@memberjunction/server 5.39.0 → 5.40.1

package/dist/auth/index.js

@@ -173,7 +173,7 @@ export const verifyUserRecord = async (email, firstName, lastName, requestDomain
                     initData.UserRoles = configInfo.userHandling.newUserRoles.map((role) => {
                         const roleInfo = md.Roles.find((r) => r.Name === role);
                         const roleID = roleInfo ? roleInfo.ID : '';
-                        return { UserID: initData.ID, RoleName: role, RoleID: roleID };
+                        return { UserID: initData.ID, Role: role, RoleID: roleID };
                     });
                     user = new UserInfo(Metadata.Provider, initData); // global-provider-ok: same JWT-validation context — no per-request provider yet
                     UserCache.Instance.Users.push(user);

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AAErC,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,UAA+B,EAAE,EAAE;IACjE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IACE,UAAU,CAAC,YAAY,CAAC,kBAAkB;YAC1C,SAAS;YACT,QAAQ;YACR,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,KAAK,KAAK,CAAC,EACtF,CAAC;YACD,uIAAuI;YACvI,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;gBACxC,4EAA4E;gBAC5E,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACpF,0DAA0D;oBAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAA6F,OAAO,CAAC,MAAM,EAAE,CAAC;oBAE5H,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBACjE,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,wCAAwC,aAAa,uNAAuN,CAC1R,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AAErC,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,UAA+B,EAAE,EAAE;IACjE,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IACE,UAAU,CAAC,YAAY,CAAC,kBAAkB;YAC1C,SAAS;YACT,QAAQ;YACR,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,KAAK,KAAK,CAAC,EACtF,CAAC;YACD,uIAAuI;YACvI,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;gBACxC,4EAA4E;gBAC5E,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACpF,0DAA0D;oBAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAAyF,OAAO,CAAC,MAAM,EAAE,CAAC;oBAExH,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC7D,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,wCAAwC,aAAa,uNAAuN,CAC1R,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}

package/dist/auth/magicLink/MagicLinkKeys.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview RS256 key manager for magic-link session JWTs.
+ *
+ * MJ signs magic-link session tokens with an RS256 private key and publishes the
+ * matching public key at a JWKS endpoint. Registering the `magic-link` auth
+ * provider with that JWKS URL lets MJServer's standard issuer-driven validation
+ * verify the tokens with no special-casing.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { BaseSingleton } from '@memberjunction/global';
+import type { MagicLinkJWTClaims } from './types.js';
+/** A single JSON Web Key plus the metadata jwks-rsa needs to match it. */
+interface PublishedJWK extends JsonWebKey {
+    kid: string;
+    use: 'sig';
+    alg: 'RS256';
+}
+/**
+ * Manages the RS256 keypair used to sign and publish magic-link session tokens.
+ * Singleton so the keypair (and therefore the `kid`) is stable for the process
+ * lifetime — restarting with an ephemeral key invalidates outstanding sessions,
+ * which is the intended dev behavior and an acceptable production key-rotation
+ * mechanism.
+ */
+export declare class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManager> {
+    private privateKeyPem;
+    private publicKey?;
+    private _kid;
+    private _initialized;
+    constructor();
+    static get Instance(): MagicLinkKeyManager;
+    get IsInitialized(): boolean;
+    get Kid(): string;
+    /**
+     * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
+     * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     */
+    Initialize(privateKeyPem?: string): void;
+    /**
+     * Signs a set of magic-link claims and returns the compact JWT.
+     * `iat`/`exp` are expected to already be set on the claims.
+     */
+    Sign(claims: MagicLinkJWTClaims): string;
+    /**
+     * Returns the JWKS document (public key set) for the JWKS endpoint.
+     */
+    GetJWKS(): {
+        keys: PublishedJWK[];
+    };
+    private ensureInitialized;
+    /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
+    private normalizePem;
+    /** Stable key id derived from the public key (SHA-256 of DER, base64url, truncated). */
+    private computeKid;
+}
+export {};
+//# sourceMappingURL=MagicLinkKeys.d.ts.map

package/dist/auth/magicLink/MagicLinkKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAyB/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAK/C;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}

package/dist/auth/magicLink/MagicLinkKeys.js

@@ -0,0 +1,99 @@
+/**
+ * @fileoverview RS256 key manager for magic-link session JWTs.
+ *
+ * MJ signs magic-link session tokens with an RS256 private key and publishes the
+ * matching public key at a JWKS endpoint. Registering the `magic-link` auth
+ * provider with that JWKS URL lets MJServer's standard issuer-driven validation
+ * verify the tokens with no special-casing.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { BaseSingleton } from '@memberjunction/global';
+import { LogStatus } from '@memberjunction/core';
+import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash } from 'node:crypto';
+import jwt from 'jsonwebtoken';
+/**
+ * Manages the RS256 keypair used to sign and publish magic-link session tokens.
+ * Singleton so the keypair (and therefore the `kid`) is stable for the process
+ * lifetime — restarting with an ephemeral key invalidates outstanding sessions,
+ * which is the intended dev behavior and an acceptable production key-rotation
+ * mechanism.
+ */
+export class MagicLinkKeyManager extends BaseSingleton {
+    // Public to satisfy BaseSingleton.getInstance's `this: new () => T` constraint
+    // (matches the AuthProviderFactory singleton pattern).
+    constructor() {
+        super();
+        this.privateKeyPem = '';
+        this._kid = '';
+        this._initialized = false;
+    }
+    static get Instance() {
+        return MagicLinkKeyManager.getInstance();
+    }
+    get IsInitialized() {
+        return this._initialized;
+    }
+    get Kid() {
+        return this._kid;
+    }
+    /**
+     * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
+     * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     */
+    Initialize(privateKeyPem) {
+        if (this._initialized) {
+            return;
+        }
+        let priv;
+        const supplied = privateKeyPem?.trim();
+        if (supplied) {
+            priv = createPrivateKey(this.normalizePem(supplied));
+        }
+        else {
+            const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+            priv = privateKey;
+            LogStatus('[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+                'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+                '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.');
+        }
+        this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' });
+        this.publicKey = createPublicKey(priv);
+        this._kid = this.computeKid(this.publicKey);
+        this._initialized = true;
+    }
+    /**
+     * Signs a set of magic-link claims and returns the compact JWT.
+     * `iat`/`exp` are expected to already be set on the claims.
+     */
+    Sign(claims) {
+        this.ensureInitialized();
+        return jwt.sign(claims, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
+    }
+    /**
+     * Returns the JWKS document (public key set) for the JWKS endpoint.
+     */
+    GetJWKS() {
+        this.ensureInitialized();
+        const jwk = this.publicKey.export({ format: 'jwk' });
+        return { keys: [{ ...jwk, kid: this._kid, use: 'sig', alg: 'RS256' }] };
+    }
+    ensureInitialized() {
+        if (!this._initialized) {
+            throw new Error('MagicLinkKeyManager not initialized — call Initialize() during server startup.');
+        }
+    }
+    /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
+    normalizePem(value) {
+        if (value.includes('-----BEGIN')) {
+            return value;
+        }
+        return Buffer.from(value, 'base64').toString('utf8');
+    }
+    /** Stable key id derived from the public key (SHA-256 of DER, base64url, truncated). */
+    computeKid(publicKey) {
+        const pem = publicKey.export({ type: 'spki', format: 'pem' });
+        return createHash('sha256').update(pem).digest('base64url').slice(0, 16);
+    }
+}
+//# sourceMappingURL=MagicLinkKeys.js.map

package/dist/auth/magicLink/MagicLinkKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,SAAS,CACP,kFAAkF;gBAClF,8FAA8F;gBAC9F,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAA0B;QACpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/magicLink/MagicLinkRouter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @fileoverview Express wiring + auth-provider registration for magic links.
+ *
+ * Mirrors the OAuth handler pattern: a public router (unauthenticated — JWKS +
+ * redeem) mounted BEFORE the unified auth middleware, and an authenticated
+ * router (invite creation) mounted AFTER it so `req.userPayload` is available.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { Router } from 'express';
+import { type MagicLinkConfig } from '../../config.js';
+/** The mount path for both routers (`/magic-link`). */
+export declare const MAGIC_LINK_MOUNT_PATH = "/magic-link";
+/** Path of the JWKS endpoint relative to the public URL. */
+export declare const MAGIC_LINK_JWKS_PATH = "/magic-link/jwks.json";
+/**
+ * Builds the magic-link routers. The caller mounts `publicRouter` before the
+ * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
+ */
+export declare function createMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
+    publicRouter: Router;
+    authenticatedRouter: Router;
+};
+/**
+ * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
+ * validation accepts MJ-issued session tokens. Issuer = public URL, JWKS URL =
+ * the public JWKS endpoint, audience = configured magic-link audience.
+ *
+ * Also appends the provider to `configInfo.authProviders` so a later
+ * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
+ */
+export declare function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLinkConfig): void;
+//# sourceMappingURL=MagicLinkRouter.d.ts.map

package/dist/auth/magicLink/MagicLinkRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F"}

package/dist/auth/magicLink/MagicLinkRouter.js

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview Express wiring + auth-provider registration for magic links.
+ *
+ * Mirrors the OAuth handler pattern: a public router (unauthenticated — JWKS +
+ * redeem) mounted BEFORE the unified auth middleware, and an authenticated
+ * router (invite creation) mounted AFTER it so `req.userPayload` is available.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { Router, json, urlencoded } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError, LogStatus } from '@memberjunction/core';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { configInfo } from '../../config.js';
+import { MagicLinkKeyManager } from './MagicLinkKeys.js';
+import { MagicLinkService } from './MagicLinkService.js';
+import { buildRedeemLandingHtml } from './redeemLanding.js';
+/** The mount path for both routers (`/magic-link`). */
+export const MAGIC_LINK_MOUNT_PATH = '/magic-link';
+/** Path of the JWKS endpoint relative to the public URL. */
+export const MAGIC_LINK_JWKS_PATH = `${MAGIC_LINK_MOUNT_PATH}/jwks.json`;
+/**
+ * Builds the magic-link routers. The caller mounts `publicRouter` before the
+ * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
+ */
+export function createMagicLinkHandler(publicUrl, config) {
+    // Initialize the signing keypair once.
+    MagicLinkKeyManager.Instance.Initialize(config.rsaPrivateKey);
+    const service = new MagicLinkService(publicUrl, config);
+    // Throttle the unauthenticated redemption endpoint and the authenticated
+    // create endpoint. /redeem is a public surface that does a DB lookup +
+    // (on a hit) user provisioning + token minting, so it must be rate-limited
+    // against guessing/enumeration/resource-exhaustion. Keyed by IP.
+    const redeemLimiter = rateLimit({
+        windowMs: config.rateLimitWindowMs,
+        limit: config.redeemRateLimitMax,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: { success: false, errorCode: 'invalid', error: 'Too many redemption attempts. Try again later.' },
+    });
+    const createLimiter = rateLimit({
+        windowMs: config.rateLimitWindowMs,
+        limit: config.createRateLimitMax,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: { success: false, error: 'Too many invite requests. Try again later.' },
+    });
+    // ── Public (unauthenticated) ──────────────────────────────────────────────
+    const publicRouter = Router();
+    publicRouter.get('/jwks.json', (_req, res) => {
+        res.status(200).json(MagicLinkKeyManager.Instance.GetJWKS());
+    });
+    // Sends a completed redemption result: browser flow → 302 into Explorer with
+    // the session token in the URL fragment (never sent to a server, so it stays
+    // out of access/proxy logs); API flow → JSON with an appropriate status.
+    const sendRedeemResult = (res, result, wantsJson) => {
+        const explorerUrl = config.explorerUrl?.replace(/\/$/, '');
+        if (explorerUrl && !wantsJson) {
+            if (result.success && result.token) {
+                // Deep-link into the invited app's route (e.g. /app/data-explorer) rather
+                // than Explorer's root — root falls through to Explorer's default resource,
+                // which isn't the scoped app. Use the app's URL Path (what Explorer's
+                // GetAppByPath matches on); fall back to a name-slug only when Path is
+                // absent. Do NOT hand-roll a slug from the name when Path exists — the two
+                // can diverge and Explorer would fail to resolve the app.
+                const appSlug = result.applicationPath
+                    ? result.applicationPath
+                    : result.applicationName
+                        ? result.applicationName.trim().toLowerCase().replace(/\s+/g, '-')
+                        : '';
+                const path = appSlug ? `/app/${encodeURIComponent(appSlug)}` : '/';
+                res.redirect(302, `${explorerUrl}${path}#token=${encodeURIComponent(result.token)}`);
+            }
+            else {
+                res.redirect(302, `${explorerUrl}/?mlError=${encodeURIComponent(result.errorCode ?? 'invalid')}`);
+            }
+            return;
+        }
+        // API/JSON flow.
+        // not_found / expired / consumed / revoked are client-side conditions (410 Gone);
+        // server_error / provisioning_failed are 500.
+        const status = result.success ? 200 : result.errorCode === 'server_error' || result.errorCode === 'provisioning_failed' ? 500 : 410;
+        res.status(status).json(result);
+    };
+    // GET /redeem is SAFE (no side effects). Link prefetchers and email security
+    // scanners routinely fetch URLs; a side-effectful GET would let them burn the
+    // single-use token before the human clicks. So GET renders an interstitial and
+    // the actual redemption happens only on POST (below), gated by a user click.
+    publicRouter.get('/redeem', redeemLimiter, (req, res) => {
+        const token = typeof req.query.token === 'string' ? req.query.token : '';
+        if (!token) {
+            res.status(400).json({ success: false, error: 'Missing token.' });
+            return;
+        }
+        // API callers must POST — GET never redeems.
+        if (req.query.format === 'json') {
+            res.status(405).json({ success: false, error: 'Redemption requires POST.', method: 'POST', path: `${MAGIC_LINK_MOUNT_PATH}/redeem` });
+            return;
+        }
+        res
+            .status(200)
+            .type('html')
+            .send(buildRedeemLandingHtml(token, `${MAGIC_LINK_MOUNT_PATH}/redeem`));
+    });
+    // POST /redeem performs the actual (side-effectful) redemption. Token arrives
+    // from the interstitial form body, an API client's JSON body, or the query.
+    publicRouter.post('/redeem', redeemLimiter, urlencoded({ extended: false }), json(), async (req, res) => {
+        const body = (req.body ?? {});
+        const token = (typeof body.token === 'string' && body.token) ||
+            (typeof req.query.token === 'string' ? req.query.token : '');
+        const wantsJson = req.query.format === 'json' || req.is('application/json') === 'application/json';
+        if (!token) {
+            res.status(400).json({ success: false, error: 'Missing token.' });
+            return;
+        }
+        // Forensic context for the redemption audit trail. `req.ip` honors the app's
+        // trust-proxy setting; headers are best-effort and may be absent for API clients.
+        const result = await service.RedeemInvite(token, {
+            ipAddress: req.ip,
+            userAgent: req.get('user-agent') ?? undefined,
+            origin: req.get('origin') ?? undefined,
+        });
+        sendRedeemResult(res, result, wantsJson);
+    });
+    // ── Authenticated (invite creation) ───────────────────────────────────────
+    const authenticatedRouter = Router();
+    authenticatedRouter.post('/create', createLimiter, json(), async (req, res) => {
+        const creatingUser = req.userPayload?.userRecord;
+        if (!creatingUser) {
+            res.status(401).json({ success: false, error: 'Authentication required.' });
+            return;
+        }
+        const body = (req.body ?? {});
+        if (!body.email || !body.applicationId) {
+            res.status(400).json({ success: false, error: 'email and applicationId are required.' });
+            return;
+        }
+        const result = await service.CreateInvite({
+            email: body.email,
+            applicationId: body.applicationId,
+            roleId: body.roleId,
+            expiresInHours: body.expiresInHours,
+            maxUses: body.maxUses,
+            firstName: body.firstName,
+            lastName: body.lastName,
+        }, creatingUser);
+        // forbidden → 403 (caller not allowed to issue invites); invalid_role and
+        // other validation failures → 400.
+        const status = result.success ? 200 : result.errorCode === 'forbidden' ? 403 : 400;
+        res.status(status).json(result);
+    });
+    return { publicRouter, authenticatedRouter };
+}
+/**
+ * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
+ * validation accepts MJ-issued session tokens. Issuer = public URL, JWKS URL =
+ * the public JWKS endpoint, audience = configured magic-link audience.
+ *
+ * Also appends the provider to `configInfo.authProviders` so a later
+ * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
+ */
+export function registerMagicLinkAuthProvider(publicUrl, config) {
+    const base = publicUrl.replace(/\/$/, '');
+    const providerConfig = {
+        name: 'magic-link',
+        type: 'magic-link',
+        issuer: publicUrl,
+        audience: config.audience,
+        jwksUri: `${base}${MAGIC_LINK_JWKS_PATH}`,
+    };
+    try {
+        configInfo.authProviders = configInfo.authProviders ?? [];
+        if (!configInfo.authProviders.some((p) => p.type === 'magic-link')) {
+            configInfo.authProviders.push(providerConfig);
+        }
+        const factory = AuthProviderFactory.Instance;
+        factory.register(AuthProviderFactory.createProvider(providerConfig));
+        LogStatus(`[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`);
+    }
+    catch (e) {
+        LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+//# sourceMappingURL=MagicLinkRouter.js.map

package/dist/auth/magicLink/MagicLinkRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA2B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,MAA6B,EAAE,SAAkB,EAAQ,EAAE;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,SAAS,EAAE,CAAC,CAAC;YACtI,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,SAAS,CAAC,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}

package/dist/auth/magicLink/MagicLinkService.d.ts

@@ -0,0 +1,123 @@
+/**
+ * @fileoverview Imperative shell for magic links: invite creation, redemption,
+ * user provisioning, and session-token minting. The pure logic lives in
+ * `magicLinkCore.ts`; this module wires it to the DB, key manager, and
+ * communication engine.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { UserInfo, type IMetadataProvider } from '@memberjunction/core';
+import { type MagicLinkConfig } from '../../config.js';
+import type { CreateMagicLinkInviteParams, CreateMagicLinkInviteResult, RedeemMagicLinkResult, RedeemAuditContext } from './types.js';
+/**
+ * Magic-link service. One instance per server, constructed with the resolved
+ * public URL and the validated config.
+ */
+export declare class MagicLinkService {
+    private readonly publicUrl;
+    private readonly config;
+    constructor(publicUrl: string, config: MagicLinkConfig);
+    /**
+     * Creates a single-use, app-scoped invite, persists its hashed token, and
+     * (when a communication provider is configured) emails the link.
+     *
+     * @param params  invite parameters
+     * @param creatingUser  the authenticated internal user issuing the invite
+     * @param provider  the request's metadata provider; falls back to the global default
+     */
+    CreateInvite(params: CreateMagicLinkInviteParams, creatingUser: UserInfo, provider?: IMetadataProvider): Promise<CreateMagicLinkInviteResult>;
+    /**
+     * Redeems a raw token: validates the invite, atomically consumes one use,
+     * provisions/links the user with the restricted role + app, and mints a
+     * session JWT. Runs in the public (pre-auth) path, so it uses the global
+     * provider and a configured provisioning context user.
+     *
+     * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
+     * BEFORE the token is minted — two concurrent redemptions of a single-use
+     * link race on the same row and exactly one wins. The consume is the gate:
+     * if a later step fails, the use is already burned (fail-closed). That is the
+     * correct trade-off for a single-use credential — burning a token on a server
+     * error is recoverable (re-issue); allowing replay is not.
+     */
+    RedeemInvite(rawToken: string, audit?: RedeemAuditContext): Promise<RedeemMagicLinkResult>;
+    /**
+     * Writes one MagicLinkRedemption audit row for a redemption attempt. Best-effort:
+     * a failure here is logged but never fails the redemption (the user already has,
+     * or has been denied, their session — losing an audit row must not change that).
+     *
+     * InviteID/ProvisionedUserID are null when the attempt didn't get far enough to
+     * resolve them (e.g. a malformed or unknown token — exactly the scan/brute-force
+     * signal we want recorded). IP/User-Agent/Origin are stored as supplied by the
+     * router per the deployment's audit policy.
+     */
+    private recordRedemption;
+    /**
+     * Writes the Phase-2 multi-scope child rows (one application + one role) that
+     * mirror the invite's single ApplicationID/RoleID. The columns remain the
+     * source of truth for redemption today; these rows pre-stage the data for the
+     * eventual switch to multi-scope reads, avoiding a breaking migration later.
+     * Best-effort: a child-write failure is logged but does not fail invite
+     * issuance (the columns alone keep the one-of-each flow working).
+     */
+    private writeInviteScopeChildRows;
+    /** Resolves the configured restricted role's ID, if present. */
+    private resolveRestrictedRoleId;
+    /** Builds the shareable redemption URL. */
+    private buildRedemptionUrl;
+    /**
+     * Provisions the redeeming user: finds them by email or creates them, then
+     * ensures the restricted role and the single app assignment exist.
+     */
+    private provisionUser;
+    /**
+     * Resolves the shared Anonymous principal for an anonymous-mode redemption. This
+     * principal is an ATTRIBUTION ANCHOR only — it holds no scenario roles and gets no
+     * UserRole/UserApplication rows here, so concurrent anon visitors can never accrete
+     * scope onto a shared identity. Their actual scope lives in the per-session JWT
+     * claims (mj_scopes) and is enforced claims-side. Fail-closed if the principal was
+     * never seeded (the Phase-4 migration is required).
+     */
+    private resolveAnonymousPrincipal;
+    /**
+     * True if an existing account is "protected" from magic-link provisioning: an
+     * Owner, or a user holding any role OUTSIDE the set of roles magic-link may
+     * legitimately grant. That allowed set is: the configured restricted role, the
+     * deployment's `grantableRoleNames`, AND the role THIS invite grants. So a prior
+     * magic-link guest holding only magic-link-grantable roles (e.g. the invite's own
+     * granted role) is NOT protected — re-redeeming a multi-use link is the intended
+     * flow. A user holding e.g. Developer/Admin is still protected and blocked.
+     *
+     * @param user  the existing account being re-provisioned
+     * @param invitedRoleName  the role name this invite grants
+     */
+    private isProtectedAccount;
+    /** Creates a new user with exactly the restricted role + single app, transactionally. */
+    private createScopedUser;
+    /** Idempotently ensures an existing user has the given role and app assignment. */
+    private ensureRoleAndApp;
+    /** Idempotently ensures the role has CanAccess to the application (Application Role). */
+    private ensureAppAccess;
+    /**
+     * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
+     * The WHERE clause re-checks every eligibility condition (Active, not
+     * exhausted, not expired) at the DB level, so the increment and the guard are
+     * a single atomic operation. Returns true ONLY when this call updated the row
+     * (won the race); concurrent redemptions of a single-use link see 0 rows.
+     *
+     * Fail-closed: any DB error returns false and the redemption is rejected.
+     */
+    private consumeInvite;
+    /** Pushes a freshly created user into the UserCache with its single role. */
+    private pushUserToCache;
+    /**
+     * True iff the invite's creator resolves to a still-active user. Used to
+     * fail-closed at redeem time so a deactivated/removed inviter's outstanding
+     * links stop working. A missing/blank CreatedByUserID is treated as inactive.
+     */
+    private isInviterActive;
+    /** Resolves the user whose context provisions magic-link users. */
+    private resolveProvisioningContextUser;
+    /** Sends the invite email via the configured communication provider. Best-effort. */
+    private sendInviteEmail;
+}
+//# sourceMappingURL=MagicLinkService.d.ts.map

package/dist/auth/magicLink/MagicLinkService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAkBpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IA2D9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;OAQG;YACW,aAAa;IAkB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAYtC,qFAAqF;YACvE,eAAe;CA0B9B"}