@memberjunction/server 5.38.0 → 5.40.0

package/dist/auth/magicLink/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export { generateRawToken, hashToken, evaluateInvite, buildSessionClaims, MAGIC_LINK_TOKEN_PREFIX, type InviteEvaluationInput, } from './magicLinkCore.js';
+export { MagicLinkKeyManager } from './MagicLinkKeys.js';
+export { MagicLinkService } from './MagicLinkService.js';
+export { createMagicLinkHandler, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT_PATH, MAGIC_LINK_JWKS_PATH, } from './MagicLinkRouter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/magicLink/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/dist/auth/magicLink/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export { generateRawToken, hashToken, evaluateInvite, buildSessionClaims, MAGIC_LINK_TOKEN_PREFIX, } from './magicLinkCore.js';
+export { MagicLinkKeyManager } from './MagicLinkKeys.js';
+export { MagicLinkService } from './MagicLinkService.js';
+export { createMagicLinkHandler, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT_PATH, MAGIC_LINK_JWKS_PATH, } from './MagicLinkRouter.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/magicLink/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/magicLink/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/dist/auth/magicLink/magicLinkCore.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Pure functional core for magic links — no DB, no email, no MJ
+ * runtime imports. Everything here is deterministic given its inputs (modulo
+ * crypto randomness) and unit-testable with plain assertions.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import type { MagicLinkJWTClaims, MagicLinkScopeEntry, RedeemErrorCode } from './types.js';
+/** Token prefix, mirroring the API-key convention (`mj_sk_`). */
+export declare const MAGIC_LINK_TOKEN_PREFIX = "mj_ml_";
+/** Generates a cryptographically random raw magic-link token. */
+export declare function generateRawToken(): string;
+/** Generates an opaque per-session id (anonymous-session forensics correlation). */
+export declare function generateSessionId(): string;
+/**
+ * SHA-256 hash of a raw token, base64url-encoded — only the hash is ever
+ * persisted. base64url (43 chars) is shorter than hex (64 chars), URL-safe, and
+ * carries the full 256 bits. Both write (CreateInvite) and read (RedeemInvite)
+ * paths call this, so the encoding stays internally consistent.
+ */
+export declare function hashToken(rawToken: string): string;
+/** Minimal shape of an invite needed for redemption eligibility. */
+export interface InviteEvaluationInput {
+    Status: string;
+    ExpiresAt: Date | string;
+    MaxUses: number;
+    UseCount: number;
+}
+/**
+ * Pure authorization check for WHO may issue magic-link invites.
+ *
+ * Owners are always allowed (Owner is MJ's superuser type). Otherwise the caller
+ * must be a member of one of `issuerRoleNames`. An empty `issuerRoleNames` means
+ * Owner-only — the secure default. This is what stops any authenticated user
+ * (including an external user already holding a restricted magic-link session)
+ * from minting invites.
+ */
+export declare function canIssueInvites(userType: string | null | undefined, userRoleNames: readonly string[], issuerRoleNames: readonly string[]): boolean;
+/**
+ * Pure check for WHAT role an invite may grant. The restricted role is always
+ * grantable; any other role must be explicitly listed in `grantableRoleNames`.
+ * Applied to every caller (Owners included) so a privileged role can never be
+ * attached to an external magic-link user unless the deployment opts in.
+ */
+export declare function isRoleGrantable(roleName: string | null | undefined, restrictedRoleName: string, grantableRoleNames: readonly string[]): boolean;
+/** Pure redemption-eligibility check. Returns ok + an error code when not. */
+export declare function evaluateInvite(invite: InviteEvaluationInput, nowMs: number): {
+    ok: boolean;
+    errorCode?: RedeemErrorCode;
+};
+export declare function buildConsumeInviteSQL(qualifiedTable: string): string;
+/**
+ * Pure scope-union: appends `next` to `prior` unless an entry from the same invite
+ * is already present (dedup by inviteId). This is how a session accumulates the union
+ * of scopes across multiple redeemed links — carried in the re-minted JWT, never as
+ * roles on a shared user, so anonymous sessions can't accrete into a superuser.
+ */
+export declare function unionScopes(prior: readonly MagicLinkScopeEntry[] | undefined, next: MagicLinkScopeEntry): MagicLinkScopeEntry[];
+/** Builds the session-token claims (pure). */
+export declare function buildSessionClaims(args: {
+    issuer: string;
+    audience: string;
+    inviteId: string;
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    applicationId: string;
+    roleName: string;
+    invitedByUserId?: string;
+    /** True for anonymous sessions — the server enforces scope from mj_scopes, not roles. */
+    anonymous?: boolean;
+    /** Opaque per-session id (anonymous forensics correlation). */
+    sessionId?: string;
+    /** Prior session's scope union to carry forward (multi-link anonymous sessions). */
+    priorScopes?: readonly MagicLinkScopeEntry[];
+    /** Resource-share/embed scope for this link's entry. */
+    resourceType?: string;
+    resourceId?: string;
+    nowSeconds: number;
+    ttlSeconds: number;
+}): MagicLinkJWTClaims;
+//# sourceMappingURL=magicLinkCore.d.ts.map

package/dist/auth/magicLink/magicLinkCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinkCore.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/magicLinkCore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE3F,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD,iEAAiE;AACjE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAOT;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,eAAe,CAAA;CAAE,CAezH;AA8BD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAM/H;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,WAAW,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,kBAAkB,CA2BrB"}

package/dist/auth/magicLink/magicLinkCore.js

@@ -0,0 +1,164 @@
+/**
+ * @fileoverview Pure functional core for magic links — no DB, no email, no MJ
+ * runtime imports. Everything here is deterministic given its inputs (modulo
+ * crypto randomness) and unit-testable with plain assertions.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { randomBytes, createHash } from 'node:crypto';
+/** Token prefix, mirroring the API-key convention (`mj_sk_`). */
+export const MAGIC_LINK_TOKEN_PREFIX = 'mj_ml_';
+/** Generates a cryptographically random raw magic-link token. */
+export function generateRawToken() {
+    return MAGIC_LINK_TOKEN_PREFIX + randomBytes(32).toString('hex');
+}
+/** Generates an opaque per-session id (anonymous-session forensics correlation). */
+export function generateSessionId() {
+    return randomBytes(16).toString('base64url');
+}
+/**
+ * SHA-256 hash of a raw token, base64url-encoded — only the hash is ever
+ * persisted. base64url (43 chars) is shorter than hex (64 chars), URL-safe, and
+ * carries the full 256 bits. Both write (CreateInvite) and read (RedeemInvite)
+ * paths call this, so the encoding stays internally consistent.
+ */
+export function hashToken(rawToken) {
+    return createHash('sha256').update(rawToken).digest('base64url');
+}
+/** Normalizes a role/name for case- and whitespace-insensitive comparison. */
+function normalizeName(name) {
+    return name.trim().toLowerCase();
+}
+/**
+ * Pure authorization check for WHO may issue magic-link invites.
+ *
+ * Owners are always allowed (Owner is MJ's superuser type). Otherwise the caller
+ * must be a member of one of `issuerRoleNames`. An empty `issuerRoleNames` means
+ * Owner-only — the secure default. This is what stops any authenticated user
+ * (including an external user already holding a restricted magic-link session)
+ * from minting invites.
+ */
+export function canIssueInvites(userType, userRoleNames, issuerRoleNames) {
+    if (normalizeName(userType ?? '') === 'owner') {
+        return true;
+    }
+    const allowed = new Set(issuerRoleNames.map(normalizeName));
+    if (allowed.size === 0) {
+        return false;
+    }
+    return userRoleNames.some((r) => allowed.has(normalizeName(r)));
+}
+/**
+ * Pure check for WHAT role an invite may grant. The restricted role is always
+ * grantable; any other role must be explicitly listed in `grantableRoleNames`.
+ * Applied to every caller (Owners included) so a privileged role can never be
+ * attached to an external magic-link user unless the deployment opts in.
+ */
+export function isRoleGrantable(roleName, restrictedRoleName, grantableRoleNames) {
+    const target = normalizeName(roleName ?? '');
+    if (!target) {
+        return false;
+    }
+    const allowed = new Set([normalizeName(restrictedRoleName), ...grantableRoleNames.map(normalizeName)]);
+    return allowed.has(target);
+}
+/** Pure redemption-eligibility check. Returns ok + an error code when not. */
+export function evaluateInvite(invite, nowMs) {
+    if (invite.Status === 'Revoked') {
+        return { ok: false, errorCode: 'revoked' };
+    }
+    const expiresMs = new Date(invite.ExpiresAt).getTime();
+    if (Number.isFinite(expiresMs) && expiresMs <= nowMs) {
+        return { ok: false, errorCode: 'expired' };
+    }
+    if (invite.Status === 'Consumed' || invite.UseCount >= invite.MaxUses) {
+        return { ok: false, errorCode: 'consumed' };
+    }
+    if (invite.Status !== 'Active') {
+        return { ok: false, errorCode: 'invalid' };
+    }
+    return { ok: true };
+}
+/**
+ * Builds the atomic compare-and-swap UPDATE that consumes one use of an invite.
+ *
+ * The WHERE clause re-checks every eligibility condition at the DB level, so the
+ * increment and the guard are a single atomic operation: concurrent redemptions
+ * of a single-use link race on the row and exactly one matches (the matched row
+ * is returned via OUTPUT). This is what actually enforces single-use — the
+ * JS-side `evaluateInvite` is only a friendly pre-check.
+ *
+ * The invite ID MUST be bound as parameter `@p0` by the caller — it is never
+ * interpolated into the string, so this builder is injection-safe regardless of
+ * the ID's contents.
+ *
+ * OUTPUT goes `INTO` a table variable (not a bare OUTPUT): SQL Server forbids a
+ * bare OUTPUT clause on a table that has enabled triggers, and CodeGen adds an
+ * `__mj_UpdatedAt` trigger to every MJ table. The trailing SELECT returns exactly
+ * the matched row(s) so the caller can detect a win (exactly one row) regardless
+ * of trigger behavior.
+ *
+ * `qualifiedTable` is asserted to be a bracket-quoted `[schema].[table]` (word
+ * chars only) before interpolation. The caller derives it from `EntityInfo`
+ * (never user input), so this is defense-in-depth: even a future careless caller
+ * cannot turn this into an injection vector — a non-conforming table throws.
+ *
+ * @param qualifiedTable  bracket-quoted `[schema].[table]` for MagicLinkInvite
+ */
+const QUALIFIED_TABLE_PATTERN = /^\[\w+\]\.\[\w+\]$/;
+export function buildConsumeInviteSQL(qualifiedTable) {
+    if (!QUALIFIED_TABLE_PATTERN.test(qualifiedTable)) {
+        throw new Error(`buildConsumeInviteSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
+    }
+    return (`DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER); ` +
+        `UPDATE ${qualifiedTable} ` +
+        `SET UseCount = UseCount + 1, ` +
+        `ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME()), ` +
+        `Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END ` +
+        `OUTPUT INSERTED.ID INTO @consumed ` +
+        `WHERE ID = @p0 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > SYSUTCDATETIME(); ` +
+        `SELECT ID FROM @consumed;`);
+}
+/**
+ * Pure scope-union: appends `next` to `prior` unless an entry from the same invite
+ * is already present (dedup by inviteId). This is how a session accumulates the union
+ * of scopes across multiple redeemed links — carried in the re-minted JWT, never as
+ * roles on a shared user, so anonymous sessions can't accrete into a superuser.
+ */
+export function unionScopes(prior, next) {
+    const result = [...(prior ?? [])];
+    if (!result.some((s) => s.inviteId === next.inviteId)) {
+        result.push(next);
+    }
+    return result;
+}
+/** Builds the session-token claims (pure). */
+export function buildSessionClaims(args) {
+    const name = [args.firstName, args.lastName].filter(Boolean).join(' ') || undefined;
+    const scopeEntry = {
+        inviteId: args.inviteId,
+        appId: args.applicationId,
+        role: args.roleName,
+        resourceType: args.resourceType,
+        resourceId: args.resourceId,
+    };
+    return {
+        iss: args.issuer,
+        aud: args.audience,
+        sub: `magic-link|${args.inviteId}`,
+        iat: args.nowSeconds,
+        exp: args.nowSeconds + args.ttlSeconds,
+        email: args.email,
+        given_name: args.firstName,
+        family_name: args.lastName,
+        name,
+        mj_app_id: args.applicationId,
+        mj_role: args.roleName,
+        mj_invited_by: args.invitedByUserId,
+        mj_scopes: unionScopes(args.priorScopes, scopeEntry),
+        mj_anon: args.anonymous ? true : undefined,
+        mj_sid: args.sessionId,
+        mj_magic_link: true,
+    };
+}
+//# sourceMappingURL=magicLinkCore.js.map

package/dist/auth/magicLink/magicLinkCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinkCore.js","sourceRoot":"","sources":["../../../src/auth/magicLink/magicLinkCore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGtD,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD,iEAAiE;AACjE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,uBAAuB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAUD,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmC,EACnC,aAAgC,EAChC,eAAkC;IAElC,IAAI,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmC,EACnC,kBAA0B,EAC1B,kBAAqC;IAErC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAA6B,EAAE,KAAa;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAErD,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,sFAAsF,cAAc,IAAI,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,CACL,iDAAiD;QACjD,UAAU,cAAc,GAAG;QAC3B,+BAA+B;QAC/B,uDAAuD;QACvD,6EAA6E;QAC7E,oCAAoC;QACpC,gGAAgG;QAChG,2BAA2B,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiD,EAAE,IAAyB;IACtG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,IAqBlC;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACpF,MAAM,UAAU,GAAwB;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,IAAI,EAAE,IAAI,CAAC,QAAQ;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IACF,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,cAAc,IAAI,CAAC,QAAQ,EAAE;QAClC,GAAG,EAAE,IAAI,CAAC,UAAU;QACpB,GAAG,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;QACtC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,aAAa;QAC7B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;QACpD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,IAAI,CAAC,SAAS;QACtB,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC"}

package/dist/auth/magicLink/redeemLanding.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @fileoverview Pure HTML for the magic-link redemption interstitial. No DB, no
+ * MJ runtime imports — deterministic string in, string out.
+ * @module @memberjunction/server/auth/magicLink
+ */
+/** Minimal HTML-escape for safe interpolation into attribute/text content. */
+export declare function escapeHtml(s: string): string;
+/**
+ * Builds the redemption landing page served by `GET /magic-link/redeem`.
+ *
+ * GET must be SAFE: link prefetchers, email security scanners, and browser
+ * preconnect routinely fetch URLs, and a side-effectful GET would let them burn
+ * the single-use token before the human ever clicks. So GET renders this page
+ * and the actual redemption happens only when the user submits the form (POST).
+ * The "Continue" button is NOT auto-submitted — a bot that merely loads the page
+ * (even one that executes JS) does not consume the token; a human gesture does.
+ *
+ * @param token       the raw magic-link token (embedded in a hidden field)
+ * @param actionPath  the same-origin path the form POSTs to (e.g. `/magic-link/redeem`)
+ */
+export declare function buildRedeemLandingHtml(token: string, actionPath: string): string;
+//# sourceMappingURL=redeemLanding.d.ts.map

package/dist/auth/magicLink/redeemLanding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeemLanding.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/redeemLanding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAgChF"}

package/dist/auth/magicLink/redeemLanding.js

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview Pure HTML for the magic-link redemption interstitial. No DB, no
+ * MJ runtime imports — deterministic string in, string out.
+ * @module @memberjunction/server/auth/magicLink
+ */
+/** Minimal HTML-escape for safe interpolation into attribute/text content. */
+export function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Builds the redemption landing page served by `GET /magic-link/redeem`.
+ *
+ * GET must be SAFE: link prefetchers, email security scanners, and browser
+ * preconnect routinely fetch URLs, and a side-effectful GET would let them burn
+ * the single-use token before the human ever clicks. So GET renders this page
+ * and the actual redemption happens only when the user submits the form (POST).
+ * The "Continue" button is NOT auto-submitted — a bot that merely loads the page
+ * (even one that executes JS) does not consume the token; a human gesture does.
+ *
+ * @param token       the raw magic-link token (embedded in a hidden field)
+ * @param actionPath  the same-origin path the form POSTs to (e.g. `/magic-link/redeem`)
+ */
+export function buildRedeemLandingHtml(token, actionPath) {
+    const t = escapeHtml(token);
+    const action = escapeHtml(actionPath);
+    // Hardcoded colors are intentional here — this is a standalone server-rendered
+    // HTML response, not Angular component CSS, so the design-token rule doesn't apply.
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>Sign in</title>
+<style>
+  body { font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; background:#f5f5f5; margin:0; display:flex; min-height:100vh; align-items:center; justify-content:center; }
+  .card { background:#fff; padding:2.5rem; border-radius:12px; box-shadow:0 1px 4px rgba(0,0,0,.12); max-width:24rem; text-align:center; }
+  h1 { font-size:1.25rem; margin:0 0 .5rem; color:#1f2937; }
+  p { color:#4b5563; margin:0 0 1.5rem; font-size:.95rem; }
+  button { background:#264FAF; color:#fff; border:0; border-radius:8px; padding:.75rem 1.5rem; font-size:1rem; cursor:pointer; width:100%; }
+  button:hover { background:#1e3f8c; }
+</style>
+</head>
+<body>
+  <div class="card">
+    <h1>Sign in to continue</h1>
+    <p>Click below to securely sign in with your invitation link.</p>
+    <form method="POST" action="${action}">
+      <input type="hidden" name="token" value="${t}">
+      <button type="submit">Continue to sign in</button>
+    </form>
+  </div>
+</body>
+</html>`;
+}
+//# sourceMappingURL=redeemLanding.js.map

package/dist/auth/magicLink/redeemLanding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeemLanding.js","sourceRoot":"","sources":["../../../src/auth/magicLink/redeemLanding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,UAAkB;IACtE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,+EAA+E;IAC/E,oFAAoF;IACpF,OAAO;;;;;;;;;;;;;;;;;;;;kCAoByB,MAAM;iDACS,CAAC;;;;;QAK1C,CAAC;AACT,CAAC"}

package/dist/auth/magicLink/types.d.ts

@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Types for the MemberJunction magic-link feature.
+ * @module @memberjunction/server/auth/magicLink
+ */
+/**
+ * One unit of scope a magic-link session holds. The union of these across all links
+ * a session has redeemed is the anonymous-session authorization boundary (enforced
+ * server-side against the claims, never via roles on the shared Anonymous principal).
+ */
+export interface MagicLinkScopeEntry {
+    /** The invite that granted this scope entry. */
+    inviteId: string;
+    /** The Application this entry grants access to. */
+    appId: string;
+    /** The role name this entry carries (email/app-session links). */
+    role?: string;
+    /** For resource-share/embed links: the shared resource's type + id. */
+    resourceType?: string;
+    resourceId?: string;
+}
+/**
+ * Claims carried by a MJ-issued magic-link session JWT.
+ * Identity claims (email/given_name/family_name) follow standard OIDC so the
+ * existing provider extraction works; the `mj_*` claims describe the scope.
+ */
+export interface MagicLinkJWTClaims {
+    /** Issuer — MJ's public URL; resolves to the registered `magic-link` auth provider. */
+    iss: string;
+    /** Audience — the configured magic-link audience (default `mj-magic-link`). */
+    aud: string;
+    /** Subject — `magic-link|<inviteId>`. */
+    sub: string;
+    /** Issued-at (epoch seconds). */
+    iat: number;
+    /** Expiry (epoch seconds). */
+    exp: number;
+    email: string;
+    given_name?: string;
+    family_name?: string;
+    name?: string;
+    /** The single Application this session is scoped to. */
+    mj_app_id: string;
+    /** The restricted role name assigned to this user (informational; enforcement is server-side via the role's entity permissions). */
+    mj_role: string;
+    /** UserID of the internal user who issued the invite (attribution/audit). Absent on links whose inviter could not be resolved. */
+    mj_invited_by?: string;
+    /**
+     * Per-session scope UNION (Phase 4+). Each entry is one redeemed link's grant.
+     * The server enforces anonymous sessions against THIS set (not the user's role
+     * set), which is why two anon visitors sharing the Anonymous principal can hold
+     * different scopes without accretion. For email sessions the singular mj_app_id/
+     * mj_role remain authoritative; this carries the union when links are stacked.
+     */
+    mj_scopes?: MagicLinkScopeEntry[];
+    /** True when this session resolves to the shared Anonymous principal (claims-based enforcement). */
+    mj_anon?: boolean;
+    /** Opaque per-session id — correlates one anonymous session's activity across audit rows without a real user. */
+    mj_sid?: string;
+    /** Marks the session as magic-link so the Explorer can confine the UI. */
+    mj_magic_link: true;
+}
+/** Parameters for creating a magic-link invite (POST /magic-link/create). */
+export interface CreateMagicLinkInviteParams {
+    /** Recipient email — becomes the provisioned user's email. */
+    email: string;
+    /** The Application the invite grants access to. */
+    applicationId: string;
+    /** Restricted role to assign. Defaults to the configured `restrictedRoleName`. */
+    roleId?: string;
+    /** Hours until the link expires. Defaults to config `defaultExpiresInHours`. */
+    expiresInHours?: number;
+    /** Maximum redemptions. Defaults to 1 (single-use). */
+    maxUses?: number;
+    /** Optional given/family name to seed the provisioned user. */
+    firstName?: string;
+    lastName?: string;
+}
+/** Result of creating an invite. */
+export interface CreateMagicLinkInviteResult {
+    success: boolean;
+    inviteId?: string;
+    /** Full redemption URL to share. */
+    redemptionUrl?: string;
+    /**
+     * The raw token, returned ONLY when no email provider is configured (so the
+     * caller can deliver the link out of band). Never returned once email send
+     * succeeds, and never persisted.
+     */
+    rawToken?: string;
+    /** Whether the invite email was dispatched. */
+    emailSent?: boolean;
+    /** ISO expiry timestamp. */
+    expiresAt?: string;
+    error?: string;
+    /**
+     * Set when the request was rejected for authorization reasons:
+     * `forbidden` — caller may not issue invites; `invalid_role` — the requested
+     * role is not grantable via magic-link. Drives the HTTP status in the router.
+     */
+    errorCode?: 'forbidden' | 'invalid_role';
+}
+/** Why a redemption failed. */
+export type RedeemErrorCode = 'not_found' | 'expired' | 'consumed' | 'revoked' | 'invalid' | 'provisioning_failed' | 'server_error';
+/**
+ * Per-request forensic context captured for the redemption audit trail
+ * (`MJ: Magic Link Redemptions`). Sourced from the HTTP request at the router;
+ * all fields optional because the API/JSON flow may omit them.
+ */
+export interface RedeemAuditContext {
+    ipAddress?: string;
+    userAgent?: string;
+    origin?: string;
+}
+/** Result of redeeming an invite. */
+export interface RedeemMagicLinkResult {
+    success: boolean;
+    /** The minted session JWT (RS256). */
+    token?: string;
+    /** ISO expiry of the session token. */
+    expiresAt?: string;
+    /** The Application the session is scoped to. */
+    applicationId?: string;
+    /** The Application's display name (used to deep-link the browser into that app). */
+    applicationName?: string;
+    /** The Application's URL path slug (preferred for deep-linking; falls back to name). */
+    applicationPath?: string;
+    email?: string;
+    error?: string;
+    errorCode?: RedeemErrorCode;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/magicLink/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,oIAAoI;IACpI,OAAO,EAAE,MAAM,CAAC;IAChB,kIAAkI;IAClI,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,oGAAoG;IACpG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,2BAA2B;IAC1C,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC;CAC1C;AAED,+BAA+B;AAC/B,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAEpI;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B"}

package/dist/auth/magicLink/types.js

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Types for the MemberJunction magic-link feature.
+ * @module @memberjunction/server/auth/magicLink
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/magicLink/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/magicLink/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}