ctx()),
+    __param(1, Arg('ImageURL', () => String, { nullable: true })),
+    __param(2, Arg('IconClass', () => String, { nullable: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, String]),
+    __metadata("design:returntype", Promise)
+], UserAvatarResolver.prototype, "UpdateMyAvatar", null);
+UserAvatarResolver = __decorate([
+    Resolver()
+], UserAvatarResolver);
+export { UserAvatarResolver };
+//# sourceMappingURL=UserAvatarResolver.js.map

package/dist/resolvers/UserAvatarResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserAvatarResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserAvatarResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAY,MAAM,sBAAsB,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,2FAA2F;AAC3F,MAAM,mBAAmB,GAAG,6EAA6E,CAAC;AAGnG,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAMhC,CAAA;AAJC;IADC,KAAK,EAAE;;qDACS;AAGjB;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACJ;AALX,oBAAoB;IADhC,UAAU,EAAE;GACA,oBAAoB,CAMhC;;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;IAClD;;;OAGG;IAEG,AAAN,KAAK,CAAC,cAAc,CACX,GAAe,EAC6B,QAAwB,EACvB,SAAyB;QAE7E,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,UAAkC,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,mEAAmE,EAAE,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,mCAAmC,MAAM,CAAC,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4FAA4F;IACpF,KAAK,CAAC,UAAU,CACtB,GAAe,EACf,MAAgB,EAChB,QAAuB,EACvB,SAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAe,WAAW,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,6DAA6D,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,kCAAkC,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,yDAAyD;QACxE,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,SAAS,CAAC,wBAAwB,MAAM,CAAC,EAAE,wDAAwD,CAAC,CAAC;QACrG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,CAAC;YACrE,QAAQ,CAAC,wCAAwC,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AArDO;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;IAElC,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;wDAsBpD;AA/BU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CA2D9B"}

package/dist/resolvers/UserResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA2E,MAAM,wBAAwB,CAAC;AAG7H,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAUrF;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,OAAO;IAE1C,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAYD,qBACa,YAAa,SAAQ,kBAAkB;IAG5C,WAAW,CAAQ,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;IA0CjE,QAAQ,CAAuB,EAAE,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IASxF,gBAAgB,CAA+B,UAAU,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IAShH,WAAW,CAA6B,KAAK,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IAS1G;;;;OAIG;YACW,gBAAgB;YA2BhB,oBAAoB;CAkBnC;AACD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"UserResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA2E,MAAM,wBAAwB,CAAC;AAG7H,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAWrF;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,OAAO;IAE1C,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAYD,qBACa,YAAa,SAAQ,kBAAkB;IAG5C,WAAW,CAAQ,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;IA2BjE,QAAQ,CAAuB,EAAE,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IASxF,gBAAgB,CAA+B,UAAU,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IAShH,WAAW,CAA6B,KAAK,EAAE,MAAM,EAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU;IAS1G;;;;OAIG;YACW,gBAAgB;YA2BhB,oBAAoB;CAkBnC;AACD,eAAe,YAAY,CAAC"}

package/dist/resolvers/UserResolver.js

@@ -15,7 +15,7 @@ import { RunView } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import { MJUser_, MJUserRole_, MJUserResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';
-import { AssertRoleLoadSucceeded, RequireContextUser, RequireLoadedUser, RequireRoleProvider, UserIdExtraFilter, } from './currentUserRoles.js';
+import { AssertRoleLoadSucceeded, RequireContextUser, RequireLoadedUser, RequireRoleProvider, SessionUserFields, UserIdExtraFilter, } from './currentUserRoles.js';
 /**
  * CurrentUser payload. Extends the generated user type with a first-class `Roles`
  * field — child-array FieldResolvers (`MJUserRoles_UserIDArray`) are no longer
@@ -37,22 +37,7 @@ let UserResolver = class UserResolver extends MJUserResolverBase {
         await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
         if (context.userPayload.userRecord) {
             const userRecord = context.userPayload.userRecord;
-            const userData = {
-                ID: userRecord.ID,
-                Name: userRecord.Name,
-                FirstName: userRecord.FirstName,
-                LastName: userRecord.LastName,
-                Title: userRecord.Title,
-                Email: userRecord.Email,
-                Type: userRecord.Type,
-                IsActive: userRecord.IsActive,
-                LinkedRecordType: userRecord.LinkedRecordType,
-                EmployeeID: userRecord.EmployeeID,
-                LinkedEntityID: userRecord.LinkedEntityID,
-                LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
-                __mj_CreatedAt: userRecord.__mj_CreatedAt,
-                __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
-            };
+            const userData = SessionUserFields(userRecord);
             console.log('CurrentUser (from userRecord)', userData.Email);
             const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
             const mapped = await this.MapFieldNamesToCodeNames('MJ: Users', userData, userRecord, provider);

package/dist/resolvers/UserResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAwB,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,OAAO;CAG3C,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;;8CACN;AAFV,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAG3B;;AAaM,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAG5C,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG;gBACf,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAY,CAAC;YAC3G,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAC1D,OAAO,CAAC,WAAW,CAAC,KAAK,CAC1B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAmB;QAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAClC,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAa;YAC1C,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,EAAE,WAAW,CAAC,CAAC;QAEhB,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAC7C,gBAAgB,EAChB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,WAAW,EACX,QAAQ,CACQ,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAmB,EACnB,IAAmC,EACnC,WAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;YACvC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAkB,CAAC;IAClH,CAAC;CACF,CAAA;AAvHO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;+CAuCvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAMtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAM9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CAOlE;AAtEU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CA0HxB;;AACD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAwB,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,OAAO;CAG3C,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;;8CACN;AAFV,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAG3B;;AAaM,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAG5C,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAY,CAAC;YAC3G,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAC1D,OAAO,CAAC,WAAW,CAAC,KAAK,CAC1B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAmB;QAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAClC,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAa;YAC1C,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,EAAE,WAAW,CAAC,CAAC;QAEhB,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAC7C,gBAAgB,EAChB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,WAAW,EACX,QAAQ,CACQ,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAmB,EACnB,IAAmC,EACnC,WAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;YACvC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAkB,CAAC;IAClH,CAAC;CACF,CAAA;AAxGO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;+CAwBvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAMtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAM9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CAOlE;AAvDU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CA2GxB;;AACD,eAAe,YAAY,CAAC"}

package/dist/resolvers/agentVisionConsentAudit.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview The audit trail for agent-vision consent: one `MJ: Audit Logs` row each time a person allows, or stops
+ * letting, agents see their camera and shared screen in a meeting room, including when LiveKit refuses the change.
+ *
+ * The row is saved by the system user, as MJ's other server-written audit rows are, because the person may not be
+ * allowed to create audit rows themselves; `UserID` and `RecordID` are the person. When the audit log type has not
+ * been seeded, the entry goes to the server log instead, so a choice is never left unrecorded.
+ *
+ * Invoked from `RealtimeBridgeResolver.SetLiveKitAgentVision`.
+ *
+ * @module @memberjunction/server
+ */
+import { type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+/** The seeded audit log type (see `metadata/audit-log-types/.realtime-session-audit-types.json`). */
+export declare const REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE = "Realtime Agent Vision Consent";
+/** One consent change to record. */
+export interface AgentVisionConsentEntry {
+    /** The person who chose. */
+    User: UserInfo;
+    /** The room they chose for. */
+    RoomName: string;
+    /** `true` to let agents see their camera and shared screen, `false` to stop. */
+    Allow: boolean;
+    /** Whether LiveKit applied the change. */
+    Applied: boolean;
+    /** Why it was not applied. */
+    ErrorMessage?: string;
+}
+/**
+ * Writes the audit row for one consent change. Never throws: a failure to audit is logged, and the person's choice
+ * stands as LiveKit applied it.
+ *
+ * @param entry The change to record.
+ * @param provider The request's provider.
+ */
+export declare function WriteAgentVisionConsentAudit(entry: AgentVisionConsentEntry, provider: IMetadataProvider | null): Promise<void>;
+//# sourceMappingURL=agentVisionConsentAudit.d.ts.map

package/dist/resolvers/agentVisionConsentAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentVisionConsentAudit.d.ts","sourceRoot":"","sources":["../../src/resolvers/agentVisionConsentAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAY,KAAK,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIvF,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,kCAAkC,CAAC;AAKxF,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,OAAO,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpI"}

package/dist/resolvers/agentVisionConsentAudit.js

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview The audit trail for agent-vision consent: one `MJ: Audit Logs` row each time a person allows, or stops
+ * letting, agents see their camera and shared screen in a meeting room, including when LiveKit refuses the change.
+ *
+ * The row is saved by the system user, as MJ's other server-written audit rows are, because the person may not be
+ * allowed to create audit rows themselves; `UserID` and `RecordID` are the person. When the audit log type has not
+ * been seeded, the entry goes to the server log instead, so a choice is never left unrecorded.
+ *
+ * Invoked from `RealtimeBridgeResolver.SetLiveKitAgentVision`.
+ *
+ * @module @memberjunction/server
+ */
+import { LogError } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/generic-database-provider';
+/** The seeded audit log type (see `metadata/audit-log-types/.realtime-session-audit-types.json`). */
+export const REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE = 'Realtime Agent Vision Consent';
+const AUDIT_LOG_ENTITY = 'MJ: Audit Logs';
+const USERS_ENTITY = 'MJ: Users';
+/**
+ * Writes the audit row for one consent change. Never throws: a failure to audit is logged, and the person's choice
+ * stands as LiveKit applied it.
+ *
+ * @param entry The change to record.
+ * @param provider The request's provider.
+ */
+export async function WriteAgentVisionConsentAudit(entry, provider) {
+    try {
+        const writer = UserCache.Instance.GetSystemUser();
+        const type = provider?.AuditLogTypes?.find((t) => t.Name?.trim().toLowerCase() === REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE.toLowerCase());
+        if (!provider || !writer || !type) {
+            LogError(`Agent vision consent not audited (${missingReason(provider, writer)}): user ${entry.User.ID}: ${describeChange(entry)}`);
+            return;
+        }
+        const row = await provider.GetEntityObject(AUDIT_LOG_ENTITY, writer);
+        row.NewRecord();
+        row.UserID = entry.User.ID;
+        row.AuditLogTypeID = type.ID;
+        row.Status = entry.Applied ? 'Success' : 'Failed';
+        row.EntityID = provider.EntityByName(USERS_ENTITY)?.ID ?? null;
+        row.RecordID = entry.User.ID;
+        row.Description = describeChange(entry);
+        row.Details = JSON.stringify({ roomName: entry.RoomName, allow: entry.Allow, error: entry.ErrorMessage ?? null });
+        if (!(await row.Save())) {
+            LogError(`Agent vision consent audit row not saved for user ${entry.User.ID}: ${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
+    }
+    catch (error) {
+        LogError(`Agent vision consent audit write threw for user ${entry.User.ID}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** Why the audit row can't be written: no provider, no system user, or the audit log type isn't seeded. */
+function missingReason(provider, writer) {
+    if (!provider) {
+        return 'no provider';
+    }
+    return writer ? `audit log type '${REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE}' is not seeded` : 'no system user';
+}
+/** One line saying what the person chose, and whether it was applied. */
+function describeChange(entry) {
+    const choice = entry.Allow ? 'Let agents see their camera and shared screen' : 'Stopped letting agents see their camera and shared screen';
+    return `${choice} in room ${entry.RoomName}${entry.Applied ? '' : ' (not applied)'}.`;
+}
+//# sourceMappingURL=agentVisionConsentAudit.js.map

package/dist/resolvers/agentVisionConsentAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentVisionConsentAudit.js","sourceRoot":"","sources":["../../src/resolvers/agentVisionConsentAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAyC,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,qGAAqG;AACrG,MAAM,CAAC,MAAM,wCAAwC,GAAG,+BAA+B,CAAC;AAExF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,YAAY,GAAG,WAAW,CAAC;AAgBjC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAA8B,EAAE,QAAkC;IACnH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,wCAAwC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3I,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,QAAQ,CAAC,qCAAqC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnI,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAmB,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACvF,GAAG,CAAC,SAAS,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC/D,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,qDAAqD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,mDAAmD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,2GAA2G;AAC3G,SAAS,aAAa,CAAC,QAAkC,EAAE,MAAmC;IAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,wCAAwC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAClH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAA8B;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,2DAA2D,CAAC;IAC3I,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC;AACxF,CAAC"}

package/dist/resolvers/avatarInputValidation.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview Trust-boundary validation for the self-service avatar mutation
+ * (`UpdateMyAvatar` in `UserAvatarResolver`).
+ *
+ * The browser checks these values too, but its URL check is `new URL(...)`, which happily accepts
+ * `javascript:` and every `data:` type. The server is the boundary, so everything that reaches
+ * `MJ: Users.UserImageURL` / `UserImageIconClass` through the mutation passes through here first.
+ *
+ * Pure: no I/O, no provider, no entity — so it is unit-testable on its own.
+ *
+ * @module @memberjunction/server/resolvers/avatarInputValidation
+ */
+/** Largest DECODED image accepted in a `data:` URI. Matches the Explorer upload cap. */
+export declare const AVATAR_MAX_IMAGE_BYTES: number;
+/** Longest `http:` / `https:` image URL accepted. */
+export declare const AVATAR_MAX_URL_LENGTH = 2048;
+/** Longest icon class string accepted. */
+export declare const AVATAR_MAX_ICON_CLASS_LENGTH = 100;
+/** The outcome of {@link ValidateAvatarInput}. Empty strings are normalised to `null` (clear). */
+export interface AvatarInputValidationResult {
+    Valid: boolean;
+    /** Why the input was refused. Set only when `Valid` is false. */
+    ErrorMessage?: string;
+    /** The value to store in `UserImageURL`; `null` clears it. */
+    ImageURL: string | null;
+    /** The value to store in `UserImageIconClass`; `null` clears it. */
+    IconClass: string | null;
+}
+/**
+ * Validates a requested avatar. Null or empty values clear the corresponding column, so both
+ * null is a valid "revert to default".
+ *
+ * - `imageURL`: a `data:image/(png|jpeg|jpg|gif|webp);base64,...` URI whose decoded size is at most
+ *   {@link AVATAR_MAX_IMAGE_BYTES}, or an absolute `http:`/`https:` URL of at most
+ *   {@link AVATAR_MAX_URL_LENGTH} characters with no whitespace. Everything else is refused.
+ * - `iconClass`: at most {@link AVATAR_MAX_ICON_CLASS_LENGTH} characters of `[a-z0-9 -]`,
+ *   containing at least one `fa-` token.
+ */
+export declare function ValidateAvatarInput(imageURL: string | null | undefined, iconClass: string | null | undefined): AvatarInputValidationResult;
+//# sourceMappingURL=avatarInputValidation.d.ts.map

package/dist/resolvers/avatarInputValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarInputValidation.d.ts","sourceRoot":"","sources":["../../src/resolvers/avatarInputValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,QAAa,CAAC;AAEjD,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAehD,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,2BAA2B,CAK7B"}

package/dist/resolvers/avatarInputValidation.js

@@ -0,0 +1,97 @@
+/**
+ * @fileoverview Trust-boundary validation for the self-service avatar mutation
+ * (`UpdateMyAvatar` in `UserAvatarResolver`).
+ *
+ * The browser checks these values too, but its URL check is `new URL(...)`, which happily accepts
+ * `javascript:` and every `data:` type. The server is the boundary, so everything that reaches
+ * `MJ: Users.UserImageURL` / `UserImageIconClass` through the mutation passes through here first.
+ *
+ * Pure: no I/O, no provider, no entity — so it is unit-testable on its own.
+ *
+ * @module @memberjunction/server/resolvers/avatarInputValidation
+ */
+/** Largest DECODED image accepted in a `data:` URI. Matches the Explorer upload cap. */
+export const AVATAR_MAX_IMAGE_BYTES = 200 * 1024;
+/** Longest `http:` / `https:` image URL accepted. */
+export const AVATAR_MAX_URL_LENGTH = 2048;
+/** Longest icon class string accepted. */
+export const AVATAR_MAX_ICON_CLASS_LENGTH = 100;
+/**
+ * Longest `data:` value that can still decode to {@link AVATAR_MAX_IMAGE_BYTES}: the longest accepted
+ * prefix plus the padded base64 payload. Anything longer is refused before the pattern scans it.
+ */
+const AVATAR_MAX_DATA_URI_LENGTH = 'data:image/jpeg;base64,'.length + Math.ceil(AVATAR_MAX_IMAGE_BYTES / 3) * 4;
+/** `data:image/<raster type>;base64,<payload>` — SVG is deliberately absent (it can carry script). */
+const DATA_URI_PATTERN = /^data:image\/(png|jpeg|jpg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+/** Lower-case Font Awesome class lists only, e.g. `fa-solid fa-user`. */
+const ICON_CLASS_PATTERN = /^[a-z0-9 -]+$/;
+const FA_TOKEN_PATTERN = /^fa-[a-z0-9-]+$/;
+/**
+ * Validates a requested avatar. Null or empty values clear the corresponding column, so both
+ * null is a valid "revert to default".
+ *
+ * - `imageURL`: a `data:image/(png|jpeg|jpg|gif|webp);base64,...` URI whose decoded size is at most
+ *   {@link AVATAR_MAX_IMAGE_BYTES}, or an absolute `http:`/`https:` URL of at most
+ *   {@link AVATAR_MAX_URL_LENGTH} characters with no whitespace. Everything else is refused.
+ * - `iconClass`: at most {@link AVATAR_MAX_ICON_CLASS_LENGTH} characters of `[a-z0-9 -]`,
+ *   containing at least one `fa-` token.
+ */
+export function ValidateAvatarInput(imageURL, iconClass) {
+    const image = imageURL ? imageURL : null;
+    const icon = iconClass ? iconClass : null;
+    const error = (image === null ? undefined : imageUrlError(image)) ?? (icon === null ? undefined : iconClassError(icon));
+    return error ? { Valid: false, ErrorMessage: error, ImageURL: null, IconClass: null } : { Valid: true, ImageURL: image, IconClass: icon };
+}
+/** Returns why an image value is refused, or `undefined` when it is acceptable. */
+function imageUrlError(value) {
+    if (value.startsWith('data:')) {
+        return dataUriError(value);
+    }
+    return httpUrlError(value);
+}
+function dataUriError(value) {
+    if (value.length > AVATAR_MAX_DATA_URI_LENGTH) {
+        return tooLargeError(Math.floor((value.length * 3) / 4));
+    }
+    const match = DATA_URI_PATTERN.exec(value);
+    if (!match || match[2].length % 4 !== 0) {
+        return 'Avatar image must be a base64 PNG, JPEG, GIF or WEBP data URI.';
+    }
+    const decodedBytes = decodedBase64Length(match[2]);
+    return decodedBytes > AVATAR_MAX_IMAGE_BYTES ? tooLargeError(decodedBytes) : undefined;
+}
+function tooLargeError(bytes) {
+    return `Avatar image must be ${AVATAR_MAX_IMAGE_BYTES / 1024}KB or smaller (this one is about ${Math.ceil(bytes / 1024)}KB).`;
+}
+/** Decoded byte length of a padded base64 string, without decoding it. */
+function decodedBase64Length(base64) {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return (base64.length / 4) * 3 - padding;
+}
+function httpUrlError(value) {
+    const refusal = 'Avatar image URL must be an absolute http or https URL.';
+    if (value.length > AVATAR_MAX_URL_LENGTH) {
+        return `Avatar image URL must be ${AVATAR_MAX_URL_LENGTH} characters or fewer.`;
+    }
+    if (/\s/.test(value) || !/^https?:\/\//i.test(value)) {
+        return refusal;
+    }
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:' ? undefined : refusal;
+    }
+    catch {
+        return refusal;
+    }
+}
+/** Returns why an icon class is refused, or `undefined` when it is acceptable. */
+function iconClassError(value) {
+    const valid = value.length <= AVATAR_MAX_ICON_CLASS_LENGTH &&
+        ICON_CLASS_PATTERN.test(value) &&
+        value.split(' ').some((token) => FA_TOKEN_PATTERN.test(token));
+    return valid
+        ? undefined
+        : `Avatar icon must be a Font Awesome class list (lower-case letters, digits, spaces and hyphens, ` +
+            `${AVATAR_MAX_ICON_CLASS_LENGTH} characters or fewer, including an fa- class).`;
+}
+//# sourceMappingURL=avatarInputValidation.js.map

package/dist/resolvers/avatarInputValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarInputValidation.js","sourceRoot":"","sources":["../../src/resolvers/avatarInputValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,0CAA0C;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,yBAAyB,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhH,sGAAsG;AACtG,MAAM,gBAAgB,GAAG,qEAAqE,CAAC;AAE/F,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAa3C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAC/B,QAAmC,EACnC,SAAoC;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9I,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,gEAAgE,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,YAAY,GAAG,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAChC,OAAO,wBAAwB,sBAAsB,GAAG,IAAI,oCAAoC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;AAClI,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,MAAc;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,yDAAyD,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,OAAO,4BAA4B,qBAAqB,uBAAuB,CAAC;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,KAAK,GACP,KAAK,CAAC,MAAM,IAAI,4BAA4B;QAC5C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK;QACR,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iGAAiG;YAC7F,GAAG,4BAA4B,gDAAgD,CAAC;AAC9F,CAAC"}

package/dist/resolvers/currentUserRoles.d.ts

@@ -1,8 +1,37 @@
+import { UserInfo } from '@memberjunction/core';
 /**
  * Guards and filter builders for CurrentUser role loading.
  * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
  * without importing generated GraphQL types or the Apollo config bootstrap.
  */
+/**
+ * The session user's own fields, as CurrentUser returns them. The client asks for every field of
+ * `UserInfo` (GraphQLDataProvider builds its query from it), so each one belongs here; anything
+ * left out reaches the client as null (as IsTemplate once did, hiding the template-user banner).
+ */
+export declare function SessionUserFields(userRecord: UserInfo): {
+    ID: string;
+    Name: string;
+    FirstName: string;
+    LastName: string;
+    Title: string;
+    Email: string;
+    Type: string;
+    IsActive: boolean;
+    IsTemplate: boolean;
+    LinkedRecordType: "None" | "Other" | "Employee";
+    EmployeeID: number;
+    LinkedEntityID: number;
+    LinkedEntityRecordID: number;
+    __mj_CreatedAt: Date;
+    __mj_UpdatedAt: Date;
+    FirstLast: string;
+    EmployeeFirstLast: string;
+    EmployeeEmail: string;
+    EmployeeTitle: string;
+    EmployeeSupervisor: string;
+    EmployeeSupervisorEmail: string;
+};
 export declare function RequireLoadedUser<T extends {
     ID?: string;
 }>(user: T | null | undefined, email: string | undefined): T & {

package/dist/resolvers/currentUserRoles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"currentUserRoles.d.ts","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAKpB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKxE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}
+{"version":3,"file":"currentUserRoles.d.ts","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AAEH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;EAwBrD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAKpB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKxE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}

package/dist/resolvers/currentUserRoles.js

@@ -4,6 +4,36 @@ import { LogError } from '@memberjunction/core';
  * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
  * without importing generated GraphQL types or the Apollo config bootstrap.
  */
+/**
+ * The session user's own fields, as CurrentUser returns them. The client asks for every field of
+ * `UserInfo` (GraphQLDataProvider builds its query from it), so each one belongs here; anything
+ * left out reaches the client as null (as IsTemplate once did, hiding the template-user banner).
+ */
+export function SessionUserFields(userRecord) {
+    return {
+        ID: userRecord.ID,
+        Name: userRecord.Name,
+        FirstName: userRecord.FirstName,
+        LastName: userRecord.LastName,
+        Title: userRecord.Title,
+        Email: userRecord.Email,
+        Type: userRecord.Type,
+        IsActive: userRecord.IsActive,
+        IsTemplate: userRecord.IsTemplate,
+        LinkedRecordType: userRecord.LinkedRecordType,
+        EmployeeID: userRecord.EmployeeID,
+        LinkedEntityID: userRecord.LinkedEntityID,
+        LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
+        __mj_CreatedAt: userRecord.__mj_CreatedAt,
+        __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
+        FirstLast: userRecord.FirstLast,
+        EmployeeFirstLast: userRecord.EmployeeFirstLast,
+        EmployeeEmail: userRecord.EmployeeEmail,
+        EmployeeTitle: userRecord.EmployeeTitle,
+        EmployeeSupervisor: userRecord.EmployeeSupervisor,
+        EmployeeSupervisorEmail: userRecord.EmployeeSupervisorEmail,
+    };
+}
 export function RequireLoadedUser(user, email) {
     if (!user?.ID) {
         throw new Error(`CurrentUser: no user found for email '${email ?? ''}'`);

package/dist/resolvers/currentUserRoles.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentUserRoles.js","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;GAIG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,IAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,IAA0B;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAA8B;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0D,EAC1D,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;QACvD,QAAQ,CAAC,8CAA8C,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"currentUserRoles.js","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoB;IACpD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,IAA0B;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAA8B;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0D,EAC1D,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;QACvD,QAAQ,CAAC,8CAA8C,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/resolvers/meetings/meetingMutations.d.ts

@@ -5,6 +5,12 @@ import * as defaultHelpers from './meetingHelpers.js';
 export type MeetingHelpers = typeof defaultHelpers;
 export declare function ExecuteCreateMeeting(provider: IMetadataProvider, user: UserInfo, input: CreateMeetingInput, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
 export declare function ExecuteUpdateMeeting(provider: IMetadataProvider, user: UserInfo, input: UpdateMeetingInput, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
+/**
+ * Starts a meeting for the `StartMeeting` mutation (`MeetingResolver`): marks it `Live`, ensures its Interaction, starts
+ * each agent participant in the room under an agent session created for it, starts an automatic recording, and mints the
+ * caller's client token. An agent that fails to start doesn't fail the meeting; the session created for it is closed
+ * (`Error`).
+ */
 export declare function ExecuteStartMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, sessionManager: SessionManager, helpers?: Partial<MeetingHelpers>): Promise<StartMeetingResult>;
 export declare function ExecuteEndMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
 export declare function ExecuteCancelMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;

package/dist/resolvers/meetings/meetingMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meetingMutations.d.ts","sourceRoot":"","sources":["../../../src/resolvers/meetings/meetingMutations.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAGjB,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AAMnD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAoHxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA6IxB;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAmF7B;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAiDxB"}
+{"version":3,"file":"meetingMutations.d.ts","sourceRoot":"","sources":["../../../src/resolvers/meetings/meetingMutations.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAGjB,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AAMnD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAoHxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA6IxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAkG7B;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAiDxB"}

package/dist/resolvers/meetings/meetingMutations.js

@@ -235,6 +235,12 @@ export async function ExecuteUpdateMeeting(provider, user, input, helpers) {
         return { Success: false, ErrorMessage: msg };
     }
 }
+/**
+ * Starts a meeting for the `StartMeeting` mutation (`MeetingResolver`): marks it `Live`, ensures its Interaction, starts
+ * each agent participant in the room under an agent session created for it, starts an automatic recording, and mints the
+ * caller's client token. An agent that fails to start doesn't fail the meeting; the session created for it is closed
+ * (`Error`).
+ */
 export async function ExecuteStartMeeting(provider, user, meetingID, sessionManager, helpers) {
     const h = resolveHelpers(helpers);
     try {
@@ -261,8 +267,11 @@ export async function ExecuteStartMeeting(provider, user, meetingID, sessionMana
         const participants = await h.LoadParticipants(meeting.ID, user, provider);
         const agentParticipants = participants.filter((p) => p.Role === 'Agent' && p.AgentID);
         for (const ap of agentParticipants) {
+            // Set once this agent's session exists, so a start that fails after it was created can close it.
+            let createdSessionID;
             try {
                 const createdSession = await sessionManager.CreateSession({ agentID: ap.AgentID, userID: user.ID }, user, provider);
+                createdSessionID = createdSession.ID;
                 await LiveKitAgentRoomCoordinator.Instance.StartAgentRoomSession({
                     AgentSessionID: createdSession.ID,
                     RoomName: meeting.RoomName,
@@ -271,10 +280,22 @@ export async function ExecuteStartMeeting(provider, user, meetingID, sessionMana
                     MetadataProvider: provider,
                     TurnMode: 'Active',
                     TurnAddressing: 'Auto',
+                    // The session exists for this agent's time in the room alone: it closes when the agent leaves (the meeting is
+                    // ended, everyone leaves, the agent is stopped), not when the janitor finds it idle.
+                    Host: {
+                        OnSessionEnded: async (reason) => {
+                            await sessionManager.CloseSessionForEndedBridge(createdSession.ID, reason, user, provider);
+                        },
+                    },
                 });
             }
             catch (agentErr) {
                 LogError(`[MeetingResolver] Failed to start agent participant ${ap.AgentID} in room ${meeting.RoomName}: ${agentErr instanceof Error ? agentErr.message : String(agentErr)}`);
+                // The agent never joined, so the hook above never runs: close its session now (Error), not when the janitor finds
+                // it idle. The coordinator has already closed any model session the start opened (#5308).
+                if (createdSessionID) {
+                    await sessionManager.CloseSessionForFailedStart(createdSessionID, user, provider);
+                }
             }
         }
         // 3. Initiate recording if RecordingPolicy is 'Automatic'