@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.5

package/src/resolvers/GetDataContextDataResolver.ts

@@ -1,9 +1,13 @@
 import { Arg, Ctx, Field, ObjectType, Query, Resolver } from "type-graphql";
+import type { DatabaseProviderBase, UserInfo } from "@memberjunction/core";
+import { IsValidUUID, UUIDsEqual } from "@memberjunction/global";
+import { DataContext, DataContextItem } from "@memberjunction/data-context";
+import { MJDataContextEntity, MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { RenderPipeline } from "@memberjunction/generic-database-provider";
 import { AppContext } from "../types.js";
-import { DataContext } from "@memberjunction/data-context";
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from "../util.js";
-import { MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { GetReadOnlyProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
 
 @ObjectType()
 export class GetDataContextItemDataOutputType {
@@ -39,6 +43,28 @@ export class GetDataContextDataOutputType {
 }
 
 
+/** The outcome of loading one data context item: its data as JSON, or why it has none. */
+interface ItemOutcome {
+    Result: string | null;
+    Error: string | null;
+}
+
+/** Which `sql` items of a data context may run: the read-only provider, and each refused item's reason. */
+interface SQLItemGate {
+    Provider: DatabaseProviderBase | null;
+    Refusals: Map<DataContextItem, string>;
+}
+
+/**
+ * Loads the data of data contexts and their items.
+ *
+ * Items of type `sql` hold raw SQL, which is held to the rules ExecuteAdhocQuery applies to
+ * caller-supplied SQL. It runs only for the data context's owner or an administrator (Owner-type
+ * user), never for a scope-limited session, only on the read-only provider, and only as a single read
+ * statement over entity base views the caller may read in full. A SQL item that may not run is
+ * refused on its own, and the other items still load. Items of the other types load through entity
+ * permissions for the calling user.
+ */
 @Resolver()
 export class GetDataContextDataResolver extends ResolverBase {
     /**
@@ -52,30 +78,25 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextItemID, appCtx.userPayload);
+        if (!IsValidUUID(DataContextItemID)) {
+            return { Success: false, ErrorMessage: 'DataContextItemID must be a UUID', Result: null };
+        }
 
         try {
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
+            const user: UserInfo = appCtx.userPayload.userRecord;
             const md = GetReadOnlyProvider(appCtx.providers, {allowFallbackToReadWrite: true});
-            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", appCtx.userPayload.userRecord);
+            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", user);
             if (await dciData.Load(DataContextItemID)) {
                 const dci = DataContext.CreateDataContextItem(); // use class factory to get whatever lowest level sub-class is registered
-                await dci.LoadMetadataFromEntityRecord(dciData, md, appCtx.userPayload.userRecord);
+                await dci.LoadMetadataFromEntityRecord(dciData, md, user);
+                const ownerID = dci.Type === 'sql' ? await this.loadDataContextOwnerID(dciData.DataContextID, md, user) : null;
+                const gate = this.authorizeSQLItems([dci], ownerID, appCtx);
                 // now the metadata is loaded so we can call the regular load function
-                if (await dci.LoadData(ds)) {
-                    return {
-                        Success: true,
-                        ErrorMessage: null,
-                        Result: JSON.stringify(dci.Data),
-                    }
-                }
-                else {
-                    return {
-                        Success: false,
-                        ErrorMessage: 'Error loading data context item data',
-                        Result: null,
-                    }
+                const outcome = await this.loadItem(dci, gate, user, false);
+                return {
+                    Success: outcome.Error === null,
+                    ErrorMessage: outcome.Error,
+                    Result: outcome.Result,
                 }
             }
             else {
@@ -89,14 +110,15 @@ export class GetDataContextDataResolver extends ResolverBase {
         catch (e) {
             return {
                 Success: false,
-                ErrorMessage: e,
+                ErrorMessage: e instanceof Error ? e.message : String(e),
                 Result: null,
             }
         }
     }
 
     /**
-     * Returns data for a given data context.
+     * Returns data for a given data context. `Results` and `ErrorMessages` hold one entry per item, in
+     * item order. `Success` is true, and `ErrorMessages` null, only when every item loaded.
      * @param DataContextID
      */
     @Query(() => GetDataContextDataOutputType)
@@ -106,38 +128,114 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextID, appCtx.userPayload);
+        // DataContext.LoadMetadata places this ID in the item filter, so it must be a plain UUID.
+        if (!IsValidUUID(DataContextID)) {
+            return { Success: false, ErrorMessages: ['DataContextID must be a UUID'], Results: null };
+        }
 
         try {
             // our job here is to load the entire data context, so we do that with the Data Context object
+            const user: UserInfo = appCtx.userPayload.userRecord;
+            const md = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: true });
             const dc = new DataContext();
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
-            const success = await dc.Load(DataContextID, ds, true, false, 0, appCtx.userPayload.userRecord);
-            if (success) {
-                const retVal =   {
-                    Success: true,
-                    ErrorMessages: null,
-                    Results: dc.Items.map((item) => {
-                        return JSON.stringify(item.Data);
-                    }),
-                }
-                return retVal;
-            }
-            else {
+            if (!(await dc.LoadMetadata(DataContextID, user, md))) {
                 return {
                     Success: false,
                     ErrorMessages: ['Error loading data context'],
-                    Results: null,    
+                    Results: null,
                 }
             }
+            const gate = this.authorizeSQLItems(dc.Items, dc.MJDataContextEntity.UserID, appCtx);
+            const outcomes = await Promise.all(dc.Items.map((item) => this.loadItem(item, gate, user, true)));
+            const allLoaded = outcomes.every((outcome) => outcome.Error === null);
+            return {
+                Success: allLoaded,
+                ErrorMessages: allLoaded ? null : outcomes.map((outcome) => outcome.Error),
+                Results: outcomes.map((outcome) => outcome.Result),
+            }
         }
         catch (e) {
             return {
                 Success: false,
-                ErrorMessages: [e],
+                ErrorMessages: [e instanceof Error ? e.message : String(e)],
                 Results: null,
             }
         }
     }
-}
+
+    /**
+     * Decides which `sql` items among `items` may run. Returns the read-only provider they run on, and
+     * the reason for each SQL item that may not run.
+     */
+    private authorizeSQLItems(items: DataContextItem[], ownerID: string | null, appCtx: AppContext): SQLItemGate {
+        const refusals = new Map<DataContextItem, string>();
+        const sqlItems = items.filter((item) => item.Type === 'sql');
+        if (sqlItems.length === 0) {
+            return { Provider: null, Refusals: refusals };
+        }
+        const user: UserInfo | undefined = appCtx.userPayload?.userRecord;
+        const provider = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: false });
+        for (const item of sqlItems) {
+            const refusal = this.sqlItemRefusal(item, ownerID, user, provider);
+            if (refusal !== null) {
+                refusals.set(item, refusal);
+            }
+        }
+        return { Provider: provider, Refusals: refusals };
+    }
+
+    /** Returns why `item` may not run for `user`, or null when it may. */
+    private sqlItemRefusal(item: DataContextItem, ownerID: string | null, user: UserInfo | undefined, provider: DatabaseProviderBase | null): string | null {
+        if (!user || IsScopeLimitedPrincipal(user)) {
+            return 'SQL data context items cannot be run by a scope-limited or unidentified session.';
+        }
+        if (!this.mayRunDataContextSQL(ownerID, user)) {
+            return 'Only the owner of this data context, or an administrator, may run its SQL items.';
+        }
+        if (!provider) {
+            return 'No read-only data source is configured, so SQL data context items cannot run.';
+        }
+        return this.screenItemSQL(item.SQL ?? '', provider, user);
+    }
+
+    /** True when `user` owns the data context or is an administrator (Owner-type user). */
+    private mayRunDataContextSQL(ownerID: string | null, user: UserInfo): boolean {
+        const isOwner = !!ownerID && UUIDsEqual(ownerID, user.ID);
+        return isOwner || user.Type?.trim().toLowerCase() === 'owner';
+    }
+
+    /**
+     * Returns why `sqlText` may not run, or null when it is a single read statement whose every table
+     * reference is an entity base view `user` may read without row-level or field-level narrowing. It is
+     * the check ExecuteAdhocQuery makes on the rendered SQL.
+     */
+    private screenItemSQL(sqlText: string, provider: DatabaseProviderBase, user: UserInfo): string | null {
+        try {
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: user, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, user, 'data context SQL');
+            return null;
+        }
+        catch (e) {
+            const reason = e instanceof Error ? e.message : String(e);
+            return reason || 'The SQL of this item did not pass the read-only check.';
+        }
+    }
+
+    /** Loads one item's data unless `gate` refused it. Returns the data as JSON, or why there is none. */
+    private async loadItem(item: DataContextItem, gate: SQLItemGate, user: UserInfo, forceRefresh: boolean): Promise<ItemOutcome> {
+        const refusal = gate.Refusals.get(item);
+        if (refusal !== undefined) {
+            return { Result: null, Error: refusal };
+        }
+        if (await item.LoadData(gate.Provider, forceRefresh, false, 0, user)) {
+            return { Result: JSON.stringify(item.Data), Error: null };
+        }
+        return { Result: null, Error: item.DataLoadingError || 'Error loading data context item data' };
+    }
+
+    /** Returns the owner (`UserID`) of a data context, or null when the caller cannot load it. */
+    private async loadDataContextOwnerID(dataContextID: string, provider: DatabaseProviderBase, user: UserInfo): Promise<string | null> {
+        const dataContext = await provider.GetEntityObject<MJDataContextEntity>('MJ: Data Contexts', user);
+        return (await dataContext.Load(dataContextID)) ? dataContext.UserID : null;
+    }
+}

package/src/resolvers/GetDataResolver.ts

@@ -158,14 +158,17 @@ export class GetDataResolver {
                         // Defense-in-depth: even system-token holders get SELECT-only SQL here.
                         // The read-only pool is the primary control, but if it is ever
                         // misconfigured to a read-write login this validator still refuses DML/DDL
-                        // (mirrors AdhocQueryResolver).
-                        const validation = SQLExpressionValidator.Instance.validateFullQuery(resolvedSQL);
+                        // (mirrors AdhocQueryResolver). The validator reads exactly the text that
+                        // runs: it is trimmed here as validate() trims it, and literal \n sequences
+                        // are not rewritten as ValidateFullQuery would.
+                        const sqlToRun = resolvedSQL.trim();
+                        const validation = SQLExpressionValidator.Instance.validate(sqlToRun, { context: 'full_query', Dialect: platform });
                         if (!validation.valid) {
                             return { result: null, error: validation.error || 'SQL validation failed' };
                         }
 
                         const request = new sql.Request(readOnlyDataSource);
-                        const result = await request.query(resolvedSQL);
+                        const result = await request.query(sqlToRun);
                         return { result: result.recordset, error: null };
                     } catch (err) {
                         // Extract clean SQL error message

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -3,7 +3,7 @@ import { CompositeKey, DatabaseProviderBase, EntityInfo, LocalCacheManager, Meta
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { NoLog } from "../logging/NoLog.js";
 import { UUIDsEqual } from "@memberjunction/global";
-import { DrainResponseBody } from "@memberjunction/network-utils";
+import { DrainResponseBody, SafeFetch } from "@memberjunction/network-utils";
 import { CronExpressionHelper } from "@memberjunction/scheduling-engine";
 import {
     MJCompanyIntegrationEntity,
@@ -6467,7 +6467,9 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
 
     private async sendWebhook(url: string, payload: Record<string, unknown>): Promise<void> {
         try {
-            const response = await fetch(url, {
+            // SECURITY: the webhook URL is caller-supplied, so go through the SSRF guard —
+            // SafeFetch validates the URL (and every redirect hop) resolves to a public address.
+            const response = await SafeFetch(url, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify(payload)

package/src/resolvers/QueryResolver.ts

@@ -101,6 +101,12 @@ export class RunQueryCacheStatusInput {
 
   @Field(() => Int, { description: 'The number of rows in cached results' })
   rowCount: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+
+  @Field(() => String, {
+    nullable: true,
+    description: "The query definition hash the cached results were written under, as this server returned it. When it differs from the server's, the result is 'stale' with fresh rows. Empty string for a slot with no hash; omit to skip the definition check."
+  })
+  definitionHash?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name, matching its siblings
 }
 
 @InputType()
@@ -140,6 +146,9 @@ export class RunQueryWithCacheCheckResultOutput {
 
   @Field(() => String, { nullable: true, description: 'Error message if status is error' })
   errorMessage?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+
+  @Field(() => String, { nullable: true, description: "The server's definition hash for the query; store it with the cached results and send it back in cacheStatus.definitionHash" })
+  definitionHash?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name, matching its siblings
 }
 
 @ObjectType()
@@ -558,6 +567,7 @@ export class RunQueryResolver extends ResolverBase {
         cacheStatus: item.cacheStatus ? {
           maxUpdatedAt: item.cacheStatus.maxUpdatedAt,
           rowCount: item.cacheStatus.rowCount,
+          definitionHash: item.cacheStatus.definitionHash ?? undefined,
         } : undefined,
       }));
 
@@ -572,6 +582,7 @@ export class RunQueryResolver extends ResolverBase {
         maxUpdatedAt: result.maxUpdatedAt,
         rowCount: result.rowCount,
         errorMessage: result.errorMessage,
+        definitionHash: result.definitionHash,
       }));
 
       return {

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -87,6 +87,7 @@ import { ResolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser, ResolveRec
 import { RunWithTrustedSessionConfigWrites } from '@memberjunction/core-entities-server';
 import { BuildMintConfigStamps, LoadInheritedVerifiedIdentity } from '../realtimeSessions/sessionConfigStamps.js';
 import { ParseConfigObject } from '../realtimeSessions/verificationCore.js';
+import { LoadOwnedRealtimeSession } from '../realtimeSessions/ownedRealtimeSession.js';
 
 /**
  * Progress steps worth narrating to the realtime model — mirrors the normal agent-run path's filter
@@ -415,7 +416,7 @@ export class CancelRealtimeSessionToolResult {
  * Result of {@link RealtimeClientSessionResolver.UploadRealtimeRecording} — a structured
  * success/failure envelope. A recording-storage failure must never throw to the browser (the
  * session it belongs to has already ended), so problems come back as `Success: false` with a
- * human-readable reason; only ownership/authn violations (from `loadOwnedSession`) still throw.
+ * human-readable reason; only ownership/authn violations (from `LoadOwnedRealtimeSession`) still throw.
  */
 @ObjectType()
 export class UploadRealtimeRecordingResult {
@@ -944,7 +945,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      * the call and uploads the assembled blob (base64) once the session ends.
      *
      * Hard gates (in order):
-     * 1. Ownership — `loadOwnedSession` enforces `UserID === contextUser.ID` (throws on violation).
+     * 1. Ownership — `LoadOwnedRealtimeSession` enforces `UserID === contextUser.ID` (throws on violation).
      * 2. Consent — `consent !== true` is a hard refusal: no audio is ever stored without it.
      * 3. Storage configuration — the session's agent must resolve a recording storage account (the
      *    agent's `RecordingStorageProviderID`, else `AttachmentStorageProviderID`).
@@ -973,7 +974,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('peaks', () => [Float], { nullable: true }) peaks?: number[],
     ): Promise<UploadRealtimeRecordingResult> {
         const { contextUser, provider } = this.requireUserAndProvider(ctx.userPayload, ctx.providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         // HARD consent gate — no audio is ever stored without an explicit grant.
         if (consent !== true) {
@@ -1060,7 +1061,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     ): Promise<boolean> {
         try {
             const { contextUser, provider } = this.requireUserAndProvider(ctx.userPayload, ctx.providers);
-            const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+            const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
             // The consolidated recording already landed and its upload deleted the shards; a shard
             // arriving now (one still on the wire at hang-up) would be an orphan nothing deletes.
             if (session.RecordingFileID) {
@@ -1183,7 +1184,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('callId', () => String, { nullable: true }) callId?: string,
     ): Promise<CancelRealtimeSessionToolResult> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
         try {
             const aborted = this.clientSessionService.CancelInFlightDelegations(agentSessionId, callId);
             return { AbortedCount: aborted, Success: true };
@@ -1230,7 +1231,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('usageDetailsJson', () => String, { nullable: true }) usageDetailsJson?: string,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         const inputDelta = this.clampTokenDelta(inputTokens);
         const outputDelta = this.clampTokenDelta(outputTokens);
@@ -1358,7 +1359,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         if (!this.isChannelInSessionScope(session, channelName)) {
             LogError(`SaveSessionChannelState: channel '${channelName}' is not in session ${agentSessionId}'s resolved scope — state not saved.`);
@@ -1441,7 +1442,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<SaveSessionChannelArtifactResult> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         if (!this.isChannelInSessionScope(session, channelName)) {
             const message = `SaveSessionChannelArtifact: channel '${channelName}' is not in session ${agentSessionId}'s resolved scope — nothing saved.`;
@@ -1954,37 +1955,13 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<MJAIAgentSessionEntity> {
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
         if (session.Status === 'Closed') {
             throw new Error(`Realtime session ${agentSessionId} is closed`);
         }
         return session;
     }
 
-    /**
-     * Loads a session and enforces inbound ownership (`UserID === contextUser.ID`) WITHOUT
-     * rejecting `Closed` sessions — {@link SaveSessionChannelState}'s final on-end flush
-     * legitimately arrives after the session closed. Throws when not found / not owned.
-     */
-    private async loadOwnedSession(
-        agentSessionId: string,
-        contextUser: UserInfo,
-        provider: IMetadataProvider,
-    ): Promise<MJAIAgentSessionEntity> {
-        const session = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
-        const loaded = await session.Load(agentSessionId);
-        if (!loaded) {
-            throw new Error(`Realtime session ${agentSessionId} not found`);
-        }
-        if (!UUIDsEqual(session.UserID, contextUser.ID)) {
-            LogError(
-                `RealtimeClientSessionResolver: ownership check failed — user ${contextUser.ID} attempted to operate on session ${agentSessionId} owned by ${session.UserID}`,
-            );
-            throw new Error('Not authorized: you do not own this realtime session');
-        }
-        return session;
-    }
-
     /**
      * Resolves an ACTIVE channel definition (`MJ: AI Agent Channels`) by name from
      * {@link AIEngineBase}'s cached `AgentChannels` (provider-scoped engine instance, lazy

package/src/resolvers/RunAIAgentResolver.ts

@@ -13,6 +13,7 @@ import { StartLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { GetReadWriteProvider } from '../util.js';
 import { ResolveWidgetGuestRunContext, ElevateUserPayload } from '../realtimeWidget/widgetGuestElevation.js';
+import { IsTrustedAgentRunCaller } from './agent-run-data-guard.js';
 import { SafeJSONParse, UUIDsEqual } from '@memberjunction/global';
 import { GetAttachmentService } from '@memberjunction/aiengine';
 import { NotificationEngine } from '@memberjunction/notifications';
@@ -252,6 +253,14 @@ export class RunAIAgentResolver extends ResolverBase {
             throw new Error(`AI Agent "${agentEntity.Name}" is not active (Status: ${agentEntity.Status})`);
         }
 
+        // Enforce agent run permissions for the calling user
+        if (currentUser && typeof AIEngine.Instance.CanUserRunAgent === 'function') {
+            const canRun = await AIEngine.Instance.CanUserRunAgent(agentEntity.ID, currentUser);
+            if (!canRun) {
+                throw new Error(`User does not have permission to run AI Agent "${agentEntity.Name}" (${agentEntity.ID})`);
+            }
+        }
+
         return agentEntity;
     }
 
@@ -294,6 +303,8 @@ export class RunAIAgentResolver extends ResolverBase {
         /** History floor for a conversation run — threaded into ExecuteAgentParams.ConversationHistoryFrom,
          *  so the framework's own conversation reads (retrieval tools, artifacts, compaction) honour it too. */
         conversationHistoryFrom?: Date,
+        /** ExecuteAgentParams.TrustReservedRunData: true only for a caller IsTrustedAgentRunCaller accepts. */
+        trustReservedRunData: boolean = false,
         /** The conversation branch of the run — threaded into ExecuteAgentParams.ConversationBranchID. */
         conversationBranchId?: string | null
     ): Promise<AIAgentRunResult> {
@@ -366,6 +377,8 @@ export class RunAIAgentResolver extends ResolverBase {
                 ConversationHistoryFrom: conversationHistoryFrom,
                 ...(conversationBranchId ? { ConversationBranchID: conversationBranchId } : {}),
                 data: parsedData,
+                // Whether the run may read the reserved data keys (scope, agent-type params); BaseAgent drops them otherwise.
+                TrustReservedRunData: trustReservedRunData,
                 context: {
                     dataSource: dataSource
                 }
@@ -564,6 +577,9 @@ export class RunAIAgentResolver extends ResolverBase {
         await this.CheckAPIKeyScopeAuthorization('agent:execute', agentId, userPayload);
 
         const p = GetReadWriteProvider(providers);
+        // Only the system user or an API key holding the agent:trusted scope may set a run's scope and agent-type
+        // params through data; for anyone else BaseAgent drops those keys (ExecuteAgentParams.TrustReservedRunData).
+        const trustRunData = await IsTrustedAgentRunCaller({ UserPayload: userPayload, IsWidgetGuestRun: false, AgentID: agentId });
 
         if (fireAndForget) {
             // Fire-and-forget mode: start execution in background, return immediately.
@@ -572,7 +588,8 @@ export class RunAIAgentResolver extends ResolverBase {
                 p, dataSource, agentId, userPayload, messagesJson, sessionId, pubSub,
                 data, payload, lastRunId, autoPopulateLastRunPayload, configurationId,
                 conversationDetailId, createArtifacts || false, createNotification || false,
-                sourceArtifactId, sourceArtifactVersionId, undefined /*conversationId*/, planMode, requestedSkillIDs, taskGraphDebug
+                sourceArtifactId, sourceArtifactVersionId, undefined /*conversationId*/, planMode, requestedSkillIDs, taskGraphDebug,
+                undefined /*conversationHistoryFrom*/, trustRunData
             );
 
             LogStatus(`🔥 Fire-and-forget: Agent ${agentId} execution started in background for session ${sessionId}`);
@@ -607,7 +624,9 @@ export class RunAIAgentResolver extends ResolverBase {
             undefined, // runRef
             planMode,
             requestedSkillIDs,
-            taskGraphDebug
+            taskGraphDebug,
+            undefined, // conversationHistoryFrom
+            trustRunData
         );
     }
 
@@ -640,6 +659,9 @@ export class RunAIAgentResolver extends ResolverBase {
         @Arg('requestedSkillIDs', () => [String], { nullable: true }) requestedSkillIDs?: string[]
     ): Promise<AIAgentRunResult> {
         const p = GetReadWriteProvider(providers);
+        // @RequireSystemUser admits only the system user, whom the rule trusts; it is still asked, so every
+        // resolver entry that takes a client's data decides the same way.
+        const trustRunData = await IsTrustedAgentRunCaller({ UserPayload: userPayload, IsWidgetGuestRun: false, AgentID: agentId });
         return this.executeAIAgent(
             p,
             dataSource,
@@ -662,7 +684,10 @@ export class RunAIAgentResolver extends ResolverBase {
             undefined, // conversationId (not pre-resolved on this path)
             undefined, // runRef
             planMode,
-            requestedSkillIDs
+            requestedSkillIDs,
+            undefined, // taskGraphDebug
+            undefined, // conversationHistoryFrom
+            trustRunData
         );
     }
 
@@ -958,6 +983,12 @@ export class RunAIAgentResolver extends ResolverBase {
         const widgetElevation = await ResolveWidgetGuestRunContext(userPayload, p);
         const effectiveAgentId = widgetElevation ? widgetElevation.PinnedAgentId : agentId;
         const effectiveUserPayload = widgetElevation ? ElevateUserPayload(userPayload, widgetElevation.ElevatedUser) : userPayload;
+        // Only the system user or an API key holding the agent:trusted scope may set a run's scope and agent-type
+        // params through data (ExecuteAgentParams.TrustReservedRunData). Judged on the caller's own payload: a widget
+        // guest runs under an elevated server principal but is never trusted.
+        const trustRunData = await IsTrustedAgentRunCaller({
+            UserPayload: userPayload, IsWidgetGuestRun: widgetElevation !== null, AgentID: agentId,
+        });
 
         try {
             // Parsed before anything loads: a floor the caller asked for must never be dropped.
@@ -1021,6 +1052,7 @@ export class RunAIAgentResolver extends ResolverBase {
                     sourceArtifactId, sourceArtifactVersionId, conversationId, planMode, requestedSkillIDs,
                     undefined, // taskGraphDebug
                     historyFrom,
+                    trustRunData,
                     branchId
                 );
 
@@ -1058,6 +1090,7 @@ export class RunAIAgentResolver extends ResolverBase {
                 requestedSkillIDs,
                 undefined, // taskGraphDebug
                 historyFrom,
+                trustRunData,
                 branchId
             );
         } catch (error) {
@@ -1281,6 +1314,8 @@ export class RunAIAgentResolver extends ResolverBase {
         taskGraphDebug?: string,
         /** History floor — threaded through to ExecuteAgentParams.ConversationHistoryFrom. */
         conversationHistoryFrom?: Date,
+        /** ExecuteAgentParams.TrustReservedRunData — see executeAIAgent. */
+        trustReservedRunData: boolean = false,
         /** The conversation branch of the run — threaded through to ExecuteAgentParams.ConversationBranchID. */
         conversationBranchId?: string | null
     ): void {
@@ -1302,7 +1337,7 @@ export class RunAIAgentResolver extends ResolverBase {
             data, payload, undefined, lastRunId, autoPopulateLastRunPayload,
             configurationId, conversationDetailId, createArtifacts, createNotification,
             sourceArtifactId, sourceArtifactVersionId, conversationId, runRef, planMode, requestedSkillIDs, taskGraphDebug,
-            conversationHistoryFrom, conversationBranchId
+            conversationHistoryFrom, trustReservedRunData, conversationBranchId
         ).catch((error: unknown) => {
             // Background execution failed unexpectedly (executeAIAgent has its own try-catch,
             // so this would only fire for truly unexpected errors).

package/src/resolvers/SearchKnowledgeStreamResolver.ts

@@ -18,8 +18,14 @@
  * Permission enforcement is identical to SearchKnowledge: each requested
  * scopeID is run through SearchScopePermissionResolver before the engine
  * is invoked. A denial publishes a single 'error' event and ends.
+ *
+ * 'provider' events are progress only — ProviderName, DurationMs and
+ * ResultCount. They arrive before the engine's permission pass, so they never
+ * carry a result: rows the caller's row filters would drop and unverified
+ * external-index hits must not reach the client. Results arrive in 'fused'
+ * and 'final'.
  */
-import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
+import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, Int, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
 import { v4 as uuidv4 } from 'uuid';
 import { GraphQLJSON } from 'graphql-type-json';
 import { AppContext } from '../types.js';
@@ -59,10 +65,17 @@ export class SearchStreamNotification {
     @Field(() => Float, { nullable: true })
     DurationMs?: number;
 
-    /** Set on `provider`, `fused`, `reranked`, `final` events. */
+    /**
+     * Set on `fused`, `reranked` and `final` events. Always empty on a `provider` event: a provider's
+     * hits arrive before the permission pass, so the stream reports only their count (`ResultCount`).
+     */
     @Field(() => [SearchKnowledgeResultItem], { nullable: true })
     Results?: SearchKnowledgeResultItem[];
 
+    /** Set on `provider` events: how many hits the provider returned, capped at `maxResults`. */
+    @Field(() => Int, { nullable: true })
+    ResultCount?: number;
+
     /** Set on `final` events. */
     @Field(() => SearchSourceCounts, { nullable: true })
     SourceCounts?: SearchSourceCounts;
@@ -253,12 +266,15 @@ export class SearchKnowledgeStreamResolver extends ResolverBase {
 
         switch (ev.phase) {
             case 'provider':
+                // Progress only. `ev.results` is never forwarded, whatever it holds: these hits have
+                // not been through the permission pass.
                 return {
                     StreamID: streamID,
                     Phase: 'provider',
                     ProviderName: ev.providerName,
                     DurationMs: ev.durationMs,
-                    Results: ev.results.map(mapItem),
+                    ResultCount: ev.resultCount,
+                    Results: [],
                 };
             case 'fused':
                 return {

package/src/resolvers/SqlLoggingConfigResolver.ts

@@ -670,10 +670,8 @@ export class SqlLoggingConfigResolver extends ResolverBase {
     }
 
     try {
-      // Check if file exists
-      await fs.access(session.filePath);
-      
-      // Read file content
+      // Read directly: a missing file surfaces as ENOENT below, so a separate existence check
+      // would only open a window for the file to change between the check and the read.
       const content = await fs.readFile(session.filePath, 'utf-8');
       
       // Apply line limit if specified