@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/resolvers/RunAIPromptResolver.ts

@@ -571,25 +571,18 @@ export class RunAIPromptResolver extends ResolverBase {
     }
     
     /**
-     * Helper method to select an embedding model by size
+     * Selects a local embedding model by size: `'small'` is the lowest-PowerRank active local model;
+     * `'medium'` and anything else is the platform default (`AIEngine.DefaultLocalEmbeddingModel`).
+     * Picking by position in the list would shift whenever a model is added.
      * @private
      */
     private selectEmbeddingModelBySize(modelSize: string): MJAIModelEntityExtended {
-        const localModels = AIEngine.Instance.LocalEmbeddingModels;
-        
-        if (!localModels || localModels.length === 0) {
+        const engine = AIEngine.Instance;
+        const model = modelSize === 'small' ? engine.LowestPowerLocalEmbeddingModel : engine.DefaultLocalEmbeddingModel;
+        if (!model) {
             throw new Error('No local embedding models available');
         }
-        
-        // Models are already sorted by PowerRank (highest first)
-        switch (modelSize) {
-            case 'small':
-                return localModels[localModels.length - 1]; // Lowest power
-            case 'medium':
-            default:
-                const midIndex = Math.floor(localModels.length / 2);
-                return localModels[midIndex] || localModels[0];
-        }
+        return model;
     }
     
     /**
@@ -825,7 +818,8 @@ export class RunAIPromptResolver extends ResolverBase {
     async EmbedText(
         @Arg('textToEmbed', () => [String]) textToEmbed: string[],
         @Arg('modelSize') modelSize: string,
-        @Ctx() { userPayload }: { userPayload: UserPayload }
+        @Ctx() { userPayload }: { userPayload: UserPayload },
+        @Arg('inputType', { nullable: true, description: "'query' for search text, 'document' (default) for text that is stored and compared" }) inputType?: string
     ): Promise<EmbedTextResult> {
         // Check API key scope authorization for embedding generation
         await this.CheckAPIKeyScopeAuthorization('embedding:generate', '*', userPayload);
@@ -847,6 +841,11 @@ export class RunAIPromptResolver extends ResolverBase {
             // Ensure AI Engine is configured
             await AIEngine.Instance.Config(false, currentUser);
             
+            const role = inputType === 'query' || inputType === 'document' ? inputType : undefined;
+            if (inputType != null && !role) {
+                return { embeddings: [], modelName: 'Unknown', vectorDimensions: 0, error: `inputType must be 'query' or 'document'` };
+            }
+
             // Select embedding model by size
             const model = this.selectEmbeddingModelBySize(modelSize);
             
@@ -863,7 +862,7 @@ export class RunAIPromptResolver extends ResolverBase {
                 }
                 
                 // Use AIEngine's EmbedText method
-                const result = await AIEngine.Instance.EmbedText(model, text);
+                const result = await AIEngine.Instance.EmbedText(model, text, undefined, { inputType: role });
                 
                 if (result && result.vector && result.vector.length > 0) {
                     embeddings.push(result.vector);
@@ -904,9 +903,10 @@ export class RunAIPromptResolver extends ResolverBase {
     async EmbedTextSystemUser(
         @Arg('textToEmbed', () => [String]) textToEmbed: string[],
         @Arg('modelSize') modelSize: string,
-        @Ctx() { userPayload }: { userPayload: UserPayload }
+        @Ctx() { userPayload }: { userPayload: UserPayload },
+        @Arg('inputType', { nullable: true, description: "'query' for search text, 'document' (default) for text that is stored and compared" }) inputType?: string
     ): Promise<EmbedTextResult> {
         // Reuse the same logic as the regular mutation
-        return this.EmbedText(textToEmbed, modelSize, { userPayload });
+        return this.EmbedText(textToEmbed, modelSize, { userPayload }, inputType);
     }
 }

package/src/resolvers/RunTemplateResolver.ts

@@ -1,6 +1,7 @@
 import { Resolver, Mutation, Arg, Ctx, ObjectType, Field } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, Metadata, RunView } from '@memberjunction/core';
+import { EscapeSQLString } from '@memberjunction/global';
 import { MJTemplateContentEntity, MJTemplateEntityExtended } from '@memberjunction/core-entities';
 import { GetTemplateRunRefusal, TemplateEngineServer } from '@memberjunction/templates';
 import { ResolverBase } from '../generic/ResolverBase.js';
@@ -84,12 +85,13 @@ export class RunTemplateResolver extends ResolverBase {
             }
 
             // Load template content (get the first/highest priority content)
-            const rv = new RunView();
+            const rv = RunView.FromMetadataProvider(p);
             const templateContentResult = await rv.RunView<MJTemplateContentEntity>({
                 EntityName: 'MJ: Template Contents',
-                ExtraFilter: `TemplateID = '${templateId}'`,
+                ExtraFilter: `TemplateID = '${EscapeSQLString(templateEntity.ID)}'`,
                 OrderBy: 'Priority ASC',
                 MaxRows: 1,
+                SkipTotalRowCount: true,
                 ResultType: 'entity_object'
             }, currentUser);
 
@@ -102,12 +104,14 @@ export class RunTemplateResolver extends ResolverBase {
             }
 
             // Configure and render the template
-            await TemplateEngineServer.Instance.Config(true /*always refresh to get latest templates*/, currentUser);
+            await TemplateEngineServer.Instance.Config(true /*always refresh to get latest templates*/, currentUser, p);
             const result = await TemplateEngineServer.Instance.RenderTemplate(
                 templateEntity, 
                 templateContentResult.Results[0], 
-                data, 
-                true // skip validation for execution
+                data,
+                true, // skip validation for execution
+                undefined,
+                { ContextUser: currentUser },
             );
 
             const executionTime = Date.now() - startTime;

package/src/resolvers/RunTestResolver.ts

@@ -15,6 +15,7 @@ import { AppContext, UserPayload } from '../types.js';
 import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
 import { TestEngine } from '@memberjunction/testing-engine';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { ProjectEntityObjectForCaller, ProjectableEntityObject } from '../generic/fieldSecurityTransport.js';
 import { StartLivenessPulse } from '../generic/FireAndForgetHeartbeat.js';
 import { TestRunVariables, TestLogMessage, TestRunResult as EngineTestRunResult } from '@memberjunction/testing-engine-base';
 
@@ -447,7 +448,8 @@ export class RunTestResolver extends ResolverBase {
                 testRunId: (testRun as { ID?: string })?.ID || testId,
                 type: 'progress',
                 testRun: testRun && typeof (testRun as { GetAll?: () => Record<string, unknown> }).GetAll === 'function'
-                    ? (testRun as { GetAll: () => Record<string, unknown> }).GetAll()
+                    // projected for the recipient: the run object comes from the test engine, not a load bound to them
+                    ? ProjectEntityObjectForCaller(testRun as unknown as ProjectableEntityObject, userPayload.userRecord)
                     : undefined,
                 progress: {
                     currentStep: progress.step,

package/src/resolvers/SyncDataResolver.ts

@@ -319,6 +319,7 @@ export class SyncDataResolver {
             }
             else {
                 // pass back the full record as it was JUST BEFORE the delete, often quite useful on the other end
+                // fls-guard: system-user-only resolver (@RequireSystemUser)
                 result.RecordJSON = await altKeyResult.GetDataObjectJSON({
                     includeRelatedEntityData: false,
                     excludeFields: [],
@@ -337,6 +338,7 @@ export class SyncDataResolver {
         }
         else if (await entityObject.InnerLoad(pk)) {
             // pass back the full record as it was JUST BEFORE the delete, often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],
@@ -368,6 +370,7 @@ export class SyncDataResolver {
             result.Success = true;
             result.PrimaryKey = new CompositeKey(entityObject.PrimaryKeys.map((pk) => ({FieldName: pk.Name, Value: pk.Value})));
             // pass back the full record AFTER the sync, that's often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],
@@ -411,6 +414,7 @@ export class SyncDataResolver {
                 result.PrimaryKey = new CompositeKey(entityObject.PrimaryKeys.map((pk) => ({FieldName: pk.Name, Value: pk.Value})));
             }
             // pass back the full record AFTER the sync, that's often quite useful on the other end
+            // fls-guard: system-user-only resolver (@RequireSystemUser)
             result.RecordJSON = await entityObject.GetDataObjectJSON({
                 includeRelatedEntityData: false,
                 excludeFields: [],

package/src/resolvers/TestQuerySQLResolver.ts

@@ -151,6 +151,7 @@ export class TestQuerySQLResolver extends ResolverBase {
 
             return {
                 Success: result.Success,
+                // fls-guard: query rows; the SQL is refused before it runs if it reads a field the caller is denied
                 Results: result.Results ? JSON.stringify(result.Results) : undefined,
                 RowCount: result.RowCount,
                 ExecutionTime: result.ExecutionTime,

package/src/resolvers/TransactionGroupResolver.ts

@@ -1,9 +1,10 @@
 import { Arg, Ctx, Field, InputType, Int, Mutation, ObjectType, registerEnumType } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { CompositeKey, EntityInfo, IMetadataProvider, KeyValuePair, LogError, Metadata, TransactionVariable, TransactionGroupBase, BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, CompositeKey, EntityInfo, IMetadataProvider, KeyValuePair, LogError, Metadata, RecordChangeMetadataSource, TransactionVariable, TransactionGroupBase, BaseEntity, UserInfo } from '@memberjunction/core';
 import { SafeJSONParse, ValuesEqual } from '@memberjunction/global';
 import { GetReadWriteProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { ProjectValuesForCaller } from '../generic/fieldSecurityTransport.js';
 
 export enum TransactionVariableType {
     Define = "Define",
@@ -148,16 +149,18 @@ export class TransactionResolver extends ResolverBase {
             // BEFORE any Save()/Delete() runs below: a 'Use' variable sets its field at Submit(), after
             // every server-side write check has passed, so an entity whose check depends on a field's
             // final value must be able to see that a variable will set it.
+            const user: UserInfo = context.userPayload.userRecord;
             for (const item of group.Items) {
-                entityObjects.push(await md.GetEntityObject(item.EntityName, context.userPayload.userRecord));
+                entityObjects.push(await md.GetEntityObject(item.EntityName, user));
             }
+            this.AssertNetworkInputWritable(group, entityObjects, user);
             this.AddNetworkVariables(group, entityObjects, tg);
 
             for (const [index, item] of group.Items.entries()) {
                 const entity = entityObjects[index];
 
                 // get the values from the payload
-                const itemValues = SafeJSONParse(item.EntityObjectJSON);
+                const itemValues = SafeJSONParse<Record<string, unknown>>(item.EntityObjectJSON) ?? {};
                 // build a primary key for the item
                 const pkey = new CompositeKey(entity.PrimaryKeys.map(pk => {
                     const kv = new KeyValuePair();
@@ -171,8 +174,10 @@ export class TransactionResolver extends ResolverBase {
                         if (item.OperationType === "Update") {
                             await entity.InnerLoad(pkey);
                             if (typeof entity.GetDataObject === 'function') {
+                                // fls-guard: pre-update snapshot; projected before the delta is built
                                 preUpdateValues.set(index, await entity.GetDataObject());
                             } else if (typeof entity.GetAll === 'function') {
+                                // fls-guard: pre-update snapshot; projected before the delta is built
                                 preUpdateValues.set(index, { ...(entity.GetAll() as Record<string, unknown>) });
                             }
                         }
@@ -197,6 +202,7 @@ export class TransactionResolver extends ResolverBase {
                         // Awaiting costs nothing here — DataObjectParams defaults
                         // includeRelatedEntityData to false, which guards the method's only awaited
                         // work, so with no params this is GetAll() plus a filter loop.
+                        // fls-guard: projected in PrepareReturnValue
                         objectValues.push(await entity.GetDataObject());
                         entity.TransactionGroup = tg;
                         if (!await entity.Delete()) {
@@ -221,17 +227,17 @@ export class TransactionResolver extends ResolverBase {
                     `TransactionResolver::ExecuteTransactionGroup --- ${refusals.length} of ${group.Items.length} ` +
                     `item(s) were refused, so the group was not submitted:\n${refusals.join('\n')}`
                 );
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues);
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
 
             // after all that, we are ready to roll, so let's run the TG
             if (await tg.Submit()) {
                 // success!
-                return await this.PrepareReturnValue(true, entityObjects, objectValues, group, preUpdateValues);
+                return await this.PrepareReturnValue(true, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
             else {
                 // failure, send back the results
-                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues);
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group, preUpdateValues, md, user);
             }
         } 
         catch (err) {
@@ -240,6 +246,32 @@ export class TransactionResolver extends ResolverBase {
         }
     }
 
+    /**
+     * Field-level security gate on everything the client sent, run before any item is applied.
+     *
+     * Each create or update payload must name only fields the caller may read, and so must every transaction
+     * variable: a `Define` on a denied field would copy its value into another item's readable
+     * field at `Submit()`, and a `Use` would write it. A key that names no field is refused with
+     * the same message as a denied one (see `AssertClientInputWritableForUser`). Callers denied
+     * nothing on an entity are not affected. A delete payload is not gated: only its primary key
+     * is read, and the record is loaded from the database.
+     */
+    protected AssertNetworkInputWritable(group: TransactionInputType, entityObjects: BaseEntity[], user: UserInfo): void {
+        for (const [index, item] of group.Items.entries()) {
+            if (item.OperationType === TransactionOperationType.Delete) {
+                continue;
+            }
+            const values = SafeJSONParse<Record<string, unknown>>(item.EntityObjectJSON);
+            AssertClientInputWritableForUser(entityObjects[index]?.EntityInfo, values, user);
+        }
+        for (const networkVar of group.Variables ?? []) {
+            const target = entityObjects[networkVar.ItemIndex];
+            if (target && networkVar.FieldName) {
+                AssertClientInputWritableForUser(target.EntityInfo, { [networkVar.FieldName]: null }, user);
+            }
+        }
+    }
+
     /**
      * Adds the network payload's variables to the group, mapping each one's item index to the entity
      * object built for that item.
@@ -261,13 +293,18 @@ export class TransactionResolver extends ResolverBase {
         entityObjects: BaseEntity[],
         objectValues: unknown[],
         group: TransactionInputType,
-        preUpdateValues?: Map<number, Record<string, unknown>>
+        preUpdateValues?: Map<number, Record<string, unknown>>,
+        provider?: RecordChangeMetadataSource,
+        user?: UserInfo
     ): Promise<TransactionOutputType> {
         const jsonResults = [];
         for (let i = 0; i < group.Items.length; i++) {
             const item = group.Items[i];
+            const project = (values: Record<string, unknown>) =>
+                ProjectValuesForCaller(entityObjects[i]?.EntityInfo, values, user, provider);
             if (item.OperationType === 'Delete') {
-                jsonResults.push(JSON.stringify(objectValues[i]));
+                const deleted = objectValues[i];
+                jsonResults.push(JSON.stringify(deleted && typeof deleted === 'object' ? project(deleted as Record<string, unknown>) : deleted));
             }
             else if (item.OperationType === 'Update') {
                 jsonResults.push(
@@ -276,13 +313,15 @@ export class TransactionResolver extends ResolverBase {
                         objectValues[i],
                         preUpdateValues?.get(i),
                         group,
-                        i
+                        i,
+                        project
                     )
                 );
             }
             else {
-                // create, return what is in the database
-                jsonResults.push(await entityObjects[i].GetDataObjectJSON());
+                // create, return what is in the database, as the caller may read it
+                // fls-guard: projected by project()
+                jsonResults.push(JSON.stringify(project(await entityObjects[i].GetDataObject())));
             }
         }
 
@@ -303,20 +342,32 @@ export class TransactionResolver extends ResolverBase {
      * - Any field whose post-save value differs from its pre-update DB snapshot (`preSaveValues`),
      *   capturing virtual fields, triggers, or server-side `BeforeSave()` mutations automatically
      *   while omitting unchanged columns.
+     *
+     * Both rows are projected for the caller BEFORE they are compared. Comparing a full-width
+     * post-save row against a snapshot taken from a narrowed load would count every denied value
+     * as changed, and the delta would then deliver exactly the values the caller may not read.
      */
     private async serializeUpdateReturnValue(
         entity: BaseEntity,
         sentValues: unknown,
         preSaveValues: Record<string, unknown> | undefined,
         group: TransactionInputType,
-        itemIndex: number
+        itemIndex: number,
+        project: (values: Record<string, unknown>) => Record<string, unknown>
     ): Promise<string> {
-        const fullDataObj: Record<string, unknown> | null = typeof entity.GetDataObject === 'function'
+        const rawDataObj: Record<string, unknown> | null = typeof entity.GetDataObject === 'function'
+            // fls-guard: projected by project() below
             ? (await entity.GetDataObject() as Record<string, unknown>)
+            // fls-guard: projected by project() below
             : SafeJSONParse<Record<string, unknown>>(await entity.GetDataObjectJSON());
-        if (!fullDataObj || typeof fullDataObj !== 'object' || !sentValues || typeof sentValues !== 'object') {
-            return await entity.GetDataObjectJSON();
+        if (!rawDataObj || typeof rawDataObj !== 'object') {
+            return JSON.stringify(rawDataObj);
+        }
+        const fullDataObj = project(rawDataObj);
+        if (!sentValues || typeof sentValues !== 'object') {
+            return JSON.stringify(fullDataObj);
         }
+        preSaveValues = preSaveValues ? project(preSaveValues) : preSaveValues;
 
         const sentRecord = sentValues as Record<string, unknown>;
         const includeKeys = new Set<string>([

package/src/resolvers/UserViewResolver.ts

@@ -5,6 +5,7 @@ import { MJUserView_, MJUserViewResolverBase } from '../generated/generated.js';
 import { UserResolver } from './UserResolver.js';
 import { MJUserViewEntity, MJUserViewEntityExtended } from '@memberjunction/core-entities';
 import { GetReadOnlyProvider, GetReadWriteProvider } from '../util.js';
+import { ProjectEntityObjectForCaller } from '../generic/fieldSecurityTransport.js';
 
 @Resolver(MJUserView_)
 export class UserViewResolver extends MJUserViewResolverBase {
@@ -63,7 +64,7 @@ export class UserViewResolver extends MJUserViewResolverBase {
     await viewEntity.UpdateWhereClause(true); // force regeneration regardless of dirty state — that is the whole point of this endpoint
 
     if (await viewEntity.Save()) {
-      return viewEntity.GetAll();
+      return ProjectEntityObjectForCaller(viewEntity, u, p);
     } else {
       throw new Error('Failed to update where clause');
     }

package/src/resolvers/__tests__/GetDataResolver.tokens.test.ts

@@ -23,6 +23,8 @@ vi.mock('../../auth/index.js', () => ({ GetSystemUser: vi.fn(),
 vi.mock('mssql', () => ({ default: { Request: vi.fn() } }));
 
 import {
+  GetDataResolver,
+  GetDataInputType,
   RegisterAccessToken,
   DeleteAccessToken,
   TokenExists,
@@ -31,6 +33,7 @@ import {
   PruneExpiredTokens,
   GetAccessTokenCount,
 } from '../GetDataResolver.js';
+import type { AppContext } from '../../types.js';
 
 // ---------------------------------------------------------------------------
 // Regression coverage for a memory leak (Memory Leak Audit Round 7, Critical):
@@ -137,4 +140,53 @@ describe('GetDataResolver access-token lifecycle', () => {
     expect(GetAccessTokenCount()).toBeLessThan(before + 51);
     expect(TokenExists(survivorToken)).toBe(true);
   });
+
+  it('never leaks raw secret token values in thrown or returned error messages', async () => {
+    const duplicateSecret = `secret-dup-${uniqueToken()}`;
+    RegisterAccessToken(duplicateSecret, 60_000);
+
+    try {
+      RegisterAccessToken(duplicateSecret, 60_000);
+      expect.unreachable('Expected duplicate registration to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(duplicateSecret);
+    }
+
+    const missingSecret = `secret-missing-${uniqueToken()}`;
+    try {
+      DeleteAccessToken(missingSecret);
+      expect.unreachable('Expected deleting unknown token to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(missingSecret);
+    }
+
+    try {
+      RecordTokenUse(missingSecret, {});
+      expect.unreachable('Expected recording unknown token use to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(missingSecret);
+    }
+
+    const resolver = new GetDataResolver();
+    const input = new GetDataInputType();
+    input.Token = missingSecret;
+    input.Queries = ['SELECT 1'];
+    const output = await resolver.GetData(input, { dataSources: [] } as Partial<AppContext> as AppContext);
+    expect(output.Success).toBe(false);
+    expect(JSON.stringify(output.ErrorMessages)).not.toContain(missingSecret);
+  });
+
+  it('rejects empty tokens and near-miss prefix tokens across multiple active slots', () => {
+    const first = `slot-a-${uniqueToken()}`;
+    const second = `slot-b-${uniqueToken()}`;
+    RegisterAccessToken(first, 60_000);
+    RegisterAccessToken(second, 60_000);
+
+    expect(IsTokenValid('')).toBe(false);
+    expect(TokenExists('')).toBe(false);
+    expect(IsTokenValid(first.slice(0, -1))).toBe(false);
+    expect(IsTokenValid(`${second}-extra`)).toBe(false);
+    expect(IsTokenValid(first)).toBe(true);
+    expect(IsTokenValid(second)).toBe(true);
+  });
 });

package/src/resolvers/__tests__/MergeRecordsResolver.test.ts

@@ -90,4 +90,47 @@ describe('RecordDependencyResolver', () => {
     expect(result[0].IsSoftLink).toBeUndefined();
     expect(result[0].EntityIDFieldName).toBeUndefined();
   });
+
+  it('forwards contextUser and options to provider and maps FieldDisplayName', async () => {
+    const mockDep: RecordDependency = {
+      EntityName: 'Users',
+      RelatedEntityName: 'MJ: Task Links',
+      FieldName: 'RecordID',
+      FieldDisplayName: 'Linked Record',
+      PrimaryKey: new CompositeKey([new KeyValuePair('ID', 'TL-200')]),
+      IsSoftLink: true,
+      EntityIDFieldName: 'EntityID',
+    };
+
+    const getRecordDepsSpy = vi.fn().mockResolvedValue([mockDep]);
+    const mockProvider = {
+      GetRecordDependencies: getRecordDepsSpy,
+    } as unknown as IMetadataProvider;
+
+    vi.mocked(GetReadOnlyProvider).mockReturnValue(mockProvider as never);
+
+    const resolver = new RecordDependencyResolver();
+    const mockUser = { ID: 'u-1', Email: 'test@example.com' };
+    const mockContext = {
+      dataSource: {},
+      userPayload: { userRecord: mockUser },
+      providers: [],
+    } as unknown as AppContext;
+    const mockPubSub = {} as PubSubEngine;
+    const options = { LinkType: 'soft' as const, IncludeSystemEntities: false };
+
+    const result = await resolver.GetRecordDependencies(
+      'Users',
+      { KeyValuePairs: [{ FieldName: 'ID', Value: 'USER-1' }] },
+      mockContext,
+      mockPubSub,
+      options
+    );
+
+    expect(getRecordDepsSpy).toHaveBeenCalledTimes(1);
+    expect(getRecordDepsSpy.mock.calls[0][0]).toBe('Users');
+    expect(getRecordDepsSpy.mock.calls[0][2]).toBe(mockUser);
+    expect(getRecordDepsSpy.mock.calls[0][3]).toEqual(options);
+    expect(result[0].FieldDisplayName).toBe('Linked Record');
+  });
 });

package/src/resolvers/meetingRecordingRegistration.ts

@@ -268,6 +268,7 @@ async function findConversationByEgressID(egressID: string, contextUser: UserInf
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'simple',
     },
     contextUser,
@@ -288,6 +289,7 @@ async function findConversationByRoomName(roomName: string, contextUser: UserInf
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'simple',
     },
     contextUser,

package/src/rest/EntityCRUDHandler.ts

@@ -1,7 +1,8 @@
 import { 
-    BaseEntity, CompositeKey, EntityDeleteOptions, EntityPermissionType, 
+    AssertClientInputWritableForUser, BaseEntity, CompositeKey, EntityDeleteOptions, EntityPermissionType, 
     EntitySaveOptions, LogError, Metadata, UserInfo 
 } from '@memberjunction/core';
+import { ProjectValuesForCaller } from '../generic/fieldSecurityTransport.js';
 
 /**
  * Entity CRUD Implementation Functions for REST endpoints
@@ -42,6 +43,9 @@ export class EntityCRUDHandler {
                 delete data.options;
             }
             
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(entity.EntityInfo, data, user);
+
             // Set values on the entity
             for (const key in data) {
                 entity.Set(key, data[key]);
@@ -70,7 +74,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -114,7 +118,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -171,6 +175,9 @@ export class EntityCRUDHandler {
                 delete data.options;
             }
             
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(entity.EntityInfo, data, user);
+
             // Update entity with new values
             for (const key in data) {
                 entity.Set(key, data[key]);
@@ -179,7 +186,7 @@ export class EntityCRUDHandler {
             // Check if entity is dirty
             if (!entity.Dirty && !options.IgnoreDirtyState) {
                 // Nothing changed, return success
-                const entityData = await entity.GetDataObject();
+                const entityData = await this.responseData(entity, user, md);
                 return { success: true, entity: entityData };
             }
             
@@ -206,7 +213,7 @@ export class EntityCRUDHandler {
             }
             
             // Get entity data for response
-            const entityData = await entity.GetDataObject();
+            const entityData = await this.responseData(entity, user, md);
             return { success: true, entity: entityData };
         } catch (error: any) {
             LogError(error);
@@ -273,6 +280,16 @@ export class EntityCRUDHandler {
         return this.DeleteEntity(entityName, id, options, user);
     }
     
+    /**
+     * The record's field values for the response, reduced to what `user` may READ. An entity
+     * object built for a restricted user holds no denied value already; this is the backstop for
+     * one that does.
+     */
+    private static async responseData(entity: BaseEntity, user: UserInfo, md: Metadata): Promise<Record<string, unknown>> {
+        // fls-guard: projected by ProjectValuesForCaller
+        return ProjectValuesForCaller(entity.EntityInfo, await entity.GetDataObject() as Record<string, unknown>, user, md);
+    }
+
     /**
      * Build the record key from the `:id` path segment. A single-column key (any column name) is
      * the bare value; a composite key is the URL-encoded `Field1|Value1||Field2|Value2` segment.

package/src/rest/MediaAccessKeys.ts

@@ -18,7 +18,7 @@
 
 import { BaseSingleton } from '@memberjunction/global';
 import { LogStatus } from '@memberjunction/core';
-import { randomBytes } from 'node:crypto';
+import { createHmac, randomBytes } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
@@ -78,7 +78,11 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     }
     const configured = process.env.MJ_BASE_ENCRYPTION_KEY?.trim();
     if (configured) {
-      this.secret = configured;
+      // Key separation: never sign tokens with the field-encryption master key itself. Derive a
+      // dedicated HS256 signing key (HKDF-style HMAC expand) so a token-signing compromise and the
+      // data-at-rest key stay decoupled. Tokens are short-lived, so changing the derivation only
+      // invalidates in-flight URLs, exactly like a restart on the ephemeral path below.
+      this.secret = createHmac('sha256', configured).update('mj-media-access-token-signing-v1').digest('base64');
     } else {
       this.secret = randomBytes(32).toString('base64');
       LogStatus(