@memberjunction/server 5.47.0 → 5.49.0

package/src/auth/magicLink/MagicLinkKeys.ts

@@ -10,7 +10,7 @@
  */
 
 import { BaseSingleton } from '@memberjunction/global';
-import { LogStatus } from '@memberjunction/core';
+import { LogStatusEx } from '@memberjunction/core';
 import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash, type KeyObject } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 import type { MagicLinkJWTClaims } from './types.js';
@@ -69,11 +69,17 @@ export class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManager> {
     } else {
       const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
       priv = privateKey;
-      LogStatus(
-        '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
-        'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
-        '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.'
-      );
+      // Verbose-only: on dev boxes with no configured key this fires on EVERY boot, and the
+      // ephemeral fallback is the designed behavior there — not a condition worth a log line in
+      // the default startup output. Deployments that care set the key; operators diagnosing
+      // magic-link session loss can re-run with verbose logging.
+      LogStatusEx({
+        message:
+          '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+          'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+          '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
+        verboseOnly: true
+      });
     }
 
     this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' }) as string;

package/src/auth/magicLink/MagicLinkRouter.ts

@@ -10,7 +10,7 @@
 
 import { Router, json, urlencoded, type Request, type Response } from 'express';
 import { rateLimit } from 'express-rate-limit';
-import { LogError, LogStatus, type AuthProviderConfig } from '@memberjunction/core';
+import { LogError, LogStatus, LogStatusEx, type AuthProviderConfig } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { configInfo, type MagicLinkConfig } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
@@ -219,7 +219,7 @@ export function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLi
     }
     const factory = AuthProviderFactory.Instance;
     factory.register(AuthProviderFactory.createProvider(providerConfig));
-    LogStatus(`[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`);
+    LogStatusEx({ message: `[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`, verboseOnly: true });
   } catch (e) {
     LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
   }

package/src/auth/magicLink/MagicLinkService.ts

@@ -549,6 +549,10 @@ export class MagicLinkService {
       // resolves this user without a full cache refresh.
       this.pushUserToCache(user, role);
 
+      // Deliberately NOT verbose-gated, unlike the MagicLink startup notices (2ddb865e40):
+      // provisioning a new external account via magic-link redemption is a security-relevant
+      // event that belongs in the default server log. At-scale deployments can revisit
+      // tapering this if volume ever makes it noise.
       LogStatus(`[MagicLink] Provisioned external user ${email} with role '${role.Name}'.`);
       return { success: true, userId: user.ID, email, firstName, lastName };
     } catch (txErr) {

package/src/config.ts

@@ -212,6 +212,18 @@ const corsSchema = z.object({
   maxAge: z.number().default(86400),
 });
 
+const startupSchema = z.object({
+  /**
+   * Startup mode for engine pre-warm: 'full' (all @RegisterForStartup engines run at boot —
+   * the right choice for MJAPI) or 'task' (no engines pre-warm; everything lazy-loads on
+   * first touch — the right choice for short-lived CLI/script processes). Because
+   * mj.config.cjs is shared by every process in a repo, this can be overridden per
+   * invocation via the MJ_STARTUP_MODE env var (highest precedence) or programmatically
+   * by each entry point. Unset ⇒ each entry point's own default applies.
+   */
+  mode: z.enum(['full', 'task']).optional(),
+});
+
 const rateLimitSchema = z.object({
   /** Master switch — when false (default), no rate limiting is applied. */
   enabled: z.boolean().default(false),
@@ -498,6 +510,7 @@ const configInfoSchema = z.object({
   feedbackSettings: feedbackSettingsSchema.optional().default({}),
   cors: corsSchema.optional().default({}),
   rateLimiting: rateLimitSchema.optional().default({}),
+  startup: startupSchema.optional().default({}),
 
   apiKey: z.string().optional(),
   baseUrl: z.string().default('http://localhost'),
@@ -556,6 +569,7 @@ export type FeedbackGithubSettingsConfig = z.infer<typeof feedbackGithubSettings
 export type FeedbackSettingsConfig = z.infer<typeof feedbackSettingsSchema>;
 export type CorsConfig = z.infer<typeof corsSchema>;
 export type RateLimitConfig = z.infer<typeof rateLimitSchema>;
+export type StartupConfig = z.infer<typeof startupSchema>;
 export type ConfigInfo = z.infer<typeof configInfoSchema>;
 
 /**

package/src/context.ts

@@ -436,7 +436,10 @@ export const getUserPayload = async (
     const token = bearerToken.replace('Bearer ', '');
 
     if (!token) {
-      console.warn('No token to validate');
+      // No log here — an anonymous/unauthenticated request is routine (a health check, a
+      // CORS preflight-adjacent probe, a client that hasn't finished its auth handshake
+      // yet), not exceptional. `createUnifiedAuthMiddleware`'s catch block below is the
+      // single place that decides how (and whether) to log this — same as `TokenExpiredError`.
       throw new AuthenticationError('Missing token');
     }
 
@@ -512,12 +515,24 @@ export const getUserPayload = async (
 
     return { userRecord: sessionUser, email: sessionUser.Email, sessionId };
   } catch (error) {
-    console.error(error);
+    // An anonymous request presenting no credentials at all (a health check, a CORS
+    // preflight-adjacent probe, a client mid-handshake) is routine, same as an expired
+    // long-lived session — neither is a bug worth a raw console dump here. Both still
+    // propagate (audited below, in the "missing token" case) so the single call site
+    // that actually decides final logging/response policy — createUnifiedAuthMiddleware's
+    // catch block — sees the real error instead of a generic, indistinguishable one.
+    const isMissingToken = error instanceof Error && error.message === 'Missing token';
+    if (!(error instanceof TokenExpiredError) && !isMissingToken) {
+      console.error(error);
+    }
     if (error instanceof TokenExpiredError) {
       throw error; // expected for long-lived sessions; not a failure worth auditing
     }
     // Best-effort failure audit (token scanning / brute-force signal). Never blocks auth.
     void auditLoginFailure(bearerToken, error, requestContext, requestDomain);
+    if (isMissingToken) {
+      throw error; // preserve the original message — see comment above
+    }
     throw new AuthenticationError('Unable to authenticate user');
   }
 };
@@ -632,6 +647,17 @@ export function createUnifiedAuthMiddleware(
         });
         return;
       }
+      // An unauthenticated request presenting no credentials at all is routine (health
+      // checks, CORS preflight-adjacent probes, a client mid-handshake) — same category as
+      // TokenExpiredError above, not a bug to surface with a full stack trace. Anything else
+      // (a malformed/tampered token, an invalid system API key) is still logged in full below,
+      // since those ARE worth a human's attention. Checked by message rather than
+      // `instanceof AuthenticationError` — `type-graphql`'s class can resolve to a distinct
+      // copy across module/bundler boundaries, where `instanceof` silently never matches.
+      if (error instanceof Error && error.message === 'Missing token') {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+      }
       console.error('Auth error:', error);
       res.status(401).json({ error: 'Authentication failed' });
     }
@@ -705,7 +731,12 @@ async function createPerRequestProviders(
     { provider: p, type: 'Read-Write' }
   ];
 
-  if (!isPostgres) {
+  if (isPostgres) {
+    const rp = await tryCreateReadOnlyPostgresProvider();
+    if (rp) {
+      providers.push({ provider: rp, type: 'Read-Only' });
+    }
+  } else {
     const rp = await tryCreateReadOnlyProvider(dataSources);
     if (rp) {
       providers.push({ provider: rp, type: 'Read-Only' });
@@ -748,6 +779,46 @@ async function createPostgresProvider(): Promise<DatabaseProviderBase> {
   return pgProvider;
 }
 
+/**
+ * Attempts to create a read-only PostgreSQL provider using DB_READ_ONLY_USERNAME/PASSWORD.
+ * Shares the connection pool from the primary provider. Returns null if no read-only credentials are configured.
+ */
+async function tryCreateReadOnlyPostgresProvider(): Promise<DatabaseProviderBase | null> {
+  const roUser = process.env.PG_READ_ONLY_USERNAME || process.env.DB_READ_ONLY_USERNAME;
+  const roPass = process.env.PG_READ_ONLY_PASSWORD || process.env.DB_READ_ONLY_PASSWORD;
+  if (!roUser || !roPass) {
+    return null;
+  }
+
+  try {
+    const { PostgreSQLDataProvider, PostgreSQLProviderConfigData } = await import('@memberjunction/postgresql-dataprovider');
+    const pgHost = process.env.PG_HOST || process.env.DB_HOST || 'localhost';
+    const pgPort = parseInt(process.env.PG_PORT || process.env.DB_PORT || '5432', 10);
+    const pgDatabase = process.env.PG_DATABASE || process.env.DB_DATABASE || '';
+
+    const roProvider = new PostgreSQLDataProvider();
+    const roConfig = new PostgreSQLProviderConfigData(
+      { Host: pgHost, Port: pgPort, Database: pgDatabase, User: roUser, Password: roPass },
+      mj_core_schema,
+      0,
+      undefined,
+      undefined,
+      false,
+    );
+
+    const primaryProvider = Metadata.Provider as unknown as { DatabaseConnection?: import('pg').Pool }; // global-provider-ok: bootstrap (share primary provider's PG pool with the read-only provider)
+    if (primaryProvider?.DatabaseConnection) {
+      await roProvider.ConfigWithSharedPool(roConfig, primaryProvider.DatabaseConnection);
+    } else {
+      await roProvider.Config(roConfig);
+    }
+
+    return roProvider;
+  } catch (_err) {
+    return null;
+  }
+}
+
 /**
  * Attempts to create a read-only SQL Server provider.
  * Returns null if no read-only data source is available.