@memberjunction/server 6.2.0-edge.7 → 6.2.0-edge.8

package/src/resolvers/TelemetryResolver.ts

@@ -3,8 +3,11 @@ import { AppContext } from '../types.js';
 import {
     TelemetryManager,
     TelemetryCategory,
-    TelemetryInsightSeverity
+    TelemetryInsightSeverity,
+    AuthorizationEvaluator,
 } from '@memberjunction/core';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
+import { GetReadOnlyProvider } from '../util.js';
 
 // ============================================================================
 // GraphQL Types for TelemetryEvent
@@ -318,12 +321,38 @@ export class TelemetryInsightFilterInput {
 
 @Resolver()
 export class TelemetryResolver {
+    /**
+     * Enforces that the caller is an authenticated, non-scope-limited user who holds either
+     * Owner privileges or the `'Diagnostics: Run Sessions'` authorization.
+     */
+    private requireDiagnosticsAccess(context: AppContext): void {
+        const user = context?.userPayload?.userRecord;
+        if (!user || IsScopeLimitedPrincipal(user)) {
+            throw new Error('Access denied: server telemetry requires an authenticated non-scope-limited user.');
+        }
+        if (user.Type?.trim().toLowerCase() === 'owner') {
+            return;
+        }
+        const authorizations = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true })?.Authorizations ?? [];
+        const diagAuth = authorizations.find(
+            (a) => a.Name?.trim().toLowerCase() === 'diagnostics: run sessions'
+        );
+        if (diagAuth) {
+            const evaluator = new AuthorizationEvaluator();
+            if (evaluator.UserCanExecuteWithAncestors(diagAuth, user, authorizations)) {
+                return;
+            }
+        }
+        throw new Error('Access denied: server telemetry requires Owner privileges or the "Diagnostics: Run Sessions" authorization.');
+    }
+
     /**
      * Get telemetry settings
-     * Accessible to any authenticated user - telemetry data is not sensitive
+     * Requires Owner privileges or 'Diagnostics: Run Sessions' authorization
      */
     @Query(() => TelemetrySettingsGQL)
-    GetServerTelemetrySettings(@Ctx() _context: AppContext): TelemetrySettingsGQL {
+    GetServerTelemetrySettings(@Ctx() context: AppContext): TelemetrySettingsGQL {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
         const settings = tm.Settings;
 
@@ -365,7 +394,8 @@ export class TelemetryResolver {
      * Get telemetry statistics
      */
     @Query(() => TelemetryStatsGQL)
-    GetServerTelemetryStats(@Ctx() _context: AppContext): TelemetryStatsGQL {
+    GetServerTelemetryStats(@Ctx() context: AppContext): TelemetryStatsGQL {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
         const stats = tm.GetStats();
 
@@ -391,9 +421,10 @@ export class TelemetryResolver {
      */
     @Query(() => [TelemetryEventGQL])
     GetServerTelemetryEvents(
-        @Ctx() _context: AppContext,
+        @Ctx() context: AppContext,
         @Arg('filter', () => TelemetryEventFilterInput, { nullable: true }) filter?: TelemetryEventFilterInput
     ): TelemetryEventGQL[] {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
 
         const events = tm.GetEvents({
@@ -427,9 +458,10 @@ export class TelemetryResolver {
      */
     @Query(() => [TelemetryPatternGQL])
     GetServerTelemetryPatterns(
-        @Ctx() _context: AppContext,
+        @Ctx() context: AppContext,
         @Arg('filter', () => TelemetryPatternFilterInput, { nullable: true }) filter?: TelemetryPatternFilterInput
     ): TelemetryPatternGQL[] {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
 
         const patterns = tm.GetPatterns({
@@ -468,9 +500,10 @@ export class TelemetryResolver {
      */
     @Query(() => [TelemetryInsightGQL])
     GetServerTelemetryInsights(
-        @Ctx() _context: AppContext,
+        @Ctx() context: AppContext,
         @Arg('filter', () => TelemetryInsightFilterInput, { nullable: true }) filter?: TelemetryInsightFilterInput
     ): TelemetryInsightGQL[] {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
 
         const insights = tm.GetInsights({
@@ -500,9 +533,10 @@ export class TelemetryResolver {
      */
     @Query(() => [TelemetryPatternGQL])
     GetServerTelemetryDuplicates(
-        @Ctx() _context: AppContext,
+        @Ctx() context: AppContext,
         @Arg('minCount', () => Int, { defaultValue: 2 }) minCount: number
     ): TelemetryPatternGQL[] {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
         const patterns = tm.GetDuplicates(minCount);
 
@@ -534,7 +568,8 @@ export class TelemetryResolver {
      * Get currently active (in-progress) events
      */
     @Query(() => [TelemetryEventGQL])
-    GetServerTelemetryActiveEvents(@Ctx() _context: AppContext): TelemetryEventGQL[] {
+    GetServerTelemetryActiveEvents(@Ctx() context: AppContext): TelemetryEventGQL[] {
+        this.requireDiagnosticsAccess(context);
         const tm = TelemetryManager.Instance;
         const events = tm.GetActiveEvents();
 

package/src/resolvers/meetings/meetingMutations.ts

@@ -5,7 +5,7 @@ import {
   RunView,
   UserInfo,
 } from '@memberjunction/core';
-import { EscapeSQLString, UUIDsEqual } from '@memberjunction/global';
+import { EscapeSQLString, IndexByUUID, UUIDsEqual } from '@memberjunction/global';
 import type {
   MJMeetingEntity,
   MJMeetingParticipantEntity,
@@ -25,6 +25,7 @@ import {
   UpdateMeetingInput,
   RSVPMeetingInput,
   MeetingParticipantType,
+  MeetingParticipantInput,
 } from './meetingTypes.js';
 import * as defaultHelpers from './meetingHelpers.js';
 
@@ -34,6 +35,39 @@ function resolveHelpers(overrides?: Partial<MeetingHelpers>): MeetingHelpers {
   return { ...defaultHelpers, ...overrides };
 }
 
+/**
+ * Indexes a meeting's participants by UserID, AgentID and lower-cased ExternalEmail, and returns a
+ * lookup that finds the participant an update input refers to. When the input matches different
+ * participants on different keys, the one listed first in `existing` wins, as a single
+ * `existing.find` over all three keys would answer.
+ */
+function indexParticipants(
+  existing: MeetingParticipantType[],
+): (input: MeetingParticipantInput) => MeetingParticipantType | undefined {
+  const byUserID = IndexByUUID(existing.filter((e) => e.UserID), (e) => e.UserID);
+  const byAgentID = IndexByUUID(existing.filter((e) => e.AgentID), (e) => e.AgentID);
+  const byEmail = new Map<string, MeetingParticipantType>();
+  const position = new Map<MeetingParticipantType, number>();
+  existing.forEach((e, i) => {
+    position.set(e, i);
+    const email = e.ExternalEmail?.toLowerCase();
+    if (email && !byEmail.has(email)) byEmail.set(email, e);
+  });
+
+  return (input) => {
+    const candidates = [
+      input.UserID ? byUserID.Get(input.UserID) : undefined,
+      input.AgentID ? byAgentID.Get(input.AgentID) : undefined,
+      input.ExternalEmail ? byEmail.get(input.ExternalEmail.toLowerCase()) : undefined,
+    ];
+    let first: MeetingParticipantType | undefined;
+    for (const candidate of candidates) {
+      if (candidate && (!first || (position.get(candidate) ?? 0) < (position.get(first) ?? 0))) first = candidate;
+    }
+    return first;
+  };
+}
+
 export async function ExecuteCreateMeeting(
   provider: IMetadataProvider,
   user: UserInfo,
@@ -235,15 +269,11 @@ export async function ExecuteUpdateMeeting(
     // If participants specified in update, sync participants (upsert by UserID/AgentID/ExternalEmail)
     if (input.Participants !== undefined) {
       const existing = await h.LoadParticipants(meeting.ID, user, provider);
+      const findExisting = indexParticipants(existing);
 
       for (const pInput of input.Participants) {
         const isSelf = pInput.UserID && UUIDsEqual(pInput.UserID, user.ID);
-        const match = existing.find(
-          (e) =>
-            (pInput.UserID && e.UserID && UUIDsEqual(e.UserID, pInput.UserID)) ||
-            (pInput.AgentID && e.AgentID && UUIDsEqual(e.AgentID, pInput.AgentID)) ||
-            (pInput.ExternalEmail && e.ExternalEmail && e.ExternalEmail.toLowerCase() === pInput.ExternalEmail.toLowerCase()),
-        );
+        const match = findExisting(pInput);
 
         if (match) {
           if (!isSelf && pInput.Role) {

package/src/util.ts

@@ -6,7 +6,8 @@ import { URL } from 'url';
 import { z } from 'zod';
 import { DataSourceInfo, ProviderInfo } from './types';
 import sql from 'mssql';
-import { DatabaseProviderBase } from '@memberjunction/core';
+import { DatabaseProviderBase, GetDiagnosticContext, IsDiagnosticCaptureSuppressed } from '@memberjunction/core';
+import { GetGlobalObjectStore } from '@memberjunction/global';
 
 const gzip = promisify(gzipCallback);
 
@@ -249,8 +250,59 @@ export async function sendPostRequest(url: string, payload: any, useCompression:
           sqlQuery = sqlQuery.replace(/\?/g, () => `@p${paramIndex++}`);
         }
       }
-      const result = await request.query(sqlQuery);
-      return result.recordset || [];
+      const startTime = performance.now();
+      const notifyPoolSqlObservers = (rowCount: number, errorMessage?: string): void => {
+        if (typeof IsDiagnosticCaptureSuppressed === 'function' && IsDiagnosticCaptureSuppressed()) {
+          return;
+        }
+        const observers = GetGlobalObjectStore()?.['___MJ_SQL_OBSERVERS___'] as
+          | Set<{ onSqlExecuted: (obs: Record<string, unknown>) => void }>
+          | undefined;
+        if (!observers || observers.size === 0) {
+          return;
+        }
+        const ctx = typeof GetDiagnosticContext === 'function' ? GetDiagnosticContext() : undefined;
+        const obs: Record<string, unknown> = {
+          ts: Date.now(),
+          sql: sqlQuery,
+          parameterTypes: Array.isArray(parameters)
+            ? parameters.map((v, idx) => ({
+                name: `p${idx}`,
+                sqlType: v === null ? 'null' : typeof v,
+                byteLength: typeof v === 'string' ? v.length : 0,
+              }))
+            : [],
+          durationMs: performance.now() - startTime,
+          rowCount,
+          isMutation: false,
+          description: 'ConnectionPool.query',
+          ...(errorMessage ? { errorMessage } : {}),
+          ...(ctx
+            ? {
+                diagnosticContext: ctx,
+                sessionId: ctx.sessionId ?? ctx.SessionID,
+                traceId: ctx.traceId ?? ctx.TraceID,
+                spanId: ctx.spanId ?? ctx.SpanID,
+              }
+            : {}),
+        };
+        for (const observer of observers) {
+          try {
+            observer.onSqlExecuted(obs);
+          } catch {
+            // Observer errors must never affect SQL execution
+          }
+        }
+      };
+      try {
+        const result = await request.query(sqlQuery);
+        const rows = result.recordset || [];
+        notifyPoolSqlObservers(rows.length);
+        return rows;
+      } catch (err) {
+        notifyPoolSqlObservers(0, err instanceof Error ? err.message : String(err));
+        throw err;
+      }
     };
     return extendedPool;
   }