ProtectedAfterProtectedAfterProtectedAfterProtectedapplyProtectedArrayFilters encrypted fields for an array of data objects
Optionalprovider: IMetadataProviderProtectedArrayProtectedBeforeProtectedBeforeProtectedBeforeProtectedCheckChecks API key scope authorization. Only performs check if request was authenticated via API key (apiKeyHash present in userPayload). For OAuth/JWT auth, this is a no-op.
The scope path (e.g., 'entity:read', 'agent:execute')
The resource name (e.g., entity name, agent name)
The user payload from context
ProtectedCheckOptionalprovider: IMetadataProviderProtectedcreateLegacy file upload path — used by the <mj-files-file-upload> Angular component.
Creates a File entity record in the database AND generates a pre-authenticated upload URL.
The client then PUTs the file binary directly to that URL.
Driver initialization: uses buildUserContext() (no storage account). The driver
initializes from environment variables (e.g. STORAGE_AZURE_ACCOUNT_NAME, STORAGE_DROPBOX_ACCESS_TOKEN).
Input: ProviderID identifies which storage provider to use.
Returns: { File, UploadUrl, NameExists } — the persisted File record, upload URL, and duplicate check.
Mints a short-lived signed media-access token for an MJ: Files record and returns the
authenticated streaming URL (<publicBase>/media/<fileId>?token=<token>). Permission-gated
IDENTICALLY to GetFileContents: the file is loaded under the CALLING USER's context, so
MJ row-level security determines access. The returned token is the capability — the streaming
route re-verifies it without re-checking row-level access. Never throws to the client.
The MJ: Files id to grant streaming access to.
{ Success, Token?, Url?, ExpiresAt?, ErrorMessage? }.
Enterprise file upload path — used by the File Browser UI. Generates a pre-authenticated upload URL only (does NOT create a File entity record). The client handles the upload directly to the storage provider via the returned URL.
Driver initialization: uses buildExtendedUserContext() with a FileStorageAccount entity.
Credentials are loaded from the Credential Engine (encrypted in the database), with
automatic token refresh for OAuth providers like Dropbox and Box.com.
Input: AccountID identifies which storage account (and its linked provider/credentials) to use.
Returns: { UploadUrl, ProviderKey } — the pre-authenticated URL and optional provider key.
ProtectedCreateProtectedcreateProtectedDeleteProtectedEmitProtectedFilterFilters encrypted field values before sending to the API client.
For each encrypted field in the entity:
Name of the entity
The data object containing field values
User context for encryption operations
Optionalprovider: IMetadataProviderThe filtered data object
ProtectedfindReturns an MJ: Files record's bytes as base64, read server-side through authenticated MJStorage
(GetObject) — NOT a public pre-signed link. Permission-gated: the file is first loaded under the
calling user's context, so MJ row-level security determines access. Never throws to the client.
The MJ: Files id whose bytes to return.
{ Success, Base64?, MimeType?, ErrorMessage? }.
ProtectedgetProtectedGetProtectedGetProtectedListenProtectedLoadLoads a single external-data-source-backed entity record by primary key and returns it in GraphQL field-name (CodeName) shape, or null if not found.
External entities (Entity.ExternalDataSourceID set) have no MJ base view or sproc — their
data is proxied live from a remote system — so the generated single-record resolver cannot run
SELECT * FROM <baseView>. Instead it loads through a BaseEntity object, whose InnerLoad
the data provider dispatches to the external read router's LoadExternalRecord (a composite-key
aware, quoted, parameter-bound single-record lookup), applying the same RLS gate and field
post-processing (decryption / datetime normalization) as the MJ-DB path. The caller is
responsible for the CheckUserReadPermissions gate beforehand.
ProtectedMapMaps field names to their GraphQL-safe CodeNames and handles encryption for API responses.
For encrypted fields coming from raw SQL queries (not entity objects):
The entity name
The data object with field values
OptionalcontextUser: UserInfoOptional user context for decryption (required for encrypted fields)
Optionalprovider: IMetadataProviderThe processed data object
ProtectedpackageProtectedPublishPublishes a CACHE_INVALIDATION event to connected browser clients after a successful entity save or delete. Includes the originSessionId so the originating browser can skip redundant re-fetches (it already handled the event locally).
ProtectedReverseReverse-maps GraphQL-safe field names back to entity CodeNames in a mutation input object.
For example, _mj__integration_SyncStatus is mapped back to __mj_integration_SyncStatus.
Also reverse-maps keys inside the OldValues___ array if present.
This is the inverse of MapFieldNamesToCodeNames and must be called before passing
GraphQL input to entity SetMany() or field lookups.
ProtectedRunOptimized RunViewGenericInternal implementation with:
Optionalaggregates: AggregateExpression[]OptionalafterKey: CompositeKeyOptionalbypassCache: booleanProtectedRunOptimized implementation that:
ProtectedsafeProtectedTestThis routine compares the OldValues property in the input object to the values in the DB that we just loaded. If there are differences, we need to check to see if the client is trying to update any of those fields (e.g. overlap). If there is overlap, we throw an error. If there is no overlap, we can proceed with the update even if the DB Values and the ClientOldValues are not 100% the same, so long as there is no overlap in the specific FIELDS that are different.
ASSUMES: input object has an OldValues___ property that is an array of Key/Value pairs that represent the old values of the record that the client is trying to update.
ProtectedUpdate
Applies an inbound RestoreContext___ blob to a server-side BaseEntity. Mirrors the OldValues___ pattern — the client-side BaseEntity's
_restoreContextdoesn't traverse the network, so the server must reconstruct it from the mutation input before calling Save().Returns true when context was applied; false when no context was on the input.