@memberjunction/core-entities 6.1.0-edge.2 → 6.1.0-edge.4

package/LICENSE

@@ -1,7 +1,183 @@
-ISC License
+Business Source License 1.1
 
-Copyright (c) 2023 MemberJunction
+License text copyright (c) 2024 MariaDB plc, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB plc.
 
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+-----------------------------------------------------------------------------
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+Parameters
+
+Licensor:             Blue Cypress, Inc.
+
+Licensed Work:        MemberJunction.
+                      The Licensed Work is (c) 2023-2026 Blue Cypress, Inc.
+
+Additional Use Grant: Subject to the terms of this License, Licensor grants
+                      you the following additional rights to make Production
+                      Use of the Licensed Work.
+
+                      1. Internal Use
+
+                      You may make production use of the Licensed Work for
+                      your own internal business or organizational operations.
+
+                      2. Nonprofit Use
+
+                      If you are a Nonprofit, you may make production use of
+                      the Licensed Work for the operations and activities of
+                      your Organizational Family.
+
+                      3. MemberJunction Certified Program Use
+
+                      If you are authorized by Licensor under the
+                      MemberJunction Certified Program to provide professional
+                      services using the Licensed Work, you may make
+                      production use of the Licensed Work in providing such
+                      professional services to a client, provided that:
+
+                      (a) the Licensed Work is deployed in, and the applicable
+                      production use occurs within, an environment owned,
+                      leased, licensed, subscribed to, or otherwise controlled
+                      by that client; and
+
+                      (b) the production use is for that client's own internal
+                      business or organizational operations or is otherwise
+                      independently permitted to that client under this
+                      Additional Use Grant.
+
+                      4. Definitions Applicable to the Additional Use Grant
+
+                      "Affiliate" means, with respect to a specified Person,
+                      any other Person that directly or indirectly Controls,
+                      is Controlled by, or is under common Control with such
+                      specified Person.
+
+                      "Control" (including the terms "Controls," "Controlled
+                      by," and "under common Control with") means the direct
+                      or indirect possession of the power to direct or cause
+                      the direction of the management and policies of a
+                      Person, whether through ownership of voting interests,
+                      by contract, or otherwise.
+
+                      "Organizational Family" means, with respect to a Person,
+                      (a) such Person and its Affiliates, and (b) any
+                      nonprofit organization, governmental entity, chapter,
+                      division, local affiliate, regional affiliate, state
+                      affiliate, national affiliate, or other entity that is
+                      formally affiliated with such Person through governing
+                      documents, a charter, bylaws, a membership agreement, or
+                      another written organizational instrument, and is
+                      recognized under such documents as part of the same
+                      organizational structure.
+
+                      "Nonprofit" means a Person recognized by the Internal
+                      Revenue Service as exempt from federal income taxation
+                      under Section 501(c)(3), 501(c)(4), 501(c)(5), or
+                      501(c)(6) of the Internal Revenue Code, or a foreign
+                      organization recognized under substantially equivalent
+                      laws.
+
+                      A Person claiming eligibility as a Nonprofit shall, upon
+                      Licensor's reasonable request, provide documentation
+                      reasonably sufficient to demonstrate that it qualifies
+                      as a Nonprofit. If such Person materially misrepresents,
+                      or is unable to demonstrate, its qualification as a
+                      Nonprofit, the rights granted to such Person under
+                      Section 2 of this Additional Use Grant shall terminate.
+
+                      "MemberJunction Certified Program" means Licensor's
+                      then-current program for certifying and authorizing a
+                      Person to provide professional services using the
+                      Licensed Work.
+
+                      "Person" means any individual, corporation, limited
+                      liability company, partnership, association, nonprofit
+                      organization, governmental entity, or other legal or
+                      organizational entity.
+
+Change Date:          Four (4) years from the date the Licensed Work is first
+                      made available.
+
+Change License:       MIT License.
+
+For information about alternative licensing arrangements for the Licensed
+Work, please contact Blue Cypress, Inc.
+
+-----------------------------------------------------------------------------
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+-----------------------------------------------------------------------------
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License
+   can be included in a program with software provided under GPL Version 2.0
+   or a later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+-----------------------------------------------------------------------------
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.

package/dist/custom/MJDashboardEntityExtended.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MJDashboardEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJDashboardEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAA+B,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAkD,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGnE,qBACa,yBAA0B,SAAQ,iBAAiB;IACrD,SAAS,IAAI,OAAO;IA4B3B;;;;OAIG;IACa,QAAQ,IAAI,gBAAgB;IAkD5C;;;OAGG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBhF"}
+{"version":3,"file":"MJDashboardEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJDashboardEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,mBAAmB,EAA+B,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAkD,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AA+CnE,qBACa,yBAA0B,SAAQ,iBAAiB;IACrD,SAAS,IAAI,OAAO;IA4B3B;;;;OAIG;IACa,QAAQ,IAAI,gBAAgB;IA8G5C;;;OAGG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CAiDhF"}

package/dist/custom/MJDashboardEntityExtended.js

@@ -8,6 +8,49 @@ import { BaseEntity, LogError } from "@memberjunction/core";
 import { RegisterClass, UUIDsEqual, ValidationErrorInfo } from "@memberjunction/global";
 import { MJDashboardEntity } from "../generated/entity_subclasses.js";
 import { DashboardEngine } from "../engines/dashboards.js";
+/**
+ * The owner as stored in the database, ignoring any pending change to `UserID`.
+ *
+ * `BaseEntity` keeps the loaded value on the field as `OldValue`, which is what makes this
+ * answerable without a round trip. For a record that was loaded and not modified, `OldValue`
+ * and the current value agree; the two diverge exactly when someone is trying to change the
+ * owner, which is the case this exists to see through.
+ *
+ * **`OldValue` is only trustworthy when the server loaded the row itself.**
+ * `ResolverBase.UpdateRecord` takes two paths: when the entity has `TrackRecordChanges` it
+ * re-reads the record server-side, but when it does NOT, it hydrates from the client-supplied
+ * `OldValues___` — and first-set hydration writes `Value` *and* `OldValue`. On that path
+ * `OldValue` is attacker-controlled and both gates below would read whatever the caller sent.
+ * `MJ: Dashboards` ships with `TrackRecordChanges = 1`, but it is an ordinary admin-editable
+ * field — MJ has already shipped a migration disabling it on other transient entities — and
+ * `EntityInfo` declares it `boolean = null` with no coercion, so a metadata row missing the key
+ * reads falsy too. Either way this returns `null` rather than a guessable value, and the
+ * callers withhold the owner shortcut instead of trusting it.
+ *
+ * Note this is a CONSERVATIVE proxy for the real condition. `ResolverBase` re-reads when
+ * `TrackRecordChanges || !input.OldValues___`, so a caller that supplies no `OldValues___` also
+ * gets a server-loaded row and a trustworthy `OldValue` — this returns null there anyway,
+ * costing that caller the owner shortcut. That is the safe direction to be wrong in, and it
+ * only ever falls back to the pre-existing engine check. The precise fix is for `BaseEntity` to
+ * expose whether the instance was server-hydrated; until it does, this errs toward refusing to
+ * trust.
+ *
+ * Deliberately a MODULE-LEVEL function, not a class member. A `protected` (or `private`) method
+ * makes the subclass structurally distinct from `MJDashboardEntity`, and the codebase assigns
+ * across those two types (`BaseDashboard`'s `DashboardConfig.dashboard`), so adding one breaks
+ * compilation in consumers that never touch this logic.
+ */
+function persistedUserID(entity) {
+    if (!entity.EntityInfo?.TrackRecordChanges) {
+        // Fail closed. Without server-side re-read there is no trustworthy persisted value
+        // here, and the alternative — falling back to `entity.UserID` — is precisely the
+        // client-supplied value the gate exists to distrust.
+        return null;
+    }
+    const field = entity.GetFieldByName('UserID');
+    const persisted = field?.OldValue;
+    return typeof persisted === 'string' && persisted.length > 0 ? persisted : entity.UserID;
+}
 let MJDashboardEntityExtended = class MJDashboardEntityExtended extends MJDashboardEntity {
     NewRecord() {
         try {
@@ -49,26 +92,78 @@ let MJDashboardEntityExtended = class MJDashboardEntityExtended extends MJDashbo
             result.Errors.push(new ValidationErrorInfo('Permission', 'You must be logged in to save a dashboard', null));
             return result;
         }
-        // For existing records (not new), check edit permission
+        // For existing records (not new), check edit permission.
+        //
+        // Ownership is answered from THIS ROW, not from the engine. GetDashboardPermissions reads
+        // DashboardEngine's backing array directly, so an engine that was never Config()'d is
+        // indistinguishable from "this dashboard grants you nothing" — and every caller is refused,
+        // the owner included. That is not hypothetical: any process using the default `task`
+        // startup mode defers engine pre-warm, which is why `mj sync push` failed on a dashboard
+        // whose UserID *was* the pushing user.
+        //
+        // The owner case needs no cache — the persisted `UserID` is on the record being validated.
+        // Resolving it first fixes the defect without weakening the gate: a non-owner still cannot
+        // pass on an unevaluable cache, which is the direction a permission check should fail.
+        // Validate() is synchronous and cannot await Config(), so a non-owner whose grant lives
+        // only in the engine is refused when the cache is cold — the pre-existing behaviour for
+        // that case, deliberately left as-is rather than opened up.
         if (this.IsSaved) {
-            const permissions = DashboardEngine.Instance.GetDashboardPermissions(this.ID, currentUser.ID);
-            // An unloaded engine is not a permission decision. GetDashboardPermissions resolves
-            // against `_dashboards`, and a dashboard it cannot find returns "no permissions" — which
-            // is indistinguishable from a genuine denial. In a process that never configures the
-            // engine (a CLI task, where the 14 engines are deferred to first use), that array is
-            // empty, so EVERY dashboard save is refused, including the owner's own.
+            const persistedOwnerID = persistedUserID(this);
+            // NOTE — supersedes upstream's `ownsRecord` fallback (255d506404, "a dashboard's owner
+            // can save when the engine is unloaded"). That fix solved the same cold-cache problem by
+            // trusting `this.UserID` whenever `DashboardEngine.Instance.Loaded` was false — but
+            // `UserID` is client-settable on the update path, so a caller who can load a dashboard
+            // could set it to themselves and, on any process where the engine happens to be cold,
+            // be granted edit on someone else's record. Reading the PERSISTED owner fixes the cold
+            // cache the same way (the row carries the answer; no engine needed) without ever
+            // trusting a value the caller supplied.
+            // The check MUST read the persisted owner, never `this.UserID`. `UserID` is a settable
+            // field on UpdateMJDashboardInput, and ResolverBase.UpdateRecord loads the row and then
+            // applies the client's values BEFORE Save() runs Validate(). Trusting the in-memory
+            // value would let any user who can load a dashboard send
+            // `UpdateMJDashboard(ID: <someone else's>, UserID: <self>)`, satisfy the owner branch
+            // with the value they just supplied, and take ownership of the record.
+            //
+            // A NULL persisted owner means that value is not trustworthy here (see
+            // persistedUserID). It must not open the owner branch — but it must not refuse the save
+            // either. Refusing turns an auditing setting into a total outage: nobody, owner
+            // included, could update any dashboard. Instead the owner shortcut is simply withheld
+            // and the engine decides, which is exactly the behaviour before this fix existed. That
+            // is strictly no weaker than the shipped baseline while still closing the escalation.
+            if (persistedOwnerID === null || !UUIDsEqual(persistedOwnerID, currentUser.ID)) {
+                const permissions = DashboardEngine.Instance.GetDashboardPermissions(this.ID, currentUser.ID);
+                if (!permissions.CanEdit) {
+                    result.Success = false;
+                    result.Errors.push(new ValidationErrorInfo('Permission', 'You do not have permission to edit this dashboard', this.ID));
+                }
+            }
+            // Reassigning ownership is an owner-only act, and separate from being able to edit.
+            // A user granted CanEdit through a share must not be able to make the dashboard theirs.
             //
-            // Ownership does not need the cache to be answered: the row carries UserID. Falling back
-            // to it keeps the owner able to save while leaving every real denial intact — a loaded
-            // engine still decides, and a non-owner is still refused either way.
+            // ⚠️ KNOWN LIMITATION when `persistedOwnerID` is null (change tracking off). `Dirty` is
+            // `Value !== OldValue`, and on that path BOTH sides come from the client: the resolver
+            // hydrates from `OldValues___`, and first-set hydration writes `Value` *and* `OldValue`.
+            // A caller who sends `OldValues___.UserID = <self>` alongside `UserID = <self>` presents
+            // a field that is NOT dirty while the value is already theirs, so this gate does not
+            // fire and the transfer proceeds. It catches an honest client, not a hostile one.
             //
-            // Found by `mj sync push` on PostgreSQL, where this record is dirty and therefore
-            // reaches Validate(); on SQL Server the same record is unchanged, so Save() short-
-            // circuits and the defect stays hidden.
-            const ownsRecord = !DashboardEngine.Instance.Loaded && UUIDsEqual(this.UserID, currentUser.ID);
-            if (!permissions.CanEdit && !ownsRecord) {
+            // This is deliberately not "fixed" by tightening the predicate — every signal reachable
+            // from here is client-supplied on that path. The real fix is for `BaseEntity` to expose
+            // whether the instance was server-hydrated (or for this to do a provider round-trip),
+            // and `Validate()` being synchronous is what rules the round-trip out today. Until then
+            // the shipped default (`TrackRecordChanges = 1`) is what keeps this closed, and that
+            // coupling is now stated rather than assumed.
+            if (persistedOwnerID === null) {
+                const field = this.GetFieldByName('UserID');
+                if (field?.Dirty) {
+                    result.Success = false;
+                    result.Errors.push(new ValidationErrorInfo('UserID', 'Dashboard ownership cannot be transferred while change tracking is disabled for ' +
+                        'MJ: Dashboards, because the current owner cannot be verified.', this.ID));
+                }
+            }
+            else if (!UUIDsEqual(this.UserID, persistedOwnerID) && !UUIDsEqual(persistedOwnerID, currentUser.ID)) {
                 result.Success = false;
-                result.Errors.push(new ValidationErrorInfo('Permission', 'You do not have permission to edit this dashboard', this.ID));
+                result.Errors.push(new ValidationErrorInfo('UserID', 'Only the owner of a dashboard can transfer its ownership', this.ID));
             }
         }
         return result;
@@ -84,7 +179,35 @@ let MJDashboardEntityExtended = class MJDashboardEntityExtended extends MJDashbo
             LogError('Cannot delete dashboard: User not authenticated');
             return false;
         }
-        // Check delete permission
+        // The owner is answered from the persisted row, for the same reason as in Validate():
+        // it needs no cache, and a cache that is merely stale — a dashboard created since the
+        // last Config() is absent from the backing array — otherwise refuses its own owner.
+        //
+        // A null answer means the persisted owner is not trustworthy (see persistedUserID), so
+        // this shortcut is skipped and the delete falls through to the engine. Unlike Validate(),
+        // that costs nothing here beyond a load — the engine is the authoritative source, and
+        // this path is async and can consult it.
+        const persistedOwnerID = persistedUserID(this);
+        if (persistedOwnerID !== null && UUIDsEqual(persistedOwnerID, currentUser.ID)) {
+            return super.Delete(options);
+        }
+        // Not the owner, so the grant can only come from the engine. Unlike Validate(), this path
+        // is async, so it can load the engine rather than guess.
+        //
+        // The load is GUARDED because it is the one thing here that can throw, and `Delete()` is
+        // documented to report logical failure by RETURNING FALSE, not by throwing — callers check
+        // the boolean and read `LatestResult`. Letting a Config() rejection escape would change
+        // this method's contract for every caller as a side effect of consulting the engine, and it
+        // would do so only on the cold-cache path, which is the one nobody exercises. A failure to
+        // load the permission source is a refusal to delete, which is the safe direction: it can
+        // never turn into an accidental grant.
+        try {
+            await DashboardEngine.Instance.Config(false, currentUser, this.ProviderToUse);
+        }
+        catch (err) {
+            LogError(`Cannot delete dashboard ${this.ID}: loading dashboard permissions failed: ${err}`);
+            return false;
+        }
         const permissions = DashboardEngine.Instance.GetDashboardPermissions(this.ID, currentUser.ID);
         if (!permissions.CanDelete) {
             LogError(`User ${currentUser.ID} does not have permission to delete dashboard ${this.ID}`);

package/dist/custom/MJDashboardEntityExtended.js.map

@@ -1 +1 @@
-{"version":3,"file":"MJDashboardEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJDashboardEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAA0C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAoB,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGjD,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,iBAAiB;IACrD,SAAS;QACZ,IAAG,CAAC;YACA,KAAK,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,oBAAoB,GAAG;gBACzB,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,EAAE;aACZ,CAAA;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;YAExC,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;YAC9D,IAAG,EAAE,CAAC,WAAW,EAAC,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAM,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACjC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACa,QAAQ;QACpB,4BAA4B;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEhC,sCAAsC;QACtC,MAAM,EAAE,GAAI,IAAI,CAAC,aAAyC,CAAA;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,WAAW,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,YAAY,EACZ,2CAA2C,EAC3C,IAAI,CACP,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;YAE9F,oFAAoF;YACpF,yFAAyF;YACzF,qFAAqF;YACrF,qFAAqF;YACrF,wEAAwE;YACxE,EAAE;YACF,yFAAyF;YACzF,uFAAuF;YACvF,qEAAqE;YACrE,EAAE;YACF,kFAAkF;YAClF,mFAAmF;YACnF,wCAAwC;YACxC,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;YAE/F,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,YAAY,EACZ,mDAAmD,EACnD,IAAI,CAAC,EAAE,CACV,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,MAAM,CAAC,OAA6B;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,aAAyC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,WAAW,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAE9F,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,QAAQ,WAAW,CAAC,EAAE,iDAAiD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,0CAA0C;QAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ,CAAA;AA5GY,yBAAyB;IADrC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,yBAAyB,CA4GrC"}
+{"version":3,"file":"MJDashboardEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJDashboardEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAA0C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAoB,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,eAAe,CAAC,MAAyB;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACzC,mFAAmF;QACnF,iFAAiF;QACjF,qDAAqD;QACrD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,KAAK,EAAE,QAAQ,CAAC;IAClC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;AAC7F,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,iBAAiB;IACrD,SAAS;QACZ,IAAG,CAAC;YACA,KAAK,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,oBAAoB,GAAG;gBACzB,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,EAAE;aACZ,CAAA;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;YAExC,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;YAC9D,IAAG,EAAE,CAAC,WAAW,EAAC,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAM,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACjC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACa,QAAQ;QACpB,4BAA4B;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEhC,sCAAsC;QACtC,MAAM,EAAE,GAAI,IAAI,CAAC,aAA6C,CAAA;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,WAAW,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,YAAY,EACZ,2CAA2C,EAC3C,IAAI,CACP,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,yDAAyD;QACzD,EAAE;QACF,0FAA0F;QAC1F,sFAAsF;QACtF,4FAA4F;QAC5F,qFAAqF;QACrF,yFAAyF;QACzF,uCAAuC;QACvC,EAAE;QACF,2FAA2F;QAC3F,2FAA2F;QAC3F,uFAAuF;QACvF,wFAAwF;QACxF,wFAAwF;QACxF,4DAA4D;QAC5D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAE/C,uFAAuF;YACvF,yFAAyF;YACzF,oFAAoF;YACpF,uFAAuF;YACvF,sFAAsF;YACtF,uFAAuF;YACvF,iFAAiF;YACjF,wCAAwC;YACxC,uFAAuF;YACvF,wFAAwF;YACxF,oFAAoF;YACpF,yDAAyD;YACzD,sFAAsF;YACtF,uEAAuE;YACvE,EAAE;YACF,uEAAuE;YACvE,wFAAwF;YACxF,gFAAgF;YAChF,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7E,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;gBAE9F,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;oBACvB,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;oBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,YAAY,EACZ,mDAAmD,EACnD,IAAI,CAAC,EAAE,CACV,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,oFAAoF;YACpF,wFAAwF;YACxF,EAAE;YACF,wFAAwF;YACxF,uFAAuF;YACvF,yFAAyF;YACzF,yFAAyF;YACzF,qFAAqF;YACrF,kFAAkF;YAClF,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,sFAAsF;YACtF,wFAAwF;YACxF,qFAAqF;YACrF,8CAA8C;YAC9C,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;oBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,QAAQ,EACR,kFAAkF;wBAClF,+DAA+D,EAC/D,IAAI,CAAC,EAAE,CACV,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrG,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,QAAQ,EACR,0DAA0D,EAC1D,IAAI,CAAC,EAAE,CACV,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,MAAM,CAAC,OAA6B;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,WAAW,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,sFAAsF;QACtF,sFAAsF;QACtF,oFAAoF;QACpF,EAAE;QACF,uFAAuF;QACvF,0FAA0F;QAC1F,sFAAsF;QACtF,yCAAyC;QACzC,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,gBAAgB,KAAK,IAAI,IAAI,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,0FAA0F;QAC1F,yDAAyD;QACzD,EAAE;QACF,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,4FAA4F;QAC5F,2FAA2F;QAC3F,yFAAyF;QACzF,uCAAuC;QACvC,IAAI,CAAC;YACD,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,aAA6C,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,2BAA2B,IAAI,CAAC,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAE9F,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,QAAQ,WAAW,CAAC,EAAE,iDAAiD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,0CAA0C;QAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ,CAAA;AArMY,yBAAyB;IADrC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;GAC/B,yBAAyB,CAqMrC"}

package/dist/engines/FileStorageEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorageEngine.d.ts","sourceRoot":"","sources":["../../src/engines/FileStorageEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4B,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAEzG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,0BAA0B,CAAC;IACpC,QAAQ,EAAE,2BAA2B,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAsB,SAAQ,UAAU,CAAC,qBAAqB,CAAC;IACxE;;;;OAIG;IACH,WAAkB,QAAQ,IAAI,qBAAqB,CAElD;IAED,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,UAAU,CAAqC;IAEvD;;;;;OAKG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhH;;OAEG;IACH,IAAW,QAAQ,IAAI,0BAA0B,EAAE,CAElD;IAED;;;OAGG;IACH,IAAW,SAAS,IAAI,2BAA2B,EAAE,CAEpD;IAED;;;OAGG;IACH,IAAW,qBAAqB,IAAI,0BAA0B,EAAE,CAW/D;IAMD;;;;OAIG;IACI,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAIhF;;;;OAIG;IACI,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAInF;;;;OAIG;IACI,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAI7E;;;;OAIG;IACI,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,0BAA0B,EAAE;IAIhF;;;;OAIG;IACI,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAOtF"}
+{"version":3,"file":"FileStorageEngine.d.ts","sourceRoot":"","sources":["../../src/engines/FileStorageEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA4B,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAEzG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,0BAA0B,CAAC;IACpC,QAAQ,EAAE,2BAA2B,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAsB,SAAQ,UAAU,CAAC,qBAAqB,CAAC;IACxE;;;;OAIG;IACH,WAAkB,QAAQ,IAAI,qBAAqB,CAElD;IAED,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,UAAU,CAAqC;IAEvD;;;;;OAKG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhH;;OAEG;IACH,IAAW,QAAQ,IAAI,0BAA0B,EAAE,CAElD;IAED;;;OAGG;IACH,IAAW,SAAS,IAAI,2BAA2B,EAAE,CAEpD;IAED;;;OAGG;IACH,IAAW,qBAAqB,IAAI,0BAA0B,EAAE,CAQ/D;IAMD;;;;OAIG;IACI,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAIhF;;;;OAIG;IACI,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,2BAA2B,GAAG,SAAS;IAInF;;;;OAIG;IACI,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAI7E;;;;OAIG;IACI,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,0BAA0B,EAAE;IAIhF;;;;OAIG;IACI,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAOtF"}

package/dist/engines/FileStorageEngine.js

@@ -74,11 +74,9 @@ export class FileStorageEngineBase extends BaseEngine {
      * Consumers should filter/sort as needed (e.g., by provider.IsActive).
      */
     get AccountsWithProviders() {
-        const providerMap = new Map();
-        this.Providers.forEach(p => providerMap.set(p.ID, p));
         return this.Accounts
             .map(account => {
-            const provider = providerMap.get(account.ProviderID);
+            const provider = this.Providers.find(p => UUIDsEqual(p.ID, account.ProviderID));
             if (!provider)
                 return null;
             return { account, provider };

package/dist/engines/FileStorageEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorageEngine.js","sourceRoot":"","sources":["../../src/engines/FileStorageEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyD,MAAM,sBAAsB,CAAC;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAiC;IAA5E;;QAUY,cAAS,GAAiC,EAAE,CAAC;QAC7C,eAAU,GAAkC,EAAE,CAAC;IAkH3D,CAAC;IA5HG;;;;OAIG;IACI,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAyB,CAAC;IACtD,CAAC;IAKD;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC5F,MAAM,OAAO,GAAwC;YACjD;gBACI,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,2BAA2B;gBACvC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,IAAI;aACnB;YACD;gBACI,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,4BAA4B;gBACxC,YAAY,EAAE,YAAY;gBAC1B,UAAU,EAAE,IAAI;aACnB;SACJ,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,2CAA2C;IAC3C,0BAA0B;IAC1B,2CAA2C;IAE3C;;OAEG;IACH,IAAW,QAAQ;QACf,OAAO,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,IAAW,qBAAqB;QAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,QAAQ;aACf,GAAG,CAAC,OAAO,CAAC,EAAE;YACX,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAsC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,2CAA2C;IAC3C,iBAAiB;IACjB,2CAA2C;IAE3C;;;;OAIG;IACI,cAAc,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,UAAkB;QACrC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAAC,UAAkB;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;CACJ"}
+{"version":3,"file":"FileStorageEngine.js","sourceRoot":"","sources":["../../src/engines/FileStorageEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyD,MAAM,sBAAsB,CAAC;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAiC;IAA5E;;QAUY,cAAS,GAAiC,EAAE,CAAC;QAC7C,eAAU,GAAkC,EAAE,CAAC;IA+G3D,CAAC;IAzHG;;;;OAIG;IACI,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAyB,CAAC;IACtD,CAAC;IAKD;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC5F,MAAM,OAAO,GAAwC;YACjD;gBACI,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,2BAA2B;gBACvC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,IAAI;aACnB;YACD;gBACI,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,4BAA4B;gBACxC,YAAY,EAAE,YAAY;gBAC1B,UAAU,EAAE,IAAI;aACnB;SACJ,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,2CAA2C;IAC3C,0BAA0B;IAC1B,2CAA2C;IAE3C;;OAEG;IACH,IAAW,QAAQ;QACf,OAAO,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,IAAW,qBAAqB;QAC5B,OAAO,IAAI,CAAC,QAAQ;aACf,GAAG,CAAC,OAAO,CAAC,EAAE;YACX,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAsC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,2CAA2C;IAC3C,iBAAiB;IACjB,2CAA2C;IAE3C;;;;OAIG;IACI,cAAc,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,UAAkB;QACrC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAAC,UAAkB;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;CACJ"}

package/dist/engines/IdentityClaimEngine.d.ts

@@ -0,0 +1,166 @@
+/**
+ * @fileoverview Identity Claim Engine and Base Driver
+ *
+ * Provides centralized metadata caching and execution for identity claim types,
+ * cross-system entitlement claiming, account linking, and invite verification.
+ *
+ * @module @memberjunction/core-entities/IdentityClaimEngine
+ */
+import { BaseEngine, IMetadataProvider, UserInfo } from "@memberjunction/core";
+import { MJIdentityClaimTypeEntity, MJIdentityClaimEntity } from "../generated/entity_subclasses.js";
+/**
+ * Context passed to claim driver lifecycle methods
+ */
+export interface ClaimContext {
+    Claim: MJIdentityClaimEntity;
+    User?: UserInfo;
+}
+/**
+ * Context passed when a claim is redeemed
+ */
+export interface ClaimRedeemContext extends ClaimContext {
+    User: UserInfo;
+    RedemptionToken?: string;
+}
+/**
+ * Result returned by a claim driver's OnClaim handler
+ */
+export interface ClaimResult {
+    Success: boolean;
+    ErrorMessage?: string;
+    Data?: Record<string, unknown>;
+}
+/**
+ * Abstract base driver for pluggable claim type behaviors.
+ * Concrete subclasses register via `@RegisterClass(BaseIdentityClaimDriver, DriverClass)`.
+ */
+export declare abstract class BaseIdentityClaimDriver {
+    /**
+     * Called immediately after a claim is created.
+     */
+    abstract OnCreate(context: ClaimContext): Promise<void>;
+    /**
+     * Called when a claim is redeemed by an authenticated user.
+     *
+     * **Idempotency Requirement**: Implementations of `OnClaim` must be safe to re-run
+     * (idempotent). If downstream provisioning fails or throws an exception, the engine
+     * automatically reverts the atomic CAS state back to 'Pending' so the customer can retry.
+     */
+    abstract OnClaim(context: ClaimRedeemContext): Promise<ClaimResult>;
+    /**
+     * Called when a claim is explicitly revoked.
+     */
+    abstract OnRevoke(context: ClaimContext): Promise<void>;
+    /**
+     * Called when a claim is found to be expired or explicitly marked expired.
+     */
+    abstract OnExpire(context: ClaimContext): Promise<void>;
+}
+/**
+ * Recognized keys of `IdentityClaimType.Configuration` (a JSON column). All keys are optional;
+ * absent keys fall back to the defaults documented per key. Unrecognized keys are preserved for
+ * driver-specific configuration but ignored by the engine.
+ */
+export interface IdentityClaimTypeConfiguration {
+    /**
+     * When true, the email-match redemption path requires the authenticated user's IdP to have
+     * positively asserted the email as verified (`EmailVerified === true`). When false/absent,
+     * email-match is refused only when the IdP explicitly asserted `EmailVerified === false`.
+     */
+    RequireVerifiedEmail?: boolean;
+    /**
+     * When true, redemption always requires the claim's verification token — an email match alone
+     * never redeems (which also excludes the type from automatic claim-on-login). Use for
+     * high-value claim types.
+     */
+    RequireToken?: boolean;
+    /**
+     * When false, the type is skipped by automatic claim-on-login (`AutoClaimForUser`); explicit
+     * redemption via link/token still works. Defaults to true.
+     */
+    AutoClaim?: boolean;
+    /** Driver-specific configuration may ride alongside the engine-recognized keys. */
+    [key: string]: unknown;
+}
+/**
+ * Parameters for creating a new Identity Claim
+ */
+export interface CreateClaimParams {
+    /** Name of the IdentityClaimType */
+    ClaimTypeName?: string;
+    /** ID of the IdentityClaimType (if Name is not provided) */
+    ClaimTypeID?: string;
+    /** Email address of the intended recipient/claimant */
+    NormalizedEmail: string;
+    /** Optional polymorphic target entity ID */
+    EntityID?: string | null;
+    /** Optional target record primary key ID */
+    RecordID?: string | null;
+    /** Optional payload data for driver consumption */
+    Payload?: Record<string, unknown> | null;
+    /** Lifespan in days before expiration (defaults to ClaimType.DefaultExpirationDays) */
+    ExpiresInDays?: number;
+    /** Optional linked MagicLinkInvite ID for token verification */
+    MagicLinkInviteID?: string | null;
+    /** Optional tracking metadata */
+    Metadata?: Record<string, unknown> | null;
+}
+/**
+ * Client + server metadata cache and shared contracts for Identity Claims.
+ *
+ * This class holds only what is safe and useful in *any* host: the `IdentityClaimType` cache,
+ * type lookups, driver resolution via `ClassFactory`, and email normalization. It deliberately
+ * does **not** implement the claim lifecycle.
+ *
+ * Claim creation, redemption and revocation live exclusively on `IdentityClaimEngineServer`
+ * (`@memberjunction/core-entities-server`), which contains an instance of this class and proxies
+ * the cached members. Those operations depend on capabilities that only exist server-side:
+ * high-entropy token generation and SHA-256 hashing, a timing-safe token comparison, an atomic
+ * compare-and-swap issued as raw SQL, and email dispatch through MJ Communications. A browser
+ * copy cannot perform any of them, and a second, weaker implementation of a security-critical
+ * operation living in a package that server code also imports is a hazard rather than a
+ * convenience.
+ *
+ * Same containment split as `AIEngineBase` / `AIEngine`.
+ */
+export declare class IdentityClaimEngine extends BaseEngine<IdentityClaimEngine> {
+    private _claimTypes;
+    private _byName;
+    private _byId;
+    /**
+     * Returns the singleton instance of IdentityClaimEngine
+     */
+    static get Instance(): IdentityClaimEngine;
+    /**
+     * Configures the engine and loads cached IdentityClaimType metadata.
+     */
+    Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void>;
+    /**
+     * All loaded Identity Claim Types
+     */
+    get ClaimTypes(): MJIdentityClaimTypeEntity[];
+    /**
+     * Finds a claim type by unique name (case-insensitive)
+     */
+    GetClaimTypeByName(name: string): MJIdentityClaimTypeEntity | undefined;
+    /**
+     * Finds a claim type by unique identifier
+     */
+    GetClaimTypeByID(id: string): MJIdentityClaimTypeEntity | undefined;
+    /**
+     * Resolves the concrete BaseIdentityClaimDriver instance for a given claim type
+     */
+    GetDriverInstance(claimType: MJIdentityClaimTypeEntity): BaseIdentityClaimDriver | null;
+    /**
+     * Standard email normalization helper (lowercase, trimmed)
+     */
+    NormalizeEmail(email: string): string;
+    /**
+     * Parses a claim type's `Configuration` JSON into the engine-recognized shape.
+     * Malformed or non-object JSON degrades to `{}` (the permissive defaults) rather than
+     * throwing — a bad configuration must never brick redemption outright, only tighten it
+     * when it parses.
+     */
+    GetClaimTypeConfiguration(claimType: MJIdentityClaimTypeEntity | undefined): IdentityClaimTypeConfiguration;
+}
+//# sourceMappingURL=IdentityClaimEngine.d.ts.map

package/dist/engines/IdentityClaimEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityClaimEngine.d.ts","sourceRoot":"","sources":["../../src/engines/IdentityClaimEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAA4B,iBAAiB,EAAE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AAE7H,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAElG;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,CAAC,EAAE,QAAQ,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACpD,IAAI,EAAE,QAAQ,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,8BAAsB,uBAAuB;IACzC;;OAEG;aACa,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D;;;;;;OAMG;aACa,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;IAE1E;;OAEG;aACa,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D;;OAEG;aACa,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC3C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAC9B,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,mBAAoB,SAAQ,UAAU,CAAC,mBAAmB,CAAC;IACpE,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,OAAO,CAAuD;IACtE,OAAO,CAAC,KAAK,CAAuD;IAEpE;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;OAEG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchH;;OAEG;IACH,IAAW,UAAU,IAAI,yBAAyB,EAAE,CAEnD;IAED;;OAEG;IACI,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;IAQ9E;;OAEG;IACI,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;IAQ1E;;OAEG;IACI,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,GAAG,uBAAuB,GAAG,IAAI;IAU9F;;OAEG;IACI,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK5C;;;;;OAKG;IACI,yBAAyB,CAAC,SAAS,EAAE,yBAAyB,GAAG,SAAS,GAAG,8BAA8B;CAYrH"}