@memberjunction/server 5.49.0 → 5.50.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "5.49.0",
+  "version": "5.50.0",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -27,93 +27,94 @@
     "@as-integrations/express5": "^1.0.0",
     "@graphql-tools/schema": "latest",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "5.49.0",
-    "@memberjunction/actions-apollo": "5.49.0",
-    "@memberjunction/actions-base": "5.49.0",
-    "@memberjunction/actions-bizapps-accounting": "5.49.0",
-    "@memberjunction/actions-bizapps-crm": "5.49.0",
-    "@memberjunction/actions-bizapps-formbuilders": "5.49.0",
-    "@memberjunction/actions-bizapps-lms": "5.49.0",
-    "@memberjunction/actions-bizapps-social": "5.49.0",
-    "@memberjunction/ai": "5.49.0",
-    "@memberjunction/ai-agent-manager": "5.49.0",
-    "@memberjunction/ai-agent-manager-actions": "5.49.0",
-    "@memberjunction/ai-agents": "5.49.0",
-    "@memberjunction/ai-bridge-base": "5.49.0",
-    "@memberjunction/ai-bridge-ringcentral": "5.49.0",
-    "@memberjunction/ai-bridge-server": "5.49.0",
-    "@memberjunction/ai-bridge-teams": "5.49.0",
-    "@memberjunction/ai-bridge-twilio": "5.49.0",
-    "@memberjunction/ai-bridge-vonage": "5.49.0",
-    "@memberjunction/ai-core-plus": "5.49.0",
-    "@memberjunction/ai-engine-base": "5.49.0",
-    "@memberjunction/ai-mcp-client": "5.49.0",
-    "@memberjunction/ai-prompts": "5.49.0",
-    "@memberjunction/ai-provider-bundle": "5.49.0",
-    "@memberjunction/ai-vector-sync": "5.49.0",
-    "@memberjunction/ai-vectordb": "5.49.0",
-    "@memberjunction/ai-vectors-pinecone": "5.49.0",
-    "@memberjunction/aiengine": "5.49.0",
-    "@memberjunction/api-keys": "5.49.0",
-    "@memberjunction/auth-providers": "5.49.0",
-    "@memberjunction/clustering-engine": "5.49.0",
-    "@memberjunction/codegen-lib": "5.49.0",
-    "@memberjunction/communication-engine": "5.49.0",
-    "@memberjunction/communication-ms-graph": "5.49.0",
-    "@memberjunction/notifications": "5.49.0",
-    "@memberjunction/communication-sendgrid": "5.49.0",
-    "@memberjunction/communication-types": "5.49.0",
-    "@memberjunction/component-registry-client-sdk": "5.49.0",
-    "@memberjunction/computer-use": "5.49.0",
-    "@memberjunction/computer-use-engine": "5.49.0",
-    "@memberjunction/config": "5.49.0",
-    "@memberjunction/core": "5.49.0",
-    "@memberjunction/core-actions": "5.49.0",
-    "@memberjunction/core-entities": "5.49.0",
-    "@memberjunction/core-entities-server": "5.49.0",
-    "@memberjunction/credentials": "5.49.0",
-    "@memberjunction/data-context": "5.49.0",
-    "@memberjunction/data-context-server": "5.49.0",
-    "@memberjunction/doc-utils": "5.49.0",
-    "@memberjunction/encryption": "5.49.0",
-    "@memberjunction/entity-communications-base": "5.49.0",
-    "@memberjunction/entity-communications-server": "5.49.0",
-    "@memberjunction/esignature": "5.49.0",
-    "@memberjunction/external-change-detection": "5.49.0",
-    "@memberjunction/generic-database-provider": "5.49.0",
-    "@memberjunction/global": "5.49.0",
-    "@memberjunction/graphql-dataprovider": "5.49.0",
-    "@memberjunction/integration-engine": "5.49.0",
-    "@memberjunction/integration-progress-artifacts": "5.49.0",
-    "@memberjunction/integration-schema-builder": "5.49.0",
-    "@memberjunction/interactive-component-types": "5.49.0",
-    "@memberjunction/lists": "5.49.0",
-    "@memberjunction/lists-base": "5.49.0",
-    "@memberjunction/livekit-room-server": "5.49.0",
-    "@memberjunction/postgresql-dataprovider": "5.49.0",
-    "@memberjunction/queue": "5.49.0",
-    "@memberjunction/record-comparison": "5.49.0",
-    "@memberjunction/redis-provider": "5.49.0",
-    "@memberjunction/remote-browser-base": "5.49.0",
-    "@memberjunction/remote-browser-cdp": "5.49.0",
-    "@memberjunction/remote-browser-selfhost": "5.49.0",
-    "@memberjunction/remote-browser-server": "5.49.0",
-    "@memberjunction/scheduling-actions": "5.49.0",
-    "@memberjunction/scheduling-base-types": "5.49.0",
-    "@memberjunction/scheduling-engine": "5.49.0",
-    "@memberjunction/scheduling-engine-base": "5.49.0",
-    "@memberjunction/schema-engine": "5.49.0",
-    "@memberjunction/search-engine": "5.49.0",
-    "@memberjunction/server-extensions-core": "5.49.0",
-    "@memberjunction/sql-dialect": "5.49.0",
-    "@memberjunction/sqlserver-dataprovider": "5.49.0",
-    "@memberjunction/storage": "5.49.0",
-    "@memberjunction/tag-engine": "5.49.0",
-    "@memberjunction/tag-engine-base": "5.49.0",
-    "@memberjunction/templates": "5.49.0",
-    "@memberjunction/testing-engine": "5.49.0",
-    "@memberjunction/testing-engine-base": "5.49.0",
-    "@memberjunction/version-history": "5.49.0",
+    "@memberjunction/actions": "5.50.0",
+    "@memberjunction/actions-apollo": "5.50.0",
+    "@memberjunction/actions-base": "5.50.0",
+    "@memberjunction/actions-bizapps-accounting": "5.50.0",
+    "@memberjunction/actions-bizapps-crm": "5.50.0",
+    "@memberjunction/actions-bizapps-formbuilders": "5.50.0",
+    "@memberjunction/actions-bizapps-lms": "5.50.0",
+    "@memberjunction/actions-bizapps-social": "5.50.0",
+    "@memberjunction/ai": "5.50.0",
+    "@memberjunction/ai-agent-manager": "5.50.0",
+    "@memberjunction/ai-agent-manager-actions": "5.50.0",
+    "@memberjunction/ai-agents": "5.50.0",
+    "@memberjunction/ai-bridge-base": "5.50.0",
+    "@memberjunction/ai-bridge-ringcentral": "5.50.0",
+    "@memberjunction/ai-bridge-server": "5.50.0",
+    "@memberjunction/ai-bridge-teams": "5.50.0",
+    "@memberjunction/ai-bridge-twilio": "5.50.0",
+    "@memberjunction/ai-bridge-vonage": "5.50.0",
+    "@memberjunction/ai-core-plus": "5.50.0",
+    "@memberjunction/ai-engine-base": "5.50.0",
+    "@memberjunction/ai-mcp-client": "5.50.0",
+    "@memberjunction/ai-prompts": "5.50.0",
+    "@memberjunction/ai-provider-bundle": "5.50.0",
+    "@memberjunction/ai-vector-sync": "5.50.0",
+    "@memberjunction/ai-vectordb": "5.50.0",
+    "@memberjunction/ai-vectors-pinecone": "5.50.0",
+    "@memberjunction/aiengine": "5.50.0",
+    "@memberjunction/api-keys": "5.50.0",
+    "@memberjunction/auth-providers": "5.50.0",
+    "@memberjunction/clustering-engine": "5.50.0",
+    "@memberjunction/codegen-lib": "5.50.0",
+    "@memberjunction/communication-engine": "5.50.0",
+    "@memberjunction/communication-ms-graph": "5.50.0",
+    "@memberjunction/communication-sendgrid": "5.50.0",
+    "@memberjunction/communication-types": "5.50.0",
+    "@memberjunction/component-registry-client-sdk": "5.50.0",
+    "@memberjunction/computer-use": "5.50.0",
+    "@memberjunction/computer-use-engine": "5.50.0",
+    "@memberjunction/config": "5.50.0",
+    "@memberjunction/core": "5.50.0",
+    "@memberjunction/core-actions": "5.50.0",
+    "@memberjunction/core-entities": "5.50.0",
+    "@memberjunction/core-entities-server": "5.50.0",
+    "@memberjunction/credentials": "5.50.0",
+    "@memberjunction/data-context": "5.50.0",
+    "@memberjunction/data-context-server": "5.50.0",
+    "@memberjunction/doc-utils": "5.50.0",
+    "@memberjunction/encryption": "5.50.0",
+    "@memberjunction/entity-communications-base": "5.50.0",
+    "@memberjunction/entity-communications-server": "5.50.0",
+    "@memberjunction/esignature": "5.50.0",
+    "@memberjunction/external-change-detection": "5.50.0",
+    "@memberjunction/generic-database-provider": "5.50.0",
+    "@memberjunction/global": "5.50.0",
+    "@memberjunction/graphql-dataprovider": "5.50.0",
+    "@memberjunction/integration-engine": "5.50.0",
+    "@memberjunction/integration-engine-base": "5.50.0",
+    "@memberjunction/integration-progress-artifacts": "5.50.0",
+    "@memberjunction/integration-schema-builder": "5.50.0",
+    "@memberjunction/interactive-component-types": "5.50.0",
+    "@memberjunction/lists": "5.50.0",
+    "@memberjunction/lists-base": "5.50.0",
+    "@memberjunction/livekit-room-server": "5.50.0",
+    "@memberjunction/notifications": "5.50.0",
+    "@memberjunction/postgresql-dataprovider": "5.50.0",
+    "@memberjunction/queue": "5.50.0",
+    "@memberjunction/record-comparison": "5.50.0",
+    "@memberjunction/redis-provider": "5.50.0",
+    "@memberjunction/remote-browser-base": "5.50.0",
+    "@memberjunction/remote-browser-cdp": "5.50.0",
+    "@memberjunction/remote-browser-selfhost": "5.50.0",
+    "@memberjunction/remote-browser-server": "5.50.0",
+    "@memberjunction/scheduling-actions": "5.50.0",
+    "@memberjunction/scheduling-base-types": "5.50.0",
+    "@memberjunction/scheduling-engine": "5.50.0",
+    "@memberjunction/scheduling-engine-base": "5.50.0",
+    "@memberjunction/schema-engine": "5.50.0",
+    "@memberjunction/search-engine": "5.50.0",
+    "@memberjunction/server-extensions-core": "5.50.0",
+    "@memberjunction/sql-dialect": "5.50.0",
+    "@memberjunction/sqlserver-dataprovider": "5.50.0",
+    "@memberjunction/storage": "5.50.0",
+    "@memberjunction/tag-engine": "5.50.0",
+    "@memberjunction/tag-engine-base": "5.50.0",
+    "@memberjunction/templates": "5.50.0",
+    "@memberjunction/testing-engine": "5.50.0",
+    "@memberjunction/testing-engine-base": "5.50.0",
+    "@memberjunction/version-history": "5.50.0",
     "@octokit/auth-app": "^7.1.5",
     "@octokit/rest": "^21.1.1",
     "@types/compression": "^1.8.1",
@@ -150,9 +151,10 @@
     "typedi": "^0.10.0",
     "uuid": "^13.0.0",
     "ws": "^8.19.0",
-    "zod": "~3.24.4"
+    "zod": "^3.25.0"
   },
   "devDependencies": {
+    "@types/express": "^4.17.25",
     "pkgroll": "2.23.0",
     "typescript": "^5.9.3",
     "vitest": "^3.1.1"

package/src/__tests__/WidgetSessionService.test.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect, vi } from 'vitest';
+
+// WidgetSessionService is the imperative shell for public widget sessions — importing it pulls in
+// config.ts (which eagerly validates DB env vars at module load) plus the full magic-link /
+// returning-visitor / communication stacks. This suite only exercises the `ResolvePerInstanceRateLimit`
+// cache-bounding behavior, so stub those transitive deps out (mirrors the pattern already established
+// in `magicLinkService.provisionLog.test.ts` for testing another imperative-shell class).
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  UserCache: {
+    Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
+    Users: [],
+  },
+}));
+vi.mock('../auth/magicLink/MagicLinkService.js', () => ({
+  MagicLinkService: class {},
+}));
+vi.mock('../agentSessions/ReturningVisitorRecap.js', () => ({
+  writeReturningVisitorRecap: async () => undefined,
+}));
+vi.mock('../realtimeWidget/visitorIdentity.js', () => ({
+  resolveIdentityByEmail: async () => null,
+  mergeVisitorIdentity: async () => 0,
+  forgetVisitor: async () => ({ notesArchived: 0, conversationsCleared: 0 }),
+}));
+
+import { WidgetSessionService } from '../realtimeWidget/WidgetSessionService.js';
+import type { WidgetConfig } from '../config.js';
+
+/**
+ * Minimal `WidgetConfig` matching the zod schema's post-parse (defaulted) shape —
+ * enough for `ResolvePerInstanceRateLimit`, which never dereferences most of these.
+ */
+function makeConfig(overrides: Partial<WidgetConfig> = {}): WidgetConfig {
+  return {
+    enabled: true,
+    signingReuse: 'magic-link',
+    audience: 'mj-magic-link',
+    anonymousEmail: 'anonymous@magic-link.local',
+    defaultSessionTtlMinutes: 15,
+    defaultRateLimitPerMinute: 30,
+    rateLimitWindowMs: 60_000,
+    voiceDefaultMaxSessionMinutes: 10,
+    hostPublicKeys: {},
+    ...overrides,
+  };
+}
+
+describe('WidgetSessionService — ResolvePerInstanceRateLimit', () => {
+  it('returns the deployment-wide default for an empty widget key without touching the cache', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig({ defaultRateLimitPerMinute: 42 }));
+    await expect(service.ResolvePerInstanceRateLimit('')).resolves.toBe(42);
+    expect(service.RateLimitCacheSize).toBe(0);
+  });
+
+  it('falls back to the default (and still caches) when the widget key cannot be resolved (no DB in unit tests)', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig({ defaultRateLimitPerMinute: 30 }));
+    await expect(service.ResolvePerInstanceRateLimit('pk_live_unknown')).resolves.toBe(30);
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+
+  it('caches a resolved limit per key instead of re-resolving on every call', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    await service.ResolvePerInstanceRateLimit('pk_live_same_key');
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+
+  it(
+    'never grows the rate-limit cache past its configured bound, even under an unbounded stream of ' +
+      'distinct attacker-supplied widget keys (Memory Leak Audit Round 8, Critical finding — the cache ' +
+      'key is unauthenticated request input on the public /widget/session endpoint)',
+    async () => {
+      const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+      // Far more distinct keys than any real deployment's widget-instance count, and comfortably
+      // more than the cache's configured max size — simulates an attacker sending a fresh garbage
+      // widgetKey on every request.
+      const distinctKeyCount = 12_000;
+      for (let i = 0; i < distinctKeyCount; i++) {
+        await service.ResolvePerInstanceRateLimit(`pk_live_attacker_${i}`);
+      }
+      expect(service.RateLimitCacheSize).toBeLessThan(distinctKeyCount);
+      expect(service.RateLimitCacheSize).toBeLessThanOrEqual(10_000);
+    },
+  );
+
+  it('trims whitespace before using the key to look up / populate the cache', async () => {
+    const service = new WidgetSessionService('https://mj.example.com', makeConfig());
+    await service.ResolvePerInstanceRateLimit('  pk_live_padded  ');
+    await service.ResolvePerInstanceRateLimit('pk_live_padded');
+    expect(service.RateLimitCacheSize).toBe(1);
+  });
+});

package/src/auth/newUsers.ts

@@ -2,7 +2,7 @@ import { ApplicationInfo, DatabaseProviderBase, EntitySaveOptions, LogError, Log
 import { RegisterClass } from "@memberjunction/global";
 import { UserCache } from "@memberjunction/sqlserver-dataprovider";
 import { configInfo } from "../config.js";
-import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType } from "@memberjunction/core-entities";
+import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 
 export class NewUserBase {
     public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {
@@ -90,10 +90,11 @@ export class NewUserBase {
                         }
                     } else {
                         LogStatus(`No UserApplications configured, using DefaultForNewUser applications for new user ${user.Name}`);
-                        applicationsToCreate = md.Applications
-                            .filter(a => a.DefaultForNewUser)
-                            .sort((a, b) => (a.DefaultSequence ?? 100) - (b.DefaultSequence ?? 100));
-                        LogStatus(`Found ${applicationsToCreate.length} applications with DefaultForNewUser=true`);
+                        // Bug F2: use the shared selector, which filters to Active apps flagged
+                        // DefaultForNewUser (in DefaultSequence order). This path previously omitted the
+                        // Status = 'Active' check, so an inactive default app could be provisioned here.
+                        applicationsToCreate = UserInfoEngine.GetDefaultApplicationsForNewUser(md);
+                        LogStatus(`Found ${applicationsToCreate.length} active applications with DefaultForNewUser=true`);
                     }
 
                     for (const [appIndex, application] of applicationsToCreate.entries()) {