@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/resolvers/SearchKnowledgeStreamResolver.ts

@@ -18,8 +18,14 @@
  * Permission enforcement is identical to SearchKnowledge: each requested
  * scopeID is run through SearchScopePermissionResolver before the engine
  * is invoked. A denial publishes a single 'error' event and ends.
+ *
+ * 'provider' events are progress only — ProviderName, DurationMs and
+ * ResultCount. They arrive before the engine's permission pass, so they never
+ * carry a result: rows the caller's row filters would drop and unverified
+ * external-index hits must not reach the client. Results arrive in 'fused'
+ * and 'final'.
  */
-import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
+import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, Int, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
 import { v4 as uuidv4 } from 'uuid';
 import { GraphQLJSON } from 'graphql-type-json';
 import { AppContext } from '../types.js';
@@ -59,10 +65,17 @@ export class SearchStreamNotification {
     @Field(() => Float, { nullable: true })
     DurationMs?: number;
 
-    /** Set on `provider`, `fused`, `reranked`, `final` events. */
+    /**
+     * Set on `fused`, `reranked` and `final` events. Always empty on a `provider` event: a provider's
+     * hits arrive before the permission pass, so the stream reports only their count (`ResultCount`).
+     */
     @Field(() => [SearchKnowledgeResultItem], { nullable: true })
     Results?: SearchKnowledgeResultItem[];
 
+    /** Set on `provider` events: how many hits the provider returned, capped at `maxResults`. */
+    @Field(() => Int, { nullable: true })
+    ResultCount?: number;
+
     /** Set on `final` events. */
     @Field(() => SearchSourceCounts, { nullable: true })
     SourceCounts?: SearchSourceCounts;
@@ -253,12 +266,15 @@ export class SearchKnowledgeStreamResolver extends ResolverBase {
 
         switch (ev.phase) {
             case 'provider':
+                // Progress only. `ev.results` is never forwarded, whatever it holds: these hits have
+                // not been through the permission pass.
                 return {
                     StreamID: streamID,
                     Phase: 'provider',
                     ProviderName: ev.providerName,
                     DurationMs: ev.durationMs,
-                    Results: ev.results.map(mapItem),
+                    ResultCount: ev.resultCount,
+                    Results: [],
                 };
             case 'fused':
                 return {

package/src/resolvers/SqlLoggingConfigResolver.ts

@@ -670,10 +670,8 @@ export class SqlLoggingConfigResolver extends ResolverBase {
     }
 
     try {
-      // Check if file exists
-      await fs.access(session.filePath);
-      
-      // Read file content
+      // Read directly: a missing file surfaces as ENOENT below, so a separate existence check
+      // would only open a window for the file to change between the check and the read.
       const content = await fs.readFile(session.filePath, 'utf-8');
       
       // Apply line limit if specified

package/src/resolvers/SyncDataResolver.ts

@@ -3,6 +3,7 @@ import { AppContext, UserPayload } from '../types.js';
 import { BaseEntity, CompositeKey, DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, IMetadataProvider, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadWriteProvider } from '../util.js';
+import { CreateIsolatedProvider } from '../isolatedProvider.js';
 import { CompositeKeyInputType, CompositeKeyOutputType } from '../generic/KeyInputOutputTypes.js';
 import { MJDatasetItemEntity } from '@memberjunction/core-entities';
 
@@ -216,7 +217,11 @@ export class SyncDataResolver {
         try {
             // Run the view to find matching records, then delete them all atomically —
             // any single failure rolls back the entire batch so the dataset stays consistent.
-            const rv = new RunView();
+            // The rows are loaded FROM the transaction's provider so each Delete() runs inside it;
+            // with no request provider, an isolated one, never the shared Metadata.Provider, whose
+            // transaction would swallow every concurrent caller's writes (see CreateIsolatedProvider).
+            const provider = (providerOverride as unknown as DatabaseProviderBase) ?? await CreateIsolatedProvider();
+            const rv = RunView.FromMetadataProvider(provider);
             const data = await rv.RunView<BaseEntity>({
                 EntityName: entityName,
                 ExtraFilter: filter,
@@ -234,7 +239,6 @@ export class SyncDataResolver {
                 return;
             }
 
-            const provider = (providerOverride ?? Metadata.Provider) as unknown as DatabaseProviderBase;
             await provider.BeginTransaction();
             try {
                 for (const entityObject of data.Results) {

package/src/resolvers/SyncRolesUsersResolver.ts

@@ -1,7 +1,7 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, IMetadataProvider, LogError, Metadata, RunView, UserInfo } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
+import { GroupByUUID, IndexByUUID, UUIDsEqual } from '@memberjunction/global';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { MJRoleEntity, MJUserEntity, MJUserRoleEntity } from '@memberjunction/core-entities';
 import { UserCache } from '@memberjunction/generic-database-provider';
@@ -430,14 +430,23 @@ export class SyncRolesAndUsersResolver {
         const dbRoles = rResult.Results;
         const dbUserRoles = urResult.Results;
 
+        // Index everything once: looking each user, role and assignment up by scanning the full lists
+        // made this O(users x user roles).
+        const dbUsersByEmail = this.indexByTrimmedLowerCase(dbUsers, u => u.Email);
+        const dbRolesByName = this.indexByTrimmedLowerCase(dbRoles, r => r.Name);
+        const dbRolesByID = IndexByUUID(dbRoles);
+        const dbUserRolesByUser = GroupByUUID(dbUserRoles, ur => ur.UserID);
+
         // Saves/Deletes below run inside the outer SyncUsers/SyncRolesAndUsers transaction.
         for (const user of users) {
-            const dbUser = dbUsers.find(u => u.Email.trim().toLowerCase() === user.Email.trim().toLowerCase());
+            const dbUser = dbUsersByEmail.get(user.Email.trim().toLowerCase());
             if (!dbUser) continue;
 
+            // Read before any save below; the saves never add to dbUserRoles, so this matches the full-list scans it replaces.
+            const thisUserDBRoles = dbUserRolesByUser.Get(dbUser.ID) ?? [];
             for (const role of user.Roles) {
-                const dbRole = dbRoles.find(r => r.Name.trim().toLowerCase() === role.Name.trim().toLowerCase());
-                if (dbRole && !dbUserRoles.find(ur => UUIDsEqual(ur.UserID, dbUser.ID) && UUIDsEqual(ur.RoleID, dbRole.ID))) {
+                const dbRole = dbRolesByName.get(role.Name.trim().toLowerCase());
+                if (dbRole && !thisUserDBRoles.some(ur => UUIDsEqual(ur.RoleID, dbRole.ID))) {
                     const ur = await md.GetEntityObject<MJUserRoleEntity>("MJ: User Roles", u);
                     ur.UserID = dbUser.ID;
                     ur.RoleID = dbRole.ID;
@@ -448,9 +457,8 @@ export class SyncRolesAndUsersResolver {
             }
 
             // Check for DB user roles that are NOT in the user.Roles input — those need to be removed
-            const thisUserDBRoles = dbUserRoles.filter(ur => UUIDsEqual(ur.UserID, dbUser.ID));
             for (const dbUserRole of thisUserDBRoles) {
-                const role = user.Roles.find(r => r.Name.trim().toLowerCase() === dbRoles.find(rr => UUIDsEqual(rr.ID, dbUserRole.RoleID))?.Name.trim().toLowerCase());
+                const role = user.Roles.find(r => r.Name.trim().toLowerCase() === dbRolesByID.Get(dbUserRole.RoleID)?.Name.trim().toLowerCase());
                 if (!role && !this.IsStandardRole(dbUserRole.Role)) {
                     if (!await dbUserRole.Delete()) {
                         throw new Error(`Failed to remove role from user '${dbUser.Email}': ${dbUserRole.LatestResult?.CompleteMessage ?? 'unknown error'}`);
@@ -459,5 +467,15 @@ export class SyncRolesAndUsersResolver {
             }
         }
     }
+
+    /** Keys rows by a trimmed, lower-cased name; the first row wins, as `find` would return. */
+    private indexByTrimmedLowerCase<T>(rows: T[], keyOf: (row: T) => string | null | undefined): Map<string, T> {
+        const index = new Map<string, T>();
+        for (const row of rows) {
+            const key = keyOf(row)?.trim().toLowerCase();
+            if (key != null && !index.has(key)) index.set(key, row);
+        }
+        return index;
+    }
 }
  

package/src/resolvers/TaskGraphFrameResolver.ts

@@ -19,6 +19,7 @@ import { Arg, Field, ID, ObjectType, PubSubEngine, Resolver, ResolverFilterData,
 import { LogError } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import type { TaskGraphFrame, TaskGraphObserver } from '@memberjunction/task-graph';
+import { PublishStatusUpdate } from '../generic/PushStatusResolver.js';
 
 export const TASK_GRAPH_FRAMES_TOPIC = 'TASK_GRAPH_FRAMES';
 
@@ -173,7 +174,10 @@ export function taskGraphFrameFilter(data: {
  * the same reason.
  */
 export class TaskGraphFrameBroadcaster implements TaskGraphObserver {
-  constructor(private readonly pubSub: PubSubEngine) {}
+  constructor(
+    private readonly pubSub: PubSubEngine,
+    private readonly bridgeToPushStatus: boolean = false,
+  ) {}
 
   public OnFrame(frame: TaskGraphFrame): void {
     try {
@@ -187,6 +191,34 @@ export class TaskGraphFrameBroadcaster implements TaskGraphObserver {
         TASK_GRAPH_FRAMES_TOPIC,
         { ...frame, ownerUserId: frame.OwnerUserID } satisfies TaskGraphFramePayload,
       );
+
+      if (
+        this.bridgeToPushStatus &&
+        (frame.Kind === 'TaskStarted' ||
+          frame.Kind === 'TaskCompleted' ||
+          frame.Kind === 'TaskFailed' ||
+          frame.Kind === 'NodeProgress' ||
+          frame.Kind === 'GraphSettled')
+      ) {
+        const defaultMsg = frame.TaskName
+          ? `${frame.TaskName}: ${frame.Status ?? frame.Kind}`
+          : `Workflow: ${frame.Status ?? frame.Kind}`;
+        PublishStatusUpdate(this.pubSub, {
+          sessionId: '*',
+          ownerUserId: frame.OwnerUserID,
+          message: JSON.stringify({
+            resolver: 'TaskOrchestrator',
+            type: 'TaskGraphFrame',
+            status: 'ok',
+            data: {
+              ...frame,
+              taskName: frame.TaskName,
+              message: frame.ProgressMessage || defaultMsg,
+              percentComplete: frame.ProgressPercent,
+            },
+          }),
+        });
+      }
     } catch (e) {
       LogError(`[TaskGraphFrameBroadcaster] Could not publish ${frame.Kind} (ignored): ${e instanceof Error ? e.message : String(e)}`);
     }

package/src/resolvers/TestQuerySQLResolver.ts

@@ -1,9 +1,12 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { RunQuery, IRunQueryProvider, LogError, LogStatus, QueryExecutionSpec } from '@memberjunction/core';
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
 import { AppContext } from '../types.js';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 
 /**
  * GraphQL input type for inline dependency queries.
@@ -88,6 +91,14 @@ export class TestQuerySQLResult {
  *
  * Security:
  * - Requires `query:test` scope for API key users (no-op for JWT auth)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView. Same screen as {@link AdhocQueryResolver.ExecuteAdhocQuery}.
  * - Uses read-only database connection (no mutation possible)
  * - Enforces MaxRows limit (default 100) to prevent unbounded queries
  *
@@ -104,15 +115,24 @@ export class TestQuerySQLResolver extends ResolverBase {
     ): Promise<TestQuerySQLResult> {
         try {
             await this.CheckAPIKeyScopeAuthorization('query:test', '*', context.userPayload);
+            // SECURITY: refuse principals whose read authority is narrower than their role grant.
+            // Transient test SQL does not go through RunView, entity permissions or row-level
+            // security, so the RLS scope tokens that confine a magic-link session are never
+            // substituted. There is no filter to narrow, so the only correct answer for such a
+            // principal is no — the same refusal ExecuteAdhocQuery applies.
+            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+            }
             // Use read-only provider for security — no mutation possible
             const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
             if (!provider) {
-                return {
-                    Success: false,
-                    RowCount: 0,
-                    ExecutionTime: 0,
-                    ErrorMessage: 'Read-only data source is not available. TestQuerySQL requires a read-only connection for security.',
-                };
+                return this.buildErrorResult('Read-only data source is not available. TestQuerySQL requires a read-only connection for security.');
+            }
+
+            const contextUser = context.userPayload?.userRecord;
+            const refusal = this.AuthorizeRenderedTestSQL(input, provider, contextUser);
+            if (refusal) {
+                return this.buildErrorResult(refusal);
             }
 
             const rq = new RunQuery(provider as unknown as IRunQueryProvider);
@@ -127,7 +147,7 @@ export class TestQuerySQLResolver extends ResolverBase {
 
             LogStatus(`TestQuerySQL: Executing transient query (MaxRows=${spec.MaxRows}, UsesTemplate=${spec.UsesTemplate ?? false}, Dependencies=${spec.Dependencies?.length ?? 0})`);
 
-            const result = await rq.ExecuteFromSpec(spec, context.userPayload.userRecord);
+            const result = await rq.ExecuteFromSpec(spec, contextUser);
 
             return {
                 Success: result.Success,
@@ -141,12 +161,47 @@ export class TestQuerySQLResolver extends ResolverBase {
         } catch (err) {
             LogError(err);
             const errorMessage = err instanceof Error ? err.message : String(err);
-            return {
-                Success: false,
-                RowCount: 0,
-                ExecutionTime: 0,
-                ErrorMessage: `TestQuerySQL failed: ${errorMessage}`,
-            };
+            return this.buildErrorResult(`TestQuerySQL failed: ${errorMessage}`);
         }
     }
+
+    /**
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run — the same
+     * screen `AdhocQueryResolver.AuthorizeRenderedSQL` applies to ad-hoc SQL. Rendering comes
+     * first because composition (`{{query:"..."}}`), inline dependencies and Nunjucks templates
+     * can introduce table references the raw input never named, so the render here uses the same
+     * Parameters / UsesTemplate / Dependencies the execution spec will. Every table reference in
+     * the rendered SQL must be an entity base view the caller can read UNSCOPED — CanRead with no
+     * row-level filter and no denied fields — because raw SQL applies neither (see
+     * `assertFullQueryUsesReadableEntityViews`). The provider renders the same input the same way
+     * and only wraps it in server-built MaxRows capping, so the rendered SQL is the full set of
+     * reads. Returns the refusal message, or null.
+     */
+    public AuthorizeRenderedTestSQL(input: TestQuerySQLInput, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null {
+        try {
+            const rendered = RenderPipeline.Run(input.SQL, {
+                Platform: provider.PlatformKey,
+                ContextUser: contextUser,
+                Parameters: input.Parameters,
+                UsesTemplate: input.UsesTemplate,
+                Dependencies: input.Dependencies,
+                OriginalSQL: input.SQL,
+                RequireReadStatement: true,
+            });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'transient test SQL');
+            return null;
+        } catch (err) {
+            return err instanceof Error ? err.message : String(err);
+        }
+    }
+
+    /** Builds a failed TestQuerySQLResult carrying the given message. */
+    private buildErrorResult(errorMessage: string): TestQuerySQLResult {
+        return {
+            Success: false,
+            RowCount: 0,
+            ExecutionTime: 0,
+            ErrorMessage: errorMessage,
+        };
+    }
 }

package/src/resolvers/TransactionGroupResolver.ts

@@ -1,7 +1,7 @@
 import { Arg, Ctx, Field, InputType, Int, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { CompositeKey, IMetadataProvider, KeyValuePair, LogError, Metadata, TransactionVariable, BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
-import { SafeJSONParse } from '@memberjunction/global';
+import { CompositeKey, EntityInfo, IMetadataProvider, KeyValuePair, LogError, Metadata, TransactionVariable, TransactionGroupBase, BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
+import { SafeJSONParse, ValuesEqual } from '@memberjunction/global';
 import { GetReadWriteProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
@@ -142,11 +142,19 @@ export class TransactionResolver extends ResolverBase {
             // rows were all refused arrive at Submit() empty, take its legitimate "nothing to do"
             // branch, and report success for writes that never happened.
             const refusals: string[] = [];
+            const preUpdateValues = new Map<number, Record<string, unknown>>();
+
+            // instantiate an entity object for every item first, so the group's variables are known
+            // BEFORE any Save()/Delete() runs below: a 'Use' variable sets its field at Submit(), after
+            // every server-side write check has passed, so an entity whose check depends on a field's
+            // final value must be able to see that a variable will set it.
+            for (const item of group.Items) {
+                entityObjects.push(await md.GetEntityObject(item.EntityName, context.userPayload.userRecord));
+            }
+            this.AddNetworkVariables(group, entityObjects, tg);
 
             for (const [index, item] of group.Items.entries()) {
-                // instantiate a new entity object for the item
-                const entity = await md.GetEntityObject(item.EntityName, context.userPayload.userRecord);
-                entityObjects.push(entity); // save for later for mapping variables if needed
+                const entity = entityObjects[index];
 
                 // get the values from the payload
                 const itemValues = SafeJSONParse(item.EntityObjectJSON);
@@ -162,6 +170,11 @@ export class TransactionResolver extends ResolverBase {
                     case "Create":
                         if (item.OperationType === "Update") {
                             await entity.InnerLoad(pkey);
+                            if (typeof entity.GetDataObject === 'function') {
+                                preUpdateValues.set(index, await entity.GetDataObject());
+                            } else if (typeof entity.GetAll === 'function') {
+                                preUpdateValues.set(index, { ...(entity.GetAll() as Record<string, unknown>) });
+                            }
                         }
                         objectValues.push(itemValues);
                         entity.SetMany(itemValues, true);
@@ -208,32 +221,17 @@ export class TransactionResolver extends ResolverBase {
                     `TransactionResolver::ExecuteTransactionGroup --- ${refusals.length} of ${group.Items.length} ` +
                     `item(s) were refused, so the group was not submitted:\n${refusals.join('\n')}`
                 );
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group);
-            }
-
-            // now, we need to set the variables
-            if (group.Variables && group.Variables.length > 0) {
-                for (const networkVar of group.Variables) {
-                    // for each variable, add it to the transaction group and map the index from the network payload to the specific entity object loaded up above
-                    if (networkVar.ItemIndex >= 0 && networkVar.ItemIndex < entityObjects.length) {
-                        const entityObject = entityObjects[networkVar.ItemIndex];
-                        const newVar = new TransactionVariable(networkVar.Name, entityObject, networkVar.FieldName, networkVar.Type);
-                        tg.AddVariable(newVar);
-                    }
-                    else {
-                        throw new Error(`TransactionResolver::ExecuteTransactionGroup --- Error\n\n' + 'Invalid ItemIndex ${networkVar.ItemIndex} in TransactionVariable "${JSON.stringify(networkVar)}"`);
-                    }
-                }
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues);
             }
 
             // after all that, we are ready to roll, so let's run the TG
             if (await tg.Submit()) {
                 // success!
-                return await this.PrepareReturnValue(true, entityObjects, objectValues, group);
+                return await this.PrepareReturnValue(true, entityObjects, objectValues, group, preUpdateValues);
             }
             else {
                 // failure, send back the results
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group);
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues);
             }
         } 
         catch (err) {
@@ -242,15 +240,48 @@ export class TransactionResolver extends ResolverBase {
         }
     }
 
-    protected async PrepareReturnValue(success: boolean, entityObjects: BaseEntity[], objectValues: any[], group: TransactionInputType): Promise<TransactionOutputType> {
+    /**
+     * Adds the network payload's variables to the group, mapping each one's item index to the entity
+     * object built for that item.
+     */
+    protected AddNetworkVariables(group: TransactionInputType, entityObjects: BaseEntity[], tg: TransactionGroupBase): void {
+        for (const networkVar of group.Variables ?? []) {
+            if (networkVar.ItemIndex >= 0 && networkVar.ItemIndex < entityObjects.length) {
+                const entityObject = entityObjects[networkVar.ItemIndex];
+                tg.AddVariable(new TransactionVariable(networkVar.Name, entityObject, networkVar.FieldName, networkVar.Type));
+            }
+            else {
+                throw new Error(`TransactionResolver::ExecuteTransactionGroup --- Error\n\n' + 'Invalid ItemIndex ${networkVar.ItemIndex} in TransactionVariable "${JSON.stringify(networkVar)}"`);
+            }
+        }
+    }
+
+    protected async PrepareReturnValue(
+        success: boolean,
+        entityObjects: BaseEntity[],
+        objectValues: unknown[],
+        group: TransactionInputType,
+        preUpdateValues?: Map<number, Record<string, unknown>>
+    ): Promise<TransactionOutputType> {
         const jsonResults = [];
         for (let i = 0; i < group.Items.length; i++) {
             const item = group.Items[i];
-            if (item.OperationType==='Delete') {
+            if (item.OperationType === 'Delete') {
                 jsonResults.push(JSON.stringify(objectValues[i]));
             }
+            else if (item.OperationType === 'Update') {
+                jsonResults.push(
+                    await this.serializeUpdateReturnValue(
+                        entityObjects[i],
+                        objectValues[i],
+                        preUpdateValues?.get(i),
+                        group,
+                        i
+                    )
+                );
+            }
             else {
-                // create or update, return what is in the database
+                // create, return what is in the database
                 jsonResults.push(await entityObjects[i].GetDataObjectJSON());
             }
         }
@@ -261,6 +292,79 @@ export class TransactionResolver extends ResolverBase {
             ResultsJSON: jsonResults
         }
     }
- 
+
+    /**
+     * Serializes a delta return payload for an `Update` transaction group item containing:
+     * - Primary key fields
+     * - All keys sent by the client in `sentValues` (`objectValues[i]`)
+     * - Any `TransactionVariable` fields targeting this item
+     * - `__mj_CreatedAt` and `__mj_UpdatedAt`
+     * - Virtual fields when any foreign key field was in `sentValues`
+     * - Any field whose post-save value differs from its pre-update DB snapshot (`preSaveValues`),
+     *   capturing virtual fields, triggers, or server-side `BeforeSave()` mutations automatically
+     *   while omitting unchanged columns.
+     */
+    private async serializeUpdateReturnValue(
+        entity: BaseEntity,
+        sentValues: unknown,
+        preSaveValues: Record<string, unknown> | undefined,
+        group: TransactionInputType,
+        itemIndex: number
+    ): Promise<string> {
+        const fullDataObj: Record<string, unknown> | null = typeof entity.GetDataObject === 'function'
+            ? (await entity.GetDataObject() as Record<string, unknown>)
+            : SafeJSONParse<Record<string, unknown>>(await entity.GetDataObjectJSON());
+        if (!fullDataObj || typeof fullDataObj !== 'object' || !sentValues || typeof sentValues !== 'object') {
+            return await entity.GetDataObjectJSON();
+        }
+
+        const sentRecord = sentValues as Record<string, unknown>;
+        const includeKeys = new Set<string>([
+            EntityInfo.CreatedAtFieldName,
+            EntityInfo.UpdatedAtFieldName,
+        ]);
+
+        for (const pk of entity.PrimaryKeys ?? []) {
+            if (pk?.Name) {
+                includeKeys.add(pk.Name);
+            }
+        }
+        for (const key of Object.keys(sentRecord)) {
+            includeKeys.add(key);
+        }
+        for (const v of group.Variables ?? []) {
+            if (v.ItemIndex === itemIndex && v.FieldName) {
+                includeKeys.add(v.FieldName);
+            }
+        }
+        if (Array.isArray(entity.Fields)) {
+            for (const f of entity.Fields) {
+                if (
+                    f.EntityFieldInfo?.IsSpecialDateField ||
+                    Boolean(f.EntityFieldInfo?.IsVirtual) ||
+                    Boolean(f.EntityFieldInfo?.IsComputed) ||
+                    f.ReadOnly
+                ) {
+                    includeKeys.add(f.Name);
+                }
+            }
+        }
+        if (preSaveValues) {
+            for (const key of Object.keys(fullDataObj)) {
+                if (!ValuesEqual(fullDataObj[key], preSaveValues[key])) {
+                    includeKeys.add(key);
+                }
+            }
+        }
+
+        const deltaObj: Record<string, unknown> = {};
+        for (const key of Object.keys(fullDataObj)) {
+            if (includeKeys.has(key)) {
+                deltaObj[key] = fullDataObj[key];
+            }
+        }
+        return JSON.stringify(deltaObj);
+    }
+
 }
  

package/src/resolvers/UserAvatarResolver.ts

@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Self-service avatar mutation: `UpdateMyAvatar(ImageURL, IconClass)`.
+ *
+ * WHY THIS EXISTS. Explorer's My Profile photo used to be a plain entity save of the caller's own
+ * `MJ: Users` row, which needs Update permission on `MJ: Users`. A deployment that locks its
+ * security model down cannot give ordinary users that permission: a row-level "own row only"
+ * filter restricts ROWS, not COLUMNS, so a user who may update their own row may also rewrite
+ * their own `Email` — and many read filters key on `{{UserEmail}}`, so the new value would match
+ * another person's memberships. MJ has no per-role field permissions (`MJUserEntityServer` in
+ * core-entities-server documents the same limit for `Type`). On such deployments every avatar save
+ * failed, and the login avatar sync failed silently.
+ *
+ * WHAT IT DOES. The caller comes ONLY from the request context — there is no user-ID argument. The
+ * input is validated at this trust boundary (`ValidateAvatarInput`). The caller's own row is then
+ * loaded AS THE SYSTEM USER, any state other than the two avatar columns is discarded, and only
+ * `UserImageURL` and `UserImageIconClass` are set before saving. Because the write is made as the
+ * system user, the caller's ID is logged. It works the same whether or not the caller holds Update
+ * on `MJ: Users`.
+ *
+ * Scope-limited sessions are refused (`IsScopeLimitedPrincipal`). An anonymous magic-link guest IS
+ * the shared Anonymous principal, so "their own row" belongs to every guest, and a system-user save
+ * goes around the entity permissions and RLS that confine any magic-link session.
+ *
+ * `MJUserEntityServer` accepts this save: the system user is the seeded `Type='Owner'` user, which
+ * is exempt from its invariants, and the save changes neither `Type` nor `Name` in any case.
+ *
+ * @module @memberjunction/server/resolvers/UserAvatarResolver
+ */
+import { Arg, Ctx, Field, Mutation, ObjectType, Resolver } from 'type-graphql';
+import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
+import type { MJUserEntity } from '@memberjunction/core-entities';
+import { AppContext } from '../types.js';
+import { GetReadWriteProvider } from '../util.js';
+import { GetSystemUser } from '../auth/index.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { ValidateAvatarInput } from './avatarInputValidation.js';
+
+/** What the browser sees when the save fails. The server's detail goes to the log only. */
+const SAVE_FAILED_MESSAGE = 'Could not save your avatar. Please try again or contact your administrator.';
+
+@ObjectType()
+export class UpdateMyAvatarResult {
+  @Field()
+  Success: boolean;
+
+  @Field({ nullable: true })
+  ErrorMessage?: string;
+}
+
+@Resolver()
+export class UserAvatarResolver extends ResolverBase {
+  /**
+   * Sets the CALLER's avatar. Null or empty clears a column; both null reverts to the default.
+   * Validation failures and save failures are returned as `Success: false` with a message.
+   */
+  @Mutation(() => UpdateMyAvatarResult)
+  async UpdateMyAvatar(
+    @Ctx() ctx: AppContext,
+    @Arg('ImageURL', () => String, { nullable: true }) imageURL?: string | null,
+    @Arg('IconClass', () => String, { nullable: true }) iconClass?: string | null,
+  ): Promise<UpdateMyAvatarResult> {
+    const caller = ctx.userPayload?.userRecord as UserInfo | undefined;
+    if (!caller?.ID) {
+      throw new Error('User is not authenticated');
+    }
+    if (IsScopeLimitedPrincipal(caller)) {
+      return { Success: false, ErrorMessage: 'Changing your avatar is not permitted for scope-limited sessions.' };
+    }
+    await this.CheckAPIKeyScopeAuthorization('entity:update', 'MJ: Users', ctx.userPayload);
+
+    const input = ValidateAvatarInput(imageURL, iconClass);
+    if (!input.Valid) {
+      return { Success: false, ErrorMessage: input.ErrorMessage };
+    }
+
+    try {
+      return await this.saveAvatar(ctx, caller, input.ImageURL, input.IconClass);
+    } catch (e) {
+      LogError(`UpdateMyAvatar: failed for user ${caller.ID}: ${e instanceof Error ? e.message : String(e)}`);
+      return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+    }
+  }
+
+  /** Loads the caller's own row as the system user and writes ONLY the two avatar columns. */
+  private async saveAvatar(
+    ctx: AppContext,
+    caller: UserInfo,
+    imageURL: string | null,
+    iconClass: string | null,
+  ): Promise<UpdateMyAvatarResult> {
+    const systemUser = await GetSystemUser();
+    const provider = GetReadWriteProvider(ctx.providers);
+    const user = await provider.GetEntityObject<MJUserEntity>('MJ: Users', systemUser);
+    if (!(await user.Load(caller.ID))) {
+      LogError(`UpdateMyAvatar: could not load the MJ: Users row for user ${caller.ID}`);
+      return { Success: false, ErrorMessage: 'Could not load your user record.' };
+    }
+
+    user.Revert(); // nothing but the two avatar columns may reach the write
+    user.UserImageURL = imageURL;
+    user.UserImageIconClass = iconClass;
+    LogStatus(`UpdateMyAvatar: user ${caller.ID} requested an avatar change; saving as the system user`);
+    if (!(await user.Save())) {
+      const detail = user.LatestResult?.CompleteMessage ?? 'unknown error';
+      LogError(`UpdateMyAvatar: save failed for user ${caller.ID}: ${detail}`);
+      return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+    }
+    return { Success: true };
+  }
+}