@memberjunction/auth-providers 6.1.0-edge.2 → 6.1.0-edge.4

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @memberjunction/auth-providers@6.1.0-edge.2 build /home/runner/work/MJ/MJ/packages/AuthProviders
+> @memberjunction/auth-providers@6.1.0-edge.4 build /home/runner/work/MJ/MJ/packages/AuthProviders
 > tsc && tsc-alias -f
 

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # @memberjunction/auth-providers
 
+## 6.1.0-edge.4
+
+### Patch Changes
+
+- Updated dependencies [4586215]
+- Updated dependencies [e2ad3c0]
+- Updated dependencies [a5f92d2]
+- Updated dependencies [647bd71]
+- Updated dependencies [d90a3ea]
+- Updated dependencies [8ad04e8]
+- Updated dependencies [53c341c]
+- Updated dependencies [a1a8989]
+  - @memberjunction/global@6.1.0-edge.4
+  - @memberjunction/core@6.1.0-edge.4
+
+## 6.1.0-edge.3
+
+### Minor Changes
+
+- 048c5ce: feat(auth): metadata-driven pluggable authentication providers
+
+  Authentication providers are now discovered the MJ way — a `@RegisterClass(BaseAuthProvider, 'x')`
+  subclass plus a row in the new `MJ: Authentication Providers` entity, resolved at runtime through
+  `ClassFactory` by `DriverClass`. Adding a provider requires no core edits.
+  - **New entity** `__mj.AuthenticationProvider`, with the OIDC connection fields as columns, an
+    optional `CredentialID` for the rare provider needing server-side secrets, and login-picker
+    presentation fields. Driver configuration is split by trust boundary: `AdditionalConfiguration`
+    is server-only, `ClientConfiguration` is published to the browser.
+  - **`AuthProviderEngine`** loads the catalog at startup and registers it with `AuthProviderFactory`.
+  - **Layered resolution** — `mj.config.cjs` `authProviders[]` remains fully supported as the baseline
+    and fallback, so existing deployments are unaffected and need no changes.
+  - **`GET /auth/providers`** publishes the non-secret catalog to the pre-auth browser (rate-limited,
+    mounted ahead of the auth middleware, allow-list projection).
+  - **`<mj-login-picker>`** — a reusable, app-agnostic multi-IdP picker built on `mjButton`, rendered
+    only when 2+ client-visible providers exist. Single-provider deployments look exactly as before.
+  - `AuthProviderFactory` no longer carries a hard-wired list of built-in provider imports; the
+    package entry point and the class-registration manifests already covered registration.
+  - **Environment-variable configuration is now pluggable too.** The hard-coded block in MJServer's
+    config that enumerated Entra / Auth0 / Cognito inline is replaced by an optional
+    `configFromEnvironment` static on each provider class (`IEnvironmentConfigurableProvider`),
+    collected through the ClassFactory registry by `AuthProviderFactory.discoverFromEnvironment()`.
+    A third-party provider can now offer the same "set two variables and you're done" experience
+    with no change to MJ core. The three existing mappings are preserved byte-for-byte; **Okta**
+    (`OKTA_DOMAIN` + `OKTA_CLIENT_ID`) and **WorkOS** (`WORKOS_CLIENT_ID`) gain env-var support they
+    did not previously have.
+
+### Patch Changes
+
+- Updated dependencies [834f8d7]
+- Updated dependencies [07cb22e]
+- Updated dependencies [c581b4f]
+- Updated dependencies [d79fe39]
+- Updated dependencies [08829f5]
+- Updated dependencies [815b9bc]
+- Updated dependencies [f5ec13b]
+- Updated dependencies [50987c4]
+- Updated dependencies [7b4abe7]
+- Updated dependencies [051e0ff]
+- Updated dependencies [95fc3e6]
+- Updated dependencies [cefc302]
+- Updated dependencies [bbb7fcc]
+- Updated dependencies [b8130f3]
+- Updated dependencies [be0bdb2]
+- Updated dependencies [68b9cf0]
+- Updated dependencies [048c5ce]
+- Updated dependencies [7300953]
+- Updated dependencies [7300953]
+- Updated dependencies [b46330e]
+- Updated dependencies [84f276e]
+- Updated dependencies [6ecfaa0]
+- Updated dependencies [f5ec13b]
+- Updated dependencies [1bd9674]
+- Updated dependencies [d0a2a55]
+  - @memberjunction/global@6.1.0-edge.3
+  - @memberjunction/core@6.1.0-edge.3
+
 ## 6.1.0-edge.2
 
 ### Patch Changes

package/LICENSE

@@ -1,7 +1,183 @@
-ISC License
+Business Source License 1.1
 
-Copyright (c) 2023 MemberJunction
+License text copyright (c) 2024 MariaDB plc, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB plc.
 
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+-----------------------------------------------------------------------------
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+Parameters
+
+Licensor:             Blue Cypress, Inc.
+
+Licensed Work:        MemberJunction.
+                      The Licensed Work is (c) 2023-2026 Blue Cypress, Inc.
+
+Additional Use Grant: Subject to the terms of this License, Licensor grants
+                      you the following additional rights to make Production
+                      Use of the Licensed Work.
+
+                      1. Internal Use
+
+                      You may make production use of the Licensed Work for
+                      your own internal business or organizational operations.
+
+                      2. Nonprofit Use
+
+                      If you are a Nonprofit, you may make production use of
+                      the Licensed Work for the operations and activities of
+                      your Organizational Family.
+
+                      3. MemberJunction Certified Program Use
+
+                      If you are authorized by Licensor under the
+                      MemberJunction Certified Program to provide professional
+                      services using the Licensed Work, you may make
+                      production use of the Licensed Work in providing such
+                      professional services to a client, provided that:
+
+                      (a) the Licensed Work is deployed in, and the applicable
+                      production use occurs within, an environment owned,
+                      leased, licensed, subscribed to, or otherwise controlled
+                      by that client; and
+
+                      (b) the production use is for that client's own internal
+                      business or organizational operations or is otherwise
+                      independently permitted to that client under this
+                      Additional Use Grant.
+
+                      4. Definitions Applicable to the Additional Use Grant
+
+                      "Affiliate" means, with respect to a specified Person,
+                      any other Person that directly or indirectly Controls,
+                      is Controlled by, or is under common Control with such
+                      specified Person.
+
+                      "Control" (including the terms "Controls," "Controlled
+                      by," and "under common Control with") means the direct
+                      or indirect possession of the power to direct or cause
+                      the direction of the management and policies of a
+                      Person, whether through ownership of voting interests,
+                      by contract, or otherwise.
+
+                      "Organizational Family" means, with respect to a Person,
+                      (a) such Person and its Affiliates, and (b) any
+                      nonprofit organization, governmental entity, chapter,
+                      division, local affiliate, regional affiliate, state
+                      affiliate, national affiliate, or other entity that is
+                      formally affiliated with such Person through governing
+                      documents, a charter, bylaws, a membership agreement, or
+                      another written organizational instrument, and is
+                      recognized under such documents as part of the same
+                      organizational structure.
+
+                      "Nonprofit" means a Person recognized by the Internal
+                      Revenue Service as exempt from federal income taxation
+                      under Section 501(c)(3), 501(c)(4), 501(c)(5), or
+                      501(c)(6) of the Internal Revenue Code, or a foreign
+                      organization recognized under substantially equivalent
+                      laws.
+
+                      A Person claiming eligibility as a Nonprofit shall, upon
+                      Licensor's reasonable request, provide documentation
+                      reasonably sufficient to demonstrate that it qualifies
+                      as a Nonprofit. If such Person materially misrepresents,
+                      or is unable to demonstrate, its qualification as a
+                      Nonprofit, the rights granted to such Person under
+                      Section 2 of this Additional Use Grant shall terminate.
+
+                      "MemberJunction Certified Program" means Licensor's
+                      then-current program for certifying and authorizing a
+                      Person to provide professional services using the
+                      Licensed Work.
+
+                      "Person" means any individual, corporation, limited
+                      liability company, partnership, association, nonprofit
+                      organization, governmental entity, or other legal or
+                      organizational entity.
+
+Change Date:          Four (4) years from the date the Licensed Work is first
+                      made available.
+
+Change License:       MIT License.
+
+For information about alternative licensing arrangements for the Licensed
+Work, please contact Blue Cypress, Inc.
+
+-----------------------------------------------------------------------------
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+-----------------------------------------------------------------------------
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License
+   can be included in a program with software provided under GPL Version 2.0
+   or a later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+-----------------------------------------------------------------------------
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.

package/README.md

@@ -102,6 +102,75 @@ Each built-in provider is registered with the MJ class factory under a lowercase
 
 Every provider also requires the base fields: `name`, `type`, `issuer`, `audience`, `jwksUri`. See [`AuthProviderConfig`](../MJCore/src/generic/authTypes.ts) for the full shape.
 
+> The list above is **not a closed set** — it is what MJ happens to ship. `type` is resolved through
+> the class factory, so any `@RegisterClass(BaseAuthProvider, 'your-key')` subclass is instantiable
+> the same way, with no change to this package. Nothing validates `type` against an enum.
+
+## Where provider configuration comes from
+
+A provider config can reach the factory from three places. They layer rather than compete, and none
+is mandatory:
+
+| Source | Set by | Notes |
+| --- | --- | --- |
+| **Environment variables** | Each provider class's optional `ConfigFromEnvironment` static | The zero-config path. See below. |
+| **`mj.config.cjs`** | The `authProviders` array | Explicit and exact. Declaring it **replaces** the environment-derived set rather than merging. |
+| **`MJ: Authentication Providers` metadata** | Rows in the database | Enables admin-managed configuration and the multi-IdP login picker. Layered on top at startup by MJServer's `AuthProviderEngine`. |
+
+Config and environment remain the bootstrap path: you cannot configure authentication through a UI
+you must first authenticate to reach.
+
+### Environment-variable configuration (`ConfigFromEnvironment`)
+
+A provider class declares its own environment mapping by implementing the optional
+[`IEnvironmentConfigurableProvider`](src/IEnvironmentConfigurableProvider.ts) static.
+`AuthProviderFactory.DiscoverFromEnvironment()` walks the class-factory registry and collects every
+provider that finds its variables — so a third-party provider gets the same "set two variables and
+you're done" experience as a built-in, without touching MJ core.
+
+| Provider | Variables | Resulting provider name |
+| --- | --- | --- |
+| Entra ID / Azure AD | `TENANT_ID` + `WEB_CLIENT_ID` | `azure` |
+| Auth0 | `AUTH0_DOMAIN` + `AUTH0_CLIENT_ID` (optional `AUTH0_CLIENT_SECRET`) | `auth0` |
+| AWS Cognito | `COGNITO_USER_POOL_ID` + `COGNITO_CLIENT_ID` + `AWS_REGION` | `cognito` |
+| Okta | `OKTA_DOMAIN` + `OKTA_CLIENT_ID` (optional `OKTA_ISSUER`, `OKTA_AUDIENCE`) | `okta` |
+| WorkOS | `WORKOS_CLIENT_ID` (optional `WORKOS_AUDIENCE`) | `workos` |
+
+Implementing it on your own provider:
+
+```typescript
+@RegisterClass(BaseAuthProvider, 'my-idp')
+export class MyIdpProvider extends BaseAuthProvider {
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    // MUST return null — never a partial config — when the variables are absent, or the
+    // half-populated result fails validateConfig() and errors on every deployment that
+    // simply does not use this provider.
+    if (!env.MY_IDP_DOMAIN || !env.MY_IDP_CLIENT_ID) return null;
+    return {
+      name: 'my-idp',
+      type: 'my-idp',
+      issuer: `https://${env.MY_IDP_DOMAIN}/`,
+      audience: env.MY_IDP_CLIENT_ID,
+      jwksUri: `https://${env.MY_IDP_DOMAIN}/.well-known/jwks.json`,
+      clientId: env.MY_IDP_CLIENT_ID
+    };
+  }
+  // ...extractUserInfo, etc.
+}
+```
+
+### Metadata configuration
+
+`MJ: Authentication Providers` rows name a `DriverClass` — the same key as `@RegisterClass` — plus
+the non-secret OIDC fields, and are resolved at runtime through the class factory. Two configuration
+blobs are split by trust boundary: `AdditionalConfiguration` is server-only and never published,
+while `ClientConfiguration` is published verbatim to the unauthenticated pre-auth catalog endpoint
+that the browser reads before login. Real secrets belong behind `CredentialID`, which points at an
+encrypted `MJ: Credentials` record.
+
+MJ ships seed rows for its providers (all `Inactive`, connection fields blank) — see
+[`metadata/authentication-providers/`](../../metadata/authentication-providers/README.md).
+
 ## Configuration
 
 In an MJ server, providers are configured under `authProviders` in `mj.config.cjs`. Multiple providers can be registered concurrently — the factory dispatches incoming tokens to the right one based on the `iss` claim.
@@ -243,7 +312,7 @@ export class KeycloakProvider extends BaseAuthProvider {
 // Then in mj.config.cjs use type: 'keycloak'
 ```
 
-> **Important:** because the provider is loaded via class-factory metadata and not by direct reference, your bundler may tree-shake it out. Make sure the file containing the `@RegisterClass` decorator is imported (directly or transitively) before `AuthProviderFactory.createProvider()` runs. The built-in providers do this from [`AuthProviderFactory.ts`](src/AuthProviderFactory.ts); follow the same pattern in your own entry point or a manifest. See the class-registration manifest discussion in [packages/CodeGenLib/CLAUDE.md](../CodeGenLib/CLAUDE.md) for background.
+> **Important:** because the provider is loaded via class-factory metadata and not by direct reference, your bundler may tree-shake it out. Make sure the file containing the `@RegisterClass` decorator is imported (directly or transitively) before `AuthProviderFactory.createProvider()` runs. The built-in providers achieve this by being exported from this package's [`index.ts`](src/index.ts) — importing anything from `@memberjunction/auth-providers` loads and registers all of them. (`AuthProviderFactory.ts` used to carry a literal roster of side-effect imports for this; it was removed because it made the built-ins look like a closed set you had to append to, and `index.ts` already covered it.) For your own provider, export it from your package entry point and make sure that package is reachable from a class-registration manifest — see the discussion in [packages/CodeGenLib/CLAUDE.md](../CodeGenLib/CLAUDE.md).
 
 ## API reference
 
@@ -314,4 +383,4 @@ A `GraphQLError` with `extensions.code = 'JWT_EXPIRED'` and `extensions.expiryDa
 
 ## License
 
-ISC — part of the [MemberJunction](https://github.com/MemberJunction/MJ) monorepo.
+Business Source License 1.1 — see [LICENSE](../../LICENSE) for details.

package/dist/AuthProviderFactory.d.ts

@@ -1,13 +1,6 @@
 import { AuthProviderConfig } from '@memberjunction/core';
 import { IAuthProvider } from './IAuthProvider.js';
 import { BaseSingleton } from '@memberjunction/global';
-import './providers/Auth0Provider.js';
-import './providers/MSALProvider.js';
-import './providers/OktaProvider.js';
-import './providers/CognitoProvider.js';
-import './providers/GoogleProvider.js';
-import './providers/WorkOSProvider.js';
-import './providers/MagicLinkProvider.js';
 /**
  * Factory and registry for managing authentication providers
  * Combines provider creation and lifecycle management in a single class
@@ -72,6 +65,23 @@ export declare class AuthProviderFactory extends BaseSingleton<AuthProviderFacto
      * Gets all registered provider types from the ClassFactory
      */
     static getRegisteredProviderTypes(): string[];
+    /**
+     * Collects provider configurations from environment variables by asking every registered
+     * provider class to configure itself.
+     *
+     * This replaces the hard-coded env block that used to live in MJServer's config and
+     * enumerated Entra / Auth0 / Cognito inline. Discovery is now driven by the same
+     * `@RegisterClass` registry that resolves drivers, so a third-party provider gets the
+     * env-var experience without a core edit — see {@link IEnvironmentConfigurableProvider}.
+     *
+     * A provider whose variables are absent returns null and is skipped. A provider whose
+     * mapping throws is skipped with an error rather than taking down startup, because one
+     * malformed mapping must not cost a deployment its other providers.
+     *
+     * @param env Environment to read from; defaults to `process.env`.
+     * @returns One config per provider that found its variables, deduplicated by name.
+     */
+    static DiscoverFromEnvironment(env?: NodeJS.ProcessEnv): AuthProviderConfig[];
     /**
      * Checks if a provider type is registered
      */

package/dist/AuthProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAG7E,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAiBvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CASvD"}
+{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAgB7E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAiBvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,EAAE;IA0B1F;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CASvD"}

package/dist/AuthProviderFactory.js

@@ -1,14 +1,20 @@
 import { LogStatusEx } from '@memberjunction/core';
 import { BaseAuthProvider } from './BaseAuthProvider.js';
+import { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 import { MJGlobal, BaseSingleton, MJLruCache } from '@memberjunction/global';
-// Import providers to ensure they're registered
-import './providers/Auth0Provider.js';
-import './providers/MSALProvider.js';
-import './providers/OktaProvider.js';
-import './providers/CognitoProvider.js';
-import './providers/GoogleProvider.js';
-import './providers/WorkOSProvider.js';
-import './providers/MagicLinkProvider.js';
+// NOTE: this file deliberately contains NO list of concrete providers.
+//
+// It used to carry a literal `import './providers/Auth0Provider.js'` roster, which made the
+// built-ins look like a closed set that had to be edited to add a provider. They never were:
+// providers are @RegisterClass plugins resolved by key, and `index.ts` already exports all of
+// them by name, so importing anything from '@memberjunction/auth-providers' loads and registers
+// every built-in. HostIdentityProvider — added later — was never in that roster and has always
+// registered fine through the package entry point and the server-bootstrap manifest, which is
+// the proof the roster was redundant rather than load-bearing.
+//
+// Adding a provider is therefore: ship a @RegisterClass(BaseAuthProvider, 'x') subclass (in this
+// package, or in any package covered by a class-registration manifest) and add an
+// `MJ: Authentication Providers` row naming 'x' as its DriverClass. No edit here.
 /**
  * Factory and registry for managing authentication providers
  * Combines provider creation and lifecycle management in a single class
@@ -154,6 +160,46 @@ export class AuthProviderFactory extends BaseSingleton {
         // Return unique provider types
         return Array.from(new Set(providerTypes));
     }
+    /**
+     * Collects provider configurations from environment variables by asking every registered
+     * provider class to configure itself.
+     *
+     * This replaces the hard-coded env block that used to live in MJServer's config and
+     * enumerated Entra / Auth0 / Cognito inline. Discovery is now driven by the same
+     * `@RegisterClass` registry that resolves drivers, so a third-party provider gets the
+     * env-var experience without a core edit — see {@link IEnvironmentConfigurableProvider}.
+     *
+     * A provider whose variables are absent returns null and is skipped. A provider whose
+     * mapping throws is skipped with an error rather than taking down startup, because one
+     * malformed mapping must not cost a deployment its other providers.
+     *
+     * @param env Environment to read from; defaults to `process.env`.
+     * @returns One config per provider that found its variables, deduplicated by name.
+     */
+    static DiscoverFromEnvironment(env = process.env) {
+        const registrations = MJGlobal.Instance.ClassFactory.GetAllRegistrations(BaseAuthProvider);
+        const configs = new Map();
+        for (const registration of registrations) {
+            const providerClass = registration.SubClass;
+            if (!isEnvironmentConfigurable(providerClass)) {
+                continue;
+            }
+            try {
+                const config = providerClass.ConfigFromEnvironment(env);
+                if (config && !configs.has(config.name)) {
+                    configs.set(config.name, config);
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                LogStatusEx({
+                    message: `Auth provider '${registration.Key}' failed to build a configuration from environment variables: ${message}`,
+                    verboseOnly: true
+                });
+            }
+        }
+        return Array.from(configs.values());
+    }
     /**
      * Checks if a provider type is registered
      */

package/dist/AuthProviderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,gDAAgD;AAChD,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AACrC,OAAO,6BAA6B,CAAC;AACrC,OAAO,gCAAgC,CAAC;AACxC,OAAO,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,gGAAgG;AAChG,+FAA+F;AAC/F,8FAA8F;AAC9F,+DAA+D;AAC/D,EAAE;AACF,iGAAiG;AACjG,kFAAkF;AAClF,kFAAkF;AAElF;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;QACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEtD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAY,YAAY,CAAC,QAAQ,CAAC;YACrD,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,WAAW,CAAC;oBACV,OAAO,EAAE,kBAAkB,YAAY,CAAC,GAAG,iEAAiE,OAAO,EAAE;oBACrH,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/IEnvironmentConfigurableProvider.d.ts

@@ -0,0 +1,51 @@
+import type { AuthProviderConfig } from '@memberjunction/core';
+/**
+ * Optional static contract a provider class implements to configure itself from environment
+ * variables.
+ *
+ * **Why this is a hook and not a list.** MJServer used to derive env-based providers from a
+ * hard-coded block that enumerated Entra, Auth0 and Cognito inline. That block was a closed
+ * domain in the one place the architecture is otherwise open: a third-party provider could
+ * register a class and take a metadata row or a `mj.config.cjs` entry, but it could never offer
+ * the "set two environment variables and you are done" experience the built-ins got, because
+ * the enumeration lived in core. Moving the mapping onto the provider class puts every provider
+ * — shipped or third-party — on the same footing.
+ *
+ * A provider that has no meaningful env-var form simply omits the static, and discovery skips it.
+ *
+ * @example
+ * ```ts
+ * @RegisterClass(BaseAuthProvider, 'my-idp')
+ * export class MyIdpProvider extends BaseAuthProvider {
+ *   static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+ *     if (!env.MY_IDP_DOMAIN || !env.MY_IDP_CLIENT_ID) return null;
+ *     return {
+ *       name: 'my-idp',
+ *       type: 'my-idp',
+ *       issuer: `https://${env.MY_IDP_DOMAIN}/`,
+ *       audience: env.MY_IDP_CLIENT_ID,
+ *       jwksUri: `https://${env.MY_IDP_DOMAIN}/.well-known/jwks.json`,
+ *       clientId: env.MY_IDP_CLIENT_ID
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export interface IEnvironmentConfigurableProvider {
+    /**
+     * Builds this provider's configuration from environment variables.
+     *
+     * MUST return `null` — not a partial config — when its variables are absent or incomplete.
+     * A half-populated config would fail `validateConfig()` at registration and surface as a
+     * startup error on every deployment that simply does not use this provider.
+     *
+     * @param env The environment to read (injected rather than read from `process.env` directly
+     *        so the mapping is testable without mutating global state).
+     */
+    ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
+}
+/**
+ * Narrows an unknown provider class to one that offers env-var configuration.
+ */
+export declare function isEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider;
+//# sourceMappingURL=IEnvironmentConfigurableProvider.d.ts.map

package/dist/IEnvironmentConfigurableProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IEnvironmentConfigurableProvider.d.ts","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;;;OASG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC1E;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gCAAgC,CAEvG"}

package/dist/IEnvironmentConfigurableProvider.js

@@ -0,0 +1,7 @@
+/**
+ * Narrows an unknown provider class to one that offers env-var configuration.
+ */
+export function isEnvironmentConfigurable(subject) {
+    return typeof subject?.ConfigFromEnvironment === 'function';
+}
+//# sourceMappingURL=IEnvironmentConfigurableProvider.js.map

package/dist/IEnvironmentConfigurableProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IEnvironmentConfigurableProvider.js","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAgDA;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO,OAAQ,OAAwD,EAAE,qBAAqB,KAAK,UAAU,CAAC;AAChH,CAAC"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { IAuthProvider } from './IAuthProvider.js';
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
+export { type IEnvironmentConfigurableProvider, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export { HostIdentityProvider, type HostAssertionVerifyResult, type HostAssertionError, } from './providers/HostIdentityProvider.js';
 export type { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,qCAAqC,CAAC;AAG7C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAM7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACzH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,qCAAqC,CAAC;AAG7C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAM7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
+export { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export { HostIdentityProvider, } from './providers/HostIdentityProvider.js';
 // Concrete auth providers. These are @RegisterClass plugins resolved by key at runtime, so

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,GAGrB,MAAM,qCAAqC,CAAC;AAK7C,2FAA2F;AAC3F,sFAAsF;AACtF,yFAAyF;AACzF,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAyC,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACzH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,GAGrB,MAAM,qCAAqC,CAAC;AAK7C,2FAA2F;AAC3F,sFAAsF;AACtF,yFAAyF;AACzF,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/providers/Auth0Provider.d.ts

@@ -6,6 +6,13 @@ import { BaseAuthProvider } from '../BaseAuthProvider.js';
  */
 export declare class Auth0Provider extends BaseAuthProvider {
     constructor(config: AuthProviderConfig);
+    /**
+     * Configures Auth0 from AUTH0_DOMAIN + AUTH0_CLIENT_ID (AUTH0_CLIENT_SECRET optional).
+     *
+     * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+     * config, so a deployment upgrading to the hook-based discovery sees no change.
+     */
+    static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null;
     /**
      * Extracts user information from Auth0 JWT payload
      */

package/dist/providers/Auth0Provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth0Provider.d.ts","sourceRoot":"","sources":["../../src/providers/Auth0Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AACH,qBACa,aAAc,SAAQ,gBAAgB;gBACrC,MAAM,EAAE,kBAAkB;IAItC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}
+{"version":3,"file":"Auth0Provider.d.ts","sourceRoot":"","sources":["../../src/providers/Auth0Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AACH,qBACa,aAAc,SAAQ,gBAAgB;gBACrC,MAAM,EAAE,kBAAkB;IAItC;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI;IAgB/E;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;IAiBlD;;OAEG;IACH,cAAc,IAAI,OAAO;CAO1B"}