@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.5

package/src/realtimeSessions/RecordingAssemblyScheduler.ts

@@ -0,0 +1,234 @@
+/**
+ * @fileoverview Per-session timers that assemble a client-direct realtime recording from its shard ledger
+ * off the request path.
+ *
+ * The recording REST routes only record shards and the terminal signal; they never decode. When a route
+ * learns a session is ready (every expected shard present) it asks for an assembly now; when shards are
+ * missing it asks for one after the grace period, forced to `Partial`. This scheduler turns those requests
+ * into at most one pending timer and at most one running assembly per session in this process.
+ *
+ * Correctness across processes does not depend on it: every run starts with the ledger's atomic
+ * `ClaimAssembly`, so of two instances (or two timers) only the claim winner assembles. The per-session
+ * guard here only avoids wasted claims. A run that dies with the process leaves the session `Assembling`,
+ * and the session janitor's stale re-claim is the backstop for that and for any request dropped here.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { DatabaseProviderBase, LogError, LogStatus, UserInfo } from '@memberjunction/core';
+import { BaseSingleton, IShutdownable, ShutdownRegistry } from '@memberjunction/global';
+import {
+    AssembleRealtimeRecordingFromLedger, AssembleRealtimeRecordingInput, AssembleRealtimeRecordingOutcome,
+    IRealtimeRecordingLedger, SqlRealtimeRecordingLedger,
+} from '@memberjunction/ai-agents';
+
+/** A cancellable one-shot timer. */
+export interface RecordingAssemblyTimer {
+    Cancel(): void;
+}
+
+/** Time source of the scheduler; injectable so tests can drive it. */
+export interface RecordingAssemblyClock {
+    /** Milliseconds since the epoch. */
+    Now(): number;
+    /** Runs `callback` once after `delayMs`. The timer must not keep the process alive. */
+    StartTimer(callback: () => void, delayMs: number): RecordingAssemblyTimer;
+}
+
+/** The narrow scheduling contract the recording routes depend on. */
+export interface IRecordingAssemblyScheduler {
+    /**
+     * Requests an assembly of `sessionID` after `delayMs`. `forcePartial` assembles what exists even when
+     * shards are missing (the grace period ran out). See {@link RecordingAssemblyScheduler.ScheduleAssembly}.
+     */
+    ScheduleAssembly(sessionID: string, delayMs: number, forcePartial: boolean): void;
+}
+
+/** What {@link RecordingAssemblyScheduler.Start} needs. */
+export interface RecordingAssemblySchedulerOptions {
+    /** The server's own provider; assembly is server-owned background work, not a request. */
+    Provider: DatabaseProviderBase;
+    /** The user assembly runs as (the system user). */
+    SystemUser: UserInfo;
+    /** Grace before a `Deferred` (incomplete) assembly is retried as forced `Partial`. */
+    GraceMs: () => number;
+    /** Defaults to {@link SqlRealtimeRecordingLedger}. */
+    CreateLedger?: (provider: DatabaseProviderBase, contextUser: UserInfo) => IRealtimeRecordingLedger;
+    /** Defaults to {@link AssembleRealtimeRecordingFromLedger}. */
+    Assemble?: (input: AssembleRealtimeRecordingInput) => Promise<AssembleRealtimeRecordingOutcome>;
+    /** Defaults to `Date.now` and unref'd `setTimeout`. */
+    Clock?: RecordingAssemblyClock;
+}
+
+interface PendingAssembly {
+    DueAt: number;
+    ForcePartial: boolean;
+    Timer: RecordingAssemblyTimer;
+}
+
+const NODE_CLOCK: RecordingAssemblyClock = {
+    Now: () => Date.now(),
+    StartTimer: (callback, delayMs) => {
+        const handle = setTimeout(callback, delayMs);
+        handle.unref?.();
+        return { Cancel: () => clearTimeout(handle) };
+    },
+};
+
+/**
+ * Process-wide scheduler of recording assemblies (see the file overview). Call {@link Start} once at
+ * server startup; requests made before it (or after {@link Shutdown}) are logged and dropped, leaving the
+ * session to the janitor.
+ */
+export class RecordingAssemblyScheduler extends BaseSingleton<RecordingAssemblyScheduler> implements IShutdownable, IRecordingAssemblyScheduler {
+    private _options: Required<RecordingAssemblySchedulerOptions> | null = null;
+    private _registered = false;
+    /** Pending timers keyed by lowercase session id. */
+    private readonly pending = new Map<string, PendingAssembly>();
+    /** Lowercase ids of sessions with an assembly running in this process. */
+    private readonly running = new Set<string>();
+    /** Sessions asked for again while running, with the ForcePartial to re-run with. */
+    private readonly rerun = new Map<string, boolean>();
+
+    protected constructor() {
+        super();
+    }
+
+    /** Process-wide singleton accessor. */
+    public static get Instance(): RecordingAssemblyScheduler {
+        return super.getInstance<RecordingAssemblyScheduler>();
+    }
+
+    /** Identifier surfaced in graceful-shutdown logs. */
+    public readonly ShutdownName = 'RecordingAssemblyScheduler';
+
+    /** Configures the scheduler and enables it; calling again replaces the configuration. */
+    public Start(options: RecordingAssemblySchedulerOptions): void {
+        this._options = {
+            CreateLedger: (provider, contextUser) => new SqlRealtimeRecordingLedger(provider, contextUser),
+            Assemble: AssembleRealtimeRecordingFromLedger,
+            Clock: NODE_CLOCK,
+            ...options,
+        };
+        if (!this._registered) {
+            ShutdownRegistry.Instance.Register(this);
+            this._registered = true;
+        }
+    }
+
+    /**
+     * Requests an assembly of `sessionID` after `delayMs`. One pending timer per session: a request
+     * replaces the pending one only when it would fire sooner (at the same time, the merged request keeps
+     * `forcePartial` if either had it). A timer that fires while the session's previous run is still going
+     * is remembered and run right after it, never alongside it.
+     *
+     * Trade-off: a sooner un-forced request replaces a pending forced one. If that run comes back
+     * `Deferred` (still incomplete), the forced `Partial` is re-scheduled a full grace from then, so a
+     * forced Partial can land up to ~2× the grace after the first terminal signal. Accepted: the sooner
+     * run completes the recording outright whenever the missing shards did arrive.
+     */
+    public ScheduleAssembly(sessionID: string, delayMs: number, forcePartial: boolean): void {
+        const options = this._options;
+        if (!options) {
+            LogError(`RecordingAssemblyScheduler: not running; dropped the assembly request for session ${sessionID} (the session janitor will assemble it)`);
+            return;
+        }
+        const key = sessionID.toLowerCase();
+        const dueAt = options.Clock.Now() + Math.max(0, delayMs);
+        const existing = this.pending.get(key);
+        if (existing && existing.DueAt < dueAt) {
+            return;
+        }
+        if (existing && existing.DueAt === dueAt) {
+            existing.ForcePartial = existing.ForcePartial || forcePartial;
+            return;
+        }
+        existing?.Timer.Cancel();
+        const timer = options.Clock.StartTimer(() => this.onTimer(key, sessionID), dueAt - options.Clock.Now());
+        this.pending.set(key, { DueAt: dueAt, ForcePartial: forcePartial, Timer: timer });
+    }
+
+    /**
+     * Cancels every pending timer and stops accepting requests until the next {@link Start}. A running
+     * assembly is not awaited: if the process exits under it, the session stays `Assembling` and the
+     * janitor's stale re-claim finishes it. Idempotent.
+     */
+    public Shutdown(): void {
+        for (const entry of this.pending.values()) {
+            entry.Timer.Cancel();
+        }
+        this.pending.clear();
+        this.rerun.clear();
+        this._options = null;
+    }
+
+    private onTimer(key: string, sessionID: string): void {
+        const entry = this.pending.get(key);
+        if (!entry) {
+            return;
+        }
+        this.pending.delete(key);
+        if (this.running.has(key)) {
+            this.rerun.set(key, (this.rerun.get(key) ?? false) || entry.ForcePartial);
+            return;
+        }
+        void this.runUntilSettled(key, sessionID, entry.ForcePartial);
+    }
+
+    /** Runs the session's assembly, then any re-run requested meanwhile. Never rejects. */
+    private async runUntilSettled(key: string, sessionID: string, forcePartial: boolean): Promise<void> {
+        this.running.add(key);
+        try {
+            let next: boolean | undefined = forcePartial;
+            while (next !== undefined) {
+                await this.runOnce(sessionID, next);
+                next = this.rerun.get(key);
+                this.rerun.delete(key);
+            }
+        } finally {
+            this.running.delete(key);
+        }
+    }
+
+    /** One claim + assembly. Logs every failure with the session id; never throws. */
+    private async runOnce(sessionID: string, forcePartial: boolean): Promise<void> {
+        const options = this._options;
+        if (!options) {
+            LogStatus(`RecordingAssemblyScheduler: shut down before session ${sessionID} could assemble; the session janitor will assemble it`);
+            return;
+        }
+        try {
+            const ledger = options.CreateLedger(options.Provider, options.SystemUser);
+            const version = await ledger.ClaimAssembly(sessionID, null);
+            if (version === null) {
+                LogStatus(`RecordingAssemblyScheduler: session ${sessionID} not claimable (assembled, assembling elsewhere, or failed); skipping`);
+                return;
+            }
+            const outcome = await options.Assemble({
+                SessionID: sessionID, Version: version, Ledger: ledger,
+                ContextUser: options.SystemUser, Provider: options.Provider, ForcePartial: forcePartial,
+            });
+            this.handleOutcome(sessionID, version, outcome, options);
+        } catch (error) {
+            LogError(`RecordingAssemblyScheduler: assembly of session ${sessionID} failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+
+    private handleOutcome(
+        sessionID: string,
+        version: number,
+        outcome: AssembleRealtimeRecordingOutcome,
+        options: Required<RecordingAssemblySchedulerOptions>,
+    ): void {
+        if (outcome === 'Deferred') {
+            // Incomplete and not forced: give missing shards the grace period, then assemble what exists.
+            LogStatus(`RecordingAssemblyScheduler: session ${sessionID} (version ${version}) is missing shards; assembling as Partial after the grace period`);
+            this.ScheduleAssembly(sessionID, options.GraceMs(), true);
+            return;
+        }
+        if (outcome === 'Retry') {
+            LogError(`RecordingAssemblyScheduler: assembly of session ${sessionID} (version ${version}) hit a transient error; the session janitor re-claims it later`);
+            return;
+        }
+        LogStatus(`RecordingAssemblyScheduler: session ${sessionID} (version ${version}) assembly finished: ${outcome}`);
+    }
+}

package/src/realtimeSessions/index.ts

@@ -14,3 +14,5 @@ export * from './sessionConfigStamps.js';
 export * from './SessionVerificationPortsBase.js';
 export * from './RealtimeSessionVerificationService.js';
 export * from './RealtimeVerifyRouter.js';
+export * from './ownedRealtimeSession.js';
+export * from './RecordingAssemblyScheduler.js';

package/src/realtimeSessions/ownedRealtimeSession.ts

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview The ownership gate for client-direct realtime session writes: the GraphQL mutations of
+ * `RealtimeClientSessionResolver` and the recording REST routes both load the session through
+ * {@link LoadOwnedRealtimeSession}, so "may this caller write to this session?" is decided in one place.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { IMetadataProvider, LogError, UserInfo } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import type { MJAIAgentSessionEntity } from '@memberjunction/core-entities';
+
+const SESSION_ENTITY = 'MJ: AI Agent Sessions';
+
+/** The session does not exist, or the caller cannot read it. */
+export class RealtimeSessionNotFoundError extends Error {
+    constructor(public readonly AgentSessionID: string) {
+        super(`Realtime session ${AgentSessionID} not found`);
+        this.name = 'RealtimeSessionNotFoundError';
+    }
+}
+
+/** The session exists but belongs to another user. */
+export class RealtimeSessionOwnershipError extends Error {
+    constructor(public readonly AgentSessionID: string) {
+        super('Not authorized: you do not own this realtime session');
+        this.name = 'RealtimeSessionOwnershipError';
+    }
+}
+
+/**
+ * Loads a session under the caller's identity and enforces ownership (`UserID === contextUser.ID`). It
+ * deliberately does NOT reject `Closed` sessions: the final channel-state flush and the recording terminal
+ * signal legitimately arrive after the session closed. A scoped-anonymous widget guest owns the session it
+ * minted, so the same check covers it; loading as the caller also applies the entity's row-level security.
+ *
+ * @throws RealtimeSessionNotFoundError when the row does not load
+ * @throws RealtimeSessionOwnershipError when the caller is not the owner (logged with both user ids)
+ */
+export async function LoadOwnedRealtimeSession(
+    agentSessionId: string,
+    contextUser: UserInfo,
+    provider: IMetadataProvider,
+): Promise<MJAIAgentSessionEntity> {
+    const session = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
+    if (!(await session.Load(agentSessionId))) {
+        throw new RealtimeSessionNotFoundError(agentSessionId);
+    }
+    if (!UUIDsEqual(session.UserID, contextUser.ID)) {
+        LogError(
+            `LoadOwnedRealtimeSession: ownership check failed — user ${contextUser.ID} attempted to operate on session ${agentSessionId} owned by ${session.UserID}`,
+        );
+        throw new RealtimeSessionOwnershipError(agentSessionId);
+    }
+    return session;
+}

package/src/realtimeSessions/sessionAccess.ts

@@ -115,11 +115,15 @@ export async function LoadSessionForAccess(
     if (!(await session.Load(agentSessionId))) {
         return null;
     }
-    return { Session: session, ConversationExternalID: await loadConversationExternalID(session, contextUser, provider) };
+    return { Session: session, ConversationExternalID: await LoadSessionConversationExternalID(session, contextUser, provider) };
 }
 
-/** Reads the session conversation's `ExternalID`; null when there is no conversation or it cannot be read. */
-async function loadConversationExternalID(
+/**
+ * Reads an already-loaded session's conversation `ExternalID` (the anonymous scope id) under `contextUser`;
+ * null when there is no conversation or it cannot be read (logged). For callers that loaded the session
+ * through another gate and only need the scope half of {@link AuthorizeSessionAccess}'s subject.
+ */
+export async function LoadSessionConversationExternalID(
     session: MJAIAgentSessionEntity,
     contextUser: UserInfo,
     provider: IMetadataProvider,

package/src/resolvers/ArtifactFileResolver.ts

@@ -46,7 +46,11 @@ export class ArtifactFileResolver extends ResolverBase {
         return this.buildDownloadUrl(artifactVersion.FileID, user, p);
     }
 
-    /** Load the File + its storage account/provider and generate a signed URL. */
+    /**
+     * Load the File (as the caller) and generate a signed URL — after the storage gate: the caller must be able to read
+     * the account the file's provider resolves to and every `MJ: Files` row that tracks its object
+     * (`FileStorageEngine.ResolveFileObject`), so an artifact cannot sign an object in an account the caller is refused.
+     */
     private async buildDownloadUrl(
         fileId: string,
         user: ReturnType<ResolverBase['GetUserFromPayload']>,
@@ -58,14 +62,11 @@ export class ArtifactFileResolver extends ResolverBase {
             throw new Error(`File record ${fileId} not found`);
         }
 
-        // Find the storage account for this file's provider using cached metadata
-        await FileStorageEngine.Instance.Config(false, user!);
-        const matchingAccounts = FileStorageEngine.Instance.GetAccountsByProviderID(fileEntity.ProviderID);
-        if (matchingAccounts.length === 0) {
+        // Resolve the storage account for this file's provider, gated for the caller (throws on refusal)
+        const resolved = await FileStorageEngine.Instance.ResolveFileObject(fileEntity, user!, 'Read', provider);
+        if (!resolved) {
             throw new Error(`No FileStorageAccount found for ProviderID ${fileEntity.ProviderID}. Cannot generate download URL.`);
         }
-
-        const driver = await FileStorageEngine.Instance.GetDriver(matchingAccounts[0].ID, user!);
-        return driver.CreatePreAuthDownloadUrl(fileEntity.ProviderKey ?? fileEntity.Name);
+        return resolved.Driver.CreatePreAuthDownloadUrl(resolved.ObjectKey);
     }
 }

package/src/resolvers/ConversationRunEventsResolver.ts

@@ -7,7 +7,7 @@ import type { AppContext } from '../types.js';
 import { GetReadOnlyProvider } from '../util.js';
 
 /** The run columns the tail reads. */
-type TailRunRow = Pick<MJAIAgentRunEntity, 'ID' | 'Status' | 'Result'>;
+type TailRunRow = Pick<MJAIAgentRunEntity, 'ID' | 'Status' | 'FinalPayload' | 'Result'>;
 
 /** The step columns an event carries. The large data columns are never read. */
 type TailStepRow = Pick<
@@ -15,7 +15,7 @@ type TailStepRow = Pick<
     'StepNumber' | 'StepType' | 'StepName' | 'Status' | 'Success' | 'ErrorMessage' | 'StartedAt' | 'CompletedAt'
 >;
 
-const RUN_FIELDS: (keyof TailRunRow)[] = ['ID', 'Status', 'Result'];
+const RUN_FIELDS: (keyof TailRunRow)[] = ['ID', 'Status', 'FinalPayload', 'Result'];
 const STEP_FIELDS: (keyof TailStepRow)[] = [
     'StepNumber', 'StepType', 'StepName', 'Status', 'Success', 'ErrorMessage', 'StartedAt', 'CompletedAt',
 ];
@@ -94,10 +94,14 @@ export class ConversationRunEventsOutput {
     /**
      * The run's answer, returned only once the run is terminal.
      *
-     * Sourced from `AIAgentRun.Result`, falling back to the conversation detail's message because
-     * `Result` is agent-dependent and null on many successful runs. Still nullable: a caller must
-     * decide a message is finished from {@link IsInFlight} / {@link DetailStatus}, never from the
-     * presence of this field, or it will wait forever on an agent that writes neither.
+     * Sourced from `AIAgentRun.FinalPayload` (`Result` on older rows), then the conversation detail's
+     * message, because the run payload is agent-dependent and null on many successful runs. Still
+     * nullable: a caller must decide a message is finished from {@link IsInFlight} /
+     * {@link DetailStatus}, never from the presence of this field, or it will wait forever on an
+     * agent that writes neither.
+     *
+     * A run that ended without completing (for example `Cancelled`) returns whatever `FinalPayload`
+     * it had saved, which can be partial, so a caller should check {@link RunStatus} first.
      */
     @Field(() => String, { nullable: true })
     FinalPayload?: string;
@@ -206,11 +210,11 @@ export class ConversationRunEventsResolver {
                 // Only meaningful once terminal; sending it mid-run would hand the client a
                 // partial payload it could mistake for the final answer.
                 //
-                // `AIAgentRun.Result` is agent-dependent — it is null on a large share of
-                // genuinely successful runs — so the conversation detail's own message is the
-                // fallback. That is the text the chat renders, so it is the answer a caller
-                // waiting on this field actually wants.
-                FinalPayload: isInFlight ? undefined : (run.Result ?? detail.Message ?? undefined),
+                // `AIAgentRun.FinalPayload` (`Result` on older rows) is agent-dependent — it is
+                // null on a large share of genuinely successful runs — so the conversation detail's
+                // own message is the fallback. That is the text the chat renders, so it is the
+                // answer a caller waiting on this field actually wants.
+                FinalPayload: isInFlight ? undefined : (run.FinalPayload ?? run.Result ?? detail.Message ?? undefined),
                 DetailStatus: detail.Status ?? undefined,
             };
         } catch (e) {

package/src/resolvers/DatasetResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
-import { AppContext } from '../types.js';
-import { LogError, Metadata } from '@memberjunction/core';
+import { AppContext, UserPayload } from '../types.js';
+import { DatabaseProviderBase, DatasetItemFilterType, DatasetItemResultType, LogError, Metadata, UserInfo } from '@memberjunction/core';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
@@ -34,9 +34,64 @@ export class DatasetItemFilterTypeGQL {
   Filter: string;
 }
 
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export abstract class DatasetResolverBase extends ResolverBase {
+  /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+  protected RequireDatasetUser(userPayload: UserPayload): UserInfo {
+    const user = this.GetUserFromPayload(userPayload);
+    if (!user) {
+      throw new Error('Dataset request refused: the session resolves to no user');
+    }
+    return user;
+  }
+
+  /**
+   * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+   * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+   */
+  protected ScreenItemFilters(
+    itemFilters: DatasetItemFilterTypeGQL[] | undefined,
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): DatasetItemFilterType[] | undefined {
+    if (!itemFilters) return undefined;
+    itemFilters.forEach((itemFilter, index) => {
+      if (itemFilter) {
+        this.assertClientClauseUsesEntityBaseViews(itemFilter.Filter, `ItemFilters[${index}].Filter`, provider, user);
+      }
+    });
+    return itemFilters.filter((itemFilter) => itemFilter != null);
+  }
+
+  /**
+   * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+   * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+   * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+   */
+  protected async ProtectEncryptedFields(
+    items: DatasetItemResultType[],
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): Promise<DatasetItemResultType[]> {
+    return Promise.all(
+      items.map(async (item) => {
+        const entity = provider.EntityByName(item.EntityName);
+        if (!item.Results?.length || !entity?.EncryptedFields.some((field) => !field.AllowDecryptInAPI)) {
+          return item;
+        }
+        const rows = item.Results.map((row: Record<string, unknown>) => ({ ...row }));
+        return { ...item, Results: await this.ArrayFilterEncryptedFieldsForAPI(item.EntityName, rows, user, provider, 'Name') };
+      }),
+    );
+  }
+}
 
 @Resolver(DatasetResultType)
-export class DatasetResolverExtended extends ResolverBase {
+export class DatasetResolverExtended extends DatasetResolverBase {
   @Query(() => DatasetResultType)
   async GetDatasetByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -45,10 +100,12 @@ export class DatasetResolverExtended extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -56,7 +113,7 @@ export class DatasetResolverExtended extends ResolverBase {
           Success: result.Success,
           Status: result.Status,
           LatestUpdateDate: result.LatestUpdateDate,
-          Results: JSON.stringify(result.Results),
+          Results: JSON.stringify(await this.ProtectEncryptedFields(result.Results, md, user)),
         };
       } else {
         throw new Error('Error retrieving Dataset: ' + DatasetName);
@@ -90,7 +147,7 @@ export class DatasetStatusResultType {
 }
 
 @Resolver(DatasetStatusResultType)
-export class DatasetStatusResolver extends ResolverBase {
+export class DatasetStatusResolver extends DatasetResolverBase {
   @Query(() => DatasetStatusResultType)
   async GetDatasetStatusByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -99,10 +156,12 @@ export class DatasetStatusResolver extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetStatusByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetStatusByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -131,12 +190,13 @@ export class DatasetStatusResolver extends ResolverBase {
     @Ctx() { providers, userPayload }: AppContext,
   ): Promise<DatasetStatusResultType[]> {
     const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
     const results: DatasetStatusResultType[] = [];
 
     // Execute all status checks in parallel
     const statusPromises = DatasetNames.map(async (name) => {
       await this.CheckAPIKeyScopeAuthorization('dataset:read', name, userPayload);
-      return md.GetDatasetStatusByName(name);
+      return md.GetDatasetStatusByName(name, undefined, user);
     });
 
     const statuses = await Promise.all(statusPromises);

package/src/resolvers/EntityRecordNameResolver.ts

@@ -38,7 +38,8 @@ export class EntityRecordNameResult {
  *
  * Entity-level read permission is checked here ({@link ResolverBase.CheckUserReadPermissions}).
  * Field- and row-level security are applied by the provider's lookup, for the acting user passed
- * to it: when any field the name is built from is withheld, it answers with no name.
+ * to it: when any field the name is built from is withheld, it answers with no name, and it reads
+ * only rows the user's read row filter allows. Without an acting user there is no lookup.
  *
  * A withheld name answers `Success: false` with the same status as a record that does not exist.
  * Callers already treat "no name" as "show the primary key", and the identical answer keeps this
@@ -85,7 +86,7 @@ export class EntityRecordNameResolver extends ResolverBase {
     if (e) {
       const contextUser = userPayload ? this.GetUserFromPayload(userPayload) : undefined;
       // The acting user is what field- and row-level security are applied for.
-      const recordName = await md.GetEntityRecordName(e.Name, pk, contextUser);
+      const recordName = contextUser ? await md.GetEntityRecordName(e.Name, pk, contextUser) : '';
       if (recordName) return { Success: true, Status: 'OK', CompositeKey: pk, RecordName: recordName, EntityName };
       else
         return {