@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/realtimeWidget/WidgetSessionService.ts

@@ -9,20 +9,22 @@
  * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
  * carried in the token, plus best-effort structured audit logging. The minted
  * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
- * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ * JWKS) and synthesized into a constrained guest principal by `BuildMagicLinkSessionUser`.
  *
  * @module @memberjunction/server/widget
  */
 
+import { createPublicKey } from 'node:crypto';
+import jwt from 'jsonwebtoken';
 import { Metadata, RunView, UserInfo, LogError, LogStatus } from '@memberjunction/core';
-import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
+import { ComputeJwkThumbprint, MJLruCache, ToProofPublicJwk, UUIDsEqual, VerifyProofOfPossessionJwt, type ProofPublicJwk } from '@memberjunction/global';
 import type { MJConversationWidgetInstanceEntity, MJConversationEntity } from '@memberjunction/core-entities';
 import { ResolveConfiguredPrincipal } from '../auth/principals.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { GenerateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
 import { configInfo, type WidgetConfig } from '../config.js';
-import { BuildWidgetGuestClaims, EvaluateWidgetMint, ParseEnabledChannels, type WidgetMintErrorCode } from './widgetCore.js';
+import { BuildWidgetGuestClaims, EvaluateWidgetMint, IsIsolatedGuestRole, ParseEnabledChannels, type GuestRolePolicy, type WidgetMintErrorCode } from './widgetCore.js';
 import { VerifyHostAssertion, type HostAssertedIdentity } from './host-identity.js';
 import { WriteReturningVisitorRecap } from '../agentSessions/ReturningVisitorRecap.js';
 import { ResolveIdentityByEmail, MergeVisitorIdentity, ForgetVisitor, type ResolvedVisitorIdentity } from './visitorIdentity.js';
@@ -33,6 +35,43 @@ const CONVERSATIONS_ENTITY = 'MJ: Conversations';
 /** Shape of the durable visitor anchor key (opaque base64url, same alphabet as generateSessionId). */
 const VISITOR_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 
+/**
+ * Maximum clock-skew / late-timer grace window (seconds) after `exp` during which
+ * `RefreshGuestSession` still accepts a widget guest Bearer token and preserves its `mj_sid`.
+ */
+export const REFRESH_GRACE_SECONDS = 300;
+
+/**
+ * Hard end of a widget guest session (seconds after its first mint, `mj_sid_iat`). Refresh keeps the
+ * visitor's `mj_sid`, so without an end a token captured once could be renewed forever and keep reading
+ * that visitor's conversations; past this point refresh is refused and no token outlives it.
+ */
+export const MAX_GUEST_SESSION_SECONDS = 12 * 3600;
+
+/**
+ * The least lifetime a refreshed token may have. Refresh is refused once less than this remains before the hard end,
+ * so the last refresh gets the 403 that makes the widget start a new session. It must exceed the widget's refresh
+ * lead (60 s before `exp`): a token issued with less would be due for refresh at once, every time, until the rate
+ * limiter answered 429 instead. It also keeps a re-minted token's `exp` after its `iat`.
+ */
+export const MIN_REFRESHED_TOKEN_SECONDS = 120;
+
+/** The refresh route's path under the widget mount; the refresh proof must name it (`htu`). */
+export const WIDGET_REFRESH_PATH = '/session/refresh';
+
+/** How far a refresh proof's signing time (`iat`) may be from the server clock, either way. */
+export const REFRESH_PROOF_MAX_SKEW_SECONDS = 60;
+
+/** The session a valid refresh token belongs to, carried into the re-minted token unchanged. */
+interface RefreshableGuestSession {
+  /** `mj_sid`. */
+  SessionId: string;
+  /** `mj_sid_iat`: when the session was first minted, epoch seconds. */
+  StartedAtSeconds: number;
+  /** `cnf.jkt`: the thumbprint of the key the session is bound to. */
+  KeyThumbprint: string;
+}
+
 /** Resolved returning-visitor anchor for a mint: the durable key + the prior conversation to chain from. */
 interface ReturningVisitorResolution {
   /** The durable VisitorKey to persist as a cookie (validated-presented or freshly minted). */
@@ -67,6 +106,19 @@ export interface MintGuestSessionInput {
    * server mints a fresh one. Ignored entirely when remembering is off.
    */
   visitorKey?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  /**
+   * The caller's current guest session JWT (`Authorization: Bearer <token>`), required by
+   * `RefreshGuestSession` so a refresh proves possession of the session being renewed and
+   * preserves its `mj_sid` (`sessionId`).
+   */
+  BearerToken?: string;
+  /**
+   * The widget's proof key (public P-256 JWK, from the mint body's `proofKey`). Its thumbprint is signed into
+   * the token as `cnf.jkt`; a token minted without one cannot be refreshed.
+   */
+  ProofKey?: ProofPublicJwk;
+  /** The refresh proof (`DPoP` header), signed by the key registered at mint. Required by `RefreshGuestSession`. */
+  Proof?: string;
   audit?: WidgetMintAuditContext;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
@@ -210,6 +262,8 @@ export class WidgetSessionService {
   constructor(
     private readonly publicUrl: string,
     private readonly config: WidgetConfig,
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    private readonly guestRolePolicy: GuestRolePolicy = { GrantableRoleNames: [] },
   ) {}
 
   /**
@@ -237,11 +291,11 @@ export class WidgetSessionService {
         return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
       }
 
-      const guestRoleName = this.resolveGuestRoleName(widget.GuestRoleID);
-      if (!guestRoleName) {
-        LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
-        return this.audited({ success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' }, input, widget);
+      const guestRole = this.resolveIsolatedGuestRole(widget);
+      if (guestRole.ok === false) {
+        return this.audited(guestRole.refusal, input, widget);
       }
+      const guestRoleName = guestRole.name;
 
       // D1 host-identity strategy: a HostIdentity widget MUST present a valid host assertion.
       let hostIdentity: HostAssertedIdentity | undefined;
@@ -267,7 +321,21 @@ export class WidgetSessionService {
       // anonymous trail to that record and surface the pair so the client stamps the new conversation.
       const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
 
-      return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity), input, widget);
+      let proofKeyThumbprint: string | undefined;
+      if (input.ProofKey !== undefined) {
+        const proofKey = ToProofPublicJwk(input.ProofKey);
+        if (!proofKey) {
+          LogError(`[Widget] Mint for widget ${widget.ID} refused: the proof key is not a public P-256 JWK.`);
+          return this.audited({ success: false, errorCode: 'not_found', error: 'Widget mint rejected.' }, input, widget);
+        }
+        proofKeyThumbprint = await ComputeJwkThumbprint(proofKey);
+      }
+
+      return this.audited(
+        this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, undefined, proofKeyThumbprint),
+        input,
+        widget,
+      );
     } catch (e) {
       LogError(e);
       return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
@@ -275,12 +343,147 @@ export class WidgetSessionService {
   }
 
   /**
-   * Refreshes a live guest session. The widget always holds its public key, so a
-   * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
-   * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+   * Refreshes a live guest session while preserving its per-visitor `sessionId` (`mj_sid`).
+   * Requires the caller's current widget guest JWT (`input.BearerToken`), verified against the
+   * magic-link signing key with a {@link REFRESH_GRACE_SECONDS} post-expiry grace window, and
+   * bound to the resolved widget instance (`mj_widget_id === widget.ID`, `mj_anon === true`,
+   * `mj_magic_link === true`). Any failure returns the same uniform 403 shape as an unknown widget key.
    */
   public async RefreshGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult> {
-    return this.MintGuestSession(input);
+    try {
+      const contextUser = this.resolveLookupUser();
+      if (!contextUser) {
+        LogError('[Widget] No lookup context user available; server not configured.');
+        return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+      }
+
+      const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+      if (!widget) {
+        return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, undefined);
+      }
+
+      const eligibility = EvaluateWidgetMint(
+        { Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality },
+        input.origin,
+      );
+      if (!eligibility.ok) {
+        return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
+      }
+
+      const guestRole = this.resolveIsolatedGuestRole(widget);
+      if (guestRole.ok === false) {
+        return this.audited(guestRole.refusal, input, widget);
+      }
+      const guestRoleName = guestRole.name;
+
+      let hostIdentity: HostAssertedIdentity | undefined;
+      if (widget.AuthStrategy === 'HostIdentity') {
+        const verified = this.verifyHost(widget, input.hostAssertion);
+        if (!verified) {
+          return this.audited({ success: false, errorCode: 'host_assertion_invalid', error: 'Host identity assertion invalid.' }, input, widget);
+        }
+        hostIdentity = verified;
+      }
+
+      const existingSession = await this.verifyRefreshRequest(input.BearerToken, input.Proof, widget.ID);
+      if (!existingSession) {
+        return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, widget);
+      }
+
+      const returningVisitor = await this.resolveReturningVisitor(widget, input.visitorKey, contextUser);
+      const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
+
+      return this.audited(
+        this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, existingSession.KeyThumbprint),
+        input,
+        widget,
+      );
+    } catch (e) {
+      LogError(e);
+      return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+    }
+  }
+
+  /**
+   * Verifies a `RefreshGuestSession` request: the caller's current widget guest JWT and the proof that the
+   * caller holds the key the token is bound to. Returns the session to carry forward, or `null` when the token
+   * is missing, tampered, expired past {@link REFRESH_GRACE_SECONDS}, past the session's hard end
+   * ({@link MAX_GUEST_SESSION_SECONDS}) or without a session start, non-anonymous, minted for a different
+   * widget, issued by another deployment, or not bound to a key; or when the proof is missing or not made by
+   * that key for this request and token.
+   */
+  private async verifyRefreshRequest(bearerToken: string | undefined, proof: string | undefined, widgetId: string): Promise<RefreshableGuestSession | null> {
+    const session = this.verifyRefreshBearerToken(bearerToken, widgetId);
+    if (!session) {
+      return null;
+    }
+    const verification = await VerifyProofOfPossessionJwt(proof ?? '', {
+      Method: 'POST',
+      PathSuffix: WIDGET_REFRESH_PATH,
+      AccessToken: (bearerToken ?? '').trim(),
+      NowSeconds: Math.floor(Date.now() / 1000),
+      MaxSkewSeconds: REFRESH_PROOF_MAX_SKEW_SECONDS,
+    });
+    if (verification.Valid === false) {
+      LogError(`[Widget] Refresh proof refused for widget ${widgetId} (${verification.Reason}).`);
+      return null;
+    }
+    if (verification.Thumbprint !== session.KeyThumbprint) {
+      LogError(`[Widget] Refresh proof refused for widget ${widgetId}: signed by a key the token is not bound to.`);
+      return null;
+    }
+    return session;
+  }
+
+  /** The token half of {@link verifyRefreshRequest}: everything except the proof. */
+  private verifyRefreshBearerToken(bearerToken: string | undefined, widgetId: string): RefreshableGuestSession | null {
+    const token = (bearerToken ?? '').trim();
+    if (!token) {
+      return null;
+    }
+    try {
+      const jwk = MagicLinkKeyManager.Instance.GetJWKS().keys[0];
+      if (!jwk) {
+        return null;
+      }
+      const publicKey = createPublicKey({ key: { ...jwk }, format: 'jwk' });
+      const verified = jwt.verify(token, publicKey, {
+        algorithms: ['RS256'],
+        audience: this.config.audience,
+        issuer: this.publicUrl,
+        ignoreExpiration: true,
+      });
+      if (typeof verified !== 'object' || verified === null) {
+        return null;
+      }
+      const payload = verified as jwt.JwtPayload;
+      const nowSeconds = Math.floor(Date.now() / 1000);
+      if (typeof payload.exp !== 'number' || nowSeconds > payload.exp + REFRESH_GRACE_SECONDS) {
+        return null;
+      }
+      if (payload.mj_magic_link !== true || payload.mj_anon !== true) {
+        return null;
+      }
+      if (typeof payload.mj_widget_id !== 'string' || !UUIDsEqual(payload.mj_widget_id, widgetId)) {
+        return null;
+      }
+      const sid = typeof payload.mj_sid === 'string' ? payload.mj_sid.trim() : '';
+      if (sid.length === 0) {
+        return null;
+      }
+      const startedAt = payload.mj_sid_iat;
+      if (typeof startedAt !== 'number' || !Number.isFinite(startedAt) || startedAt + MAX_GUEST_SESSION_SECONDS - nowSeconds < MIN_REFRESHED_TOKEN_SECONDS) {
+        return null;
+      }
+      const keyThumbprint = typeof payload.cnf?.jkt === 'string' ? payload.cnf.jkt : '';
+      if (keyThumbprint.length === 0) {
+        return null;
+      }
+      return { SessionId: sid, StartedAtSeconds: startedAt, KeyThumbprint: keyThumbprint };
+    } catch (e) {
+      LogError(`[Widget] Refresh token verification failed for widget ${widgetId}: ${e instanceof Error ? e.message : String(e)}`);
+      return null;
+    }
   }
 
   /**
@@ -343,7 +546,7 @@ export class WidgetSessionService {
    * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
    * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
    *
-   * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+   * This converges on the SAME `AuthProviderFactory` + `BuildMagicLinkSessionUser` path as the guest
    * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
    * throws for business failures — returns a structured result.
    */
@@ -412,12 +615,18 @@ export class WidgetSessionService {
     hostIdentity?: HostAssertedIdentity,
     returningVisitor?: ReturningVisitorResolution,
     resolvedIdentity?: ResolvedVisitorIdentity,
+    existingSession?: RefreshableGuestSession,
+    proofKeyThumbprint?: string,
   ): MintGuestSessionResult {
     const nowSeconds = Math.floor(Date.now() / 1000);
     const ttlMinutes = widget.SessionTTLMinutes || this.config.defaultSessionTtlMinutes;
-    // Generated once and returned to the client: the widget stamps Conversation.ExternalID with
-    // this id so the Widget Guest RLS filters ({{ScopeResourceID}}) isolate this guest's rows.
-    const sessionId = GenerateSessionId();
+    // Generated once on initial mint and preserved across refreshes: the widget (and server-side
+    // voice session creation) stamps Conversation.ExternalID with this id so the Widget Guest RLS
+    // filters ({{ScopeResourceID}}) and AuthorizeSessionAccess isolate this guest's rows.
+    const sessionId = existingSession?.SessionId ?? GenerateSessionId();
+    const startedAtSeconds = existingSession?.StartedAtSeconds ?? nowSeconds;
+    // No token outlives the session's hard end, so the cap holds for API calls as well as for refresh.
+    const ttlSeconds = Math.min(ttlMinutes * 60, startedAtSeconds + MAX_GUEST_SESSION_SECONDS - nowSeconds);
     const claims = BuildWidgetGuestClaims({
       issuer: this.publicUrl,
       audience: this.config.audience,
@@ -427,7 +636,9 @@ export class WidgetSessionService {
       applicationId: widget.ApplicationID,
       guestRoleName,
       nowSeconds,
-      ttlSeconds: ttlMinutes * 60,
+      ttlSeconds,
+      sessionStartedAtSeconds: startedAtSeconds,
+      proofKeyThumbprint,
       hostIdentity,
       // RV1/RV2/RV4: carry the returning-visitor anchor + resolved identity as claims so the voice path
       // (server-created conversation) stamps the same fields the text path stamps client-side.
@@ -692,6 +903,30 @@ export class WidgetSessionService {
     return role?.Name ?? null;
   }
 
+  /**
+   * The ONE decision, for mint and refresh alike, of which role a guest token carries: the widget's `GuestRoleID`
+   * must resolve, and it must be a role the deployment may hand to an anonymous visitor
+   * ({@link IsIsolatedGuestRole}). Both refusals are the admin's to fix, so both are logged with the widget id;
+   * the visitor gets a uniform rejection.
+   */
+  private resolveIsolatedGuestRole(
+    widget: MJConversationWidgetInstanceEntity,
+  ): { ok: true; name: string } | { ok: false; refusal: MintGuestSessionResult } {
+    const name = this.resolveGuestRoleName(widget.GuestRoleID);
+    if (!name) {
+      LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
+      return { ok: false, refusal: { success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' } };
+    }
+    if (!IsIsolatedGuestRole(name, this.guestRolePolicy)) {
+      LogError(
+        `[Widget] Widget ${widget.ID} grants guest role '${name}', whose row filters do not isolate anonymous visitors ` +
+          `from each other. Use the Widget Guest role, or list '${name}' in magicLink.grantableRoleNames to allow it (MJ#6043).`,
+      );
+      return { ok: false, refusal: { success: false, errorCode: 'guest_role_not_isolated', error: 'Widget mint rejected.' } };
+    }
+    return { ok: true, name };
+  }
+
   /** Resolves the server-side context user used to READ widget config (not the guest principal). */
   private resolveLookupUser(): UserInfo | null {
     return ResolveConfiguredPrincipal(this.config.contextUserForLookup, 'Widget');

package/src/realtimeWidget/host-identity.ts

@@ -5,7 +5,7 @@
  * `POST /widget/session`, which verifies it against the host's registered public key
  * and folds the host-provided identity into the minted guest claims. The minted token
  * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
- * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * `BuildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
  * session-validation provider (it converges on the one pathway, per D1).
  *
  * Pure + unit-testable: verification takes the PEM as an argument.

package/src/realtimeWidget/widgetCore.ts

@@ -12,7 +12,7 @@
  * @module @memberjunction/server/widget
  */
 
-import { BuildSessionClaims } from '../auth/magicLink/magicLinkCore.js';
+import { BuildSessionClaims, IsRoleGrantable } from '../auth/magicLink/magicLinkCore.js';
 import type { MagicLinkJWTClaims } from '../auth/magicLink/types.js';
 
 /**
@@ -31,8 +31,29 @@ export type WidgetMintErrorCode =
     | 'host_assertion_invalid'
     | 'upgrade_not_enabled'
     | 'invalid_email'
+    | 'guest_role_not_isolated'
     | 'server_error';
 
+/**
+ * The one stock role whose row filters key on the per-visitor scope id (`{{ScopeResourceID}}`) rather than on
+ * `UserID`. Every anonymous widget guest authenticates as the ONE shared Anonymous user, so a role whose filters
+ * compare `UserID` (the stock `UI` role, for instance) lets every guest read and update every other guest's rows
+ * through the generic API (MJ#6043). A widget may therefore grant only this role, or a role the deployment has
+ * explicitly listed as safe for anonymous visitors — the same opt-in list magic-link invites use.
+ */
+export const WIDGET_GUEST_ROLE_NAME = 'Widget Guest';
+
+/** Which roles, beyond {@link WIDGET_GUEST_ROLE_NAME}, a deployment allows a widget to hand to an anonymous guest. */
+export interface GuestRolePolicy {
+  /** Role names (case-insensitive) the deployment has opted in, normally `magicLink.grantableRoleNames`. */
+  GrantableRoleNames: readonly string[];
+}
+
+/** Pure check: may a widget grant `roleName` to an anonymous guest under `policy`? See {@link WIDGET_GUEST_ROLE_NAME}. */
+export function IsIsolatedGuestRole(roleName: string | null | undefined, policy: GuestRolePolicy): boolean {
+  return IsRoleGrantable(roleName, WIDGET_GUEST_ROLE_NAME, policy.GrantableRoleNames);
+}
+
 /** The minimal widget-instance shape the pure validators need (a subset of the entity). */
 export interface WidgetInstanceEligibilityInput {
   Status: string;
@@ -206,6 +227,10 @@ export function BuildWidgetGuestClaims(args: {
   guestRoleName: string;
   nowSeconds: number;
   ttlSeconds: number;
+  /** When `sessionId` was first minted (`mj_sid_iat`); a refresh passes the original. Defaults to `nowSeconds`. */
+  sessionStartedAtSeconds?: number;
+  /** Thumbprint of the widget's proof key (`cnf.jkt`). Without it the token cannot be refreshed. */
+  proofKeyThumbprint?: string;
   /**
    * Host-asserted identity for a `host-identity` session. Its email/name are carried as
    * INFORMATIONAL claims only — the principal-resolving `email`/`sub` remain the shared
@@ -248,6 +273,10 @@ export function BuildWidgetGuestClaims(args: {
   });
   // Additive widget claim — lets the synthesized principal be bound to one widget.
   claims.mj_widget_id = args.widgetId;
+  claims.mj_sid_iat = args.sessionStartedAtSeconds ?? args.nowSeconds;
+  if (args.proofKeyThumbprint) {
+    claims.cnf = { jkt: args.proofKeyThumbprint };
+  }
   if (args.hostIdentity) {
     claims.given_name = args.hostIdentity.firstName ?? claims.given_name;
     claims.family_name = args.hostIdentity.lastName ?? claims.family_name;

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -41,7 +41,7 @@ export interface WidgetGuestRunContext {
  * Returns elevation context when the request is a public web-widget guest, else `null` (the common
  * case — every non-widget request). A widget guest is identified by the synthesized principal's
  * `IsMagicLinkAnonymous` flag plus a `WidgetGuestContext.WidgetID` (sourced from the signed
- * `mj_widget_id` claim by `buildMagicLinkSessionUser`). The widget instance is loaded under the
+ * `mj_widget_id` claim by `BuildMagicLinkSessionUser`). The widget instance is loaded under the
  * SYSTEM principal so resolving the pinned agent does not depend on the guest's narrow grants.
  *
  * Never throws: a resolution failure (no system user, widget not found, read error) returns `null`,
@@ -169,6 +169,7 @@ export function ElevateUserPayload(userPayload: UserPayload, elevatedUser: UserI
     email: elevatedUser.Email,
     userRecord: elevatedUser,
     isSystemUser: true,
+    ElevatedFrom: userPayload.userRecord,
   };
 }
 

package/src/resolvers/ActionResolver.ts

@@ -1,17 +1,19 @@
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase } from "@memberjunction/core";
-import { ActionParam, ActionResult, MJActionEntityExtended } from "@memberjunction/actions-base";
+import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase, EntityInfo, IMetadataProvider } from "@memberjunction/core";
+import { ActionParam, ActionResult, MJActionEntityExtended, ProjectActionParamValuesForUser } from "@memberjunction/actions-base";
 import { UserCache } from "@memberjunction/generic-database-provider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
 import { AppContext, ProviderInfo } from "../types.js";
-import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, IndexByUUID, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
 import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
 import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
+import { EntityObjectDataBinding, ProjectActionParamsForCaller } from "../generic/actionOutputFieldSecurity.js";
+import type { EntityActionResult } from "@memberjunction/actions-base";
 
 /**
  * Input type for action parameters
@@ -213,8 +215,8 @@ export class ActionResolver extends ResolverBase {
       // params.Provider.SearchEntity) run against the caller's metadata layer.
       const result = await this.executeAction(action, user, params, ctx.providers);
 
-      // Return the result
-      return this.createActionResult(result);
+      // Return the result, its output parameters projected for the caller
+      return this.createActionResult(result, user, ctx.providers);
     } catch (e) {
       return this.handleActionError(e);
     }
@@ -357,20 +359,29 @@ export class ActionResolver extends ResolverBase {
   }
 
   /**
-   * Creates an action result from the execution result
+   * Creates an action result from the execution result. The output parameters are projected for
+   * the caller first (see {@link ProjectActionParamValuesForUser}): an action may return rows it
+   * did not load as the caller, such as engine-cached or system-user rows, so an entity object is
+   * sent as its field values projected for the caller and a plain row of a field-secured entity
+   * loses the keys the caller is denied. An entity object of an entity the caller cannot read is
+   * kept as it is, so `CopyScalarsAndArrays` drops it exactly as it always has.
    * @param result The execution result
+   * @param user The caller the result is sent to
+   * @param providers The request's providers, for the entity metadata the projection reads
    * @returns The formatted action result
    * @private
    */
-  private createActionResult(result: ActionResult): ActionResultOutput {
-    const x =(result.Params || result.RunParams.Params || [])
+  private createActionResult(result: ActionResult, user: UserInfo, providers: Array<ProviderInfo>): ActionResultOutput {
+    const outputs = (result.Params || result.RunParams.Params || [])
               .filter(p => p.Type.trim().toLowerCase() === 'output' ||
-                           p.Type.trim().toLowerCase() === 'both')     ;
+                           p.Type.trim().toLowerCase() === 'both');
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true }) ?? undefined;
+    const projected = ProjectActionParamValuesForUser(outputs, user, provider, { UnreadableEntityObjects: 'keep' }) ?? outputs;
     return {
       Success: result.Success,
       Message: result.Message,
       ResultCode: result.Result?.ResultCode,
-      ResultData: x && x.length > 0 ? JSON.stringify(CopyScalarsAndArrays(x)) : undefined
+      ResultData: projected.length > 0 ? JSON.stringify(CopyScalarsAndArrays(projected)) : undefined
     };
   }
 
@@ -442,11 +453,11 @@ export class ActionResolver extends ResolverBase {
         };
       }
 
-      // Return the result
+      // Return the result, its echoed parameters projected for the caller
       return {
         Success: result.Success,
         Message: result.Message,
-        ResultData: JSON.stringify(result)
+        ResultData: JSON.stringify(this.projectEntityActionResult(result, entityAction, params.EntityObject, user, ctx.providers))
       };
     } catch (e) {
       return this.handleError(e);
@@ -513,13 +524,65 @@ export class ActionResolver extends ResolverBase {
       throw new Error("Entity information is required");
     }
 
-    // Create a composite key and load the entity object
+    // Create a composite key and load the entity object FOR THE CALLER: with no user the load
+    // falls back to the provider's current user, which on a server is the system user (every
+    // column, and none of the caller's row-level security).
     const compositeKey = this.createCompositeKey(entity, input.PrimaryKey);
-    const entityObject = await md.GetEntityObject(entity.Name);
-    await entityObject.InnerLoad(compositeKey);
+    const entityObject = await md.GetEntityObject(entity.Name, user);
+    if (!await entityObject.InnerLoad(compositeKey)) {
+      // One message whether the record is missing or out of the caller's reach.
+      throw new Error('Record not found or access denied');
+    }
     params['EntityObject'] = entityObject;
   }
 
+  /**
+   * The entity action result as it may be sent to `user`: its parameters, which the result echoes
+   * (in `Params` and in `RunParams.Params`), projected for the caller wherever their entity is known.
+   * That is any entity object among them, and the parameters bound to the record's field values
+   * (`'Entity Object Data'`), whose entity is the bound record's. Any other value then passes the
+   * general backstop ({@link ProjectActionParamValuesForUser}), which narrows plain objects shaped
+   * like a row of a field-secured entity.
+   */
+  private projectEntityActionResult(
+    result: EntityActionResult,
+    entityAction: { EntityID?: string; Params?: Array<{ ActionParamID: string; ValueType: string }> },
+    entityObject: BaseEntity | undefined,
+    user: UserInfo,
+    providers: Array<ProviderInfo>
+  ): EntityActionResult {
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true }) ?? undefined;
+    const binding = this.entityObjectDataBinding(entityAction, entityObject, provider);
+    const project = (params: ActionParam[]) =>
+      ProjectActionParamValuesForUser(ProjectActionParamsForCaller(params, user, provider, binding), user, provider, { UnreadableEntityObjects: 'keep' });
+    const projected: EntityActionResult = { ...result, Params: project(result.Params) };
+    if (result.RunParams) {
+      projected.RunParams = { ...result.RunParams, Params: project(result.RunParams.Params) };
+    }
+    return projected;
+  }
+
+  /** The action parameters bound as `'Entity Object Data'`, with the entity their values belong to. */
+  private entityObjectDataBinding(
+    entityAction: { EntityID?: string; Params?: Array<{ ActionParamID: string; ValueType: string }> },
+    entityObject: BaseEntity | undefined,
+    provider: IMetadataProvider | undefined
+  ): EntityObjectDataBinding | undefined {
+    const entityInfo: EntityInfo | undefined = entityObject?.EntityInfo
+      ?? provider?.Entities?.find(e => UUIDsEqual(e.ID, entityAction?.EntityID));
+    if (!entityInfo) {
+      return undefined;
+    }
+    const names = new Set<string>();
+    const dataParams = (entityAction?.Params ?? []).filter(eap => eap.ValueType === 'Entity Object Data');
+    const actionParamsById = dataParams.length > 0 ? IndexByUUID(ActionEngineServer.Instance.ActionParams) : null;
+    for (const eap of dataParams) {
+      const param = actionParamsById?.Get(eap.ActionParamID);
+      if (param?.Name) names.add(param.Name.trim().toLowerCase());
+    }
+    return names.size > 0 ? { EntityInfo: entityInfo, ParamNames: names } : undefined;
+  }
+
   /**
    * Creates a composite key from the input
    * @param entity The entity information

package/src/resolvers/AdhocQueryResolver.ts

@@ -139,6 +139,7 @@ export class AdhocQueryResolver extends ResolverBase {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
             Success: true,
+            // fls-guard: query rows; the SQL is refused before it runs if it reads a field the caller is denied
             Results: JSON.stringify(result.Results),
             RowCount: result.RowCount,
             TotalRowCount: result.TotalRowCount,