@memberjunction/server 5.48.0 → 5.50.0

package/src/realtimeProxy/RealtimeProxyServer.ts

@@ -52,6 +52,13 @@ export class RealtimeProxyServer extends BaseSingleton<RealtimeProxyServer> impl
             return false; // not ours — leave it for the GraphQL WS server
         }
         this.ensureRegistered();
+        // Optional Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS: comma-separated origins).
+        // Unset ⇒ prior behavior (the single-use short-TTL ticket remains the primary guard);
+        // set ⇒ a browser page on a foreign origin cannot ride a leaked ticket id.
+        if (!RealtimeProxyServer.originAllowed(request.headers?.origin)) {
+            RealtimeProxyServer.rejectUpgrade(socket, 403, 'Forbidden');
+            return true;
+        }
         const ticketId = url.searchParams.get('ticket') ?? '';
         const entry = RealtimeProxyRegistry.Instance.Consume(ticketId);
         if (!entry) {
@@ -62,6 +69,28 @@ export class RealtimeProxyServer extends BaseSingleton<RealtimeProxyServer> impl
         return true;
     }
 
+    /**
+     * Evaluates the optional Origin allowlist. Comparison is exact on the normalized origin
+     * (scheme://host[:port], lowercased, no trailing slash). An upgrade WITHOUT an Origin header
+     * (non-browser client, e.g. a native app or test rig) passes — the allowlist targets
+     * cross-origin BROWSER pages, which always send the header.
+     *
+     * @param origin The upgrade request's Origin header, if any.
+     * @returns True when allowed (or no allowlist is configured).
+     */
+    private static originAllowed(origin: string | undefined): boolean {
+        const raw = process.env['MJ_REALTIME_PROXY_ALLOWED_ORIGINS'];
+        if (!raw || raw.trim().length === 0) {
+            return true; // no allowlist configured — prior behavior
+        }
+        if (!origin) {
+            return true; // non-browser upgrade (no Origin header) — tickets remain the guard
+        }
+        const normalize = (value: string): string => value.trim().toLowerCase().replace(/\/+$/, '');
+        const allowed = raw.split(',').map(normalize).filter((v) => v.length > 0);
+        return allowed.includes(normalize(origin));
+    }
+
     /** Opens the upstream leg and wires a bidirectional pump between the browser socket and it. */
     private openTunnel(browserWs: WsClient, entry: RealtimeProxyTicketEntry): void {
         const tunnel = new RealtimeProxyTunnel(browserWs, entry, () => this.tunnels.delete(tunnel));
@@ -118,9 +147,21 @@ export class RealtimeProxyServer extends BaseSingleton<RealtimeProxyServer> impl
  * then pumps both directions byte-transparently (text and binary alike). Closing either side closes the other.
  */
 class RealtimeProxyTunnel {
+    /** How long the upstream websocket may take to OPEN before the tunnel is torn down (ms). */
+    private static readonly UPSTREAM_OPEN_TIMEOUT_MS = 15_000;
+    /**
+     * Cap on frames buffered browser→upstream before the upstream opens. A half-connected
+     * upstream (TCP accepted, WS handshake never completes) must not let a browser streaming PCM
+     * grow an unbounded in-memory array on MJAPI; past the cap the OLDEST frames are dropped
+     * (voice frames are perishable — late delivery of stale audio is worthless anyway).
+     */
+    private static readonly MAX_PENDING_FRAMES = 512;
+
     private upstream: WsClient | null = null;
     /** Frames the browser sent before the upstream opened; flushed in order once it's ready. */
     private readonly pending: Array<{ data: RawData; isBinary: boolean }> = [];
+    private openDeadline: ReturnType<typeof setTimeout> | null = null;
+    private droppedPendingFrames = 0;
     private closed = false;
 
     constructor(
@@ -135,7 +176,24 @@ class RealtimeProxyTunnel {
         const upstream = new WsClient(this.entry.UpstreamUrl, { headers });
         this.upstream = upstream;
 
-        upstream.on('open', () => this.flushPending());
+        // Deadline: an upstream that accepts TCP but never completes the WS handshake would
+        // otherwise hold the tunnel (and its buffer) open forever.
+        this.openDeadline = setTimeout(() => {
+            this.openDeadline = null;
+            if (!this.closed && upstream.readyState !== WsClient.OPEN) {
+                console.warn(`[RealtimeProxy] upstream did not open within ${RealtimeProxyTunnel.UPSTREAM_OPEN_TIMEOUT_MS}ms — closing tunnel`);
+                this.Close();
+            }
+        }, RealtimeProxyTunnel.UPSTREAM_OPEN_TIMEOUT_MS);
+        (this.openDeadline as { unref?: () => void }).unref?.();
+
+        upstream.on('open', () => {
+            if (this.openDeadline) {
+                clearTimeout(this.openDeadline);
+                this.openDeadline = null;
+            }
+            this.flushPending();
+        });
         upstream.on('message', (data: RawData, isBinary: boolean) => this.forward(this.browser, data, isBinary));
         upstream.on('close', () => this.Close());
         upstream.on('error', () => this.Close());
@@ -151,6 +209,13 @@ class RealtimeProxyTunnel {
             this.forward(this.upstream, data, isBinary);
         } else {
             this.pending.push({ data, isBinary });
+            if (this.pending.length > RealtimeProxyTunnel.MAX_PENDING_FRAMES) {
+                this.pending.shift(); // drop-oldest: stale voice frames are worthless anyway
+                this.droppedPendingFrames++;
+                if (this.droppedPendingFrames === 1 || this.droppedPendingFrames % 100 === 0) {
+                    console.warn(`[RealtimeProxy] pre-open buffer cap hit — dropped ${this.droppedPendingFrames} oldest frame(s) awaiting upstream open`);
+                }
+            }
         }
     }
 
@@ -179,6 +244,10 @@ class RealtimeProxyTunnel {
 
     /** Closes both legs and detaches the tunnel from the server. Idempotent. */
     public Close(): void {
+        if (this.openDeadline) {
+            clearTimeout(this.openDeadline);
+            this.openDeadline = null;
+        }
         if (this.closed) {
             return;
         }

package/src/realtimeWidget/WidgetRouter.ts

@@ -11,7 +11,7 @@
  */
 
 import { Router, json, type Request, type Response } from 'express';
-import { rateLimit } from 'express-rate-limit';
+import { rateLimit, ipKeyGenerator } from 'express-rate-limit';
 import { LogStatus } from '@memberjunction/core';
 import { configInfo, type WidgetConfig } from '../config.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
@@ -65,7 +65,11 @@ export function createWidgetHandler(publicUrl: string, config: WidgetConfig): {
     windowMs: config.rateLimitWindowMs,
     standardHeaders: 'draft-7',
     legacyHeaders: false,
-    keyGenerator: (req: Request) => `${readWidgetKey(req)}:${req.ip ?? 'noip'}`,
+    // ipKeyGenerator collapses IPv6 addresses to their /56 subnet before keying. Raw `req.ip`
+    // would give every IPv6 client a practically unlimited supply of distinct keys (one per
+    // address in their delegated prefix), letting them sidestep the per-IP bucket entirely —
+    // express-rate-limit v8 refuses to start with a keyGenerator that reads req.ip without it.
+    keyGenerator: (req: Request) => `${readWidgetKey(req)}:${req.ip ? ipKeyGenerator(req.ip) : 'noip'}`,
     limit: async (req: Request) => service.ResolvePerInstanceRateLimit(readWidgetKey(req)),
     message: { success: false, errorCode: 'rate_limited', error: 'Too many widget session requests. Try again later.' },
   });

package/src/realtimeWidget/WidgetSessionService.ts

@@ -15,7 +15,7 @@
  */
 
 import { Metadata, RunView, UserInfo, LogError, LogStatus } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
+import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
 import type { MJConversationWidgetInstanceEntity, MJConversationEntity } from '@memberjunction/core-entities';
 import { UserCache } from '@memberjunction/sqlserver-dataprovider';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
@@ -283,9 +283,26 @@ export class WidgetSessionService {
     return this.MintGuestSession(input);
   }
 
-  /** Short-TTL cache of resolved per-instance rate limits, so the limiter doesn't hit the DB per request. */
-  private readonly rateLimitCache = new Map<string, { limit: number; expiresAtMs: number }>();
+  /**
+   * Short-TTL, size-bounded cache of resolved per-instance rate limits, so the limiter doesn't hit
+   * the DB per request. The cache key (`widgetKey`) is presented by an UNAUTHENTICATED caller on the
+   * public `/widget/session` endpoint, so an unbounded `Map` here lets anyone grow server memory
+   * forever by sending an endless stream of distinct garbage keys (Memory Leak Audit Round 8,
+   * Critical finding). `MJLruCache` evicts the least-recently-used entry once `RATE_LIMIT_CACHE_MAX_SIZE`
+   * is reached, in addition to the existing TTL — `RATE_LIMIT_CACHE_MAX_SIZE` is sized well above any
+   * realistic deployment's widget-instance count so legitimate lookups are never evicted prematurely.
+   */
+  private readonly rateLimitCache = new MJLruCache<string, number>({
+    maxSize: WidgetSessionService.RATE_LIMIT_CACHE_MAX_SIZE,
+    ttlMs: WidgetSessionService.RATE_LIMIT_CACHE_TTL_MS,
+  });
   private static readonly RATE_LIMIT_CACHE_TTL_MS = 60_000;
+  private static readonly RATE_LIMIT_CACHE_MAX_SIZE = 10_000;
+
+  /** Current entry count in the per-instance rate-limit cache (diagnostic / test hook). */
+  public get RateLimitCacheSize(): number {
+    return this.rateLimitCache.Size;
+  }
 
   /**
    * Resolves the per-instance `RateLimitPerMinute` for a widget key (W6 hardening), falling back to the
@@ -299,10 +316,9 @@ export class WidgetSessionService {
     if (!key) {
       return fallback;
     }
-    const cached = this.rateLimitCache.get(key);
-    const now = Date.now();
-    if (cached && cached.expiresAtMs > now) {
-      return cached.limit;
+    const cached = this.rateLimitCache.Get(key);
+    if (cached !== undefined) {
+      return cached;
     }
     let limit = fallback;
     try {
@@ -316,7 +332,7 @@ export class WidgetSessionService {
     } catch (e) {
       LogError(e);
     }
-    this.rateLimitCache.set(key, { limit, expiresAtMs: now + WidgetSessionService.RATE_LIMIT_CACHE_TTL_MS });
+    this.rateLimitCache.Set(key, limit);
     return limit;
   }
 

package/src/resolvers/AdhocQueryResolver.ts

@@ -6,6 +6,7 @@ import { AppContext } from '../types.js';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { RunQueryResultType } from './QueryResolver.js';
+import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
 import sql from 'mssql';
 
 /**
@@ -23,7 +24,7 @@ class AdhocQueryInput {
     @Field(() => Int, { nullable: true, description: 'Maximum number of rows to return; applied at the database via the render pipeline.' })
     MaxRows?: number;
 
-    @Field(() => Int, { nullable: true, description: 'Zero-based offset for pagination. When > 0, the row cap switches to OFFSET/FETCH pagination.' })
+    @Field(() => Int, { nullable: true, description: 'Zero-based offset for pagination. Whenever MaxRows > 0 the query is paged via OFFSET/FETCH — including the first page (StartRow 0).' })
     StartRow?: number;
 }
 
@@ -76,55 +77,53 @@ export class AdhocQueryResolver extends ResolverBase {
             // 4. Route the SQL through RenderPipeline so composition tokens
             // resolve, comments and templates are processed, and the row cap
             // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
-            const startRow = input.StartRow ?? 0;
+            //
+            // Page whenever a positive MaxRows is requested — INCLUDING the first
+            // page (StartRow 0). This yields OFFSET/FETCH data SQL *and* a
+            // COUNT(*) query so the response reports the true total row count
+            // rather than just the returned page size. It mirrors the saved-query
+            // path (GenericDatabaseProvider.InternalRunQuery → WrapWithPaging).
+            // (Previously paging was gated on StartRow > 0, so page 1 fell back to
+            // a TOP-N cap with TotalRowCount = page size — hiding the pager.)
+            // Clamp StartRow to a non-negative integer. A negative offset must not slip
+            // past the paging gate (which would then run the query with no row cap at all).
+            const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow! : 0);
             const maxRows = input.MaxRows;
-            const usePaging =
-                maxRows != null &&
-                Number.isInteger(maxRows) &&
-                maxRows > 0 &&
-                Number.isInteger(startRow) &&
-                startRow > 0;
-            let executableSql: string;
+            const usePaging = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
+
+            let dataSQL: string;
+            let countSQL: string | null = null;
             try {
                 const rendered = RenderPipeline.Run(input.SQL, {
                     Platform: platform,
                     ContextUser: contextUser,
-                    ...(usePaging
-                        ? { Paging: { StartRow: startRow, MaxRows: maxRows! } }
-                        : maxRows != null && maxRows > 0
-                            ? { MaxRows: maxRows }
-                            : {}),
+                    ...(usePaging ? { Paging: { StartRow: startRow, MaxRows: maxRows! } } : {}),
                 });
-                executableSql = rendered.FinalSQL;
+                dataSQL = rendered.FinalSQL;
+                countSQL = rendered.PagingResult?.CountSQL ?? null;
             } catch (renderErr) {
                 const renderMsg = renderErr instanceof Error ? renderErr.message : String(renderErr);
                 return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
             }
 
-            // 5. Execute with timeout
-            const timeoutMs = (input.TimeoutSeconds ?? 30) * 1000;
-            const request = new sql.Request(readOnlyDS);
-
-            const result = await Promise.race([
-                request.query(executableSql),
-                new Promise<never>((_, reject) =>
-                    setTimeout(() => reject(new Error('Query timeout exceeded')), timeoutMs)
-                )
-            ]);
+            // 5. Execute the page (and, only when a full page needs it, the count) under
+            // a shared wall-clock deadline derived from the request's timeout budget.
+            const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
+            const { recordset, totalRowCount } = await this.executeDataAndCount(
+                readOnlyDS, dataSQL, countSQL, startRow, usePaging ? maxRows! : null, deadline
+            );
             const executionTimeMs = Date.now() - startTime;
 
             // 6. Return as RunQueryResultType
-            const recordset = result.recordset ?? [];
-
             return {
                 QueryID: '',
                 QueryName: 'Ad-Hoc Query',
                 Success: true,
                 Results: JSON.stringify(recordset),
                 RowCount: recordset.length,
-                TotalRowCount: recordset.length,
-                PageNumber: maxRows != null && maxRows > 0 ? Math.floor(startRow / maxRows) + 1 : undefined,
-                PageSize: maxRows ?? undefined,
+                TotalRowCount: totalRowCount,
+                PageNumber: usePaging ? Math.floor(startRow / maxRows!) + 1 : undefined,
+                PageSize: usePaging ? maxRows! : undefined,
                 ExecutionTime: executionTimeMs,
                 ErrorMessage: ''
             };
@@ -164,6 +163,74 @@ export class AdhocQueryResolver extends ResolverBase {
         }
     }
 
+    /**
+     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
+     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
+     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     *
+     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
+     * duplicate column names are legal in a result set but rejected inside the COUNT
+     * CTE wrap. A count failure must never sink the whole result, so we log it and
+     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
+     */
+    private async executeDataAndCount(
+        ds: sql.ConnectionPool,
+        dataSQL: string,
+        countSQL: string | null,
+        startRow: number,
+        maxRows: number | null,
+        deadline: number,
+    ): Promise<{ recordset: Record<string, unknown>[]; totalRowCount: number }> {
+        const dataResult = await this.runSqlWithDeadline<Record<string, unknown>>(ds, dataSQL, deadline);
+        const recordset = (dataResult.recordset ?? []) as Record<string, unknown>[];
+
+        // Total already known from the page alone (unpaged, or a short page)? Skip the count.
+        const exact = exactTotalFromPage(startRow, recordset.length, maxRows);
+        if (exact != null || !countSQL) {
+            return { recordset, totalRowCount: exact ?? recordset.length };
+        }
+
+        // Full page — a COUNT(*) is required to know the true total.
+        const lowerBound = startRow + recordset.length;
+        try {
+            const countResult = await this.runSqlWithDeadline<{ TotalRowCount: number }>(ds, countSQL, deadline);
+            return { recordset, totalRowCount: resolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
+        } catch (countErr) {
+            const msg = countErr instanceof Error ? countErr.message : String(countErr);
+            LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);
+            return { recordset, totalRowCount: lowerBound };
+        }
+    }
+
+    /**
+     * Executes one SQL statement on the read-only pool, racing it against the shared
+     * wall-clock `deadline`. The timer is always cleared on completion so a settled
+     * query never leaves a dangling timeout armed.
+     */
+    private async runSqlWithDeadline<T>(
+        ds: sql.ConnectionPool,
+        sqlText: string,
+        deadline: number,
+    ): Promise<sql.IResult<T>> {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw new Error('Query timeout exceeded');
+        }
+        let timer: ReturnType<typeof setTimeout> | undefined;
+        try {
+            return await Promise.race([
+                new sql.Request(ds).query<T>(sqlText),
+                new Promise<never>((_, reject) => {
+                    timer = setTimeout(() => reject(new Error('Query timeout exceeded')), remaining);
+                }),
+            ]);
+        } finally {
+            if (timer) {
+                clearTimeout(timer);
+            }
+        }
+    }
+
     private buildErrorResult(errorMessage: string): RunQueryResultType {
         return {
             QueryID: '',

package/src/resolvers/GetDataResolver.ts

@@ -281,8 +281,37 @@ export class GetDataAccessToken {
     TokenUses: TokenUseLog[];
 }
 const __accessTokens: GetDataAccessToken[] = [];
-const __defaultTokenLifeSpan = 1000 * 60 * 5; // 5 minutes  
+const __defaultTokenLifeSpan = 1000 * 60 * 5; // 5 minutes
+
+/**
+ * Removes every token whose `ExpiresAt` has already passed (and its `TokenUses`
+ * log along with it). Without this sweep `__accessTokens` grows forever — nothing
+ * else in this module ever removes an expired token, `deleteAccessToken()` has no
+ * production caller (tokens are consumed implicitly via short-lived `GetData`
+ * calls, never explicitly released by the requesting system), and `isTokenValid()`
+ * only checks the expiry timestamp without pruning it. Called from
+ * `registerAccessToken()` — the natural "allocation" moment — so the array
+ * self-bounds to roughly "tokens registered within one lifespan window" instead
+ * of growing with total lifetime registrations (Memory Leak Audit Round 7,
+ * Critical finding).
+ * @param now injectable for tests; defaults to the real current time
+ */
+export function pruneExpiredTokens(now: Date = new Date()): void {
+    for (let i = __accessTokens.length - 1; i >= 0; i--) {
+        if (__accessTokens[i].ExpiresAt <= now) {
+            __accessTokens.splice(i, 1);
+        }
+    }
+}
+
+/** Number of tokens currently tracked (post-sweep, at last mutation). Exposed for tests/diagnostics. */
+export function getAccessTokenCount(): number {
+    return __accessTokens.length;
+}
+
 export function registerAccessToken(token?: string, lifeSpan: number = __defaultTokenLifeSpan, requestorPayload?: any): GetDataAccessToken {
+    pruneExpiredTokens();
+
     const tokenToUse = token || uuidv4();
 
     if (tokenExists(tokenToUse)) {