@memberjunction/server 5.39.0 → 5.40.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "5.39.0",
+  "version": "5.40.1",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -27,76 +27,79 @@
     "@as-integrations/express5": "^1.0.0",
     "@graphql-tools/schema": "latest",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "5.39.0",
-    "@memberjunction/actions-apollo": "5.39.0",
-    "@memberjunction/actions-base": "5.39.0",
-    "@memberjunction/actions-bizapps-accounting": "5.39.0",
-    "@memberjunction/actions-bizapps-crm": "5.39.0",
-    "@memberjunction/actions-bizapps-formbuilders": "5.39.0",
-    "@memberjunction/actions-bizapps-lms": "5.39.0",
-    "@memberjunction/actions-bizapps-social": "5.39.0",
-    "@memberjunction/ai": "5.39.0",
-    "@memberjunction/ai-agent-manager": "5.39.0",
-    "@memberjunction/ai-agent-manager-actions": "5.39.0",
-    "@memberjunction/ai-agents": "5.39.0",
-    "@memberjunction/ai-core-plus": "5.39.0",
-    "@memberjunction/ai-mcp-client": "5.39.0",
-    "@memberjunction/ai-prompts": "5.39.0",
-    "@memberjunction/ai-provider-bundle": "5.39.0",
-    "@memberjunction/ai-vector-sync": "5.39.0",
-    "@memberjunction/ai-vectordb": "5.39.0",
-    "@memberjunction/ai-vectors-pinecone": "5.39.0",
-    "@memberjunction/aiengine": "5.39.0",
-    "@memberjunction/api-keys": "5.39.0",
-    "@memberjunction/auth-providers": "5.39.0",
-    "@memberjunction/codegen-lib": "5.39.0",
-    "@memberjunction/communication-ms-graph": "5.39.0",
-    "@memberjunction/communication-sendgrid": "5.39.0",
-    "@memberjunction/communication-types": "5.39.0",
-    "@memberjunction/component-registry-client-sdk": "5.39.0",
-    "@memberjunction/computer-use-engine": "5.39.0",
-    "@memberjunction/config": "5.39.0",
-    "@memberjunction/core": "5.39.0",
-    "@memberjunction/core-actions": "5.39.0",
-    "@memberjunction/core-entities": "5.39.0",
-    "@memberjunction/core-entities-server": "5.39.0",
-    "@memberjunction/data-context": "5.39.0",
-    "@memberjunction/data-context-server": "5.39.0",
-    "@memberjunction/doc-utils": "5.39.0",
-    "@memberjunction/encryption": "5.39.0",
-    "@memberjunction/entity-communications-base": "5.39.0",
-    "@memberjunction/entity-communications-server": "5.39.0",
-    "@memberjunction/external-change-detection": "5.39.0",
-    "@memberjunction/generic-database-provider": "5.39.0",
-    "@memberjunction/global": "5.39.0",
-    "@memberjunction/graphql-dataprovider": "5.39.0",
-    "@memberjunction/integration-engine": "5.39.0",
-    "@memberjunction/integration-progress-artifacts": "5.39.0",
-    "@memberjunction/integration-schema-builder": "5.39.0",
-    "@memberjunction/interactive-component-types": "5.39.0",
-    "@memberjunction/lists": "5.39.0",
-    "@memberjunction/lists-base": "5.39.0",
-    "@memberjunction/notifications": "5.39.0",
-    "@memberjunction/postgresql-dataprovider": "5.39.0",
-    "@memberjunction/queue": "5.39.0",
-    "@memberjunction/redis-provider": "5.39.0",
-    "@memberjunction/scheduling-actions": "5.39.0",
-    "@memberjunction/scheduling-base-types": "5.39.0",
-    "@memberjunction/scheduling-engine": "5.39.0",
-    "@memberjunction/scheduling-engine-base": "5.39.0",
-    "@memberjunction/schema-engine": "5.39.0",
-    "@memberjunction/search-engine": "5.39.0",
-    "@memberjunction/server-extensions-core": "5.39.0",
-    "@memberjunction/skip-types": "5.39.0",
-    "@memberjunction/sql-dialect": "5.39.0",
-    "@memberjunction/sqlserver-dataprovider": "5.39.0",
-    "@memberjunction/storage": "5.39.0",
-    "@memberjunction/tag-engine": "5.39.0",
-    "@memberjunction/tag-engine-base": "5.39.0",
-    "@memberjunction/templates": "5.39.0",
-    "@memberjunction/testing-engine": "5.39.0",
-    "@memberjunction/testing-engine-base": "5.39.0",
-    "@memberjunction/version-history": "5.39.0",
+    "@memberjunction/actions": "5.40.1",
+    "@memberjunction/actions-apollo": "5.40.1",
+    "@memberjunction/actions-base": "5.40.1",
+    "@memberjunction/actions-bizapps-accounting": "5.40.1",
+    "@memberjunction/actions-bizapps-crm": "5.40.1",
+    "@memberjunction/actions-bizapps-formbuilders": "5.40.1",
+    "@memberjunction/actions-bizapps-lms": "5.40.1",
+    "@memberjunction/actions-bizapps-social": "5.40.1",
+    "@memberjunction/ai": "5.40.1",
+    "@memberjunction/ai-agent-manager": "5.40.1",
+    "@memberjunction/ai-agent-manager-actions": "5.40.1",
+    "@memberjunction/ai-agents": "5.40.1",
+    "@memberjunction/ai-core-plus": "5.40.1",
+    "@memberjunction/ai-mcp-client": "5.40.1",
+    "@memberjunction/ai-prompts": "5.40.1",
+    "@memberjunction/ai-provider-bundle": "5.40.1",
+    "@memberjunction/ai-vector-sync": "5.40.1",
+    "@memberjunction/ai-vectordb": "5.40.1",
+    "@memberjunction/ai-vectors-pinecone": "5.40.1",
+    "@memberjunction/aiengine": "5.40.1",
+    "@memberjunction/clustering-engine": "5.40.1",
+    "@memberjunction/api-keys": "5.40.1",
+    "@memberjunction/auth-providers": "5.40.1",
+    "@memberjunction/codegen-lib": "5.40.1",
+    "@memberjunction/communication-engine": "5.40.1",
+    "@memberjunction/communication-ms-graph": "5.40.1",
+    "@memberjunction/communication-sendgrid": "5.40.1",
+    "@memberjunction/communication-types": "5.40.1",
+    "@memberjunction/component-registry-client-sdk": "5.40.1",
+    "@memberjunction/computer-use-engine": "5.40.1",
+    "@memberjunction/config": "5.40.1",
+    "@memberjunction/core": "5.40.1",
+    "@memberjunction/core-actions": "5.40.1",
+    "@memberjunction/core-entities": "5.40.1",
+    "@memberjunction/core-entities-server": "5.40.1",
+    "@memberjunction/data-context": "5.40.1",
+    "@memberjunction/esignature": "5.40.1",
+    "@memberjunction/data-context-server": "5.40.1",
+    "@memberjunction/doc-utils": "5.40.1",
+    "@memberjunction/encryption": "5.40.1",
+    "@memberjunction/entity-communications-base": "5.40.1",
+    "@memberjunction/entity-communications-server": "5.40.1",
+    "@memberjunction/external-change-detection": "5.40.1",
+    "@memberjunction/generic-database-provider": "5.40.1",
+    "@memberjunction/global": "5.40.1",
+    "@memberjunction/graphql-dataprovider": "5.40.1",
+    "@memberjunction/integration-engine": "5.40.1",
+    "@memberjunction/integration-progress-artifacts": "5.40.1",
+    "@memberjunction/integration-schema-builder": "5.40.1",
+    "@memberjunction/interactive-component-types": "5.40.1",
+    "@memberjunction/lists": "5.40.1",
+    "@memberjunction/lists-base": "5.40.1",
+    "@memberjunction/notifications": "5.40.1",
+    "@memberjunction/postgresql-dataprovider": "5.40.1",
+    "@memberjunction/queue": "5.40.1",
+    "@memberjunction/redis-provider": "5.40.1",
+    "@memberjunction/scheduling-actions": "5.40.1",
+    "@memberjunction/scheduling-base-types": "5.40.1",
+    "@memberjunction/scheduling-engine": "5.40.1",
+    "@memberjunction/scheduling-engine-base": "5.40.1",
+    "@memberjunction/schema-engine": "5.40.1",
+    "@memberjunction/search-engine": "5.40.1",
+    "@memberjunction/server-extensions-core": "5.40.1",
+    "@memberjunction/skip-types": "5.40.1",
+    "@memberjunction/sql-dialect": "5.40.1",
+    "@memberjunction/sqlserver-dataprovider": "5.40.1",
+    "@memberjunction/storage": "5.40.1",
+    "@memberjunction/tag-engine": "5.40.1",
+    "@memberjunction/tag-engine-base": "5.40.1",
+    "@memberjunction/templates": "5.40.1",
+    "@memberjunction/testing-engine": "5.40.1",
+    "@memberjunction/testing-engine-base": "5.40.1",
+    "@memberjunction/version-history": "5.40.1",
     "@octokit/auth-app": "^7.1.5",
     "@octokit/rest": "^21.1.1",
     "@types/compression": "^1.8.1",
@@ -114,6 +117,7 @@
     "cosmiconfig": "9.0.0",
     "dotenv": "^17.2.4",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "fast-glob": "^3.3.3",
     "graphql": "^16.12.0",
     "graphql-scalars": "^1.25.0",

package/src/__tests__/magicLink.test.ts

@@ -0,0 +1,387 @@
+import { describe, it, expect } from 'vitest';
+import jwt from 'jsonwebtoken';
+import { createPublicKey } from 'node:crypto';
+import {
+  generateRawToken,
+  hashToken,
+  evaluateInvite,
+  buildSessionClaims,
+  buildConsumeInviteSQL,
+  canIssueInvites,
+  isRoleGrantable,
+  unionScopes,
+  MAGIC_LINK_TOKEN_PREFIX,
+} from '../auth/magicLink/magicLinkCore.js';
+import { buildRedeemLandingHtml, escapeHtml } from '../auth/magicLink/redeemLanding.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+
+describe('magic-link core', () => {
+  describe('generateRawToken', () => {
+    it('prefixes tokens and uses 32 bytes of hex entropy', () => {
+      const t = generateRawToken();
+      expect(t.startsWith(MAGIC_LINK_TOKEN_PREFIX)).toBe(true);
+      const body = t.slice(MAGIC_LINK_TOKEN_PREFIX.length);
+      expect(body).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    it('produces unique tokens', () => {
+      const set = new Set(Array.from({ length: 100 }, () => generateRawToken()));
+      expect(set.size).toBe(100);
+    });
+  });
+
+  describe('hashToken', () => {
+    it('is deterministic and base64url-encoded sha256 (43 chars, URL-safe alphabet)', () => {
+      const raw = 'mj_ml_abc';
+      expect(hashToken(raw)).toBe(hashToken(raw));
+      // base64url of 32 bytes = 43 chars, no padding, only [A-Za-z0-9_-]
+      expect(hashToken(raw)).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    });
+
+    it('differs for different inputs and never equals the raw token', () => {
+      const raw = generateRawToken();
+      expect(hashToken(raw)).not.toBe(hashToken(generateRawToken()));
+      expect(hashToken(raw)).not.toBe(raw);
+    });
+  });
+
+  describe('evaluateInvite', () => {
+    const now = Date.UTC(2026, 0, 1);
+    const future = new Date(now + 3600_000);
+    const past = new Date(now - 3600_000);
+
+    it('accepts an active, unexpired, unused invite', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: true });
+    });
+
+    it('rejects revoked invites first', () => {
+      expect(evaluateInvite({ Status: 'Revoked', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'revoked' });
+    });
+
+    it('rejects expired invites', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: past, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'expired' });
+    });
+
+    it('rejects consumed invites (by status)', () => {
+      expect(evaluateInvite({ Status: 'Consumed', ExpiresAt: future, MaxUses: 1, UseCount: 1 }, now)).toEqual({ ok: false, errorCode: 'consumed' });
+    });
+
+    it('rejects when use count reaches max', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 3, UseCount: 3 }, now)).toEqual({ ok: false, errorCode: 'consumed' });
+    });
+
+    it('allows multi-use invites that still have uses left', () => {
+      expect(evaluateInvite({ Status: 'Active', ExpiresAt: future, MaxUses: 3, UseCount: 2 }, now)).toEqual({ ok: true });
+    });
+
+    it('rejects unknown statuses as invalid', () => {
+      expect(evaluateInvite({ Status: 'Pending', ExpiresAt: future, MaxUses: 1, UseCount: 0 }, now)).toEqual({ ok: false, errorCode: 'invalid' });
+    });
+  });
+
+  describe('buildSessionClaims', () => {
+    it('scopes the token to exactly the given app and role and marks it magic-link', () => {
+      const claims = buildSessionClaims({
+        issuer: 'http://localhost:4051',
+        audience: 'mj-magic-link',
+        inviteId: 'INVITE-1',
+        email: 'ext@client.com',
+        firstName: 'Ext',
+        lastName: 'User',
+        applicationId: 'APP-1',
+        roleName: 'Magic Link Baseline',
+        nowSeconds: 1000,
+        ttlSeconds: 3600,
+      });
+      expect(claims.mj_app_id).toBe('APP-1');
+      expect(claims.mj_role).toBe('Magic Link Baseline');
+      expect(claims.mj_magic_link).toBe(true);
+      expect(claims.sub).toBe('magic-link|INVITE-1');
+      expect(claims.exp - claims.iat).toBe(3600);
+      expect(claims.email).toBe('ext@client.com');
+      expect(claims.name).toBe('Ext User');
+    });
+
+    it('carries mj_invited_by when an inviter is supplied (attribution claim)', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline',
+        invitedByUserId: 'USER-42', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_invited_by).toBe('USER-42');
+    });
+
+    it('omits mj_invited_by when no inviter is supplied', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline',
+        nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_invited_by).toBeUndefined();
+    });
+
+    it('always emits a single-entry mj_scopes for the current link', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_scopes).toEqual([{ inviteId: 'INVITE-1', appId: 'APP-1', role: 'Magic Link Baseline', resourceType: undefined, resourceId: undefined }]);
+    });
+
+    it('marks anonymous sessions and carries the per-session id + prior-scope union', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-2', email: 'anon@x',
+        applicationId: 'APP-2', roleName: 'Guest', anonymous: true, sessionId: 'SID-9',
+        priorScopes: [{ inviteId: 'INVITE-1', appId: 'APP-1', role: 'Guest' }],
+        nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_anon).toBe(true);
+      expect(claims.mj_sid).toBe('SID-9');
+      // union = prior + this link, both apps present, no accretion duplicate
+      expect(claims.mj_scopes?.map((s) => s.appId).sort()).toEqual(['APP-1', 'APP-2']);
+    });
+
+    it('does NOT mark mj_anon for email sessions', () => {
+      const claims = buildSessionClaims({
+        issuer: 'i', audience: 'a', inviteId: 'INVITE-1', email: 'e@x.com',
+        applicationId: 'APP-1', roleName: 'Magic Link Baseline', nowSeconds: 1000, ttlSeconds: 3600,
+      });
+      expect(claims.mj_anon).toBeUndefined();
+    });
+  });
+
+  describe('unionScopes', () => {
+    const a = { inviteId: 'I1', appId: 'A1', role: 'R' };
+    const b = { inviteId: 'I2', appId: 'A2', role: 'R' };
+
+    it('appends a new scope entry', () => {
+      expect(unionScopes([a], b)).toEqual([a, b]);
+    });
+
+    it('is idempotent by inviteId — re-redeeming the same link never accretes a duplicate', () => {
+      expect(unionScopes([a, b], { inviteId: 'I1', appId: 'A1', role: 'R' })).toEqual([a, b]);
+    });
+
+    it('handles an empty/undefined prior union', () => {
+      expect(unionScopes(undefined, a)).toEqual([a]);
+      expect(unionScopes([], a)).toEqual([a]);
+    });
+  });
+
+  describe('buildConsumeInviteSQL', () => {
+    const table = '[__mj].[MagicLinkInvite]';
+    const sql = buildConsumeInviteSQL(table);
+
+    it('targets the supplied qualified table', () => {
+      expect(sql).toContain(`UPDATE ${table} `);
+    });
+
+    it('increments UseCount', () => {
+      expect(sql).toContain('UseCount = UseCount + 1');
+    });
+
+    it('stamps ConsumedAt only the first time (COALESCE preserves an existing value)', () => {
+      expect(sql).toContain('ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME())');
+    });
+
+    it('flips Status to Consumed exactly when the last use is taken', () => {
+      expect(sql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
+    });
+
+    it('returns the affected row via OUTPUT INTO a table var so the caller can detect a win (exactly one row)', () => {
+      // Must be OUTPUT ... INTO, not a bare OUTPUT: SQL Server forbids a bare
+      // OUTPUT clause on a table with enabled triggers, and CodeGen adds an
+      // __mj_UpdatedAt trigger to every MJ table. Regression guard for that bug.
+      expect(sql).toContain('OUTPUT INSERTED.ID INTO @consumed');
+      expect(sql).not.toMatch(/OUTPUT INSERTED\.ID(?!\s+INTO)/);
+      expect(sql).toContain('SELECT ID FROM @consumed');
+    });
+
+    it('guards atomically on Active + not-exhausted + not-expired — this IS the single-use gate', () => {
+      const where = sql.slice(sql.indexOf('WHERE'));
+      expect(where).toContain("Status = 'Active'");
+      expect(where).toContain('UseCount < MaxUses');
+      expect(where).toContain('ExpiresAt > SYSUTCDATETIME()');
+    });
+
+    it('binds the invite ID as a parameter, never interpolated (injection-safe)', () => {
+      expect(sql).toContain('ID = @p0');
+      // The id must not be string-interpolated with quotes around a value.
+      expect(sql).not.toMatch(/ID = '/);
+    });
+
+    it('is a self-contained batch: declare table var, update-with-output, select', () => {
+      // Intentionally a 3-statement batch (the OUTPUT-INTO requirement). The ID is
+      // still parameterized, so the batch carries no interpolated user input.
+      expect(sql).toContain('DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER)');
+      expect(sql.match(/;/g)?.length).toBe(3);
+      expect(sql.trim().endsWith(';')).toBe(true);
+    });
+
+    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
+      // Only bracket-quoted [schema].[table] of word chars is accepted, even though
+      // the caller derives the table from EntityInfo and never from user input.
+      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite')).toThrow();
+      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]; DROP TABLE x;--')).toThrow();
+      expect(() => buildConsumeInviteSQL('[__mj].[Magic Link]')).toThrow();
+      expect(() => buildConsumeInviteSQL(table)).not.toThrow();
+    });
+  });
+
+  describe('canIssueInvites', () => {
+    it('always allows Owners, regardless of issuer-role config (case/space-insensitive)', () => {
+      expect(canIssueInvites('Owner', [], [])).toBe(true);
+      expect(canIssueInvites('  owner ', [], [])).toBe(true);
+    });
+
+    it('Owner-only by default: a non-Owner with no configured issuer roles is denied', () => {
+      expect(canIssueInvites('User', ['Developer', 'Magic Link Baseline'], [])).toBe(false);
+    });
+
+    it('denies an external user holding the restricted role (the escalation we are blocking)', () => {
+      // restricted role is never an issuer role, so this stays false even if someone
+      // mistakenly leaves issuerRoleNames empty
+      expect(canIssueInvites('User', ['Magic Link Baseline'], [])).toBe(false);
+    });
+
+    it('allows a non-Owner only when one of their roles is a configured issuer role', () => {
+      expect(canIssueInvites('User', ['Sales Admin'], ['Sales Admin'])).toBe(true);
+      expect(canIssueInvites('User', ['sales admin'], ['Sales Admin'])).toBe(true); // case-insensitive
+      expect(canIssueInvites('User', ['Marketing'], ['Sales Admin'])).toBe(false);
+    });
+
+    it('handles null/undefined type and empty role lists safely', () => {
+      expect(canIssueInvites(null, [], ['X'])).toBe(false);
+      expect(canIssueInvites(undefined, ['X'], ['X'])).toBe(true);
+    });
+  });
+
+  describe('isRoleGrantable', () => {
+    const restricted = 'Magic Link Baseline';
+
+    it('always allows the restricted role (case/space-insensitive)', () => {
+      expect(isRoleGrantable('Magic Link Baseline', restricted, [])).toBe(true);
+      expect(isRoleGrantable(' magic link baseline ', restricted, [])).toBe(true);
+    });
+
+    it('rejects a privileged role by default — blocks roleId=Owner escalation', () => {
+      expect(isRoleGrantable('Owner', restricted, [])).toBe(false);
+      expect(isRoleGrantable('Administrator', restricted, [])).toBe(false);
+    });
+
+    it('allows additional roles only when explicitly opted in', () => {
+      expect(isRoleGrantable('Read Only Guest', restricted, ['Read Only Guest'])).toBe(true);
+      expect(isRoleGrantable('read only guest', restricted, ['Read Only Guest'])).toBe(true);
+      expect(isRoleGrantable('Owner', restricted, ['Read Only Guest'])).toBe(false);
+    });
+
+    it('rejects empty/null role names', () => {
+      expect(isRoleGrantable('', restricted, [])).toBe(false);
+      expect(isRoleGrantable(null, restricted, [])).toBe(false);
+    });
+  });
+
+  describe('escapeHtml', () => {
+    it('escapes the five significant HTML characters', () => {
+      expect(escapeHtml(`<>&"'`)).toBe('&lt;&gt;&amp;&quot;&#39;');
+    });
+
+    it('leaves a normal magic-link token untouched', () => {
+      const t = generateRawToken();
+      expect(escapeHtml(t)).toBe(t);
+    });
+  });
+
+  describe('buildRedeemLandingHtml', () => {
+    const token = generateRawToken();
+    const html = buildRedeemLandingHtml(token, '/magic-link/redeem');
+
+    it('renders a POST form to the redeem path (GET stays side-effect-free)', () => {
+      expect(html).toContain('method="POST"');
+      expect(html).toContain('action="/magic-link/redeem"');
+    });
+
+    it('carries the token in a hidden field for the click-to-continue submit', () => {
+      expect(html).toContain(`name="token" value="${token}"`);
+    });
+
+    it('requires a human click — it does NOT auto-submit (defeats link scanners)', () => {
+      expect(html).not.toContain('.submit()');
+      expect(html).not.toContain('onload');
+    });
+
+    it('discourages indexing', () => {
+      expect(html).toContain('name="robots"');
+    });
+
+    it('escapes a token containing HTML metacharacters into the form value', () => {
+      const evil = buildRedeemLandingHtml('a"><script>x</script>', '/magic-link/redeem');
+      expect(evil).not.toContain('<script>x</script>');
+      expect(evil).toContain('&lt;script&gt;');
+    });
+  });
+});
+
+describe('MagicLinkKeyManager', () => {
+  it('mints an RS256 token verifiable against the published JWKS, with a matching kid', () => {
+    const km = MagicLinkKeyManager.Instance;
+    km.Initialize(); // ephemeral keypair
+
+    const claims = buildSessionClaims({
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+      inviteId: 'INVITE-1',
+      email: 'ext@client.com',
+      applicationId: 'APP-1',
+      roleName: 'Magic Link Baseline',
+      nowSeconds: Math.floor(Date.now() / 1000),
+      ttlSeconds: 3600,
+    });
+    const token = km.Sign(claims);
+
+    const jwks = km.GetJWKS();
+    expect(jwks.keys).toHaveLength(1);
+    const jwk = jwks.keys[0];
+    expect(jwk.alg).toBe('RS256');
+    expect(jwk.use).toBe('sig');
+
+    // Token header kid must match the published key id (so jwks-rsa resolves it).
+    const header = (jwt.decode(token, { complete: true }) as { header: { kid?: string; alg?: string } }).header;
+    expect(header.alg).toBe('RS256');
+    expect(header.kid).toBe(jwk.kid);
+
+    // Full verification against the public key reconstructed from the JWK.
+    const publicKey = createPublicKey({ key: jwk as object, format: 'jwk' });
+    const decoded = jwt.verify(token, publicKey, {
+      algorithms: ['RS256'],
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+    }) as Record<string, unknown>;
+    expect(decoded.mj_magic_link).toBe(true);
+    expect(decoded.mj_app_id).toBe('APP-1');
+  });
+
+  it('rejects a tampered token', () => {
+    const km = MagicLinkKeyManager.Instance;
+    km.Initialize();
+    const claims = buildSessionClaims({
+      issuer: 'http://localhost:4051',
+      audience: 'mj-magic-link',
+      inviteId: 'INVITE-2',
+      email: 'ext@client.com',
+      applicationId: 'APP-1',
+      roleName: 'Magic Link Baseline',
+      nowSeconds: Math.floor(Date.now() / 1000),
+      ttlSeconds: 3600,
+    });
+    const token = km.Sign(claims);
+    const publicKey = createPublicKey({ key: km.GetJWKS().keys[0] as object, format: 'jwk' });
+
+    // Flip a character in the payload segment.
+    const parts = token.split('.');
+    parts[1] = parts[1].slice(0, -2) + (parts[1].endsWith('A') ? 'BB' : 'AA');
+    const tampered = parts.join('.');
+
+    expect(() => jwt.verify(tampered, publicKey, { algorithms: ['RS256'] })).toThrow();
+  });
+});

package/src/auth/index.ts

@@ -235,13 +235,13 @@ export const verifyUserRecord = async (
           // to init it, including passing in the role list for the user.
           const md: Metadata = new Metadata(); // global-provider-ok: JWT validation + role lookup runs BEFORE AppContext.providers is built — no per-request provider yet
 
-          const initData: MJUserEntityType & { UserRoles: { UserID: string; RoleName: string; RoleID: string }[] } = newUser.GetAll();
+          const initData: MJUserEntityType & { UserRoles: { UserID: string; Role: string; RoleID: string }[] } = newUser.GetAll();
 
           initData.UserRoles = configInfo.userHandling.newUserRoles.map((role) => {
             const roleInfo: RoleInfo | undefined = md.Roles.find((r) => r.Name === role);
             const roleID: string = roleInfo ? roleInfo.ID : '';
 
-            return { UserID: initData.ID, RoleName: role, RoleID: roleID };
+            return { UserID: initData.ID, Role: role, RoleID: roleID };
           });
 
           user = new UserInfo(Metadata.Provider, initData); // global-provider-ok: same JWT-validation context — no per-request provider yet