@memberjunction/server 5.48.0 → 5.50.0

package/src/__tests__/unifiedAuth.test.ts

@@ -258,9 +258,11 @@ describe('createUnifiedAuthMiddleware', () => {
   });
 
   describe('Authentication failures', () => {
-    it('should return 401 when no authorization header is provided', async () => {
+    it('should return 401 when no authorization header is provided, quietly (no stack-trace log)', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
       // No auth header → empty bearer token → empty token after strip → "Missing token"
       const req = makeMockReq({ headers: {} });
       const res = makeMockRes();
@@ -270,7 +272,14 @@ describe('createUnifiedAuthMiddleware', () => {
 
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
-      expect(res._json).toEqual({ error: 'Authentication failed' });
+      expect(res._json).toEqual({ error: 'Authentication required' });
+      // An anonymous/unauthenticated request (health check, CORS-preflight-adjacent probe,
+      // a client mid-handshake) is routine — it must NOT log a warning or a stack trace.
+      // Same treatment as the existing TokenExpiredError branch.
+      expect(warnSpy).not.toHaveBeenCalled();
+      expect(errorSpy).not.toHaveBeenCalled();
+      warnSpy.mockRestore();
+      errorSpy.mockRestore();
     });
 
     it('should return 401 with JWT_EXPIRED code for expired tokens', async () => {
@@ -301,10 +310,11 @@ describe('createUnifiedAuthMiddleware', () => {
       });
     });
 
-    it('should return 401 when jwt.decode returns null (corrupt token)', async () => {
+    it('should return 401 when jwt.decode returns null (corrupt token), and still log it in full', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);
       mockGetReadWriteDS.mockReturnValue(MOCK_POOL);
       mockJwtDecode.mockReturnValue(null);
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
 
       const req = makeMockReq({
         headers: { authorization: 'Bearer corrupt-token' },
@@ -317,6 +327,11 @@ describe('createUnifiedAuthMiddleware', () => {
       expect(next).not.toHaveBeenCalled();
       expect(res._status).toBe(401);
       expect(res._json).toEqual({ error: 'Authentication failed' });
+      // Unlike a bare "no credentials supplied" request, a token that IS present but
+      // fails to decode is worth a human's attention — the quiet path above is scoped
+      // to the "Missing token" case only, not a blanket suppression of auth logging.
+      expect(errorSpy).toHaveBeenCalledWith('Auth error:', expect.any(Error));
+      errorSpy.mockRestore();
     });
 
     it('should return 401 when verifyUserRecord returns null', async () => {

package/src/auth/magicLink/MagicLinkKeys.ts

@@ -10,7 +10,7 @@
  */
 
 import { BaseSingleton } from '@memberjunction/global';
-import { LogStatus } from '@memberjunction/core';
+import { LogStatusEx } from '@memberjunction/core';
 import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash, type KeyObject } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 import type { MagicLinkJWTClaims } from './types.js';
@@ -69,11 +69,17 @@ export class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManager> {
     } else {
       const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
       priv = privateKey;
-      LogStatus(
-        '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
-        'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
-        '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.'
-      );
+      // Verbose-only: on dev boxes with no configured key this fires on EVERY boot, and the
+      // ephemeral fallback is the designed behavior there — not a condition worth a log line in
+      // the default startup output. Deployments that care set the key; operators diagnosing
+      // magic-link session loss can re-run with verbose logging.
+      LogStatusEx({
+        message:
+          '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+          'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+          '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
+        verboseOnly: true
+      });
     }
 
     this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' }) as string;

package/src/auth/magicLink/MagicLinkRouter.ts

@@ -10,7 +10,7 @@
 
 import { Router, json, urlencoded, type Request, type Response } from 'express';
 import { rateLimit } from 'express-rate-limit';
-import { LogError, LogStatus, type AuthProviderConfig } from '@memberjunction/core';
+import { LogError, LogStatus, LogStatusEx, type AuthProviderConfig } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { configInfo, type MagicLinkConfig } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
@@ -219,7 +219,7 @@ export function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLi
     }
     const factory = AuthProviderFactory.Instance;
     factory.register(AuthProviderFactory.createProvider(providerConfig));
-    LogStatus(`[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`);
+    LogStatusEx({ message: `[MagicLink] Registered auth provider (issuer: ${publicUrl}, jwks: ${providerConfig.jwksUri})`, verboseOnly: true });
   } catch (e) {
     LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
   }

package/src/auth/magicLink/MagicLinkService.ts

@@ -549,6 +549,10 @@ export class MagicLinkService {
       // resolves this user without a full cache refresh.
       this.pushUserToCache(user, role);
 
+      // Deliberately NOT verbose-gated, unlike the MagicLink startup notices (2ddb865e40):
+      // provisioning a new external account via magic-link redemption is a security-relevant
+      // event that belongs in the default server log. At-scale deployments can revisit
+      // tapering this if volume ever makes it noise.
       LogStatus(`[MagicLink] Provisioned external user ${email} with role '${role.Name}'.`);
       return { success: true, userId: user.ID, email, firstName, lastName };
     } catch (txErr) {

package/src/auth/newUsers.ts

@@ -2,7 +2,7 @@ import { ApplicationInfo, DatabaseProviderBase, EntitySaveOptions, LogError, Log
 import { RegisterClass } from "@memberjunction/global";
 import { UserCache } from "@memberjunction/sqlserver-dataprovider";
 import { configInfo } from "../config.js";
-import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType } from "@memberjunction/core-entities";
+import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 
 export class NewUserBase {
     public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {
@@ -90,10 +90,11 @@ export class NewUserBase {
                         }
                     } else {
                         LogStatus(`No UserApplications configured, using DefaultForNewUser applications for new user ${user.Name}`);
-                        applicationsToCreate = md.Applications
-                            .filter(a => a.DefaultForNewUser)
-                            .sort((a, b) => (a.DefaultSequence ?? 100) - (b.DefaultSequence ?? 100));
-                        LogStatus(`Found ${applicationsToCreate.length} applications with DefaultForNewUser=true`);
+                        // Bug F2: use the shared selector, which filters to Active apps flagged
+                        // DefaultForNewUser (in DefaultSequence order). This path previously omitted the
+                        // Status = 'Active' check, so an inactive default app could be provisioned here.
+                        applicationsToCreate = UserInfoEngine.GetDefaultApplicationsForNewUser(md);
+                        LogStatus(`Found ${applicationsToCreate.length} active applications with DefaultForNewUser=true`);
                     }
 
                     for (const [appIndex, application] of applicationsToCreate.entries()) {

package/src/config.ts

@@ -212,6 +212,18 @@ const corsSchema = z.object({
   maxAge: z.number().default(86400),
 });
 
+const startupSchema = z.object({
+  /**
+   * Startup mode for engine pre-warm: 'full' (all @RegisterForStartup engines run at boot —
+   * the right choice for MJAPI) or 'task' (no engines pre-warm; everything lazy-loads on
+   * first touch — the right choice for short-lived CLI/script processes). Because
+   * mj.config.cjs is shared by every process in a repo, this can be overridden per
+   * invocation via the MJ_STARTUP_MODE env var (highest precedence) or programmatically
+   * by each entry point. Unset ⇒ each entry point's own default applies.
+   */
+  mode: z.enum(['full', 'task']).optional(),
+});
+
 const rateLimitSchema = z.object({
   /** Master switch — when false (default), no rate limiting is applied. */
   enabled: z.boolean().default(false),
@@ -498,6 +510,7 @@ const configInfoSchema = z.object({
   feedbackSettings: feedbackSettingsSchema.optional().default({}),
   cors: corsSchema.optional().default({}),
   rateLimiting: rateLimitSchema.optional().default({}),
+  startup: startupSchema.optional().default({}),
 
   apiKey: z.string().optional(),
   baseUrl: z.string().default('http://localhost'),
@@ -556,6 +569,7 @@ export type FeedbackGithubSettingsConfig = z.infer<typeof feedbackGithubSettings
 export type FeedbackSettingsConfig = z.infer<typeof feedbackSettingsSchema>;
 export type CorsConfig = z.infer<typeof corsSchema>;
 export type RateLimitConfig = z.infer<typeof rateLimitSchema>;
+export type StartupConfig = z.infer<typeof startupSchema>;
 export type ConfigInfo = z.infer<typeof configInfoSchema>;
 
 /**

package/src/context.ts

@@ -436,7 +436,10 @@ export const getUserPayload = async (
     const token = bearerToken.replace('Bearer ', '');
 
     if (!token) {
-      console.warn('No token to validate');
+      // No log here — an anonymous/unauthenticated request is routine (a health check, a
+      // CORS preflight-adjacent probe, a client that hasn't finished its auth handshake
+      // yet), not exceptional. `createUnifiedAuthMiddleware`'s catch block below is the
+      // single place that decides how (and whether) to log this — same as `TokenExpiredError`.
       throw new AuthenticationError('Missing token');
     }
 
@@ -512,12 +515,24 @@ export const getUserPayload = async (
 
     return { userRecord: sessionUser, email: sessionUser.Email, sessionId };
   } catch (error) {
-    console.error(error);
+    // An anonymous request presenting no credentials at all (a health check, a CORS
+    // preflight-adjacent probe, a client mid-handshake) is routine, same as an expired
+    // long-lived session — neither is a bug worth a raw console dump here. Both still
+    // propagate (audited below, in the "missing token" case) so the single call site
+    // that actually decides final logging/response policy — createUnifiedAuthMiddleware's
+    // catch block — sees the real error instead of a generic, indistinguishable one.
+    const isMissingToken = error instanceof Error && error.message === 'Missing token';
+    if (!(error instanceof TokenExpiredError) && !isMissingToken) {
+      console.error(error);
+    }
     if (error instanceof TokenExpiredError) {
       throw error; // expected for long-lived sessions; not a failure worth auditing
     }
     // Best-effort failure audit (token scanning / brute-force signal). Never blocks auth.
     void auditLoginFailure(bearerToken, error, requestContext, requestDomain);
+    if (isMissingToken) {
+      throw error; // preserve the original message — see comment above
+    }
     throw new AuthenticationError('Unable to authenticate user');
   }
 };
@@ -632,6 +647,17 @@ export function createUnifiedAuthMiddleware(
         });
         return;
       }
+      // An unauthenticated request presenting no credentials at all is routine (health
+      // checks, CORS preflight-adjacent probes, a client mid-handshake) — same category as
+      // TokenExpiredError above, not a bug to surface with a full stack trace. Anything else
+      // (a malformed/tampered token, an invalid system API key) is still logged in full below,
+      // since those ARE worth a human's attention. Checked by message rather than
+      // `instanceof AuthenticationError` — `type-graphql`'s class can resolve to a distinct
+      // copy across module/bundler boundaries, where `instanceof` silently never matches.
+      if (error instanceof Error && error.message === 'Missing token') {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+      }
       console.error('Auth error:', error);
       res.status(401).json({ error: 'Authentication failed' });
     }