@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/resolvers/RunTemplateResolver.ts

@@ -84,7 +84,7 @@ export class RunTemplateResolver extends ResolverBase {
             }
 
             // Load template content (get the first/highest priority content)
-            const rv = new RunView();
+            const rv = RunView.FromMetadataProvider(p);
             const templateContentResult = await rv.RunView<MJTemplateContentEntity>({
                 EntityName: 'MJ: Template Contents',
                 ExtraFilter: `TemplateID = '${templateId}'`,
@@ -102,12 +102,14 @@ export class RunTemplateResolver extends ResolverBase {
             }
 
             // Configure and render the template
-            await TemplateEngineServer.Instance.Config(true /*always refresh to get latest templates*/, currentUser);
+            await TemplateEngineServer.Instance.Config(true /*always refresh to get latest templates*/, currentUser, p);
             const result = await TemplateEngineServer.Instance.RenderTemplate(
                 templateEntity, 
                 templateContentResult.Results[0], 
-                data, 
-                true // skip validation for execution
+                data,
+                true, // skip validation for execution
+                undefined,
+                { ContextUser: currentUser },
             );
 
             const executionTime = Date.now() - startTime;

package/src/resolvers/RunTestResolver.ts

@@ -15,6 +15,7 @@ import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
 import { TestEngine } from '@memberjunction/testing-engine';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { ProjectEntityObjectForCaller, ProjectableEntityObject } from '../generic/fieldSecurityTransport.js';
 import { StartLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { TestRunVariables, TestLogMessage, TestRunResult as EngineTestRunResult } from '@memberjunction/testing-engine-base';
 
@@ -447,7 +448,8 @@ export class RunTestResolver extends ResolverBase {
                 testRunId: (testRun as { ID?: string })?.ID || testId,
                 type: 'progress',
                 testRun: testRun && typeof (testRun as { GetAll?: () => Record<string, unknown> }).GetAll === 'function'
-                    ? (testRun as { GetAll: () => Record<string, unknown> }).GetAll()
+                    // projected for the recipient: the run object comes from the test engine, not a load bound to them
+                    ? ProjectEntityObjectForCaller(testRun as unknown as ProjectableEntityObject, userPayload.userRecord)
                     : undefined,
                 progress: {
                     currentStep: progress.step,

package/src/resolvers/SearchKnowledgeStreamResolver.ts

@@ -18,8 +18,14 @@
  * Permission enforcement is identical to SearchKnowledge: each requested
  * scopeID is run through SearchScopePermissionResolver before the engine
  * is invoked. A denial publishes a single 'error' event and ends.
+ *
+ * 'provider' events are progress only — ProviderName, DurationMs and
+ * ResultCount. They arrive before the engine's permission pass, so they never
+ * carry a result: rows the caller's row filters would drop and unverified
+ * external-index hits must not reach the client. Results arrive in 'fused'
+ * and 'final'.
  */
-import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
+import { Resolver, Mutation, Arg, Ctx, ObjectType, Field, Float, Int, ID, Subscription, Root, PubSub, PubSubEngine } from 'type-graphql';
 import { v4 as uuidv4 } from 'uuid';
 import { GraphQLJSON } from 'graphql-type-json';
 import { AppContext } from '../types.js';
@@ -59,10 +65,17 @@ export class SearchStreamNotification {
     @Field(() => Float, { nullable: true })
     DurationMs?: number;
 
-    /** Set on `provider`, `fused`, `reranked`, `final` events. */
+    /**
+     * Set on `fused`, `reranked` and `final` events. Always empty on a `provider` event: a provider's
+     * hits arrive before the permission pass, so the stream reports only their count (`ResultCount`).
+     */
     @Field(() => [SearchKnowledgeResultItem], { nullable: true })
     Results?: SearchKnowledgeResultItem[];
 
+    /** Set on `provider` events: how many hits the provider returned, capped at `maxResults`. */
+    @Field(() => Int, { nullable: true })
+    ResultCount?: number;
+
     /** Set on `final` events. */
     @Field(() => SearchSourceCounts, { nullable: true })
     SourceCounts?: SearchSourceCounts;
@@ -253,12 +266,15 @@ export class SearchKnowledgeStreamResolver extends ResolverBase {
 
         switch (ev.phase) {
             case 'provider':
+                // Progress only. `ev.results` is never forwarded, whatever it holds: these hits have
+                // not been through the permission pass.
                 return {
                     StreamID: streamID,
                     Phase: 'provider',
                     ProviderName: ev.providerName,
                     DurationMs: ev.durationMs,
-                    Results: ev.results.map(mapItem),
+                    ResultCount: ev.resultCount,
+                    Results: [],
                 };
             case 'fused':
                 return {

package/src/resolvers/SqlLoggingConfigResolver.ts

@@ -670,10 +670,8 @@ export class SqlLoggingConfigResolver extends ResolverBase {
     }
 
     try {
-      // Check if file exists
-      await fs.access(session.filePath);
-      
-      // Read file content
+      // Read directly: a missing file surfaces as ENOENT below, so a separate existence check
+      // would only open a window for the file to change between the check and the read.
       const content = await fs.readFile(session.filePath, 'utf-8');
       
       // Apply line limit if specified

package/src/resolvers/SyncDataResolver.ts

@@ -319,6 +319,7 @@ export class SyncDataResolver {
             }
             else {
                 // pass back the full record as it was JUST BEFORE the delete, often quite useful on the other end
+                // fls-guard: system-user-only resolver (@RequireSystemUser)
                 result.RecordJSON = await altKeyResult.GetDataObjectJSON({
                     includeRelatedEntityData: false,
                     excludeFields: [],
@@ -337,6 +338,7 @@ export class SyncDataResolver {
         }
         else if (await entityObject.InnerLoad(pk)) {
             // pass back the full record as it was JUST BEFORE the delete, often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],
@@ -368,6 +370,7 @@ export class SyncDataResolver {
             result.Success = true;
             result.PrimaryKey = new CompositeKey(entityObject.PrimaryKeys.map((pk) => ({FieldName: pk.Name, Value: pk.Value})));
             // pass back the full record AFTER the sync, that's often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],
@@ -411,6 +414,7 @@ export class SyncDataResolver {
                 result.PrimaryKey = new CompositeKey(entityObject.PrimaryKeys.map((pk) => ({FieldName: pk.Name, Value: pk.Value})));
             }
             // pass back the full record AFTER the sync, that's often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],

package/src/resolvers/TaskGraphFrameResolver.ts

@@ -19,6 +19,7 @@ import { Arg, Field, ID, ObjectType, PubSubEngine, Resolver, ResolverFilterData,
 import { LogError } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import type { TaskGraphFrame, TaskGraphObserver } from '@memberjunction/task-graph';
+import { PublishStatusUpdate } from '../generic/PushStatusResolver.js';
 
 export const TASK_GRAPH_FRAMES_TOPIC = 'TASK_GRAPH_FRAMES';
 
@@ -173,7 +174,10 @@ export function taskGraphFrameFilter(data: {
  * the same reason.
  */
 export class TaskGraphFrameBroadcaster implements TaskGraphObserver {
-  constructor(private readonly pubSub: PubSubEngine) {}
+  constructor(
+    private readonly pubSub: PubSubEngine,
+    private readonly bridgeToPushStatus: boolean = false,
+  ) {}
 
   public OnFrame(frame: TaskGraphFrame): void {
     try {
@@ -187,6 +191,34 @@ export class TaskGraphFrameBroadcaster implements TaskGraphObserver {
         TASK_GRAPH_FRAMES_TOPIC,
         { ...frame, ownerUserId: frame.OwnerUserID } satisfies TaskGraphFramePayload,
       );
+
+      if (
+        this.bridgeToPushStatus &&
+        (frame.Kind === 'TaskStarted' ||
+          frame.Kind === 'TaskCompleted' ||
+          frame.Kind === 'TaskFailed' ||
+          frame.Kind === 'NodeProgress' ||
+          frame.Kind === 'GraphSettled')
+      ) {
+        const defaultMsg = frame.TaskName
+          ? `${frame.TaskName}: ${frame.Status ?? frame.Kind}`
+          : `Workflow: ${frame.Status ?? frame.Kind}`;
+        PublishStatusUpdate(this.pubSub, {
+          sessionId: '*',
+          ownerUserId: frame.OwnerUserID,
+          message: JSON.stringify({
+            resolver: 'TaskOrchestrator',
+            type: 'TaskGraphFrame',
+            status: 'ok',
+            data: {
+              ...frame,
+              taskName: frame.TaskName,
+              message: frame.ProgressMessage || defaultMsg,
+              percentComplete: frame.ProgressPercent,
+            },
+          }),
+        });
+      }
     } catch (e) {
       LogError(`[TaskGraphFrameBroadcaster] Could not publish ${frame.Kind} (ignored): ${e instanceof Error ? e.message : String(e)}`);
     }

package/src/resolvers/TestQuerySQLResolver.ts

@@ -1,9 +1,12 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { RunQuery, IRunQueryProvider, LogError, LogStatus, QueryExecutionSpec } from '@memberjunction/core';
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
 import { AppContext } from '../types.js';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 
 /**
  * GraphQL input type for inline dependency queries.
@@ -88,6 +91,14 @@ export class TestQuerySQLResult {
  *
  * Security:
  * - Requires `query:test` scope for API key users (no-op for JWT auth)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView. Same screen as {@link AdhocQueryResolver.ExecuteAdhocQuery}.
  * - Uses read-only database connection (no mutation possible)
  * - Enforces MaxRows limit (default 100) to prevent unbounded queries
  *
@@ -104,15 +115,24 @@ export class TestQuerySQLResolver extends ResolverBase {
     ): Promise<TestQuerySQLResult> {
         try {
             await this.CheckAPIKeyScopeAuthorization('query:test', '*', context.userPayload);
+            // SECURITY: refuse principals whose read authority is narrower than their role grant.
+            // Transient test SQL does not go through RunView, entity permissions or row-level
+            // security, so the RLS scope tokens that confine a magic-link session are never
+            // substituted. There is no filter to narrow, so the only correct answer for such a
+            // principal is no — the same refusal ExecuteAdhocQuery applies.
+            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+            }
             // Use read-only provider for security — no mutation possible
             const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
             if (!provider) {
-                return {
-                    Success: false,
-                    RowCount: 0,
-                    ExecutionTime: 0,
-                    ErrorMessage: 'Read-only data source is not available. TestQuerySQL requires a read-only connection for security.',
-                };
+                return this.buildErrorResult('Read-only data source is not available. TestQuerySQL requires a read-only connection for security.');
+            }
+
+            const contextUser = context.userPayload?.userRecord;
+            const refusal = this.AuthorizeRenderedTestSQL(input, provider, contextUser);
+            if (refusal) {
+                return this.buildErrorResult(refusal);
             }
 
             const rq = new RunQuery(provider as unknown as IRunQueryProvider);
@@ -127,10 +147,11 @@ export class TestQuerySQLResolver extends ResolverBase {
 
             LogStatus(`TestQuerySQL: Executing transient query (MaxRows=${spec.MaxRows}, UsesTemplate=${spec.UsesTemplate ?? false}, Dependencies=${spec.Dependencies?.length ?? 0})`);
 
-            const result = await rq.ExecuteFromSpec(spec, context.userPayload.userRecord);
+            const result = await rq.ExecuteFromSpec(spec, contextUser);
 
             return {
                 Success: result.Success,
+                // fls-guard: query rows; the SQL is refused before it runs if it reads a field the caller is denied
                 Results: result.Results ? JSON.stringify(result.Results) : undefined,
                 RowCount: result.RowCount,
                 ExecutionTime: result.ExecutionTime,
@@ -141,12 +162,47 @@ export class TestQuerySQLResolver extends ResolverBase {
         } catch (err) {
             LogError(err);
             const errorMessage = err instanceof Error ? err.message : String(err);
-            return {
-                Success: false,
-                RowCount: 0,
-                ExecutionTime: 0,
-                ErrorMessage: `TestQuerySQL failed: ${errorMessage}`,
-            };
+            return this.buildErrorResult(`TestQuerySQL failed: ${errorMessage}`);
         }
     }
+
+    /**
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run — the same
+     * screen `AdhocQueryResolver.AuthorizeRenderedSQL` applies to ad-hoc SQL. Rendering comes
+     * first because composition (`{{query:"..."}}`), inline dependencies and Nunjucks templates
+     * can introduce table references the raw input never named, so the render here uses the same
+     * Parameters / UsesTemplate / Dependencies the execution spec will. Every table reference in
+     * the rendered SQL must be an entity base view the caller can read UNSCOPED — CanRead with no
+     * row-level filter and no denied fields — because raw SQL applies neither (see
+     * `assertFullQueryUsesReadableEntityViews`). The provider renders the same input the same way
+     * and only wraps it in server-built MaxRows capping, so the rendered SQL is the full set of
+     * reads. Returns the refusal message, or null.
+     */
+    public AuthorizeRenderedTestSQL(input: TestQuerySQLInput, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null {
+        try {
+            const rendered = RenderPipeline.Run(input.SQL, {
+                Platform: provider.PlatformKey,
+                ContextUser: contextUser,
+                Parameters: input.Parameters,
+                UsesTemplate: input.UsesTemplate,
+                Dependencies: input.Dependencies,
+                OriginalSQL: input.SQL,
+                RequireReadStatement: true,
+            });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'transient test SQL');
+            return null;
+        } catch (err) {
+            return err instanceof Error ? err.message : String(err);
+        }
+    }
+
+    /** Builds a failed TestQuerySQLResult carrying the given message. */
+    private buildErrorResult(errorMessage: string): TestQuerySQLResult {
+        return {
+            Success: false,
+            RowCount: 0,
+            ExecutionTime: 0,
+            ErrorMessage: errorMessage,
+        };
+    }
 }

package/src/resolvers/TransactionGroupResolver.ts

@@ -1,9 +1,10 @@
 import { Arg, Ctx, Field, InputType, Int, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { CompositeKey, IMetadataProvider, KeyValuePair, LogError, Metadata, TransactionVariable, BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
-import { SafeJSONParse } from '@memberjunction/global';
+import { AssertClientInputWritableForUser, CompositeKey, EntityInfo, IMetadataProvider, KeyValuePair, LogError, Metadata, RecordChangeMetadataSource, TransactionVariable, TransactionGroupBase, BaseEntity, UserInfo } from '@memberjunction/core';
+import { SafeJSONParse, ValuesEqual } from '@memberjunction/global';
 import { GetReadWriteProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { ProjectValuesForCaller } from '../generic/fieldSecurityTransport.js';
 
 export enum TransactionVariableType {
     Define = "Define",
@@ -142,14 +143,24 @@ export class TransactionResolver extends ResolverBase {
             // rows were all refused arrive at Submit() empty, take its legitimate "nothing to do"
             // branch, and report success for writes that never happened.
             const refusals: string[] = [];
+            const preUpdateValues = new Map<number, Record<string, unknown>>();
+
+            // instantiate an entity object for every item first, so the group's variables are known
+            // BEFORE any Save()/Delete() runs below: a 'Use' variable sets its field at Submit(), after
+            // every server-side write check has passed, so an entity whose check depends on a field's
+            // final value must be able to see that a variable will set it.
+            const user: UserInfo = context.userPayload.userRecord;
+            for (const item of group.Items) {
+                entityObjects.push(await md.GetEntityObject(item.EntityName, user));
+            }
+            this.AssertNetworkInputWritable(group, entityObjects, user);
+            this.AddNetworkVariables(group, entityObjects, tg);
 
             for (const [index, item] of group.Items.entries()) {
-                // instantiate a new entity object for the item
-                const entity = await md.GetEntityObject(item.EntityName, context.userPayload.userRecord);
-                entityObjects.push(entity); // save for later for mapping variables if needed
+                const entity = entityObjects[index];
 
                 // get the values from the payload
-                const itemValues = SafeJSONParse(item.EntityObjectJSON);
+                const itemValues = SafeJSONParse<Record<string, unknown>>(item.EntityObjectJSON) ?? {};
                 // build a primary key for the item
                 const pkey = new CompositeKey(entity.PrimaryKeys.map(pk => {
                     const kv = new KeyValuePair();
@@ -162,6 +173,13 @@ export class TransactionResolver extends ResolverBase {
                     case "Create":
                         if (item.OperationType === "Update") {
                             await entity.InnerLoad(pkey);
+                            if (typeof entity.GetDataObject === 'function') {
+                                // fls-guard: pre-update snapshot; projected before the delta is built
+                                preUpdateValues.set(index, await entity.GetDataObject());
+                            } else if (typeof entity.GetAll === 'function') {
+                                // fls-guard: pre-update snapshot; projected before the delta is built
+                                preUpdateValues.set(index, { ...(entity.GetAll() as Record<string, unknown>) });
+                            }
                         }
                         objectValues.push(itemValues);
                         entity.SetMany(itemValues, true);
@@ -184,6 +202,7 @@ export class TransactionResolver extends ResolverBase {
                         // Awaiting costs nothing here — DataObjectParams defaults
                         // includeRelatedEntityData to false, which guards the method's only awaited
                         // work, so with no params this is GetAll() plus a filter loop.
+                        // fls-guard: projected in PrepareReturnValue
                         objectValues.push(await entity.GetDataObject());
                         entity.TransactionGroup = tg;
                         if (!await entity.Delete()) {
@@ -208,32 +227,17 @@ export class TransactionResolver extends ResolverBase {
                     `TransactionResolver::ExecuteTransactionGroup --- ${refusals.length} of ${group.Items.length} ` +
                     `item(s) were refused, so the group was not submitted:\n${refusals.join('\n')}`
                 );
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group);
-            }
-
-            // now, we need to set the variables
-            if (group.Variables && group.Variables.length > 0) {
-                for (const networkVar of group.Variables) {
-                    // for each variable, add it to the transaction group and map the index from the network payload to the specific entity object loaded up above
-                    if (networkVar.ItemIndex >= 0 && networkVar.ItemIndex < entityObjects.length) {
-                        const entityObject = entityObjects[networkVar.ItemIndex];
-                        const newVar = new TransactionVariable(networkVar.Name, entityObject, networkVar.FieldName, networkVar.Type);
-                        tg.AddVariable(newVar);
-                    }
-                    else {
-                        throw new Error(`TransactionResolver::ExecuteTransactionGroup --- Error\n\n' + 'Invalid ItemIndex ${networkVar.ItemIndex} in TransactionVariable "${JSON.stringify(networkVar)}"`);
-                    }
-                }
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
 
             // after all that, we are ready to roll, so let's run the TG
             if (await tg.Submit()) {
                 // success!
-                return await this.PrepareReturnValue(true, entityObjects, objectValues, group);
+                return await this.PrepareReturnValue(true, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
             else {
                 // failure, send back the results
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group);
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
         } 
         catch (err) {
@@ -242,16 +246,82 @@ export class TransactionResolver extends ResolverBase {
         }
     }
 
-    protected async PrepareReturnValue(success: boolean, entityObjects: BaseEntity[], objectValues: any[], group: TransactionInputType): Promise<TransactionOutputType> {
+    /**
+     * Field-level security gate on everything the client sent, run before any item is applied.
+     *
+     * Each create or update payload must name only fields the caller may read, and so must every transaction
+     * variable: a `Define` on a denied field would copy its value into another item's readable
+     * field at `Submit()`, and a `Use` would write it. A key that names no field is refused with
+     * the same message as a denied one (see `AssertClientInputWritableForUser`). Callers denied
+     * nothing on an entity are not affected. A delete payload is not gated: only its primary key
+     * is read, and the record is loaded from the database.
+     */
+    protected AssertNetworkInputWritable(group: TransactionInputType, entityObjects: BaseEntity[], user: UserInfo): void {
+        for (const [index, item] of group.Items.entries()) {
+            if (item.OperationType === TransactionOperationType.Delete) {
+                continue;
+            }
+            const values = SafeJSONParse<Record<string, unknown>>(item.EntityObjectJSON);
+            AssertClientInputWritableForUser(entityObjects[index]?.EntityInfo, values, user);
+        }
+        for (const networkVar of group.Variables ?? []) {
+            const target = entityObjects[networkVar.ItemIndex];
+            if (target && networkVar.FieldName) {
+                AssertClientInputWritableForUser(target.EntityInfo, { [networkVar.FieldName]: null }, user);
+            }
+        }
+    }
+
+    /**
+     * Adds the network payload's variables to the group, mapping each one's item index to the entity
+     * object built for that item.
+     */
+    protected AddNetworkVariables(group: TransactionInputType, entityObjects: BaseEntity[], tg: TransactionGroupBase): void {
+        for (const networkVar of group.Variables ?? []) {
+            if (networkVar.ItemIndex >= 0 && networkVar.ItemIndex < entityObjects.length) {
+                const entityObject = entityObjects[networkVar.ItemIndex];
+                tg.AddVariable(new TransactionVariable(networkVar.Name, entityObject, networkVar.FieldName, networkVar.Type));
+            }
+            else {
+                throw new Error(`TransactionResolver::ExecuteTransactionGroup --- Error\n\n' + 'Invalid ItemIndex ${networkVar.ItemIndex} in TransactionVariable "${JSON.stringify(networkVar)}"`);
+            }
+        }
+    }
+
+    protected async PrepareReturnValue(
+        success: boolean,
+        entityObjects: BaseEntity[],
+        objectValues: unknown[],
+        group: TransactionInputType,
+        preUpdateValues?: Map<number, Record<string, unknown>>,
+        provider?: RecordChangeMetadataSource,
+        user?: UserInfo
+    ): Promise<TransactionOutputType> {
         const jsonResults = [];
         for (let i = 0; i < group.Items.length; i++) {
             const item = group.Items[i];
-            if (item.OperationType==='Delete') {
-                jsonResults.push(JSON.stringify(objectValues[i]));
+            const project = (values: Record<string, unknown>) =>
+                ProjectValuesForCaller(entityObjects[i]?.EntityInfo, values, user, provider);
+            if (item.OperationType === 'Delete') {
+                const deleted = objectValues[i];
+                jsonResults.push(JSON.stringify(deleted && typeof deleted === 'object' ? project(deleted as Record<string, unknown>) : deleted));
+            }
+            else if (item.OperationType === 'Update') {
+                jsonResults.push(
+                    await this.serializeUpdateReturnValue(
+                        entityObjects[i],
+                        objectValues[i],
+                        preUpdateValues?.get(i),
+                        group,
+                        i,
+                        project
+                    )
+                );
             }
             else {
-                // create or update, return what is in the database
-                jsonResults.push(await entityObjects[i].GetDataObjectJSON());
+                // create, return what is in the database, as the caller may read it
+                // fls-guard: projected by project()
+                jsonResults.push(JSON.stringify(project(await entityObjects[i].GetDataObject())));
             }
         }
 
@@ -261,6 +331,91 @@ export class TransactionResolver extends ResolverBase {
             ResultsJSON: jsonResults
         }
     }
- 
+
+    /**
+     * Serializes a delta return payload for an `Update` transaction group item containing:
+     * - Primary key fields
+     * - All keys sent by the client in `sentValues` (`objectValues[i]`)
+     * - Any `TransactionVariable` fields targeting this item
+     * - `__mj_CreatedAt` and `__mj_UpdatedAt`
+     * - Virtual fields when any foreign key field was in `sentValues`
+     * - Any field whose post-save value differs from its pre-update DB snapshot (`preSaveValues`),
+     *   capturing virtual fields, triggers, or server-side `BeforeSave()` mutations automatically
+     *   while omitting unchanged columns.
+     *
+     * Both rows are projected for the caller BEFORE they are compared. Comparing a full-width
+     * post-save row against a snapshot taken from a narrowed load would count every denied value
+     * as changed, and the delta would then deliver exactly the values the caller may not read.
+     */
+    private async serializeUpdateReturnValue(
+        entity: BaseEntity,
+        sentValues: unknown,
+        preSaveValues: Record<string, unknown> | undefined,
+        group: TransactionInputType,
+        itemIndex: number,
+        project: (values: Record<string, unknown>) => Record<string, unknown>
+    ): Promise<string> {
+        const rawDataObj: Record<string, unknown> | null = typeof entity.GetDataObject === 'function'
+            // fls-guard: projected by project() below
+            ? (await entity.GetDataObject() as Record<string, unknown>)
+            // fls-guard: projected by project() below
+            : SafeJSONParse<Record<string, unknown>>(await entity.GetDataObjectJSON());
+        if (!rawDataObj || typeof rawDataObj !== 'object') {
+            return JSON.stringify(rawDataObj);
+        }
+        const fullDataObj = project(rawDataObj);
+        if (!sentValues || typeof sentValues !== 'object') {
+            return JSON.stringify(fullDataObj);
+        }
+        preSaveValues = preSaveValues ? project(preSaveValues) : preSaveValues;
+
+        const sentRecord = sentValues as Record<string, unknown>;
+        const includeKeys = new Set<string>([
+            EntityInfo.CreatedAtFieldName,
+            EntityInfo.UpdatedAtFieldName,
+        ]);
+
+        for (const pk of entity.PrimaryKeys ?? []) {
+            if (pk?.Name) {
+                includeKeys.add(pk.Name);
+            }
+        }
+        for (const key of Object.keys(sentRecord)) {
+            includeKeys.add(key);
+        }
+        for (const v of group.Variables ?? []) {
+            if (v.ItemIndex === itemIndex && v.FieldName) {
+                includeKeys.add(v.FieldName);
+            }
+        }
+        if (Array.isArray(entity.Fields)) {
+            for (const f of entity.Fields) {
+                if (
+                    f.EntityFieldInfo?.IsSpecialDateField ||
+                    Boolean(f.EntityFieldInfo?.IsVirtual) ||
+                    Boolean(f.EntityFieldInfo?.IsComputed) ||
+                    f.ReadOnly
+                ) {
+                    includeKeys.add(f.Name);
+                }
+            }
+        }
+        if (preSaveValues) {
+            for (const key of Object.keys(fullDataObj)) {
+                if (!ValuesEqual(fullDataObj[key], preSaveValues[key])) {
+                    includeKeys.add(key);
+                }
+            }
+        }
+
+        const deltaObj: Record<string, unknown> = {};
+        for (const key of Object.keys(fullDataObj)) {
+            if (includeKeys.has(key)) {
+                deltaObj[key] = fullDataObj[key];
+            }
+        }
+        return JSON.stringify(deltaObj);
+    }
+
 }
  

package/src/resolvers/UserViewResolver.ts

@@ -5,6 +5,7 @@ import { MJUserView_, MJUserViewResolverBase } from '../generated/generated.js';
 import { UserResolver } from './UserResolver.js';
 import { MJUserViewEntity, MJUserViewEntityExtended } from '@memberjunction/core-entities';
 import { GetReadOnlyProvider, GetReadWriteProvider } from '../util.js';
+import { ProjectEntityObjectForCaller } from '../generic/fieldSecurityTransport.js';
 
 @Resolver(MJUserView_)
 export class UserViewResolver extends MJUserViewResolverBase {
@@ -63,7 +64,7 @@ export class UserViewResolver extends MJUserViewResolverBase {
     await viewEntity.UpdateWhereClause(true); // force regeneration regardless of dirty state — that is the whole point of this endpoint
 
     if (await viewEntity.Save()) {
-      return viewEntity.GetAll();
+      return ProjectEntityObjectForCaller(viewEntity, u, p);
     } else {
       throw new Error('Failed to update where clause');
     }