@memberjunction/server 5.48.0 → 5.49.0

package/src/__tests__/EntityMapLifecycle.dagWarnings.test.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest';
+import { ComputeCascadeRemovalSet, ComputeRemovedDependencyWarnings } from '../integration/EntityMapLifecycle.js';
+
+/**
+ * rsuplan "adding and removing tables": removing a table another table relies on must NOT
+ * auto-remove the dependent — the broken edge is surfaced as a warning so a consumer can
+ * prompt a force-remove (or re-add). These tests pin the pure decision function.
+ */
+describe('ComputeRemovedDependencyWarnings', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],          // Orders depends on Customers
+        ['orderitems', ['Orders', 'Products']],
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('warns for each still-active object that depends on a removed object', () => {
+        const w = ComputeRemovedDependencyWarnings(['Orders', 'OrderItems', 'Products'], ['Customers'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Customers'");
+        expect(w[0]).toContain('force-remove');
+    });
+
+    it('lists every removed parent an active object depends on', () => {
+        const w = ComputeRemovedDependencyWarnings(['OrderItems'], ['Orders', 'Products'], parents);
+        expect(w).toHaveLength(1);
+        expect(w[0]).toContain("'Orders'");
+        expect(w[0]).toContain("'Products'");
+    });
+
+    it('is case-insensitive on both sides of the edge', () => {
+        const w = ComputeRemovedDependencyWarnings(['ORDERS'], ['customers'], parents);
+        expect(w).toHaveLength(1);
+    });
+
+    it('returns nothing when no active object depends on a removed one (leaf removal is clean)', () => {
+        expect(ComputeRemovedDependencyWarnings(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('returns nothing when nothing was removed or nothing remains active', () => {
+        expect(ComputeRemovedDependencyWarnings(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeRemovedDependencyWarnings([], ['Customers'], parents)).toEqual([]);
+    });
+
+    it('tolerates objects absent from the dependency map (no persisted IO row)', () => {
+        expect(ComputeRemovedDependencyWarnings(['UnknownThing'], ['Customers'], parents)).toEqual([]);
+    });
+});
+
+/**
+ * rsuplan force-remove: "a consumer may want the user to force remove those too" — the
+ * transitive closure of dependents that cascades with a removed object when the caller opts in.
+ */
+describe('ComputeCascadeRemovalSet', () => {
+    const parents = new Map<string, string[]>([
+        ['orders', ['Customers']],
+        ['orderitems', ['Orders', 'Products']],
+        ['shipments', ['OrderItems']],          // 3 levels deep
+        ['customers', []],
+        ['products', []],
+    ]);
+
+    it('cascades direct dependents of a removed object', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'Products', 'Customers'], ['Products'], parents);
+        // Orders depends on Customers (kept) — only OrderItems-style dependents of Products cascade;
+        // here Orders does NOT depend on Products, so nothing cascades except true dependents.
+        expect(c).toEqual([]);
+    });
+
+    it('cascades the FULL transitive closure (removed → dependent → its dependent …)', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems', 'Shipments', 'Products'], ['Customers'], parents);
+        // Customers removed → Orders cascades → OrderItems (depends on Orders) → Shipments (depends on OrderItems)
+        expect(c).toEqual(['Orders', 'OrderItems', 'Shipments']);
+    });
+
+    it('is case-insensitive across edges', () => {
+        const c = ComputeCascadeRemovalSet(['ORDERS'], ['customers'], parents);
+        expect(c).toEqual(['ORDERS']);
+    });
+
+    it('returns nothing when nothing was removed or nothing depends on the removed', () => {
+        expect(ComputeCascadeRemovalSet(['Orders'], [], parents)).toEqual([]);
+        expect(ComputeCascadeRemovalSet(['Customers', 'Products'], ['Orders'], parents)).toEqual([]);
+    });
+
+    it('never cascades an object that is itself already removed', () => {
+        const c = ComputeCascadeRemovalSet(['Orders', 'OrderItems'], ['Customers', 'Orders'], parents);
+        expect(c).toEqual(['OrderItems']); // Orders already in the removed set — not double-listed
+    });
+});

package/src/__tests__/OAuthCallbackHandler.xss.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import type express from 'express';
+import { OAuthCallbackHandler } from '../rest/OAuthCallbackHandler.js';
+
+/**
+ * These tests verify that query-string-derived values interpolated into the OAuth
+ * success/error HTML pages are HTML-escaped, preventing reflected XSS (audit bug B6).
+ *
+ * The page renderers are private, so we reach them through a narrowly-typed view of
+ * the instance using the codebase's established `as unknown as` double-assertion pattern.
+ */
+interface PageRenderer {
+    handleSuccessPage(req: express.Request, res: express.Response): void;
+    handleErrorPage(req: express.Request, res: express.Response): void;
+    escapeHtml(value: string): string;
+}
+
+function makeRenderer(): PageRenderer {
+    const handler = new OAuthCallbackHandler({ publicUrl: 'https://example.test' });
+    return handler as unknown as PageRenderer;
+}
+
+/** Minimal Express request/response doubles that capture the rendered body. */
+function makeReqRes(query: Record<string, string>): {
+    req: express.Request;
+    res: express.Response;
+    getBody: () => string;
+} {
+    let body = '';
+    const res = {
+        status(): express.Response {
+            return res as unknown as express.Response;
+        },
+        send(html: string): express.Response {
+            body = html;
+            return res as unknown as express.Response;
+        }
+    };
+    return {
+        req: { query } as unknown as express.Request,
+        res: res as unknown as express.Response,
+        getBody: () => body
+    };
+}
+
+describe('OAuthCallbackHandler escapeHtml', () => {
+    it('neutralizes <script>, quotes, and ampersands', () => {
+        const renderer = makeRenderer();
+        const escaped = renderer.escapeHtml(`<script>alert("x")&'y'</script>`);
+        expect(escaped).toBe('&lt;script&gt;alert(&quot;x&quot;)&amp;&#39;y&#39;&lt;/script&gt;');
+        expect(escaped).not.toContain('<script>');
+    });
+
+    it('escapes & first so no double-encoding occurs', () => {
+        const renderer = makeRenderer();
+        expect(renderer.escapeHtml('&lt;')).toBe('&amp;lt;');
+    });
+});
+
+describe('OAuthCallbackHandler reflected-XSS protection', () => {
+    it('escapes a malicious connectionId on the success page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({ connectionId: '<script>alert(1)</script>' });
+        renderer.handleSuccessPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<script>alert(1)</script>');
+        expect(body).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
+    });
+
+    it('escapes malicious error code and description on the error page', () => {
+        const renderer = makeRenderer();
+        const { req, res, getBody } = makeReqRes({
+            error: '"><img src=x onerror=alert(1)>',
+            error_description: `</div><script>evil()</script>`
+        });
+        renderer.handleErrorPage(req, res);
+        const body = getBody();
+        expect(body).not.toContain('<img src=x onerror=alert(1)>');
+        expect(body).not.toContain('<script>evil()</script>');
+        expect(body).toContain('&lt;img src=x onerror=alert(1)&gt;');
+        expect(body).toContain('&lt;script&gt;evil()&lt;/script&gt;');
+    });
+});

package/src/__tests__/RealtimeProxyServer.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import type { IncomingMessage } from 'node:http';
 import type { Duplex } from 'node:stream';
 import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
@@ -68,3 +68,55 @@ describe('RealtimeProxyServer.TryHandleUpgrade', () => {
         expect(fake.Destroyed).toBe(true); // already consumed → treated as invalid
     });
 });
+
+describe('C3: Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS)', () => {
+    const ENV_KEY = 'MJ_REALTIME_PROXY_ALLOWED_ORIGINS';
+    let saved: string | undefined;
+    let proxy: RealtimeProxyServer;
+
+    beforeEach(() => {
+        proxy = RealtimeProxyServer.Instance;
+        saved = process.env[ENV_KEY];
+    });
+    afterEach(() => {
+        if (saved === undefined) delete process.env[ENV_KEY];
+        else process.env[ENV_KEY] = saved;
+    });
+
+    function reqWithOrigin(url: string, origin?: string): IncomingMessage {
+        return { url, headers: origin ? { origin } : {} } as unknown as IncomingMessage;
+    }
+
+    it('no allowlist configured → prior behavior (origin irrelevant, ticket governs)', () => {
+        delete process.env[ENV_KEY];
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://evil.example'), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written.join('')).toContain('401'); // fell through to the ticket check
+    });
+
+    it('rejects a FOREIGN browser origin with 403 BEFORE consuming the ticket', () => {
+        process.env[ENV_KEY] = 'https://app.example.com, https://portal.example.com';
+        const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://internal:8000/v1/realtime', TTLSeconds: 60 });
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`, 'https://evil.example'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('403');
+        // The ticket SURVIVED the rejected foreign attempt — the legitimate page can still connect.
+        expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
+    });
+
+    it('accepts an allowlisted origin (normalization: case + trailing slash)', () => {
+        process.env[ENV_KEY] = 'https://App.Example.com/';
+        const fake = new FakeSocket();
+        // Unknown ticket → passes the origin gate, fails the ticket check with 401 (NOT 403).
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`, 'https://app.example.com'), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401');
+    });
+
+    it('an upgrade WITHOUT an Origin header (non-browser client) passes the gate', () => {
+        process.env[ENV_KEY] = 'https://app.example.com';
+        const fake = new FakeSocket();
+        proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=nope`), sock(fake), HEAD);
+        expect(fake.Written.join('')).toContain('401'); // ticket check, not the origin gate
+    });
+});

package/src/__tests__/adhoc-query-helpers.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { exactTotalFromPage, resolveAdhocTotalRowCount } from '../resolvers/adhoc-query-helpers';
+
+describe('exactTotalFromPage', () => {
+    it('returns the row count when not paging (maxRows null) — the query was uncapped', () => {
+        expect(exactTotalFromPage(0, 47, null)).toBe(47);
+        expect(exactTotalFromPage(0, 0, null)).toBe(0);
+    });
+
+    it('returns startRow + pageLength for a SHORT page (fewer rows than the page size)', () => {
+        expect(exactTotalFromPage(0, 47, 100)).toBe(47);   // page 1, short → exact total
+        expect(exactTotalFromPage(200, 30, 100)).toBe(230); // page 3, short last page
+        expect(exactTotalFromPage(100, 0, 100)).toBe(100);  // empty page past the end
+    });
+
+    it('returns null for a FULL page — a COUNT is required because more rows may exist', () => {
+        expect(exactTotalFromPage(0, 100, 100)).toBeNull();
+        expect(exactTotalFromPage(500, 100, 100)).toBeNull();
+    });
+
+    it('treats an over-full page defensively as "needs count" (should not occur with OFFSET/FETCH)', () => {
+        expect(exactTotalFromPage(0, 150, 100)).toBeNull();
+    });
+});
+
+describe('resolveAdhocTotalRowCount', () => {
+    it('reads TotalRowCount from the count recordset', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 2087 }], 100)).toBe(2087);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 0 }], 100)).toBe(0);
+    });
+
+    it('floors a fractional/stringified count', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 42.9 }], 0)).toBe(42);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: '2087' as unknown as number }], 0)).toBe(2087);
+    });
+
+    it('falls back when the count is absent, empty, null, or malformed', () => {
+        expect(resolveAdhocTotalRowCount(null, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount(undefined, 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{}], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: null }], 100)).toBe(100);
+    });
+
+    it('falls back on non-finite or negative counts (never reports a misleading total)', () => {
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Number.NaN }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: -5 }], 100)).toBe(100);
+        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Infinity }], 100)).toBe(100);
+    });
+});

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// this suite only exercises provisioning's console-log behavior, so
+// @memberjunction/core (the logging implementation) stays real.
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+
+/** Minimal BaseEntity stand-in: NewRecord/Save/GetAll plus writable fields. */
+interface MockEntity {
+  NewRecord: () => void;
+  Save: () => Promise<boolean>;
+  GetAll: () => Record<string, unknown>;
+  LatestResult?: { CompleteMessage: string };
+  [field: string]: unknown;
+}
+
+function makeMockEntity(id: string): MockEntity {
+  const entity: MockEntity = {
+    NewRecord: () => {
+      entity.ID = id;
+    },
+    Save: async () => true,
+    GetAll: () => ({
+      ID: entity.ID,
+      Name: entity.Name,
+      Email: entity.Email,
+      FirstName: entity.FirstName,
+      LastName: entity.LastName,
+    }),
+  };
+  return entity;
+}
+
+describe('MagicLinkService provisioning log policy', () => {
+  const originalVerbose = process.env.MJ_VERBOSE;
+  let service: MagicLinkService;
+  let invite: MJMagicLinkInviteEntity;
+  let role: RoleInfo;
+  let contextUser: UserInfo;
+
+  beforeEach(() => {
+    const provider = {
+      BeginTransaction: async () => undefined,
+      CommitTransaction: async () => undefined,
+      RollbackTransaction: async () => undefined,
+      GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
+    };
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    invite = {
+      Email: 'guest@example.com',
+      RoleID: 'role-1',
+      ApplicationID: 'app-1',
+    } as unknown as MJMagicLinkInviteEntity;
+    role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+    contextUser = { ID: 'ctx-user' } as UserInfo;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+    if (originalVerbose === undefined) {
+      delete process.env.MJ_VERBOSE;
+    } else {
+      process.env.MJ_VERBOSE = originalVerbose;
+    }
+  });
+
+  async function provisionAndCollectLogs(): Promise<{ success: boolean; provisionLines: string[] }> {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const result = await service['createScopedUser'](invite, role, contextUser);
+    const provisionLines = logSpy.mock.calls
+      .map((call) => String(call[0]))
+      .filter((line) => line.includes('[MagicLink] Provisioned'));
+    return { success: result.success, provisionLines };
+  }
+
+  // Deliberate policy (do not verbose-gate this like the startup notices in 2ddb865e40):
+  // magic-link redemption provisioning a new external account is a security-relevant
+  // event and must stay visible in the DEFAULT server log, so operators see the vector
+  // being exercised without needing MJ_VERBOSE.
+  it('emits the provisioned-user notice on the default (non-verbose) server log', async () => {
+    delete process.env.MJ_VERBOSE;
+    const { success, provisionLines } = await provisionAndCollectLogs();
+    expect(success).toBe(true);
+    expect(provisionLines).toHaveLength(1);
+    expect(provisionLines[0]).toContain("guest@example.com with role 'External Guest'");
+  });
+});

package/src/__tests__/media-upgrade-router.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest';
+import { IsGraphQLWsPath } from '../telephony/media-upgrade-router.js';
+
+describe('IsGraphQLWsPath', () => {
+    describe('bare-root default (GRAPHQL_ROOT_PATH unset — the stock-install case)', () => {
+        it('accepts an exact match on the bare root', () => {
+            expect(IsGraphQLWsPath('/', '/')).toBe(true);
+        });
+
+        it('accepts the conventional /graphql suffix as an alias of the bare root', () => {
+            // This is the fix: MJExplorer's shipped environment.ts hardcodes
+            // GRAPHQL_WS_URI: 'ws://<host>/graphql', which never matched the server's
+            // bare-root default before this alias existed — every subscription upgrade
+            // was silently rejected (400) on a stock install with no .env overrides.
+            expect(IsGraphQLWsPath('/graphql', '/')).toBe(true);
+        });
+
+        it('rejects an unrelated path', () => {
+            expect(IsGraphQLWsPath('/telephony/twilio/media', '/')).toBe(false);
+        });
+
+        it('rejects a path that merely starts with /graphql (no accidental prefix match)', () => {
+            expect(IsGraphQLWsPath('/graphql-admin', '/')).toBe(false);
+        });
+    });
+
+    describe('non-default configured root (custom GRAPHQL_ROOT_PATH — unchanged behavior)', () => {
+        it('accepts an exact match on the configured root', () => {
+            expect(IsGraphQLWsPath('/api/graphql', '/api/graphql')).toBe(true);
+        });
+
+        it('does NOT apply the /graphql alias when the configured root is not the bare root', () => {
+            // The alias is scoped to the bare-root default only — a deployment that has
+            // deliberately set a custom root keeps requiring an exact match, so this
+            // fix can't silently widen what a custom-configured server accepts.
+            expect(IsGraphQLWsPath('/graphql', '/api/graphql')).toBe(false);
+        });
+
+        it('rejects a mismatched custom path', () => {
+            expect(IsGraphQLWsPath('/', '/api/graphql')).toBe(false);
+        });
+    });
+});

package/src/__tests__/unifiedAuth.test.ts

@@ -258,9 +258,11 @@ describe('createUnifiedAuthMiddleware', () => {
   });
 
   describe('Authentication failures', () => {
-    it('should return 401 when no authorization header is provided', async () => {
+    it('should return 401 when no authorization header is provided, quietly (no stack-trace log)', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
       // No auth header → empty bearer token → empty token after strip → "Missing token"
       const req = makeMockReq({ headers: {} });
       const res = makeMockRes();
@@ -270,7 +272,14 @@ describe('createUnifiedAuthMiddleware', () => {
 
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
-      expect(res._json).toEqual({ error: 'Authentication failed' });
+      expect(res._json).toEqual({ error: 'Authentication required' });
+      // An anonymous/unauthenticated request (health check, CORS-preflight-adjacent probe,
+      // a client mid-handshake) is routine — it must NOT log a warning or a stack trace.
+      // Same treatment as the existing TokenExpiredError branch.
+      expect(warnSpy).not.toHaveBeenCalled();
+      expect(errorSpy).not.toHaveBeenCalled();
+      warnSpy.mockRestore();
+      errorSpy.mockRestore();
     });
 
     it('should return 401 with JWT_EXPIRED code for expired tokens', async () => {
@@ -301,10 +310,11 @@ describe('createUnifiedAuthMiddleware', () => {
       });
     });
 
-    it('should return 401 when jwt.decode returns null (corrupt token)', async () => {
+    it('should return 401 when jwt.decode returns null (corrupt token), and still log it in full', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
       mockJwtDecode.mockReturnValue(null);
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
 
       const req = makeMockReq({
         headers: { authorization: 'Bearer corrupt-token' },
@@ -317,6 +327,11 @@ describe('createUnifiedAuthMiddleware', () => {
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
       expect(res._json).toEqual({ error: 'Authentication failed' });
+      // Unlike a bare "no credentials supplied" request, a token that IS present but
+      // fails to decode is worth a human's attention — the quiet path above is scoped
+      // to the "Missing token" case only, not a blanket suppression of auth logging.
+      expect(errorSpy).toHaveBeenCalledWith('Auth error:', expect.any(Error));
+      errorSpy.mockRestore();
     });
 
     it('should return 401 when verifyUserRecord returns null', async () => {

package/src/auth/magicLink/MagicLinkKeys.ts

@@ -10,7 +10,7 @@
  */
 
 import { BaseSingleton } from '@memberjunction/global';
-import { LogStatus } from '@memberjunction/core';
+import { LogStatusEx } from '@memberjunction/core';
 import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash, type KeyObject } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 import type { MagicLinkJWTClaims } from './types.js';
@@ -69,11 +69,17 @@ export class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManager> {
     } else {
       const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
       priv = privateKey;
-      LogStatus(
-        '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
-        'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
-        '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.'
-      );
+      // Verbose-only: on dev boxes with no configured key this fires on EVERY boot, and the
+      // ephemeral fallback is the designed behavior there — not a condition worth a log line in
+      // the default startup output. Deployments that care set the key; operators diagnosing
+      // magic-link session loss can re-run with verbose logging.
+      LogStatusEx({
+        message:
+          '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+          'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+          '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
+        verboseOnly: true
+      });
     }
 
     this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' }) as string;

package/src/auth/magicLink/MagicLinkRouter.ts

@@ -10,7 +10,7 @@
 
 import { Router, json, urlencoded, type Request, type Response } from 'express';
 import { rateLimit } from 'express-rate-limit';
-import { LogError, LogStatus, type AuthProviderConfig } from '@memberjunction/core';
+import { LogError, LogStatus, LogStatusEx, type AuthProviderConfig } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { configInfo, type MagicLinkConfig } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
@@ -219,7 +219,7 @@ export function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLi
     }
     const factory = AuthProviderFactory.Instance;
     factory.register(AuthProviderFactory.createProvider(providerConfig));
-    LogStatus(`[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`);
+    LogStatusEx({ message: `[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`, verboseOnly: true });
   } catch (e) {
     LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
   }

package/src/auth/magicLink/MagicLinkService.ts

@@ -549,6 +549,10 @@ export class MagicLinkService {
       // resolves this user without a full cache refresh.
       this.pushUserToCache(user, role);
 
+      // Deliberately NOT verbose-gated, unlike the MagicLink startup notices (2ddb865e40):
+      // provisioning a new external account via magic-link redemption is a security-relevant
+      // event that belongs in the default server log. At-scale deployments can revisit
+      // tapering this if volume ever makes it noise.
       LogStatus(`[MagicLink] Provisioned external user ${email} with role '${role.Name}'.`);
       return { success: true, userId: user.ID, email, firstName, lastName };
     } catch (txErr) {

package/src/config.ts

@@ -212,6 +212,18 @@ const corsSchema = z.object({
   maxAge: z.number().default(86400),
 });
 
+const startupSchema = z.object({
+  /**
+   * Startup mode for engine pre-warm: 'full' (all @RegisterForStartup engines run at boot —
+   * the right choice for MJAPI) or 'task' (no engines pre-warm; everything lazy-loads on
+   * first touch — the right choice for short-lived CLI/script processes). Because
+   * mj.config.cjs is shared by every process in a repo, this can be overridden per
+   * invocation via the MJ_STARTUP_MODE env var (highest precedence) or programmatically
+   * by each entry point. Unset ⇒ each entry point's own default applies.
+   */
+  mode: z.enum(['full', 'task']).optional(),
+});
+
 const rateLimitSchema = z.object({
   /** Master switch — when false (default), no rate limiting is applied. */
   enabled: z.boolean().default(false),
@@ -498,6 +510,7 @@ const configInfoSchema = z.object({
   feedbackSettings: feedbackSettingsSchema.optional().default({}),
   cors: corsSchema.optional().default({}),
   rateLimiting: rateLimitSchema.optional().default({}),
+  startup: startupSchema.optional().default({}),
 
   apiKey: z.string().optional(),
   baseUrl: z.string().default('http://localhost'),
@@ -556,6 +569,7 @@ export type FeedbackGithubSettingsConfig = z.infer<typeof feedbackGithubSettings
 export type FeedbackSettingsConfig = z.infer<typeof feedbackSettingsSchema>;
 export type CorsConfig = z.infer<typeof corsSchema>;
 export type RateLimitConfig = z.infer<typeof rateLimitSchema>;
+export type StartupConfig = z.infer<typeof startupSchema>;
 export type ConfigInfo = z.infer<typeof configInfoSchema>;
 
 /**

package/src/context.ts

@@ -436,7 +436,10 @@ export const getUserPayload = async (
     const token = bearerToken.replace('Bearer ', '');
 
     if (!token) {
-      console.warn('No token to validate');
+      // No log here — an anonymous/unauthenticated request is routine (a health check, a
+      // CORS preflight-adjacent probe, a client that hasn't finished its auth handshake
+      // yet), not exceptional. `createUnifiedAuthMiddleware`'s catch block below is the
+      // single place that decides how (and whether) to log this — same as `TokenExpiredError`.
       throw new AuthenticationError('Missing token');
     }
 
@@ -512,12 +515,24 @@ export const getUserPayload = async (
 
     return { userRecord: sessionUser, email: sessionUser.Email, sessionId };
   } catch (error) {
-    console.error(error);
+    // An anonymous request presenting no credentials at all (a health check, a CORS
+    // preflight-adjacent probe, a client mid-handshake) is routine, same as an expired
+    // long-lived session — neither is a bug worth a raw console dump here. Both still
+    // propagate (audited below, in the "missing token" case) so the single call site
+    // that actually decides final logging/response policy — createUnifiedAuthMiddleware's
+    // catch block — sees the real error instead of a generic, indistinguishable one.
+    const isMissingToken = error instanceof Error && error.message === 'Missing token';
+    if (!(error instanceof TokenExpiredError) && !isMissingToken) {
+      console.error(error);
+    }
     if (error instanceof TokenExpiredError) {
       throw error; // expected for long-lived sessions; not a failure worth auditing
     }
     // Best-effort failure audit (token scanning / brute-force signal). Never blocks auth.
     void auditLoginFailure(bearerToken, error, requestContext, requestDomain);
+    if (isMissingToken) {
+      throw error; // preserve the original message — see comment above
+    }
     throw new AuthenticationError('Unable to authenticate user');
   }
 };
@@ -632,6 +647,17 @@ export function createUnifiedAuthMiddleware(
         });
         return;
       }
+      // An unauthenticated request presenting no credentials at all is routine (health
+      // checks, CORS preflight-adjacent probes, a client mid-handshake) — same category as
+      // TokenExpiredError above, not a bug to surface with a full stack trace. Anything else
+      // (a malformed/tampered token, an invalid system API key) is still logged in full below,
+      // since those ARE worth a human's attention. Checked by message rather than
+      // `instanceof AuthenticationError` — `type-graphql`'s class can resolve to a distinct
+      // copy across module/bundler boundaries, where `instanceof` silently never matches.
+      if (error instanceof Error && error.message === 'Missing token') {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+      }
       console.error('Auth error:', error);
       res.status(401).json({ error: 'Authentication failed' });
     }