@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/dist/generic/ResolverBase.js

@@ -1,4 +1,5 @@
-import { BaseEntity, BaseEntityEvent, CompositeKey, EntityFieldTSType, EntityPermissionType, KeyValuePair, LogDebug, LogError, LogStatus, Metadata, ReadableFieldsTransportKey, RecordChangeFieldSecurityProjector, RecordChangePayloadFields, } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, BaseEntity, BaseEntityEvent, CompositeKey, EntityFieldTSType, EntityPermissionType, KeyValuePair, LogDebug, LogError, LogErrorEx, LogStatus, Metadata, ProjectEntityValuesForUser, ReadableFieldsTransportKey, RecordChangeFieldSecurityProjector, RecordChangePayloadFields, } from '@memberjunction/core';
+import { UserViewEngine } from '@memberjunction/core-entities';
 import { ClientClauseScreen, UserCache } from '@memberjunction/generic-database-provider';
 import { AuthorizationError } from 'type-graphql';
 import { GraphQLError } from 'graphql';
@@ -6,10 +7,10 @@ import { RefusalExtensions } from './refusalExtensions.js';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { httpTransport, CloudEvent, emitterFor } from 'cloudevents';
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
-import { MJEventType, MJGlobal, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
+import { MJEventType, MJGlobal, UUIDsEqual, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
 import { SQLParser, IsBalancedSQLFragment, LexSQL } from '@memberjunction/sql-parser';
 import { EncryptionEngine, IsEncryptionKeyUnavailable, ReportEncryptionKeyUnavailable } from '@memberjunction/encryption';
-import { PublishStatusUpdate } from './PushStatusResolver.js';
+import { PublishStatusUpdate, StatusUpdateOwnerID } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData } from './CacheInvalidationResolver.js';
 import { PubSubManager } from './PubSubManager.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
@@ -17,11 +18,18 @@ import { FieldMapper } from '@memberjunction/graphql-dataprovider';
  * Entities whose update is always hydrated from the stored row, never from the client's `OldValues___`, though they
  * do not track record changes: their server-side write rules compare against the prior state, which a client could
  * otherwise supply itself (lower-case names). See `ResolverBase.MustLoadTruthFromDatabase`.
+ *
+ * `mj: conversations` and `mj: ai agent sessions` carry the anonymous realtime-session ownership key
+ * (`ExternalID` / `ConversationID`), which their server entities refuse an anonymous visitor to change — a rule
+ * that decides on `Dirty`, so the baseline must be the stored row, not a client-supplied one (#4931).
  */
 const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW = new Set([
     'mj: record changes',
     'mj: conversation details',
     'mj: data context items',
+    'mj: conversations',
+    'mj: ai agent sessions',
+    'mj: ai agent runs',
 ]);
 export class ResolverBase {
     static { this._emit = process.env.CLOUDEVENTS_HTTP_TRANSPORT ? emitterFor(httpTransport(process.env.CLOUDEVENTS_HTTP_TRANSPORT)) : null; }
@@ -69,7 +77,7 @@ export class ResolverBase {
         const entityInfo = md.EntityByName(entityName);
         if (!entityInfo)
             throw new Error(`Entity ${entityName} not found in metadata`);
-        const denied = deniedReadFields ?? (entityInfo.EnableFieldLevelSecurity && contextUser
+        const denied = deniedReadFields ?? (entityInfo.FieldLevelSecurityApplies && contextUser
             ? entityInfo.GetDeniedReadFields(contextUser)
             : null);
         const mapper = new FieldMapper();
@@ -284,6 +292,7 @@ export class ResolverBase {
         if (!loaded) {
             return null;
         }
+        // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
         const mapped = await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
         return mapped;
     }
@@ -449,23 +458,54 @@ export class ResolverBase {
             return [];
         }
     }
+    /**
+     * Resolves a User View by name, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to a database `RunView` only on a cache miss.
+     */
+    async resolveUserViewByName(viewName, provider, contextUser) {
+        if (UserViewEngine.Instance.Loaded) {
+            const cached = UserViewEngine.Instance.GetViewByName(viewName);
+            if (cached) {
+                return cached;
+            }
+        }
+        const rv = provider;
+        const result = await rv.RunView({
+            EntityName: 'MJ: User Views',
+            // SECURITY: the view name is client-supplied and lands inside a SQL literal.
+            ExtraFilter: "Name='" + EscapeSQLString(viewName) + "'",
+        }, contextUser);
+        if (result && result.Success && result.Results.length > 0) {
+            return result.Results[0];
+        }
+        return null;
+    }
+    /**
+     * Resolves a User View by ID, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to an entity `Load()` only on a cache miss.
+     */
+    async resolveUserViewByID(viewID, provider, contextUser) {
+        if (UserViewEngine.Instance.Loaded) {
+            const cached = UserViewEngine.Instance.GetViewById(viewID);
+            if (cached) {
+                return cached;
+            }
+        }
+        const viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
+        await viewInfo.Load(viewID);
+        return viewInfo;
+    }
     async RunViewByNameGeneric(viewInput, provider, userPayload, pubSub) {
         try {
             // Log aggregate input for debugging
             if (viewInput.Aggregates?.length) {
                 LogStatus(`[ResolverBase] RunViewByNameGeneric received aggregates: viewName=${viewInput.ViewName}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
             }
-            const rv = provider;
-            const result = await rv.RunView({
-                EntityName: 'MJ: User Views',
-                // SECURITY: the view name is client-supplied and lands inside a SQL literal.
-                ExtraFilter: "Name='" + EscapeSQLString(viewInput.ViewName) + "'",
-            }, userPayload.userRecord);
-            if (result && result.Success && result.Results.length > 0) {
-                const viewInfo = result.Results[0];
+            const viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
+            if (viewInfo) {
                 return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, viewInput.AfterKey
                     ? CompositeKey.FromKeyValuePairs(viewInput.AfterKey.KeyValuePairs)
-                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
             }
             else {
                 LogError(`RunViewByNameGeneric: View ${viewInput.ViewName} not found or no results returned`);
@@ -484,9 +524,11 @@ export class ResolverBase {
                 LogStatus(`[ResolverBase] RunViewByIDGeneric received aggregates: viewID=${viewInput.ViewID}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
             }
             const contextUser = this.GetUserFromPayload(userPayload);
-            const viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
-            await viewInfo.Load(viewInput.ViewID);
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+            const viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
+            if (!viewInfo) {
+                return null;
+            }
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
         }
         catch (err) {
             console.log(err);
@@ -509,7 +551,7 @@ export class ResolverBase {
                 EntityID: entity.ID,
                 EntityBaseView: entity.BaseView,
             }; // only providing a few bits of data here, but it's enough to get the view to run
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView);
         }
         catch (err) {
             console.log(err);
@@ -524,7 +566,7 @@ export class ResolverBase {
             try {
                 let viewInfo = null;
                 if (viewInput.ViewName) {
-                    viewInfo = this.safeFirstArrayElement(await this.findBy(provider, 'MJ: User Views', { Name: viewInput.ViewName }, userPayload.userRecord));
+                    viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
                     // Populate EntityName on the input so callers (e.g. RunViews resolver) can
                     // look up the entity without re-querying the view
                     if (viewInfo && !viewInput.EntityName) {
@@ -532,8 +574,7 @@ export class ResolverBase {
                     }
                 }
                 else if (viewInput.ViewID) {
-                    viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
-                    await viewInfo.Load(viewInput.ViewID);
+                    viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
                     // Populate EntityName on the input so callers can look up the entity
                     if (viewInfo && !viewInput.EntityName) {
                         viewInput.EntityName = viewInfo.Entity;
@@ -580,6 +621,8 @@ export class ResolverBase {
                     bypassCache: viewInput.BypassCache,
                     dataSource: viewInput.DataSource,
                     includeBinaryFields: viewInput.IncludeBinaryFields,
+                    alternateBaseView: viewInput.AlternateBaseView,
+                    properties: viewInput.Properties,
                 });
             }
             catch (err) {
@@ -590,6 +633,30 @@ export class ResolverBase {
         let results = await this.RunViewsGenericInternal(params);
         return results;
     }
+    /**
+     * What an entity event may carry to a CloudEvents sink or a log line.
+     *
+     * The whole row for an entity without field security. For one where it applies (its own flag
+     * or an IS-A ancestor's), and for `MJ: Record Changes` (whose payload columns hold other
+     * entities' values), only the primary key and the names of the fields that changed: the sink
+     * is outside MemberJunction with no reader to project the row for, and these events fire for
+     * server-internal saves too, whose objects hold every column.
+     */
+    EntityEventPayload(baseEntity, changedFieldNames) {
+        const entityInfo = baseEntity.EntityInfo;
+        if (!entityInfo?.FieldLevelSecurityApplies && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)) {
+            // fls-guard: entity without field security and not the audit trail; whole row is the documented payload
+            return baseEntity.GetAll();
+        }
+        return {
+            // Read through Get() rather than PrimaryKey, which builds every field object of a raw-mode record.
+            PrimaryKey: (entityInfo.PrimaryKeys ?? []).map((pk) => ({ FieldName: pk.Name, Value: baseEntity.Get(pk.Name) })),
+            // A completed save has already rebased the object, so nothing on it is dirty: the event
+            // carries the names the save wrote. Other events (save_started) still read them off the object.
+            // GetDirtyFieldNames answers without building field objects for a record still in raw mode.
+            ChangedFields: changedFieldNames ?? baseEntity.GetDirtyFieldNames(),
+        };
+    }
     static { this._priorEmittedData = []; }
     async EmitCloudEvent({ component, event, eventCode, args }) {
         if (ResolverBase._emit && event === MJEventType.ComponentEvent && eventCode === BaseEntity.BaseEventCode) {
@@ -597,7 +664,7 @@ export class ResolverBase {
             const type = `MemberJunction.${event}${extendedType}`;
             const source = `${process.env.CLOUDEVENTS_SOURCE ?? 'MemberJunction'}`;
             const subject = args instanceof BaseEntityEvent ? args.baseEntity.EntityInfo.CodeName : undefined;
-            const data = args?.baseEntity?.GetAll() ?? {};
+            const data = args?.baseEntity ? this.EntityEventPayload(args.baseEntity, args.ChangedFieldNames) : {};
             const cloudEvent = new CloudEvent({ type, source, subject, data });
             try {
                 // check to see if the combination of Entity and pkey was already emitted, if so, Log that condtion next
@@ -873,7 +940,7 @@ export class ResolverBase {
      * - Field filtering at source (Fix #7)
      * - Improved error handling (Fix #9)
      */
-    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields) {
+    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields, alternateBaseView, properties) {
         try {
             if (!viewInfo || !userPayload)
                 return null;
@@ -919,6 +986,7 @@ export class ResolverBase {
             const result = await rv.RunView({
                 ViewID: viewInfo.ID,
                 ViewName: viewInfo.Name,
+                ViewEntity: viewInfo.ID ? viewInfo : undefined,
                 EntityName: viewInfo.Entity,
                 ExtraFilter: extraFilter,
                 OrderBy: orderBy,
@@ -939,7 +1007,18 @@ export class ResolverBase {
                 BypassCache: bypassCache,
                 DataSource: dataSource,
                 IncludeBinaryFields: includeBinaryFields,
+                AlternateBaseView: alternateBaseView,
+                Properties: properties,
+                TimeZone: userPayload?.TimeZone,
             }, user);
+            if (result && typeof result === 'object') {
+                Object.defineProperty(result, '_resolvedViewEntity', {
+                    value: viewInfo,
+                    enumerable: false,
+                    configurable: true,
+                    writable: true,
+                });
+            }
             // Log aggregate results for debugging
             if (aggregates?.length) {
                 LogStatus(`[ResolverBase] RunView result aggregate info: entityName=${viewInfo.Entity}, hasAggregateResults=${!!result?.AggregateResults}, aggregateResultCount=${result?.AggregateResults?.length || 0}, aggregateExecutionTime=${result?.AggregateExecutionTime}, aggregateResults=${JSON.stringify(result?.AggregateResults)}`);
@@ -966,7 +1045,7 @@ export class ResolverBase {
             if (result?.Success && result.Results?.length) {
                 result.Results = result.Results.map(r => mapper.MapFields({ ...r }));
                 // Filter encrypted fields before sending to API client
-                await this.ArrayFilterEncryptedFieldsForAPI(viewInfo.Entity, result.Results, user);
+                await this.ArrayFilterEncryptedFieldsForAPI(viewInfo.Entity, result.Results, user, md);
             }
             return result;
         }
@@ -1050,6 +1129,7 @@ export class ResolverBase {
                 runViewParams.push({
                     ViewID: param.viewInfo.ID,
                     ViewName: param.viewInfo.Name,
+                    ViewEntity: param.viewInfo.ID ? param.viewInfo : undefined,
                     EntityName: param.viewInfo.Entity,
                     ExtraFilter: param.extraFilter,
                     OrderBy: param.orderBy,
@@ -1070,6 +1150,9 @@ export class ResolverBase {
                     BypassCache: param.bypassCache,
                     DataSource: param.dataSource,
                     IncludeBinaryFields: param.includeBinaryFields,
+                    AlternateBaseView: param.alternateBaseView,
+                    Properties: param.properties,
+                    TimeZone: param.userPayload?.TimeZone,
                 });
             }
             // Fix #4: Run views in a single batch through RunViews
@@ -1086,7 +1169,7 @@ export class ResolverBase {
                     // Use the corresponding param's entity name
                     const entityName = params[i]?.viewInfo?.Entity;
                     if (entityName && contextUser) {
-                        await this.ArrayFilterEncryptedFieldsForAPI(entityName, runViewResult.Results, contextUser);
+                        await this.ArrayFilterEncryptedFieldsForAPI(entityName, runViewResult.Results, contextUser, md);
                     }
                 }
             }
@@ -1205,8 +1288,9 @@ export class ResolverBase {
      * skip redundant re-fetches (it already handled the event locally).
      *
      * The row itself rides along ONLY for entities opted in via
-     * `cacheSettings.recordDataBroadcastEntities` — this event reaches every connected client
-     * unfiltered, so the row would otherwise be readable by sessions that could not read the record.
+     * `cacheSettings.recordDataBroadcastEntities`, and never for one under field-level security —
+     * this event reaches every connected client unprojected, so the row would otherwise be readable
+     * by sessions that could not read the record or its restricted fields.
      */
     PublishCacheInvalidation(entityObject, action, userPayload) {
         const entityName = entityObject.EntityInfo.Name;
@@ -1217,23 +1301,25 @@ export class ResolverBase {
             sourceServerId: MJGlobal.Instance.ProcessUUID,
             timestamp: new Date(),
             originSessionId: userPayload?.sessionId || null,
-            recordData: action === 'save' && MayBroadcastRecordData(entityName)
+            recordData: action === 'save' && MayBroadcastRecordData(entityName, entityObject.EntityInfo)
+                // fls-guard: MayBroadcastRecordData refuses FLS entities and Record Changes
                 ? JSON.stringify(entityObject.GetAll())
                 : undefined,
         });
     }
     /**
      * Publishes a push-status update to the client on {@link PUSH_STATUS_UPDATES_TOPIC}, stamping the
-     * authenticated owner's user ID from `userPayload` so the subscription filter can bind delivery
-     * to identity (see B49 / `statusUpdatesFilter`). The ergonomic wrapper every resolver should use
-     * instead of calling `pubSub.publish` on the topic directly — it makes omitting identity
-     * impossible. Non-resolver publishers (services, the liveness heartbeat) call the shared
-     * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
+     * owner key of `userPayload` (`StatusUpdateOwnerID`: the request's user, or the widget guest an
+     * elevated payload stands in for) so the subscription filter can bind delivery to identity (see B49 /
+     * `StatusUpdatesFilter`). The ergonomic wrapper every resolver should use instead of calling
+     * `pubSub.publish` on the topic directly — it makes omitting identity impossible. Non-resolver
+     * publishers (services, the liveness heartbeat) call the shared `PublishStatusUpdate()` function
+     * directly with an explicit `ownerUserId`.
      */
     PublishStatusUpdate(pubSub, sessionId, message, userPayload) {
         PublishStatusUpdate(pubSub, {
             sessionId,
-            ownerUserId: userPayload?.userRecord?.ID ?? '',
+            ownerUserId: StatusUpdateOwnerID(userPayload),
             message,
         });
     }
@@ -1253,28 +1339,50 @@ export class ResolverBase {
                     if (baseEntity?.EntityInfo?.Name !== uniqueKey) {
                         return;
                     }
-                    const baseEntityValues = baseEntity ? baseEntity.GetAll() : null;
+                    const baseEntityValues = baseEntity ? this.EntityEventPayload(baseEntity, event.args instanceof BaseEntityEvent ? event.args.ChangedFieldNames : undefined) : null;
                     const eventToLog = { entityName: entityObject.EntityInfo.Name, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
                     LogDebug(`ResolverBase.ListenForEntityMessages: Received Event from within MJGlobal.Instance.GetEventListener() callback. Will call EmitCloudEvent() next\nEvent data:\n${JSON.stringify(eventToLog)}`);
                     await this.EmitCloudEvent(event);
                     LogDebug(`ResolverBase.ListenForEntityMessages: EmitCloudEvent() completed successfully`);
-                    if (event.args && event.args instanceof BaseEntityEvent) {
-                        const baseEntityEvent = event.args;
-                        // message from our entity object, relay it to the client
+                    if (event.args && event.args instanceof BaseEntityEvent && this.EntityEventBelongsToSession(event.args, userPayload)) {
+                        // message from an entity object of this session's user, relay it to the client
                         LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
-                        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
-                            status: 'OK',
-                            type: 'EntityObjectStatusMessage',
-                            entityName: baseEntityEvent.baseEntity.EntityInfo.Name,
-                            primaryKey: baseEntityEvent.baseEntity.PrimaryKey,
-                            message: event.args.payload,
-                        }), userPayload);
+                        this.PublishStatusUpdate(pubSub, userPayload.sessionId, this.EntityStatusMessage(event.args), userPayload);
                     }
                 }
             });
             this.eventSubscriptions.set(uniqueKey, theSub);
         }
     }
+    /**
+     * Whether an entity event may be relayed to the session whose call created the listener. The
+     * listener is shared by every caller in the process for that entity, so an event raised by an
+     * object loaded for another user (or for the system user) is never relayed to this session.
+     */
+    EntityEventBelongsToSession(event, userPayload) {
+        const sessionUserId = userPayload?.userRecord?.ID;
+        const objectUserId = event.baseEntity?.ContextCurrentUser?.ID;
+        return Boolean(sessionUserId && objectUserId && UUIDsEqual(sessionUserId, objectUserId));
+    }
+    /**
+     * The status message relayed for an entity event: the entity, key and event type. The event's
+     * payload is included only when it cannot carry record values: never for a delete (its payload
+     * is the whole deleted row), an entity under field-level security, or `MJ: Record Changes`.
+     */
+    EntityStatusMessage(event) {
+        const entityInfo = event.baseEntity.EntityInfo;
+        const mayCarryPayload = event.type !== 'delete'
+            && !entityInfo.FieldLevelSecurityApplies
+            && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+        return JSON.stringify({
+            status: 'OK',
+            type: 'EntityObjectStatusMessage',
+            entityName: entityInfo.Name,
+            primaryKey: event.baseEntity.PrimaryKey,
+            eventType: event.type,
+            message: mayCarryPayload ? event.payload : undefined,
+        });
+    }
     /**
      * IS-A PROMOTION over the wire: an EXISTING parent record gaining a subtype — an Animal that is
      * now also a Dog. It arrives as the CHILD's create mutation carrying the existing parent's
@@ -1348,6 +1456,9 @@ export class ResolverBase {
             // IS-A promotion: bind the new child to its EXISTING parent row BEFORE the field
             // assignments, so values the client sent for parent fields land on the loaded parent
             // (as an update) instead of being wiped by the load.
+            // Field-level security: refuse a key the caller may not read, or that names no field, before
+            // anything is applied (the same gate as the update path).
+            AssertClientInputWritableForUser(entityObject.EntityInfo, fieldsForSet, this.GetUserFromPayload(userPayload));
             await this.attachToExistingParentIfPromotion(entityObject, fieldsForSet);
             entityObject.SetMany(fieldsForSet);
             // Reconstruct the client-side restore context, if any, on this server
@@ -1361,6 +1472,7 @@ export class ResolverBase {
                 // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
                 const contextUser = this.GetUserFromPayload(userPayload);
                 // MapFieldNamesToCodeNames now handles encryption filtering as well
+                // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
                 return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
             }
             // save failed, throw error with message
@@ -1398,12 +1510,11 @@ export class ResolverBase {
                 }
             });
             // Field-level security: any value the client sends for a field it cannot READ is
-            // fabricated by construction (the field was stripped from every payload the client ever
-            // received), so strip such values before anything applies them. When any field is
-            // denied we also force the truth-load branch below — client OldValues for denied fields
-            // are equally fabricated, so hydrating from them (the no-DB-load path) would write
-            // fabricated state into the denied columns on save.
-            const hasDeniedReadFields = this.StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues);
+            // fabricated by construction (the field was absent from every payload the client ever
+            // received), so the input is refused before anything applies it. When any field is
+            // denied we also force the truth-load branch below, so the denied columns keep what the
+            // database holds rather than anything derived from the client's OldValues.
+            const hasDeniedReadFields = this.AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues);
             // The audit-trail equivalent. Its `true` matters most on THIS entity: 'MJ: Record Changes'
             // has TrackRecordChanges off, so without it a client sending OldValues takes the branch below
             // that hydrates from those values — never loading what the database actually holds.
@@ -1459,6 +1570,7 @@ export class ResolverBase {
                 await this.AfterUpdate(provider, input); // fire event
                 // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
                 // MapFieldNamesToCodeNames now handles encryption filtering as well
+                // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
                 return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), userInfo);
             }
             else {
@@ -1510,7 +1622,7 @@ export class ResolverBase {
      * writable fields in `OldValues___`, so {@link hasCompleteOldValues} returns `false` and forces the
      * database load (`InnerLoad`) so untouched columns retain their stored values.
      *
-     * `EnableFieldLevelSecurity` is the security-critical one, and it is NOT redundant with
+     * `FieldLevelSecurityApplies` (own flag or an IS-A ancestor's) is the security-critical one, and it is NOT redundant with
      * `hasDeniedReadFields`. That flag reports READ denials, and the canonical FLS configuration is
      * Read Allow + Update Deny — which leaves it false. Such a caller would be hydrated from its own
      * `OldValues___`, and a value it supplies there for an update-denied field arrives through
@@ -1558,60 +1670,43 @@ export class ResolverBase {
             !this.hasCompleteOldValues(entityInfo, input.OldValues___) ||
             hasDeniedReadFields ||
             hasNarrowedAuditPayload ||
-            entityInfo.EnableFieldLevelSecurity ||
+            entityInfo.FieldLevelSecurityApplies ||
             !user ||
             entityInfo.GetEffectiveRowFilterWhereClause(user, EntityPermissionType.Update, '').length > 0);
     }
     /**
-     * Field-level security guard for the update path.
+     * Field-level security gate on the update path's client input.
      *
-     * Every denied-read field is stripped — new values AND OldValues. A field the user cannot
-     * read was absent from every payload that client ever received, so any value coming back for
-     * it is the transport's invention rather than user intent, and applying it would silently
-     * overwrite the real column. Stripping is what makes "load a record, edit an unrelated field,
-     * save" safe for a restricted user.
+     * For a caller denied at least one field on the entity, refuses (with a `FieldSecurityError`)
+     * any key in the new values or in `OldValues___` that names a field the caller cannot READ, or
+     * that names no field at all, with the same message for both (see
+     * `AssertClientInputWritableForUser`), so the refusal does not reveal which columns exist.
      *
-     * There is no split by update permission: Read is required for Update, so a user denied read
-     * is denied update too and denied-read ∩ denied-update is just denied-read.
+     * Refused rather than dropped: a field the caller cannot read was absent from every payload the
+     * client received, so a value for it can only be fabricated. A well-behaved client never sends
+     * one (it omits fields it did not load), so ordinary traffic is unaffected.
      *
-     * Silent narrowing, not rejection — consistent with the output projection the client already
-     * experiences, and with the ambiguous-error rule (naming the field would confirm it exists
-     * and is restricted).
+     * There is no split by update permission: Read is required for Update, so a user denied read is
+     * denied update too.
      *
-     * Returns true when the user has a non-empty denied-read set on this entity. The caller
-     * must then hydrate the entity from the DATABASE (never from client OldValues), so denied
-     * fields hold true values that an omitted key leaves untouched.
+     * Returns true when the user has a non-empty denied-read set on this entity. The caller must
+     * then hydrate the entity from the DATABASE (never from client OldValues), so denied fields hold
+     * true values the client input never touches.
      */
-    StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues) {
-        if (!entityInfo.EnableFieldLevelSecurity || !userInfo) {
+    AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues) {
+        if (!entityInfo.FieldLevelSecurityApplies || !userInfo) {
             return false;
         }
-        const deniedReadNames = entityInfo.GetDeniedReadFields(userInfo);
-        if (deniedReadNames.size === 0) {
+        if (entityInfo.GetDeniedReadFields(userInfo).size === 0) {
             return false;
         }
-        // Input keys are entity CodeNames (post ReverseMapInputFieldNames); the denied set holds
-        // lowercased field Names — bridge via the field metadata once.
-        const deniedReadCodeNames = new Set();
-        for (const field of entityInfo.Fields) {
-            if (deniedReadNames.has(field.Name.trim().toLowerCase())) {
-                deniedReadCodeNames.add(field.CodeName.trim().toLowerCase());
-            }
-        }
-        const stripped = [];
-        for (const key of Object.keys(clientNewValues)) {
-            if (deniedReadCodeNames.has(key.trim().toLowerCase())) {
-                delete clientNewValues[key];
-                delete input[key];
-                stripped.push(key);
-            }
-        }
+        AssertClientInputWritableForUser(entityInfo, clientNewValues, userInfo);
         if (Array.isArray(input.OldValues___)) {
-            input.OldValues___ = input.OldValues___.filter((item) => !deniedReadCodeNames.has(String(item.Key).trim().toLowerCase()));
-        }
-        if (stripped.length > 0) {
-            LogDebug(`[FieldSecurity] UpdateRecord on '${entityInfo.Name}' for user ${userInfo.Email}: ` +
-                `stripped client-sent value(s) for denied-read field(s) ${stripped.join(', ')}`);
+            const oldValueKeys = {};
+            for (const item of input.OldValues___) {
+                oldValueKeys[String(item.Key)] = null;
+            }
+            AssertClientInputWritableForUser(entityInfo, oldValueKeys, userInfo);
         }
         return true;
     }
@@ -1740,6 +1835,7 @@ export class ResolverBase {
         });
         // clientOldValues now has all of the oldValues the CLIENT passed us. Now we need to build the same kind of object
         // with the DB values
+        // fls-guard: compared on the server only, never returned
         const dbValues = entityObject.GetAll();
         // now we need to compare clientOldValues and dbValues and have a new array that has entries for any differences and have FieldName, clientOldValue and dbValue as properties
         const dbDifferences = [];
@@ -1820,30 +1916,31 @@ export class ResolverBase {
                 };
                 // Log as warning to console and ErrorLog table instead of throwing error
                 console.warn('Entity save inconsistency detected but allowing save to continue:', JSON.stringify(msg));
-                LogError({
-                    service: 'ResolverBase',
-                    operation: 'TestAndSetClientOldValuesToDBValues',
-                    error: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
-                    details: {
+                LogErrorEx({
+                    message: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
+                    severity: 'warning',
+                    category: 'ResolverBase.TestAndSetClientOldValuesToDBValues',
+                    metadata: {
                         entityName: entityObject.EntityInfo.Name,
                         clientDifferences: clientDifferences,
                         dbDifferences: dbDifferences,
-                        overlap: overlap
-                    }
+                        overlap: overlap,
+                    },
                 });
                 // Create ErrorLog record in the database — use the entity's bound provider so the
                 // ErrorLog write goes to the same connection as the entity that triggered it.
                 try {
                     const md = entityObject.ProviderToUse;
                     const errorLogEntity = await md.GetEntityObject('MJ: Error Logs', contextUser);
-                    errorLogEntity.Code = 'ENTITY_SAVE_INCONSISTENCY';
+                    // Code is NCHAR(20); a longer value is rejected at the database
+                    errorLogEntity.Code = 'SAVE_INCONSISTENCY';
                     errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
                     errorLogEntity.Status = 'Warning';
                     errorLogEntity.Category = 'Entity Save';
                     errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
                     const saveResult = await errorLogEntity.Save();
                     if (!saveResult) {
-                        console.error('Failed to save ErrorLog record');
+                        console.error(`Failed to save ErrorLog record for ${entityObject.EntityInfo.Name}: ${errorLogEntity.LatestResult?.CompleteMessage}`);
                     }
                 }
                 catch (errorLogError) {
@@ -1872,7 +1969,10 @@ export class ResolverBase {
                     extensions: { code: 'LOAD_ENTITY_ERROR', entityName },
                 });
             }
-            const returnValue = entityObject.GetAll(); // grab the values before we delete so we can return last state before delete if we are successful.
+            // Grab the values before we delete so we can return the last state if the delete succeeds,
+            // projected for the caller in case the object holds a column they may not read.
+            // fls-guard: projected by ProjectEntityValuesForUser
+            const returnValue = ProjectEntityValuesForUser(provider, entityObject.EntityInfo, entityObject.GetAll(), this.GetUserFromPayload(userPayload));
             this.ListenForEntityMessages(entityObject, pubSub, userPayload);
             if (await entityObject.Delete(options)) {
                 await this.AfterDelete(provider, key); // fire event