@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/resolvers/AgentRunStatusPublisher.ts

@@ -14,8 +14,10 @@ import type {
     AgentExecutionStreamingCallback,
     ExecuteAgentResult,
 } from '@memberjunction/ai-core-plus';
+import type { EntityInfo } from '@memberjunction/core';
 import type { UserPayload } from '../types.js';
-import { PublishStatusUpdate } from '../generic/PushStatusResolver.js';
+import { PublishStatusUpdate, StatusUpdateOwnerID } from '../generic/PushStatusResolver.js';
+import { ProjectEntityObjectForCaller } from '../generic/fieldSecurityTransport.js';
 
 const SIGNIFICANT_STEPS = ['prompt_execution', 'action_execution', 'subagent_execution', 'decision_processing'];
 
@@ -25,7 +27,8 @@ interface StatusRun {
     ConversationDetailID?: string;
     ErrorMessage?: string;
     Steps?: Array<{ StepName?: string }>;
-    GetAll?: () => unknown;
+    EntityInfo?: EntityInfo | null;
+    GetAll?: () => Record<string, unknown>;
 }
 
 export class AgentRunStatusPublisher {
@@ -34,11 +37,15 @@ export class AgentRunStatusPublisher {
     /**
      * @param sessionId Session stamped on the message body. Defaults to the payload's session.
      *   The push itself is always addressed to `userPayload.sessionId`, matching the resolver.
+     * @param conversationDetailId The run's reply row. When set, every message carries it as
+     *   `conversationDetailId`, not only the completion, so a client that reconnects mid-run can
+     *   find its row. When omitted, messages are as before.
      */
     constructor(
         private readonly pubSub: PubSubEngine,
         private readonly userPayload: UserPayload,
         private readonly sessionId: string = userPayload.sessionId,
+        private readonly conversationDetailId?: string,
     ) {}
 
     /** Latest run observed from a progress event, including steps that are not published. */
@@ -66,7 +73,8 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'progress',
-                agentRun: agentRun.GetAll ? agentRun.GetAll() : agentRun,
+                ...this.replyRow(),
+                agentRun: this.runValues(agentRun),
                 progress: {
                     currentStep: progress.step,
                     percentage: progress.percentage,
@@ -93,7 +101,8 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'streaming',
-                agentRun: agentRun.GetAll ? agentRun.GetAll() : agentRun,
+                ...this.replyRow(),
+                agentRun: this.runValues(agentRun),
                 streaming: {
                     content: chunk.content,
                     isPartial: !chunk.isComplete,
@@ -122,6 +131,7 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'partial_result',
+                ...this.replyRow(),
                 partialResult: {
                     currentStep: lastStep,
                     partialOutput: result.payload || undefined,
@@ -134,7 +144,7 @@ export class AgentRunStatusPublisher {
             agentRunId: agentRun?.ID || 'unknown',
             type: 'complete',
             timestamp: new Date(),
-            conversationDetailId: conversationDetailId || agentRun?.ConversationDetailID,
+            conversationDetailId: conversationDetailId || agentRun?.ConversationDetailID || this.conversationDetailId,
             success: result.success,
             errorMessage: agentRun?.ErrorMessage || undefined,
             result: resultJson || undefined,
@@ -142,8 +152,9 @@ export class AgentRunStatusPublisher {
     }
 
     /**
-     * Completion for a failure that has no run. The fire-and-forget path uses this when
-     * `executeAIAgent` rejects. A host uses it the same way: when the turn throws
+     * Completion for a failure that has no run result. `executeAIAgent` sends it when the run
+     * throws (the agent could not start, the run failed, or its reply could not be saved), so a
+     * fire-and-forget client learns the reason. A host uses it the same way: when the turn throws
      * instead of returning a result, call `PublishFailure` with the reply row's id
      * and the error. That completion is what tells the chat the reply finished.
      */
@@ -160,10 +171,27 @@ export class AgentRunStatusPublisher {
         });
     }
 
+    /** `{ conversationDetailId }` when this run has a reply row, otherwise nothing, so the message keeps its old shape. */
+    private replyRow(): { conversationDetailId?: string } {
+        return this.conversationDetailId ? { conversationDetailId: this.conversationDetailId } : {};
+    }
+
+    /**
+     * The run's field values as the recipient may read them. The run object comes from the agent
+     * engine, which is not bound to this session's user, so it is projected here.
+     */
+    private runValues(agentRun: StatusRun): unknown {
+        if (!agentRun.GetAll) {
+            return agentRun;
+        }
+        const getAll = agentRun.GetAll;
+        return ProjectEntityObjectForCaller({ EntityInfo: agentRun.EntityInfo, GetAll: () => getAll.call(agentRun) }, this.userPayload?.userRecord);
+    }
+
     private publish(type: 'ExecutionProgress' | 'StreamingContent', data: unknown): void {
         PublishStatusUpdate(this.pubSub, {
             sessionId: this.userPayload.sessionId,
-            ownerUserId: this.userPayload?.userRecord?.ID ?? '',
+            ownerUserId: StatusUpdateOwnerID(this.userPayload),
             message: JSON.stringify({
                 resolver: 'RunAIAgentResolver',
                 type,

package/src/resolvers/AgentSessionResolver.ts

@@ -13,12 +13,30 @@
  */
 import { Resolver, Mutation, Arg, Ctx, ObjectType, Field } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { UserInfo, IMetadataProvider, LogError } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
-import { MJAIAgentSessionEntity } from '@memberjunction/core-entities';
+import { UserInfo, IMetadataProvider } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
-import { SessionManager, SessionAuthorizationError } from '../agentSessions/index.js';
+import { SessionManager, SessionAuthorizationError, type SessionCloseReason } from '../agentSessions/index.js';
+import {
+    LoadOwnedRealtimeSession,
+    RealtimeSessionNotFoundError,
+    RealtimeSessionOwnershipError,
+} from '../realtimeSessions/ownedRealtimeSession.js';
+
+/** The `CloseReason` values a client may stamp on its own session; `Janitor` and `Shutdown` are the server's. */
+const CLIENT_CLOSE_REASONS: readonly SessionCloseReason[] = ['Explicit', 'Error'];
+
+/** Reads the mutation's optional `closeReason`: absent means `Explicit`; a server-only or unknown value is refused. */
+function ParseClientCloseReason(closeReason: string | null | undefined): SessionCloseReason {
+    if (closeReason == null || closeReason === '') {
+        return 'Explicit';
+    }
+    const match = CLIENT_CLOSE_REASONS.find((r) => r === closeReason);
+    if (!match) {
+        throw new Error(`Unsupported close reason '${closeReason}': a client may close its session as ${CLIENT_CLOSE_REASONS.join(' or ')}`);
+    }
+    return match;
+}
 
 /** Result of {@link AgentSessionResolver.StartAgentSession}. */
 @ObjectType()
@@ -77,15 +95,22 @@ export class AgentSessionResolver extends ResolverBase {
     /**
      * Close a session. Rejects unless the caller owns it. Returns `true` on a successful (or
      * idempotent) close, `false` if the session can't be loaded.
+     *
+     * `closeReason` is what the row records as its `CloseReason`: `Explicit` (the default, and what
+     * every client sent before the argument existed) when the user or host ended the call, `Error`
+     * when the client ended it because the start or the call failed (MJ#6013). The other reasons are
+     * the server's own (janitor, shutdown) and are refused from a client.
      */
     @Mutation(() => Boolean)
     async CloseAgentSession(
         @Arg('agentSessionId') agentSessionId: string,
         @Ctx() { userPayload, providers }: AppContext,
+        @Arg('closeReason', () => String, { nullable: true }) closeReason?: string | null,
     ): Promise<boolean> {
+        const reason = ParseClientCloseReason(closeReason);
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.assertOwnership(agentSessionId, contextUser, provider);
-        return this.sessionManager.CloseSession(agentSessionId, contextUser, provider);
+        await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        return this.sessionManager.CloseSession(agentSessionId, contextUser, provider, reason);
     }
 
     /**
@@ -98,7 +123,7 @@ export class AgentSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.assertOwnership(agentSessionId, contextUser, provider);
+        await this.loadOwnedSession(agentSessionId, contextUser, provider);
         return this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
     }
 
@@ -117,22 +142,25 @@ export class AgentSessionResolver extends ResolverBase {
     }
 
     /**
-     * Inbound ownership gate (the one genuinely new session-authz primitive): the session's `UserID`
-     * must equal the caller's. Throws on mismatch or when the session can't be loaded.
+     * Inbound ownership gate: delegates to {@link LoadOwnedRealtimeSession} (which enforces both
+     * `UserID === contextUser.ID` and `AuthorizeSessionAccess` scope/visitor binding) and maps its
+     * typed errors to this resolver's message format.
      */
-    private async assertOwnership(
+    private async loadOwnedSession(
         agentSessionId: string,
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<void> {
-        const session = await provider.GetEntityObject<MJAIAgentSessionEntity>('MJ: AI Agent Sessions', contextUser);
-        const loaded = await session.Load(agentSessionId);
-        if (!loaded) {
-            throw new Error(`Agent session ${agentSessionId} not found`);
-        }
-        if (!UUIDsEqual(session.UserID, contextUser.ID)) {
-            LogError(`AgentSessionResolver: ownership check failed — user ${contextUser.ID} attempted to operate on session ${agentSessionId} owned by ${session.UserID}`);
-            throw new Error('Not authorized: you do not own this agent session');
+        try {
+            await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
+        } catch (err) {
+            if (err instanceof RealtimeSessionNotFoundError) {
+                throw new Error(`Agent session ${agentSessionId} not found`);
+            }
+            if (err instanceof RealtimeSessionOwnershipError) {
+                throw new Error('Not authorized: you do not own this agent session');
+            }
+            throw err;
         }
     }
 }

package/src/resolvers/ArtifactFileResolver.ts

@@ -46,7 +46,11 @@ export class ArtifactFileResolver extends ResolverBase {
         return this.buildDownloadUrl(artifactVersion.FileID, user, p);
     }
 
-    /** Load the File + its storage account/provider and generate a signed URL. */
+    /**
+     * Load the File (as the caller) and generate a signed URL — after the storage gate: the caller must be able to read
+     * the account the file's provider resolves to and every `MJ: Files` row that tracks its object
+     * (`FileStorageEngine.ResolveFileObject`), so an artifact cannot sign an object in an account the caller is refused.
+     */
     private async buildDownloadUrl(
         fileId: string,
         user: ReturnType<ResolverBase['GetUserFromPayload']>,
@@ -58,14 +62,11 @@ export class ArtifactFileResolver extends ResolverBase {
             throw new Error(`File record ${fileId} not found`);
         }
 
-        // Find the storage account for this file's provider using cached metadata
-        await FileStorageEngine.Instance.Config(false, user!);
-        const matchingAccounts = FileStorageEngine.Instance.GetAccountsByProviderID(fileEntity.ProviderID);
-        if (matchingAccounts.length === 0) {
+        // Resolve the storage account for this file's provider, gated for the caller (throws on refusal)
+        const resolved = await FileStorageEngine.Instance.ResolveFileObject(fileEntity, user!, 'Read', provider);
+        if (!resolved) {
             throw new Error(`No FileStorageAccount found for ProviderID ${fileEntity.ProviderID}. Cannot generate download URL.`);
         }
-
-        const driver = await FileStorageEngine.Instance.GetDriver(matchingAccounts[0].ID, user!);
-        return driver.CreatePreAuthDownloadUrl(fileEntity.ProviderKey ?? fileEntity.Name);
+        return resolved.Driver.CreatePreAuthDownloadUrl(resolved.ObjectKey);
     }
 }

package/src/resolvers/ConversationRunEventsResolver.ts

@@ -7,7 +7,7 @@ import type { AppContext } from '../types.js';
 import { GetReadOnlyProvider } from '../util.js';
 
 /** The run columns the tail reads. */
-type TailRunRow = Pick<MJAIAgentRunEntity, 'ID' | 'Status' | 'Result'>;
+type TailRunRow = Pick<MJAIAgentRunEntity, 'ID' | 'Status' | 'FinalPayload' | 'Result'>;
 
 /** The step columns an event carries. The large data columns are never read. */
 type TailStepRow = Pick<
@@ -15,7 +15,7 @@ type TailStepRow = Pick<
     'StepNumber' | 'StepType' | 'StepName' | 'Status' | 'Success' | 'ErrorMessage' | 'StartedAt' | 'CompletedAt'
 >;
 
-const RUN_FIELDS: (keyof TailRunRow)[] = ['ID', 'Status', 'Result'];
+const RUN_FIELDS: (keyof TailRunRow)[] = ['ID', 'Status', 'FinalPayload', 'Result'];
 const STEP_FIELDS: (keyof TailStepRow)[] = [
     'StepNumber', 'StepType', 'StepName', 'Status', 'Success', 'ErrorMessage', 'StartedAt', 'CompletedAt',
 ];
@@ -94,10 +94,14 @@ export class ConversationRunEventsOutput {
     /**
      * The run's answer, returned only once the run is terminal.
      *
-     * Sourced from `AIAgentRun.Result`, falling back to the conversation detail's message because
-     * `Result` is agent-dependent and null on many successful runs. Still nullable: a caller must
-     * decide a message is finished from {@link IsInFlight} / {@link DetailStatus}, never from the
-     * presence of this field, or it will wait forever on an agent that writes neither.
+     * Sourced from `AIAgentRun.FinalPayload` (`Result` on older rows), then the conversation detail's
+     * message, because the run payload is agent-dependent and null on many successful runs. Still
+     * nullable: a caller must decide a message is finished from {@link IsInFlight} /
+     * {@link DetailStatus}, never from the presence of this field, or it will wait forever on an
+     * agent that writes neither.
+     *
+     * A run that ended without completing (for example `Cancelled`) returns whatever `FinalPayload`
+     * it had saved, which can be partial, so a caller should check {@link RunStatus} first.
      */
     @Field(() => String, { nullable: true })
     FinalPayload?: string;
@@ -206,11 +210,11 @@ export class ConversationRunEventsResolver {
                 // Only meaningful once terminal; sending it mid-run would hand the client a
                 // partial payload it could mistake for the final answer.
                 //
-                // `AIAgentRun.Result` is agent-dependent — it is null on a large share of
-                // genuinely successful runs — so the conversation detail's own message is the
-                // fallback. That is the text the chat renders, so it is the answer a caller
-                // waiting on this field actually wants.
-                FinalPayload: isInFlight ? undefined : (run.Result ?? detail.Message ?? undefined),
+                // `AIAgentRun.FinalPayload` (`Result` on older rows) is agent-dependent — it is
+                // null on a large share of genuinely successful runs — so the conversation detail's
+                // own message is the fallback. That is the text the chat renders, so it is the
+                // answer a caller waiting on this field actually wants.
+                FinalPayload: isInFlight ? undefined : (run.FinalPayload ?? run.Result ?? detail.Message ?? undefined),
                 DetailStatus: detail.Status ?? undefined,
             };
         } catch (e) {

package/src/resolvers/DatasetResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
-import { AppContext } from '../types.js';
-import { LogError, Metadata } from '@memberjunction/core';
+import { AppContext, UserPayload } from '../types.js';
+import { DatabaseProviderBase, DatasetItemFilterType, DatasetItemResultType, LogError, Metadata, UserInfo } from '@memberjunction/core';
 import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
@@ -34,9 +34,64 @@ export class DatasetItemFilterTypeGQL {
   Filter: string;
 }
 
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export abstract class DatasetResolverBase extends ResolverBase {
+  /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+  protected RequireDatasetUser(userPayload: UserPayload): UserInfo {
+    const user = this.GetUserFromPayload(userPayload);
+    if (!user) {
+      throw new Error('Dataset request refused: the session resolves to no user');
+    }
+    return user;
+  }
+
+  /**
+   * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+   * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+   */
+  protected ScreenItemFilters(
+    itemFilters: DatasetItemFilterTypeGQL[] | undefined,
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): DatasetItemFilterType[] | undefined {
+    if (!itemFilters) return undefined;
+    itemFilters.forEach((itemFilter, index) => {
+      if (itemFilter) {
+        this.assertClientClauseUsesEntityBaseViews(itemFilter.Filter, `ItemFilters[${index}].Filter`, provider, user);
+      }
+    });
+    return itemFilters.filter((itemFilter) => itemFilter != null);
+  }
+
+  /**
+   * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+   * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+   * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+   */
+  protected async ProtectEncryptedFields(
+    items: DatasetItemResultType[],
+    provider: DatabaseProviderBase,
+    user: UserInfo,
+  ): Promise<DatasetItemResultType[]> {
+    return Promise.all(
+      items.map(async (item) => {
+        const entity = provider.EntityByName(item.EntityName);
+        if (!item.Results?.length || !entity?.EncryptedFields.some((field) => !field.AllowDecryptInAPI)) {
+          return item;
+        }
+        const rows = item.Results.map((row: Record<string, unknown>) => ({ ...row }));
+        return { ...item, Results: await this.ArrayFilterEncryptedFieldsForAPI(item.EntityName, rows, user, provider, 'Name') };
+      }),
+    );
+  }
+}
 
 @Resolver(DatasetResultType)
-export class DatasetResolverExtended extends ResolverBase {
+export class DatasetResolverExtended extends DatasetResolverBase {
   @Query(() => DatasetResultType)
   async GetDatasetByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -45,10 +100,12 @@ export class DatasetResolverExtended extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -56,7 +113,7 @@ export class DatasetResolverExtended extends ResolverBase {
           Success: result.Success,
           Status: result.Status,
           LatestUpdateDate: result.LatestUpdateDate,
-          Results: JSON.stringify(result.Results),
+          Results: JSON.stringify(await this.ProtectEncryptedFields(result.Results, md, user)),
         };
       } else {
         throw new Error('Error retrieving Dataset: ' + DatasetName);
@@ -90,7 +147,7 @@ export class DatasetStatusResultType {
 }
 
 @Resolver(DatasetStatusResultType)
-export class DatasetStatusResolver extends ResolverBase {
+export class DatasetStatusResolver extends DatasetResolverBase {
   @Query(() => DatasetStatusResultType)
   async GetDatasetStatusByName(
     @Arg('DatasetName', () => String) DatasetName: string,
@@ -99,10 +156,12 @@ export class DatasetStatusResolver extends ResolverBase {
   ) {
     // Check API key scope authorization for dataset read
     await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+    const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
+    const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
 
     try {
-      const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
-      const result = await md.GetDatasetStatusByName(DatasetName, ItemFilters);
+      const result = await md.GetDatasetStatusByName(DatasetName, itemFilters, user);
       if (result) {
         return {
           DatasetID: result.DatasetID,
@@ -131,12 +190,13 @@ export class DatasetStatusResolver extends ResolverBase {
     @Ctx() { providers, userPayload }: AppContext,
   ): Promise<DatasetStatusResultType[]> {
     const md = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true});
+    const user = this.RequireDatasetUser(userPayload);
     const results: DatasetStatusResultType[] = [];
 
     // Execute all status checks in parallel
     const statusPromises = DatasetNames.map(async (name) => {
       await this.CheckAPIKeyScopeAuthorization('dataset:read', name, userPayload);
-      return md.GetDatasetStatusByName(name);
+      return md.GetDatasetStatusByName(name, undefined, user);
     });
 
     const statuses = await Promise.all(statusPromises);

package/src/resolvers/EntityCommunicationsResolver.ts

@@ -3,12 +3,14 @@ import { AppContext } from '../types.js';
 import { RunViewByIDInput } from '../generic/RunViewResolver.js';
 import { Message } from '@memberjunction/communication-types';
 import { EntityCommunicationsEngine } from '@memberjunction/entity-communications-server';
-import { RunViewParams } from '@memberjunction/core';
+import { DatabaseProviderBase, IMetadataProvider, RunViewParams, UserInfo } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { TemplateEngineServer } from '@memberjunction/templates';
 import { EntityCommunicationParams } from '@memberjunction/entity-communications-base';
 import { z } from 'zod';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { GetReadOnlyProvider } from '../util.js';
 
 @InputType()
 export class CommunicationProviderMessageType {
@@ -168,6 +170,11 @@ export class RunEntityCommunicationResultType {
 
 @Resolver(RunEntityCommunicationResultType)
 export class ReportResolver extends ResolverBase {
+  /**
+   * Runs a message against a view of records, as the caller. The recipient and related-entity reads
+   * run as the authenticated user, so a preview returns and a send merges only rows and fields that
+   * user may read. The view's client-supplied clauses get the same screen as a RunView request.
+   */
   @Query(() => RunEntityCommunicationResultType)
   async RunEntityCommunicationByViewID(
     @Arg('entityID', () => String) entityID: string,
@@ -177,25 +184,29 @@ export class ReportResolver extends ResolverBase {
     @Arg('message', () => CommunicationMessageInput) message: CommunicationMessageInput,
     @Arg('previewOnly', () => Boolean) previewOnly: boolean,
     @Arg('includeProcessedMessages', () => Boolean) includeProcessedMessages: boolean,
-    @Ctx() { userPayload }: AppContext
+    @Ctx() { userPayload, providers }: AppContext
   ): Promise<RunEntityCommunicationResultType> {
     // Check API key scope authorization for communication send
     await this.CheckAPIKeyScopeAuthorization('communication:send', entityID, userPayload);
 
     try {
-      await EntityCommunicationsEngine.Instance.Config(false, userPayload.userRecord);
-      const newMessage = new Message(message as unknown as Message);
-      await TemplateEngineServer.Instance.Config(false, userPayload.userRecord);
-      // for the templates, replace the values from the input with the objects from the Template Engine we have here
-      if (newMessage.BodyTemplate) {
-        newMessage.BodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.BodyTemplate.Name);
-      }
-      if (newMessage.HTMLBodyTemplate) {
-        newMessage.HTMLBodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.HTMLBodyTemplate.Name);
-      }
-      if (newMessage.SubjectTemplate) {
-        newMessage.SubjectTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.SubjectTemplate.Name);
-      }
+      const contextUser = this.GetUserFromPayload(userPayload);
+      if (!contextUser) throw new Error('Unable to determine the acting user for this communication');
+      const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+      this.screenClientViewClauses(
+        {
+          extraFilter: runViewByIDInput.ExtraFilter,
+          orderBy: runViewByIDInput.OrderBy,
+          userSearchString: runViewByIDInput.UserSearchString,
+          overrideExcludeFilter: runViewByIDInput.OverrideExcludeFilter,
+        },
+        provider as unknown as IMetadataProvider,
+        contextUser,
+      );
+      await this.assertViewBelongsToEntity(runViewByIDInput.ViewID, entityID, provider, contextUser);
+
+      await EntityCommunicationsEngine.Instance.Config(false, contextUser);
+      const newMessage = await this.resolveMessageTemplates(message, contextUser);
       const params: EntityCommunicationParams = {
         EntityID: entityID,
         RunViewParams: <RunViewParams>runViewByIDInput,
@@ -204,6 +215,8 @@ export class ReportResolver extends ResolverBase {
         Message: newMessage,
         PreviewOnly: previewOnly,
         IncludeProcessedMessages: includeProcessedMessages,
+        ContextUser: contextUser,
+        Provider: provider,
       };
       const result = await EntityCommunicationsEngine.Instance.RunEntityCommunication(params);
       return {
@@ -222,4 +235,32 @@ export class ReportResolver extends ResolverBase {
       };
     }
   }
+
+  /**
+   * Refuses a view that is not a view of `entityID`, with the same message as for a view that does
+   * not exist or that the caller cannot load, so the refusal does not reveal which views exist.
+   */
+  private async assertViewBelongsToEntity(viewID: string | undefined, entityID: string, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<void> {
+    if (!viewID) return;
+    const view = await this.resolveUserViewByID(viewID, provider, contextUser);
+    if (!view?.ID || !UUIDsEqual(view.ID, viewID) || !UUIDsEqual(view.EntityID, entityID)) {
+      throw new Error('The requested view does not exist or you do not have access to it');
+    }
+  }
+
+  /** Builds the message, replacing each template the client named with the server's copy of it. */
+  private async resolveMessageTemplates(message: CommunicationMessageInput, contextUser: UserInfo): Promise<Message> {
+    const newMessage = new Message(message as unknown as Message);
+    await TemplateEngineServer.Instance.Config(false, contextUser);
+    if (newMessage.BodyTemplate) {
+      newMessage.BodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.BodyTemplate.Name);
+    }
+    if (newMessage.HTMLBodyTemplate) {
+      newMessage.HTMLBodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.HTMLBodyTemplate.Name);
+    }
+    if (newMessage.SubjectTemplate) {
+      newMessage.SubjectTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.SubjectTemplate.Name);
+    }
+    return newMessage;
+  }
 }

package/src/resolvers/EntityRecordNameResolver.ts

@@ -38,7 +38,8 @@ export class EntityRecordNameResult {
  *
  * Entity-level read permission is checked here ({@link ResolverBase.CheckUserReadPermissions}).
  * Field- and row-level security are applied by the provider's lookup, for the acting user passed
- * to it: when any field the name is built from is withheld, it answers with no name.
+ * to it: when any field the name is built from is withheld, it answers with no name, and it reads
+ * only rows the user's read row filter allows. Without an acting user there is no lookup.
  *
  * A withheld name answers `Success: false` with the same status as a record that does not exist.
  * Callers already treat "no name" as "show the primary key", and the identical answer keeps this
@@ -85,7 +86,7 @@ export class EntityRecordNameResolver extends ResolverBase {
     if (e) {
       const contextUser = userPayload ? this.GetUserFromPayload(userPayload) : undefined;
       // The acting user is what field- and row-level security are applied for.
-      const recordName = await md.GetEntityRecordName(e.Name, pk, contextUser);
+      const recordName = contextUser ? await md.GetEntityRecordName(e.Name, pk, contextUser) : '';
       if (recordName) return { Success: true, Status: 'OK', CompositeKey: pk, RecordName: recordName, EntityName };
       else
         return {