@memberjunction/server 5.38.0 → 5.40.0

package/README.md

@@ -109,6 +109,7 @@ MJServer uses a layered configuration system with the following priority (highes
 | `MJ_REST_API_EXCLUDE_ENTITIES` | Comma-separated entity exclude list | (optional) |
 | `MJ_TELEMETRY_ENABLED` | Enable server telemetry | `true` |
 | `METADATA_CACHE_REFRESH_INTERVAL` | Metadata refresh interval (ms) | `180000` |
+| `MJ_LOG_GRAPHQL_VARIABLES` | Enable redacted verbose echo of GraphQL variables to stdout — see [Debugging GraphQL requests](#debugging-graphql-requests) | `false` |
 
 ### Configuration File (`mj.config.cjs`)
 
@@ -166,9 +167,75 @@ module.exports = {
     enabled: true,
     level: 'standard',  // 'minimal' | 'standard' | 'verbose' | 'debug'
   },
+
+  // Debugging — see "Debugging GraphQL requests" below
+  loggingSettings: {
+    graphql: {
+      logVariables: false, // env override: MJ_LOG_GRAPHQL_VARIABLES
+    },
+  },
 };
 ```
 
+### Debugging GraphQL requests
+
+By default, MJServer logs only the GraphQL `operationName` for each incoming request. The `variables` payload is **never** logged in the default configuration — this protects credentials and other sensitive material from leaking into container logs, cloud log aggregators, or `tail -f` sessions.
+
+For local debugging, you can enable a **redacted verbose echo** of variables via the `loggingSettings.graphql.logVariables` flag (or the `MJ_LOG_GRAPHQL_VARIABLES=true` environment variable). When enabled:
+
+- A second log line is emitted per root resolver call: `{ operation: '<name>', args: { ... } }`
+- Fields on `Create<X>Input` / `Update<X>Input` that map to an entity column with `EntityFieldInfo.Encrypt=true` are redacted automatically (metadata-driven).
+- Fields or parameters explicitly marked with the `@NoLog` decorator are redacted manually (for custom resolvers and non-metadata-bound args).
+- A boot-time audit warns about every custom-resolver `@Arg` that is neither metadata-bound nor `@NoLog`-marked, so authors know which arguments will appear in plaintext while the flag is active.
+- The first call into any such resolver also emits a one-time runtime warning naming the un-decorated args.
+
+**Security notes:**
+
+- This flag is opt-in and defaults to `false` in every environment regardless of `NODE_ENV`. Never set it to `true` in production.
+- It does NOT re-enable the historical variables leak. The default-config log line emits operation name only; the verbose echo is a separate, redaction-aware path.
+- Custom resolvers that accept sensitive arguments (e.g. credential-test mutations) should mark those parameters with `@NoLog` from `@memberjunction/server` so they remain redacted even when verbose logging is on.
+
+**Enabling for a single session:**
+
+```bash
+MJ_LOG_GRAPHQL_VARIABLES=true npm run start
+```
+
+**Enabling persistently via `mj.config.cjs`:**
+
+```javascript
+loggingSettings: {
+  graphql: {
+    logVariables: true,
+  },
+}
+```
+
+**Applying `@NoLog` to a custom resolver:**
+
+```typescript
+import { NoLog } from '@memberjunction/server';
+
+@Mutation(() => Boolean)
+async TestCredential(
+  @Arg('accessToken') @NoLog accessToken: string,
+  @Ctx() ctx: AppContext,
+): Promise<boolean> {
+  // ...
+}
+```
+
+```typescript
+import { InputType, Field } from 'type-graphql';
+import { NoLog } from '@memberjunction/server';
+
+@InputType()
+export class MyInput {
+  @Field(() => String) @NoLog Token: string;
+  @Field(() => String) Description: string;
+}
+```
+
 ## Usage
 
 ### Basic Server Setup

package/dist/apolloServer/index.d.ts

@@ -2,14 +2,6 @@ import { ApolloServer, ApolloServerOptions, ApolloServerPlugin } from '@apollo/s
 import { Disposable } from 'graphql-ws';
 import { Server } from 'http';
 import { AppContext } from '../types.js';
-/**
- * Creates and configures an Apollo Server instance with built-in plugins
- * for HTTP drain and WebSocket cleanup.
- *
- * @param configOverride - Apollo Server options (typically contains the schema)
- * @param servers - HTTP server and WebSocket cleanup disposable
- * @param additionalPlugins - Optional additional plugins to merge with built-in plugins
- */
 declare const buildApolloServer: (configOverride: ApolloServerOptions<AppContext>, { httpServer, serverCleanup }: {
     httpServer: Server;
     serverCleanup: Disposable;

package/dist/apolloServer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apolloServer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC;;;;;;;GAOG;AACH,QAAA,MAAM,iBAAiB,GACrB,gBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAC/C,+BAA+B;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,EAChF,oBAAoB,kBAAkB,EAAE,6BA0BzC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apolloServer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqEzC,QAAA,MAAM,iBAAiB,GACrB,gBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAC/C,+BAA+B;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,EAChF,oBAAoB,kBAAkB,EAAE,6BA2BzC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/apolloServer/index.js

@@ -9,9 +9,70 @@ import { enableIntrospection } from '../config.js';
  * @param servers - HTTP server and WebSocket cleanup disposable
  * @param additionalPlugins - Optional additional plugins to merge with built-in plugins
  */
+/**
+ * Apollo plugin: log every Integration* GraphQL operation to stdout as
+ * structured JSON.  Lets operators tailing the MJAPI log see exactly which
+ * resolver the wizard / Explorer hit on each press, with arg names (values
+ * redacted for credentials).  Diagnostic-only — no behavior change.
+ *
+ * Emits two events per operation:
+ *   {"event":"gql.integration.request","method":"...","fieldName":"...","argNames":[...]}
+ *   {"event":"gql.integration.response","method":"...","fieldName":"...","durationMs":N,"hasErrors":bool}
+ *
+ * Filter from the log:
+ *   tail -f /tmp/mjapi.log | grep '"event":"gql\.integration\.'
+ */
+const integrationOperationTracer = {
+    async requestDidStart(requestCtx) {
+        // Off by default — the plugin stays registered but emits nothing unless the
+        // MJ_INTEGRATION_TRACE debug flag is explicitly set. Avoids logging on every
+        // request in normal operation.
+        if (process.env.MJ_INTEGRATION_TRACE !== 'true')
+            return undefined;
+        const opName = requestCtx.request.operationName ?? 'anonymous';
+        const query = requestCtx.request.query ?? '';
+        // Lightweight match — fire only for operations that touch an Integration
+        // resolver field.  Avoid logging every Color / User / Task query.
+        if (!query.includes('Integration'))
+            return undefined;
+        const startedAt = Date.now();
+        return {
+            async willSendResponse(rc) {
+                // Walk the fields the operation queried; only those starting with
+                // "Integration" matter.  Variables surfaced as keys only.
+                const op = rc.operation;
+                if (!op)
+                    return;
+                const integrationFields = [];
+                for (const sel of op.selectionSet.selections) {
+                    if (sel.kind === 'Field' && sel.name.value.startsWith('Integration')) {
+                        integrationFields.push(sel.name.value);
+                    }
+                }
+                if (integrationFields.length === 0)
+                    return;
+                const argNames = Object.keys(rc.request.variables ?? {});
+                const durationMs = Date.now() - startedAt;
+                const hasErrors = !!(rc.response.body.kind === 'single' && rc.response.body.singleResult.errors?.length);
+                for (const field of integrationFields) {
+                    console.log(JSON.stringify({
+                        ts: new Date().toISOString(),
+                        event: 'gql.integration.response',
+                        operationName: opName,
+                        method: field,
+                        argNames,
+                        durationMs,
+                        hasErrors,
+                    }));
+                }
+            },
+        };
+    },
+};
 const buildApolloServer = (configOverride, { httpServer, serverCleanup }, additionalPlugins) => {
     const builtInPlugins = [
         ApolloServerPluginDrainHttpServer({ httpServer }),
+        integrationOperationTracer,
         {
             async serverWillStart() {
                 return {

package/dist/apolloServer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apolloServer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA2C,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,CACxB,cAA+C,EAC/C,EAAE,UAAU,EAAE,aAAa,EAAqD,EAChF,iBAAwC,EACxC,EAAE;IACF,MAAM,cAAc,GAAyB;QAC3C,iCAAiC,CAAC,EAAE,UAAU,EAAE,CAAC;QACjD;YACE,KAAK,CAAC,eAAe;gBACnB,OAAO;oBACL,KAAK,CAAC,WAAW;wBACf,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;oBAChC,CAAC;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IAEF,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,iBAAiB,CAAC;QAC3C,CAAC,CAAC,cAAc,CAAC;IAEnB,OAAO,IAAI,YAAY,CAAC;QACtB,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,mBAAmB;QAClC,GAAG,cAAc;KAClB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apolloServer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA2C,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,0BAA0B,GAAuB;IACrD,KAAK,CAAC,eAAe,CAAC,UAAU;QAC9B,4EAA4E;QAC5E,6EAA6E;QAC7E,+BAA+B;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,CAAC,gBAAgB,CAAC,EAAE;gBACvB,kEAAkE;gBAClE,0DAA0D;gBAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;gBACxB,IAAI,CAAC,EAAE;oBAAE,OAAO;gBAChB,MAAM,iBAAiB,GAAa,EAAE,CAAC;gBACvC,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;oBAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;wBACrE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACzD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACzG,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;oBACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACzB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBAC5B,KAAK,EAAE,0BAA0B;wBACjC,aAAa,EAAE,MAAM;wBACrB,MAAM,EAAE,KAAK;wBACb,QAAQ;wBACR,UAAU;wBACV,SAAS;qBACV,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,cAA+C,EAC/C,EAAE,UAAU,EAAE,aAAa,EAAqD,EAChF,iBAAwC,EACxC,EAAE;IACF,MAAM,cAAc,GAAyB;QAC3C,iCAAiC,CAAC,EAAE,UAAU,EAAE,CAAC;QACjD,0BAA0B;QAC1B;YACE,KAAK,CAAC,eAAe;gBACnB,OAAO;oBACL,KAAK,CAAC,WAAW;wBACf,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;oBAChC,CAAC;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IAEF,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,iBAAiB,CAAC;QAC3C,CAAC,CAAC,cAAc,CAAC;IAEnB,OAAO,IAAI,YAAY,CAAC;QACtB,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,mBAAmB;QAClC,GAAG,cAAc;KAClB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -173,7 +173,7 @@ export const verifyUserRecord = async (email, firstName, lastName, requestDomain
                     initData.UserRoles = configInfo.userHandling.newUserRoles.map((role) => {
                         const roleInfo = md.Roles.find((r) => r.Name === role);
                         const roleID = roleInfo ? roleInfo.ID : '';
-                        return { UserID: initData.ID, RoleName: role, RoleID: roleID };
+                        return { UserID: initData.ID, Role: role, RoleID: roleID };
                     });
                     user = new UserInfo(Metadata.Provider, initData); // global-provider-ok: same JWT-validation context — no per-request provider yet
                     UserCache.Instance.Users.push(user);

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AAErC,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,UAA+B,EAAE,EAAE;IACjE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IACE,UAAU,CAAC,YAAY,CAAC,kBAAkB;YAC1C,SAAS;YACT,QAAQ;YACR,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,KAAK,KAAK,CAAC,EACtF,CAAC;YACD,uIAAuI;YACvI,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;gBACxC,4EAA4E;gBAC5E,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACpF,0DAA0D;oBAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAA6F,OAAO,CAAC,MAAM,EAAE,CAAC;oBAE5H,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBACjE,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,wCAAwC,aAAa,uNAAuN,CAC1R,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AAErC,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,UAA+B,EAAE,EAAE;IACjE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IACE,UAAU,CAAC,YAAY,CAAC,kBAAkB;YAC1C,SAAS;YACT,QAAQ;YACR,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,KAAK,KAAK,CAAC,EACtF,CAAC;YACD,uIAAuI;YACvI,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;gBACxC,4EAA4E;gBAC5E,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACpF,0DAA0D;oBAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAAyF,OAAO,CAAC,MAAM,EAAE,CAAC;oBAExH,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC7D,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,wCAAwC,aAAa,uNAAuN,CAC1R,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}

package/dist/auth/magicLink/MagicLinkKeys.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview RS256 key manager for magic-link session JWTs.
+ *
+ * MJ signs magic-link session tokens with an RS256 private key and publishes the
+ * matching public key at a JWKS endpoint. Registering the `magic-link` auth
+ * provider with that JWKS URL lets MJServer's standard issuer-driven validation
+ * verify the tokens with no special-casing.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { BaseSingleton } from '@memberjunction/global';
+import type { MagicLinkJWTClaims } from './types.js';
+/** A single JSON Web Key plus the metadata jwks-rsa needs to match it. */
+interface PublishedJWK extends JsonWebKey {
+    kid: string;
+    use: 'sig';
+    alg: 'RS256';
+}
+/**
+ * Manages the RS256 keypair used to sign and publish magic-link session tokens.
+ * Singleton so the keypair (and therefore the `kid`) is stable for the process
+ * lifetime — restarting with an ephemeral key invalidates outstanding sessions,
+ * which is the intended dev behavior and an acceptable production key-rotation
+ * mechanism.
+ */
+export declare class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManager> {
+    private privateKeyPem;
+    private publicKey?;
+    private _kid;
+    private _initialized;
+    constructor();
+    static get Instance(): MagicLinkKeyManager;
+    get IsInitialized(): boolean;
+    get Kid(): string;
+    /**
+     * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
+     * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     */
+    Initialize(privateKeyPem?: string): void;
+    /**
+     * Signs a set of magic-link claims and returns the compact JWT.
+     * `iat`/`exp` are expected to already be set on the claims.
+     */
+    Sign(claims: MagicLinkJWTClaims): string;
+    /**
+     * Returns the JWKS document (public key set) for the JWKS endpoint.
+     */
+    GetJWKS(): {
+        keys: PublishedJWK[];
+    };
+    private ensureInitialized;
+    /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
+    private normalizePem;
+    /** Stable key id derived from the public key (SHA-256 of DER, base64url, truncated). */
+    private computeKid;
+}
+export {};
+//# sourceMappingURL=MagicLinkKeys.d.ts.map

package/dist/auth/magicLink/MagicLinkKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAyB/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAK/C;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}

package/dist/auth/magicLink/MagicLinkKeys.js

@@ -0,0 +1,99 @@
+/**
+ * @fileoverview RS256 key manager for magic-link session JWTs.
+ *
+ * MJ signs magic-link session tokens with an RS256 private key and publishes the
+ * matching public key at a JWKS endpoint. Registering the `magic-link` auth
+ * provider with that JWKS URL lets MJServer's standard issuer-driven validation
+ * verify the tokens with no special-casing.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { BaseSingleton } from '@memberjunction/global';
+import { LogStatus } from '@memberjunction/core';
+import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash } from 'node:crypto';
+import jwt from 'jsonwebtoken';
+/**
+ * Manages the RS256 keypair used to sign and publish magic-link session tokens.
+ * Singleton so the keypair (and therefore the `kid`) is stable for the process
+ * lifetime — restarting with an ephemeral key invalidates outstanding sessions,
+ * which is the intended dev behavior and an acceptable production key-rotation
+ * mechanism.
+ */
+export class MagicLinkKeyManager extends BaseSingleton {
+    // Public to satisfy BaseSingleton.getInstance's `this: new () => T` constraint
+    // (matches the AuthProviderFactory singleton pattern).
+    constructor() {
+        super();
+        this.privateKeyPem = '';
+        this._kid = '';
+        this._initialized = false;
+    }
+    static get Instance() {
+        return MagicLinkKeyManager.getInstance();
+    }
+    get IsInitialized() {
+        return this._initialized;
+    }
+    get Kid() {
+        return this._kid;
+    }
+    /**
+     * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
+     * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     */
+    Initialize(privateKeyPem) {
+        if (this._initialized) {
+            return;
+        }
+        let priv;
+        const supplied = privateKeyPem?.trim();
+        if (supplied) {
+            priv = createPrivateKey(this.normalizePem(supplied));
+        }
+        else {
+            const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+            priv = privateKey;
+            LogStatus('[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+                'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+                '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.');
+        }
+        this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' });
+        this.publicKey = createPublicKey(priv);
+        this._kid = this.computeKid(this.publicKey);
+        this._initialized = true;
+    }
+    /**
+     * Signs a set of magic-link claims and returns the compact JWT.
+     * `iat`/`exp` are expected to already be set on the claims.
+     */
+    Sign(claims) {
+        this.ensureInitialized();
+        return jwt.sign(claims, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
+    }
+    /**
+     * Returns the JWKS document (public key set) for the JWKS endpoint.
+     */
+    GetJWKS() {
+        this.ensureInitialized();
+        const jwk = this.publicKey.export({ format: 'jwk' });
+        return { keys: [{ ...jwk, kid: this._kid, use: 'sig', alg: 'RS256' }] };
+    }
+    ensureInitialized() {
+        if (!this._initialized) {
+            throw new Error('MagicLinkKeyManager not initialized — call Initialize() during server startup.');
+        }
+    }
+    /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
+    normalizePem(value) {
+        if (value.includes('-----BEGIN')) {
+            return value;
+        }
+        return Buffer.from(value, 'base64').toString('utf8');
+    }
+    /** Stable key id derived from the public key (SHA-256 of DER, base64url, truncated). */
+    computeKid(publicKey) {
+        const pem = publicKey.export({ type: 'spki', format: 'pem' });
+        return createHash('sha256').update(pem).digest('base64url').slice(0, 16);
+    }
+}
+//# sourceMappingURL=MagicLinkKeys.js.map

package/dist/auth/magicLink/MagicLinkKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,SAAS,CACP,kFAAkF;gBAClF,8FAA8F;gBAC9F,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAA0B;QACpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/magicLink/MagicLinkRouter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @fileoverview Express wiring + auth-provider registration for magic links.
+ *
+ * Mirrors the OAuth handler pattern: a public router (unauthenticated — JWKS +
+ * redeem) mounted BEFORE the unified auth middleware, and an authenticated
+ * router (invite creation) mounted AFTER it so `req.userPayload` is available.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { Router } from 'express';
+import { type MagicLinkConfig } from '../../config.js';
+/** The mount path for both routers (`/magic-link`). */
+export declare const MAGIC_LINK_MOUNT_PATH = "/magic-link";
+/** Path of the JWKS endpoint relative to the public URL. */
+export declare const MAGIC_LINK_JWKS_PATH = "/magic-link/jwks.json";
+/**
+ * Builds the magic-link routers. The caller mounts `publicRouter` before the
+ * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
+ */
+export declare function createMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
+    publicRouter: Router;
+    authenticatedRouter: Router;
+};
+/**
+ * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
+ * validation accepts MJ-issued session tokens. Issuer = public URL, JWKS URL =
+ * the public JWKS endpoint, audience = configured magic-link audience.
+ *
+ * Also appends the provider to `configInfo.authProviders` so a later
+ * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
+ */
+export declare function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLinkConfig): void;
+//# sourceMappingURL=MagicLinkRouter.d.ts.map

package/dist/auth/magicLink/MagicLinkRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F"}

package/dist/auth/magicLink/MagicLinkRouter.js

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview Express wiring + auth-provider registration for magic links.
+ *
+ * Mirrors the OAuth handler pattern: a public router (unauthenticated — JWKS +
+ * redeem) mounted BEFORE the unified auth middleware, and an authenticated
+ * router (invite creation) mounted AFTER it so `req.userPayload` is available.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { Router, json, urlencoded } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError, LogStatus } from '@memberjunction/core';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { configInfo } from '../../config.js';
+import { MagicLinkKeyManager } from './MagicLinkKeys.js';
+import { MagicLinkService } from './MagicLinkService.js';
+import { buildRedeemLandingHtml } from './redeemLanding.js';
+/** The mount path for both routers (`/magic-link`). */
+export const MAGIC_LINK_MOUNT_PATH = '/magic-link';
+/** Path of the JWKS endpoint relative to the public URL. */
+export const MAGIC_LINK_JWKS_PATH = `${MAGIC_LINK_MOUNT_PATH}/jwks.json`;
+/**
+ * Builds the magic-link routers. The caller mounts `publicRouter` before the
+ * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
+ */
+export function createMagicLinkHandler(publicUrl, config) {
+    // Initialize the signing keypair once.
+    MagicLinkKeyManager.Instance.Initialize(config.rsaPrivateKey);
+    const service = new MagicLinkService(publicUrl, config);
+    // Throttle the unauthenticated redemption endpoint and the authenticated
+    // create endpoint. /redeem is a public surface that does a DB lookup +
+    // (on a hit) user provisioning + token minting, so it must be rate-limited
+    // against guessing/enumeration/resource-exhaustion. Keyed by IP.
+    const redeemLimiter = rateLimit({
+        windowMs: config.rateLimitWindowMs,
+        limit: config.redeemRateLimitMax,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: { success: false, errorCode: 'invalid', error: 'Too many redemption attempts. Try again later.' },
+    });
+    const createLimiter = rateLimit({
+        windowMs: config.rateLimitWindowMs,
+        limit: config.createRateLimitMax,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: { success: false, error: 'Too many invite requests. Try again later.' },
+    });
+    // ── Public (unauthenticated) ──────────────────────────────────────────────
+    const publicRouter = Router();
+    publicRouter.get('/jwks.json', (_req, res) => {
+        res.status(200).json(MagicLinkKeyManager.Instance.GetJWKS());
+    });
+    // Sends a completed redemption result: browser flow → 302 into Explorer with
+    // the session token in the URL fragment (never sent to a server, so it stays
+    // out of access/proxy logs); API flow → JSON with an appropriate status.
+    const sendRedeemResult = (res, result, wantsJson) => {
+        const explorerUrl = config.explorerUrl?.replace(/\/$/, '');
+        if (explorerUrl && !wantsJson) {
+            if (result.success && result.token) {
+                // Deep-link into the invited app's route (e.g. /app/data-explorer) rather
+                // than Explorer's root — root falls through to Explorer's default resource,
+                // which isn't the scoped app. Use the app's URL Path (what Explorer's
+                // GetAppByPath matches on); fall back to a name-slug only when Path is
+                // absent. Do NOT hand-roll a slug from the name when Path exists — the two
+                // can diverge and Explorer would fail to resolve the app.
+                const appSlug = result.applicationPath
+                    ? result.applicationPath
+                    : result.applicationName
+                        ? result.applicationName.trim().toLowerCase().replace(/\s+/g, '-')
+                        : '';
+                const path = appSlug ? `/app/${encodeURIComponent(appSlug)}` : '/';
+                res.redirect(302, `${explorerUrl}${path}#token=${encodeURIComponent(result.token)}`);
+            }
+            else {
+                res.redirect(302, `${explorerUrl}/?mlError=${encodeURIComponent(result.errorCode ?? 'invalid')}`);
+            }
+            return;
+        }
+        // API/JSON flow.
+        // not_found / expired / consumed / revoked are client-side conditions (410 Gone);
+        // server_error / provisioning_failed are 500.
+        const status = result.success ? 200 : result.errorCode === 'server_error' || result.errorCode === 'provisioning_failed' ? 500 : 410;
+        res.status(status).json(result);
+    };
+    // GET /redeem is SAFE (no side effects). Link prefetchers and email security
+    // scanners routinely fetch URLs; a side-effectful GET would let them burn the
+    // single-use token before the human clicks. So GET renders an interstitial and
+    // the actual redemption happens only on POST (below), gated by a user click.
+    publicRouter.get('/redeem', redeemLimiter, (req, res) => {
+        const token = typeof req.query.token === 'string' ? req.query.token : '';
+        if (!token) {
+            res.status(400).json({ success: false, error: 'Missing token.' });
+            return;
+        }
+        // API callers must POST — GET never redeems.
+        if (req.query.format === 'json') {
+            res.status(405).json({ success: false, error: 'Redemption requires POST.', method: 'POST', path: `${MAGIC_LINK_MOUNT_PATH}/redeem` });
+            return;
+        }
+        res
+            .status(200)
+            .type('html')
+            .send(buildRedeemLandingHtml(token, `${MAGIC_LINK_MOUNT_PATH}/redeem`));
+    });
+    // POST /redeem performs the actual (side-effectful) redemption. Token arrives
+    // from the interstitial form body, an API client's JSON body, or the query.
+    publicRouter.post('/redeem', redeemLimiter, urlencoded({ extended: false }), json(), async (req, res) => {
+        const body = (req.body ?? {});
+        const token = (typeof body.token === 'string' && body.token) ||
+            (typeof req.query.token === 'string' ? req.query.token : '');
+        const wantsJson = req.query.format === 'json' || req.is('application/json') === 'application/json';
+        if (!token) {
+            res.status(400).json({ success: false, error: 'Missing token.' });
+            return;
+        }
+        // Forensic context for the redemption audit trail. `req.ip` honors the app's
+        // trust-proxy setting; headers are best-effort and may be absent for API clients.
+        const result = await service.RedeemInvite(token, {
+            ipAddress: req.ip,
+            userAgent: req.get('user-agent') ?? undefined,
+            origin: req.get('origin') ?? undefined,
+        });
+        sendRedeemResult(res, result, wantsJson);
+    });
+    // ── Authenticated (invite creation) ───────────────────────────────────────
+    const authenticatedRouter = Router();
+    authenticatedRouter.post('/create', createLimiter, json(), async (req, res) => {
+        const creatingUser = req.userPayload?.userRecord;
+        if (!creatingUser) {
+            res.status(401).json({ success: false, error: 'Authentication required.' });
+            return;
+        }
+        const body = (req.body ?? {});
+        if (!body.email || !body.applicationId) {
+            res.status(400).json({ success: false, error: 'email and applicationId are required.' });
+            return;
+        }
+        const result = await service.CreateInvite({
+            email: body.email,
+            applicationId: body.applicationId,
+            roleId: body.roleId,
+            expiresInHours: body.expiresInHours,
+            maxUses: body.maxUses,
+            firstName: body.firstName,
+            lastName: body.lastName,
+        }, creatingUser);
+        // forbidden → 403 (caller not allowed to issue invites); invalid_role and
+        // other validation failures → 400.
+        const status = result.success ? 200 : result.errorCode === 'forbidden' ? 403 : 400;
+        res.status(status).json(result);
+    });
+    return { publicRouter, authenticatedRouter };
+}
+/**
+ * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
+ * validation accepts MJ-issued session tokens. Issuer = public URL, JWKS URL =
+ * the public JWKS endpoint, audience = configured magic-link audience.
+ *
+ * Also appends the provider to `configInfo.authProviders` so a later
+ * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
+ */
+export function registerMagicLinkAuthProvider(publicUrl, config) {
+    const base = publicUrl.replace(/\/$/, '');
+    const providerConfig = {
+        name: 'magic-link',
+        type: 'magic-link',
+        issuer: publicUrl,
+        audience: config.audience,
+        jwksUri: `${base}${MAGIC_LINK_JWKS_PATH}`,
+    };
+    try {
+        configInfo.authProviders = configInfo.authProviders ?? [];
+        if (!configInfo.authProviders.some((p) => p.type === 'magic-link')) {
+            configInfo.authProviders.push(providerConfig);
+        }
+        const factory = AuthProviderFactory.Instance;
+        factory.register(AuthProviderFactory.createProvider(providerConfig));
+        LogStatus(`[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`);
+    }
+    catch (e) {
+        LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+//# sourceMappingURL=MagicLinkRouter.js.map

package/dist/auth/magicLink/MagicLinkRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA2B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,MAA6B,EAAE,SAAkB,EAAQ,EAAE;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,SAAS,EAAE,CAAC,CAAC;YACtI,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,SAAS,CAAC,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}