@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/requestOrigin.ts

@@ -0,0 +1,64 @@
+/**
+ * Request-origin helpers shared by the GraphQL context (`AppContext.RequestOrigin`) and the realtime
+ * widget origin allowlist, so an origin read from a request and an origin read from an allowlist are
+ * normalized the same way and compare with plain string equality.
+ */
+
+/**
+ * Shape of a serialized http(s) origin: scheme, host and optional port, with no path, query,
+ * fragment or credentials. Applied after {@link NormalizeOrigin}, so it only needs lowercase.
+ */
+const HTTP_ORIGIN_PATTERN = /^https?:\/\/[^/?#@\s]+$/;
+
+/** Character code of `/`. */
+const SLASH_CHAR_CODE = 47;
+
+/**
+ * Normalizes an origin for stable comparison: trims whitespace, lowercases, and strips trailing
+ * slashes. It does not parse the value or rewrite ports, so `https://a.com:443` stays as written.
+ * @param origin an origin as written in a header or an allowlist entry
+ */
+export function NormalizeOrigin(origin: string): string {
+  return StripTrailingSlashes(origin.trim().toLowerCase());
+}
+
+/**
+ * Removes trailing `/` characters with a linear scan. A `/\/+$/` regex is quadratic on input with
+ * many `/` not at the end, and this runs on a request header the client controls.
+ */
+function StripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) {
+    end--;
+  }
+  return value.slice(0, end);
+}
+
+/**
+ * Reads a request's `Origin` header into a normalized origin (`scheme://host[:port]`).
+ *
+ * Returns undefined when the header is absent, repeated, blank, opaque (`null`, which sandboxed
+ * frames and privacy-sensitive redirects send), or anything other than a parseable http(s) origin.
+ * Ports are kept as sent: browsers omit default ports from `Origin`, and allowlist entries pass
+ * through the same {@link NormalizeOrigin}, so both sides agree without rewriting.
+ * @param originHeader the raw `Origin` header value from the request
+ */
+export function ReadRequestOrigin(originHeader: string | string[] | undefined): string | undefined {
+  if (typeof originHeader !== 'string') {
+    return undefined;
+  }
+  const normalized = NormalizeOrigin(originHeader);
+  return IsHttpOrigin(normalized) ? normalized : undefined;
+}
+
+/** True when a normalized value is a parseable http(s) origin with no path, query, fragment or credentials. */
+function IsHttpOrigin(normalized: string): boolean {
+  if (!HTTP_ORIGIN_PATTERN.test(normalized)) {
+    return false;
+  }
+  try {
+    return new URL(normalized).host.length > 0;
+  } catch {
+    return false;
+  }
+}

package/src/resolvers/ActionResolver.ts

@@ -1,17 +1,19 @@
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase } from "@memberjunction/core";
-import { ActionParam, ActionResult, MJActionEntityExtended } from "@memberjunction/actions-base";
+import { Metadata, UserInfo, BaseEntity, CompositeKey, KeyValuePair, LogError, RunView, DatabaseProviderBase, EntityInfo, IMetadataProvider } from "@memberjunction/core";
+import { ActionParam, ActionResult, MJActionEntityExtended, ProjectActionParamValuesForUser } from "@memberjunction/actions-base";
 import { UserCache } from "@memberjunction/generic-database-provider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
 import { AppContext, ProviderInfo } from "../types.js";
-import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, IndexByUUID, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
 import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
 import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
+import { EntityObjectDataBinding, ProjectActionParamsForCaller } from "../generic/actionOutputFieldSecurity.js";
+import type { EntityActionResult } from "@memberjunction/actions-base";
 
 /**
  * Input type for action parameters
@@ -213,8 +215,8 @@ export class ActionResolver extends ResolverBase {
       // params.Provider.SearchEntity) run against the caller's metadata layer.
       const result = await this.executeAction(action, user, params, ctx.providers);
 
-      // Return the result
-      return this.createActionResult(result);
+      // Return the result, its output parameters projected for the caller
+      return this.createActionResult(result, user, ctx.providers);
     } catch (e) {
       return this.handleActionError(e);
     }
@@ -357,20 +359,29 @@ export class ActionResolver extends ResolverBase {
   }
 
   /**
-   * Creates an action result from the execution result
+   * Creates an action result from the execution result. The output parameters are projected for
+   * the caller first (see {@link ProjectActionParamValuesForUser}): an action may return rows it
+   * did not load as the caller, such as engine-cached or system-user rows, so an entity object is
+   * sent as its field values projected for the caller and a plain row of a field-secured entity
+   * loses the keys the caller is denied. An entity object of an entity the caller cannot read is
+   * kept as it is, so `CopyScalarsAndArrays` drops it exactly as it always has.
    * @param result The execution result
+   * @param user The caller the result is sent to
+   * @param providers The request's providers, for the entity metadata the projection reads
    * @returns The formatted action result
    * @private
    */
-  private createActionResult(result: ActionResult): ActionResultOutput {
-    const x =(result.Params || result.RunParams.Params || [])
+  private createActionResult(result: ActionResult, user: UserInfo, providers: Array<ProviderInfo>): ActionResultOutput {
+    const outputs = (result.Params || result.RunParams.Params || [])
               .filter(p => p.Type.trim().toLowerCase() === 'output' ||
-                           p.Type.trim().toLowerCase() === 'both')     ;
+                           p.Type.trim().toLowerCase() === 'both');
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true }) ?? undefined;
+    const projected = ProjectActionParamValuesForUser(outputs, user, provider, { UnreadableEntityObjects: 'keep' }) ?? outputs;
     return {
       Success: result.Success,
       Message: result.Message,
       ResultCode: result.Result?.ResultCode,
-      ResultData: x && x.length > 0 ? JSON.stringify(CopyScalarsAndArrays(x)) : undefined
+      ResultData: projected.length > 0 ? JSON.stringify(CopyScalarsAndArrays(projected)) : undefined
     };
   }
 
@@ -442,11 +453,11 @@ export class ActionResolver extends ResolverBase {
         };
       }
 
-      // Return the result
+      // Return the result, its echoed parameters projected for the caller
       return {
         Success: result.Success,
         Message: result.Message,
-        ResultData: JSON.stringify(result)
+        ResultData: JSON.stringify(this.projectEntityActionResult(result, entityAction, params.EntityObject, user, ctx.providers))
       };
     } catch (e) {
       return this.handleError(e);
@@ -513,13 +524,65 @@ export class ActionResolver extends ResolverBase {
       throw new Error("Entity information is required");
     }
 
-    // Create a composite key and load the entity object
+    // Create a composite key and load the entity object FOR THE CALLER: with no user the load
+    // falls back to the provider's current user, which on a server is the system user (every
+    // column, and none of the caller's row-level security).
     const compositeKey = this.createCompositeKey(entity, input.PrimaryKey);
-    const entityObject = await md.GetEntityObject(entity.Name);
-    await entityObject.InnerLoad(compositeKey);
+    const entityObject = await md.GetEntityObject(entity.Name, user);
+    if (!await entityObject.InnerLoad(compositeKey)) {
+      // One message whether the record is missing or out of the caller's reach.
+      throw new Error('Record not found or access denied');
+    }
     params['EntityObject'] = entityObject;
   }
 
+  /**
+   * The entity action result as it may be sent to `user`: its parameters, which the result echoes
+   * (in `Params` and in `RunParams.Params`), projected for the caller wherever their entity is known.
+   * That is any entity object among them, and the parameters bound to the record's field values
+   * (`'Entity Object Data'`), whose entity is the bound record's. Any other value then passes the
+   * general backstop ({@link ProjectActionParamValuesForUser}), which narrows plain objects shaped
+   * like a row of a field-secured entity.
+   */
+  private projectEntityActionResult(
+    result: EntityActionResult,
+    entityAction: { EntityID?: string; Params?: Array<{ ActionParamID: string; ValueType: string }> },
+    entityObject: BaseEntity | undefined,
+    user: UserInfo,
+    providers: Array<ProviderInfo>
+  ): EntityActionResult {
+    const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true }) ?? undefined;
+    const binding = this.entityObjectDataBinding(entityAction, entityObject, provider);
+    const project = (params: ActionParam[]) =>
+      ProjectActionParamValuesForUser(ProjectActionParamsForCaller(params, user, provider, binding), user, provider, { UnreadableEntityObjects: 'keep' });
+    const projected: EntityActionResult = { ...result, Params: project(result.Params) };
+    if (result.RunParams) {
+      projected.RunParams = { ...result.RunParams, Params: project(result.RunParams.Params) };
+    }
+    return projected;
+  }
+
+  /** The action parameters bound as `'Entity Object Data'`, with the entity their values belong to. */
+  private entityObjectDataBinding(
+    entityAction: { EntityID?: string; Params?: Array<{ ActionParamID: string; ValueType: string }> },
+    entityObject: BaseEntity | undefined,
+    provider: IMetadataProvider | undefined
+  ): EntityObjectDataBinding | undefined {
+    const entityInfo: EntityInfo | undefined = entityObject?.EntityInfo
+      ?? provider?.Entities?.find(e => UUIDsEqual(e.ID, entityAction?.EntityID));
+    if (!entityInfo) {
+      return undefined;
+    }
+    const names = new Set<string>();
+    const dataParams = (entityAction?.Params ?? []).filter(eap => eap.ValueType === 'Entity Object Data');
+    const actionParamsById = dataParams.length > 0 ? IndexByUUID(ActionEngineServer.Instance.ActionParams) : null;
+    for (const eap of dataParams) {
+      const param = actionParamsById?.Get(eap.ActionParamID);
+      if (param?.Name) names.add(param.Name.trim().toLowerCase());
+    }
+    return names.size > 0 ? { EntityInfo: entityInfo, ParamNames: names } : undefined;
+  }
+
   /**
    * Creates a composite key from the input
    * @param entity The entity information

package/src/resolvers/AdhocQueryResolver.ts

@@ -139,6 +139,7 @@ export class AdhocQueryResolver extends ResolverBase {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
             Success: true,
+            // fls-guard: query rows; the SQL is refused before it runs if it reads a field the caller is denied
             Results: JSON.stringify(result.Results),
             RowCount: result.RowCount,
             TotalRowCount: result.TotalRowCount,

package/src/resolvers/AgentRunStatusPublisher.ts

@@ -14,8 +14,10 @@ import type {
     AgentExecutionStreamingCallback,
     ExecuteAgentResult,
 } from '@memberjunction/ai-core-plus';
+import type { EntityInfo } from '@memberjunction/core';
 import type { UserPayload } from '../types.js';
-import { PublishStatusUpdate } from '../generic/PushStatusResolver.js';
+import { PublishStatusUpdate, StatusUpdateOwnerID } from '../generic/PushStatusResolver.js';
+import { ProjectEntityObjectForCaller } from '../generic/fieldSecurityTransport.js';
 
 const SIGNIFICANT_STEPS = ['prompt_execution', 'action_execution', 'subagent_execution', 'decision_processing'];
 
@@ -25,7 +27,8 @@ interface StatusRun {
     ConversationDetailID?: string;
     ErrorMessage?: string;
     Steps?: Array<{ StepName?: string }>;
-    GetAll?: () => unknown;
+    EntityInfo?: EntityInfo | null;
+    GetAll?: () => Record<string, unknown>;
 }
 
 export class AgentRunStatusPublisher {
@@ -34,11 +37,15 @@ export class AgentRunStatusPublisher {
     /**
      * @param sessionId Session stamped on the message body. Defaults to the payload's session.
      *   The push itself is always addressed to `userPayload.sessionId`, matching the resolver.
+     * @param conversationDetailId The run's reply row. When set, every message carries it as
+     *   `conversationDetailId`, not only the completion, so a client that reconnects mid-run can
+     *   find its row. When omitted, messages are as before.
      */
     constructor(
         private readonly pubSub: PubSubEngine,
         private readonly userPayload: UserPayload,
         private readonly sessionId: string = userPayload.sessionId,
+        private readonly conversationDetailId?: string,
     ) {}
 
     /** Latest run observed from a progress event, including steps that are not published. */
@@ -66,7 +73,8 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'progress',
-                agentRun: agentRun.GetAll ? agentRun.GetAll() : agentRun,
+                ...this.replyRow(),
+                agentRun: this.runValues(agentRun),
                 progress: {
                     currentStep: progress.step,
                     percentage: progress.percentage,
@@ -93,7 +101,8 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'streaming',
-                agentRun: agentRun.GetAll ? agentRun.GetAll() : agentRun,
+                ...this.replyRow(),
+                agentRun: this.runValues(agentRun),
                 streaming: {
                     content: chunk.content,
                     isPartial: !chunk.isComplete,
@@ -122,6 +131,7 @@ export class AgentRunStatusPublisher {
                 sessionId: this.sessionId,
                 agentRunId: agentRun.ID,
                 type: 'partial_result',
+                ...this.replyRow(),
                 partialResult: {
                     currentStep: lastStep,
                     partialOutput: result.payload || undefined,
@@ -134,7 +144,7 @@ export class AgentRunStatusPublisher {
             agentRunId: agentRun?.ID || 'unknown',
             type: 'complete',
             timestamp: new Date(),
-            conversationDetailId: conversationDetailId || agentRun?.ConversationDetailID,
+            conversationDetailId: conversationDetailId || agentRun?.ConversationDetailID || this.conversationDetailId,
             success: result.success,
             errorMessage: agentRun?.ErrorMessage || undefined,
             result: resultJson || undefined,
@@ -142,8 +152,9 @@ export class AgentRunStatusPublisher {
     }
 
     /**
-     * Completion for a failure that has no run. The fire-and-forget path uses this when
-     * `executeAIAgent` rejects. A host uses it the same way: when the turn throws
+     * Completion for a failure that has no run result. `executeAIAgent` sends it when the run
+     * throws (the agent could not start, the run failed, or its reply could not be saved), so a
+     * fire-and-forget client learns the reason. A host uses it the same way: when the turn throws
      * instead of returning a result, call `PublishFailure` with the reply row's id
      * and the error. That completion is what tells the chat the reply finished.
      */
@@ -160,10 +171,27 @@ export class AgentRunStatusPublisher {
         });
     }
 
+    /** `{ conversationDetailId }` when this run has a reply row, otherwise nothing, so the message keeps its old shape. */
+    private replyRow(): { conversationDetailId?: string } {
+        return this.conversationDetailId ? { conversationDetailId: this.conversationDetailId } : {};
+    }
+
+    /**
+     * The run's field values as the recipient may read them. The run object comes from the agent
+     * engine, which is not bound to this session's user, so it is projected here.
+     */
+    private runValues(agentRun: StatusRun): unknown {
+        if (!agentRun.GetAll) {
+            return agentRun;
+        }
+        const getAll = agentRun.GetAll;
+        return ProjectEntityObjectForCaller({ EntityInfo: agentRun.EntityInfo, GetAll: () => getAll.call(agentRun) }, this.userPayload?.userRecord);
+    }
+
     private publish(type: 'ExecutionProgress' | 'StreamingContent', data: unknown): void {
         PublishStatusUpdate(this.pubSub, {
             sessionId: this.userPayload.sessionId,
-            ownerUserId: this.userPayload?.userRecord?.ID ?? '',
+            ownerUserId: StatusUpdateOwnerID(this.userPayload),
             message: JSON.stringify({
                 resolver: 'RunAIAgentResolver',
                 type,

package/src/resolvers/AgentSessionResolver.ts

@@ -13,12 +13,34 @@
  */
 import { Resolver, Mutation, Arg, Ctx, ObjectType, Field } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { UserInfo, IMetadataProvider, LogError } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
-import { MJAIAgentSessionEntity } from '@memberjunction/core-entities';
+import { UserInfo, IMetadataProvider } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
-import { SessionManager, SessionAuthorizationError } from '../agentSessions/index.js';
+import { SessionManager, SessionAuthorizationError, type SessionCloseReason } from '../agentSessions/index.js';
+import {
+    LoadOwnedRealtimeSession,
+    RealtimeSessionNotFoundError,
+    RealtimeSessionOwnershipError,
+} from '../realtimeSessions/ownedRealtimeSession.js';
+
+/**
+ * The `CloseReason` values a client may stamp on its own session; `Idle`, `Janitor` and `Shutdown` are the server's.
+ * `TimeLimit` is a claim: the browser's deadline alarm fired, and {@link SessionManager.CloseSession} verifies it
+ * against the session's stored deadline, recording `Explicit` instead when the deadline is not near.
+ */
+const CLIENT_CLOSE_REASONS: readonly SessionCloseReason[] = ['Explicit', 'Error', 'TimeLimit'];
+
+/** Reads the mutation's optional `closeReason`: absent means `Explicit`; a server-only or unknown value is refused. */
+function ParseClientCloseReason(closeReason: string | null | undefined): SessionCloseReason {
+    if (closeReason == null || closeReason === '') {
+        return 'Explicit';
+    }
+    const match = CLIENT_CLOSE_REASONS.find((r) => r === closeReason);
+    if (!match) {
+        throw new Error(`Unsupported close reason '${closeReason}': a client may close its session as ${CLIENT_CLOSE_REASONS.join(' or ')}`);
+    }
+    return match;
+}
 
 /** Result of {@link AgentSessionResolver.StartAgentSession}. */
 @ObjectType()
@@ -77,15 +99,22 @@ export class AgentSessionResolver extends ResolverBase {
     /**
      * Close a session. Rejects unless the caller owns it. Returns `true` on a successful (or
      * idempotent) close, `false` if the session can't be loaded.
+     *
+     * `closeReason` is what the row records as its `CloseReason`: `Explicit` (the default, and what
+     * every client sent before the argument existed) when the user or host ended the call, `Error`
+     * when the client ended it because the start or the call failed (MJ#6013). The other reasons are
+     * the server's own (janitor, shutdown) and are refused from a client.
      */
     @Mutation(() => Boolean)
     async CloseAgentSession(
         @Arg('agentSessionId') agentSessionId: string,
         @Ctx() { userPayload, providers }: AppContext,
+        @Arg('closeReason', () => String, { nullable: true }) closeReason?: string | null,
     ): Promise<boolean> {
+        const reason = ParseClientCloseReason(closeReason);
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.assertOwnership(agentSessionId, contextUser, provider);
-        return this.sessionManager.CloseSession(agentSessionId, contextUser, provider);
+        await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        return this.sessionManager.CloseSession(agentSessionId, contextUser, provider, reason);
     }
 
     /**
@@ -98,7 +127,7 @@ export class AgentSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.assertOwnership(agentSessionId, contextUser, provider);
+        await this.loadOwnedSession(agentSessionId, contextUser, provider);
         return this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
     }
 
@@ -117,22 +146,25 @@ export class AgentSessionResolver extends ResolverBase {
     }
 
     /**
-     * Inbound ownership gate (the one genuinely new session-authz primitive): the session's `UserID`
-     * must equal the caller's. Throws on mismatch or when the session can't be loaded.
+     * Inbound ownership gate: delegates to {@link LoadOwnedRealtimeSession} (which enforces both
+     * `UserID === contextUser.ID` and `AuthorizeSessionAccess` scope/visitor binding) and maps its
+     * typed errors to this resolver's message format.
      */
-    private async assertOwnership(
+    private async loadOwnedSession(
         agentSessionId: string,
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<void> {
-        const session = await provider.GetEntityObject<MJAIAgentSessionEntity>('MJ: AI Agent Sessions', contextUser);
-        const loaded = await session.Load(agentSessionId);
-        if (!loaded) {
-            throw new Error(`Agent session ${agentSessionId} not found`);
-        }
-        if (!UUIDsEqual(session.UserID, contextUser.ID)) {
-            LogError(`AgentSessionResolver: ownership check failed — user ${contextUser.ID} attempted to operate on session ${agentSessionId} owned by ${session.UserID}`);
-            throw new Error('Not authorized: you do not own this agent session');
+        try {
+            await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
+        } catch (err) {
+            if (err instanceof RealtimeSessionNotFoundError) {
+                throw new Error(`Agent session ${agentSessionId} not found`);
+            }
+            if (err instanceof RealtimeSessionOwnershipError) {
+                throw new Error('Not authorized: you do not own this agent session');
+            }
+            throw err;
         }
     }
 }

package/src/resolvers/AutotagPipelineResolver.ts

@@ -170,7 +170,8 @@ export class AutotagPipelineResolver extends ResolverBase {
                     EntityName: 'MJ: Content Sources',
                     Fields: ['ID'],
                     ResultType: 'simple',
-                    MaxRows: 1
+                    MaxRows: 1,
+                    SkipTotalRowCount: true
                 }, currentUser);
                 if (result.Success && result.Results.length > 0) {
                     sourceID = result.Results[0].ID;

package/src/resolvers/ConversationRunEventsResolver.ts

@@ -235,6 +235,7 @@ export class ConversationRunEventsResolver {
                 EntityName: 'MJ: Conversation Details',
                 ExtraFilter: `ID='${this.escape(conversationDetailID)}'`,
                 MaxRows: 1,
+                SkipTotalRowCount: true,
                 ResultType: 'entity_object',
                 BypassCache: true,
             },
@@ -259,6 +260,7 @@ export class ConversationRunEventsResolver {
                 ExtraFilter: `ConversationDetailID='${this.escape(conversationDetailID)}'`,
                 OrderBy: '__mj_CreatedAt DESC',
                 MaxRows: 1,
+                SkipTotalRowCount: true,
                 Fields: RUN_FIELDS,
                 ResultType: 'simple',
                 BypassCache: true,

package/src/resolvers/EntityCommunicationsResolver.ts

@@ -3,12 +3,14 @@ import { AppContext } from '../types.js';
 import { RunViewByIDInput } from '../generic/RunViewResolver.js';
 import { Message } from '@memberjunction/communication-types';
 import { EntityCommunicationsEngine } from '@memberjunction/entity-communications-server';
-import { RunViewParams } from '@memberjunction/core';
+import { DatabaseProviderBase, IMetadataProvider, RunViewParams, UserInfo } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
 import { GraphQLJSONObject } from 'graphql-type-json';
 import { TemplateEngineServer } from '@memberjunction/templates';
 import { EntityCommunicationParams } from '@memberjunction/entity-communications-base';
 import { z } from 'zod';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { GetReadOnlyProvider } from '../util.js';
 
 @InputType()
 export class CommunicationProviderMessageType {
@@ -168,6 +170,11 @@ export class RunEntityCommunicationResultType {
 
 @Resolver(RunEntityCommunicationResultType)
 export class ReportResolver extends ResolverBase {
+  /**
+   * Runs a message against a view of records, as the caller. The recipient and related-entity reads
+   * run as the authenticated user, so a preview returns and a send merges only rows and fields that
+   * user may read. The view's client-supplied clauses get the same screen as a RunView request.
+   */
   @Query(() => RunEntityCommunicationResultType)
   async RunEntityCommunicationByViewID(
     @Arg('entityID', () => String) entityID: string,
@@ -177,25 +184,29 @@ export class ReportResolver extends ResolverBase {
     @Arg('message', () => CommunicationMessageInput) message: CommunicationMessageInput,
     @Arg('previewOnly', () => Boolean) previewOnly: boolean,
     @Arg('includeProcessedMessages', () => Boolean) includeProcessedMessages: boolean,
-    @Ctx() { userPayload }: AppContext
+    @Ctx() { userPayload, providers }: AppContext
   ): Promise<RunEntityCommunicationResultType> {
     // Check API key scope authorization for communication send
     await this.CheckAPIKeyScopeAuthorization('communication:send', entityID, userPayload);
 
     try {
-      await EntityCommunicationsEngine.Instance.Config(false, userPayload.userRecord);
-      const newMessage = new Message(message as unknown as Message);
-      await TemplateEngineServer.Instance.Config(false, userPayload.userRecord);
-      // for the templates, replace the values from the input with the objects from the Template Engine we have here
-      if (newMessage.BodyTemplate) {
-        newMessage.BodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.BodyTemplate.Name);
-      }
-      if (newMessage.HTMLBodyTemplate) {
-        newMessage.HTMLBodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.HTMLBodyTemplate.Name);
-      }
-      if (newMessage.SubjectTemplate) {
-        newMessage.SubjectTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.SubjectTemplate.Name);
-      }
+      const contextUser = this.GetUserFromPayload(userPayload);
+      if (!contextUser) throw new Error('Unable to determine the acting user for this communication');
+      const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+      this.screenClientViewClauses(
+        {
+          extraFilter: runViewByIDInput.ExtraFilter,
+          orderBy: runViewByIDInput.OrderBy,
+          userSearchString: runViewByIDInput.UserSearchString,
+          overrideExcludeFilter: runViewByIDInput.OverrideExcludeFilter,
+        },
+        provider as unknown as IMetadataProvider,
+        contextUser,
+      );
+      await this.assertViewBelongsToEntity(runViewByIDInput.ViewID, entityID, provider, contextUser);
+
+      await EntityCommunicationsEngine.Instance.Config(false, contextUser);
+      const newMessage = await this.resolveMessageTemplates(message, contextUser);
       const params: EntityCommunicationParams = {
         EntityID: entityID,
         RunViewParams: <RunViewParams>runViewByIDInput,
@@ -204,6 +215,8 @@ export class ReportResolver extends ResolverBase {
         Message: newMessage,
         PreviewOnly: previewOnly,
         IncludeProcessedMessages: includeProcessedMessages,
+        ContextUser: contextUser,
+        Provider: provider,
       };
       const result = await EntityCommunicationsEngine.Instance.RunEntityCommunication(params);
       return {
@@ -222,4 +235,32 @@ export class ReportResolver extends ResolverBase {
       };
     }
   }
+
+  /**
+   * Refuses a view that is not a view of `entityID`, with the same message as for a view that does
+   * not exist or that the caller cannot load, so the refusal does not reveal which views exist.
+   */
+  private async assertViewBelongsToEntity(viewID: string | undefined, entityID: string, provider: DatabaseProviderBase, contextUser: UserInfo): Promise<void> {
+    if (!viewID) return;
+    const view = await this.resolveUserViewByID(viewID, provider, contextUser);
+    if (!view?.ID || !UUIDsEqual(view.ID, viewID) || !UUIDsEqual(view.EntityID, entityID)) {
+      throw new Error('The requested view does not exist or you do not have access to it');
+    }
+  }
+
+  /** Builds the message, replacing each template the client named with the server's copy of it. */
+  private async resolveMessageTemplates(message: CommunicationMessageInput, contextUser: UserInfo): Promise<Message> {
+    const newMessage = new Message(message as unknown as Message);
+    await TemplateEngineServer.Instance.Config(false, contextUser);
+    if (newMessage.BodyTemplate) {
+      newMessage.BodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.BodyTemplate.Name);
+    }
+    if (newMessage.HTMLBodyTemplate) {
+      newMessage.HTMLBodyTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.HTMLBodyTemplate.Name);
+    }
+    if (newMessage.SubjectTemplate) {
+      newMessage.SubjectTemplate = TemplateEngineServer.Instance.FindTemplate(newMessage.SubjectTemplate.Name);
+    }
+    return newMessage;
+  }
 }