@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.2

package/src/__tests__/ResolverBase.transportMapping.test.ts

@@ -0,0 +1,289 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { MJUserViewEntityExtended } from '@memberjunction/core-entities';
+import { FieldMapper } from '@memberjunction/graphql-dataprovider';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * Regression guard for the server-cache corruption behind
+ * "Field _mj__CreatedAt does not exist on MJ: Template Categories".
+ *
+ * GraphQL reserves the `__` prefix, so MJ renames `__mj_*` columns to the
+ * transport alias `_mj__*` on the way out. `ResolverBase` used to apply that
+ * rename IN PLACE over `result.Results` — but those are the data provider's own
+ * row objects, and the server's cache holds them BY REFERENCE. Preparing one
+ * GraphQL response therefore rewrote the keys inside the live cache, and every
+ * subsequent read served from it handed the client transport-shaped rows that
+ * `BaseEntity.SetMany` rejects. Process-wide cache ⇒ one response poisoned every
+ * later request, across all workers.
+ *
+ * The fix is copy-then-map. The first block exercises the REAL resolver path (so a
+ * revert to in-place mapping fails here); the second pins the two `FieldMapper`
+ * invariants that make the fix correct.
+ *
+ * These copies are now LOAD-BEARING rather than merely defensive: `LocalCacheManager`
+ * deep-freezes cached rows on reference-sharing storage providers, so mapping in place
+ * would throw a `TypeError` instead of silently corrupting the cache. The third block
+ * pins that the copy-then-map pattern still works on frozen input — the shape the cache
+ * actually hands out — and that in-place mapping is now refused outright.
+ */
+
+/** A cache-held row, shaped the way the provider hands them back. */
+type CachedRow = Record<string, unknown>;
+
+/**
+ * Reaches the protected `RunViewGenericInternal` and records what
+ * `ArrayFilterEncryptedFieldsForAPI` was handed — the second in-place mutator that
+ * must also see copies, and stubbed here so the assertion needs no live Metadata.
+ */
+class Probe extends ResolverBase {
+    public filteredRows: Record<string, unknown>[] | null = null;
+
+    protected override async ArrayFilterEncryptedFieldsForAPI(
+        _entityName: string,
+        dataObjectArray: Record<string, unknown>[]
+    ): Promise<Record<string, unknown>[]> {
+        this.filteredRows = dataObjectArray;
+        return dataObjectArray;
+    }
+
+    public Run(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, userPayload: UserPayload) {
+        return this.RunViewGenericInternal(
+            provider,
+            viewInfo,
+            '', // extraFilter
+            '', // orderBy
+            '', // userSearchString
+            undefined, // excludeUserViewRunID
+            undefined, // overrideExcludeFilter
+            undefined, // saveViewResults
+            undefined, // fields
+            undefined, // ignoreMaxRows
+            undefined, // excludeDataFromAllPriorViewRuns
+            undefined, // forceAuditLog
+            undefined, // auditLogDescription
+            'simple', // resultType
+            userPayload,
+            undefined, // maxRows
+            undefined // startRow
+        );
+    }
+}
+
+const ENTITY_NAME = 'MJ: Template Categories';
+
+/** Minimal provider: the entity lookup + the RunView the resolver awaits. */
+function fakeProvider(rows: CachedRow[]): DatabaseProviderBase {
+    return {
+        Entities: [{ Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] }],
+        RunView: async (_params: RunViewParams): Promise<RunViewResult> =>
+            ({ Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult),
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeViewInfo = () =>
+    ({ ID: 'view-1', Name: 'Test View', Entity: ENTITY_NAME } as unknown as MJUserViewEntityExtended);
+
+/** `userRecord` short-circuits the UserCache lookup; no apiKeyHash skips the scope check. */
+const fakePayload = () =>
+    ({ email: 'tester@example.com', userRecord: { Email: 'tester@example.com' } as UserInfo } as UserPayload);
+
+describe('ResolverBase.RunViewGenericInternal — cache safety', () => {
+    it('leaves the provider\'s (cache-held) rows untouched while returning transport keys', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+        const probe = new Probe();
+
+        const result = await probe.Run(fakeProvider([cachedRow]), fakeViewInfo(), fakePayload());
+
+        // The pre-fix code renamed these keys in place — this is the assertion that fails on a revert.
+        expect(cachedRow.__mj_CreatedAt).toBe('T0');
+        expect(cachedRow.__mj_UpdatedAt).toBe('T1');
+        expect(cachedRow._mj__CreatedAt).toBeUndefined();
+
+        // The outgoing rows carry the GraphQL-legal aliases, and are NOT the cached objects.
+        const wire = result?.Results as Record<string, unknown>[];
+        expect(wire[0]._mj__CreatedAt).toBe('T0');
+        expect(wire[0]).not.toBe(cachedRow);
+    });
+
+    it('hands the encrypted-field filter the copies, not the cached rows', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+        const probe = new Probe();
+
+        await probe.Run(fakeProvider([cachedRow]), fakeViewInfo(), fakePayload());
+
+        expect(probe.filteredRows).not.toBeNull();
+        expect(probe.filteredRows![0]).not.toBe(cachedRow);
+    });
+});
+
+describe('FieldMapper transport mapping — the invariants the fix rests on', () => {
+    it('MapFields MUTATES its argument (the hazard the resolver must not expose the cache to)', () => {
+        // Documents WHY the resolver must copy. If this ever becomes non-mutating,
+        // the copy in ResolverBase is redundant rather than load-bearing — and this
+        // test failing is the signal to revisit it.
+        const row: Record<string, unknown> = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' };
+
+        new FieldMapper().MapFields(row);
+
+        expect(row.__mj_CreatedAt).toBeUndefined();
+        expect(row._mj__CreatedAt).toBe('T0');
+    });
+
+    it('post-map mutation of the copy cannot reach the cached row', () => {
+        // ArrayFilterEncryptedFieldsForAPI redacts in place after mapping; on the
+        // pre-fix code that stripped secrets out of the CACHED row too.
+        const mapper = new FieldMapper();
+        const cachedRow: Record<string, unknown> = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+
+        const wireRow = mapper.MapFields({ ...cachedRow })!;
+        wireRow.Secret = null; // stand-in for the encrypted-field filter
+
+        expect(cachedRow.Secret).toBe('plaintext');
+        expect(wireRow.Secret).toBeNull();
+    });
+
+    it('round-trips a mapped copy back to entity field names', () => {
+        // The client's ConvertBackToMJFields must undo exactly what the server did.
+        const mapper = new FieldMapper();
+        const original: Record<string, unknown> = { ID: 'a1', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+
+        const wire = mapper.MapFields({ ...original })!;
+        const back = mapper.ReverseMapFields({ ...wire });
+
+        expect(back).toEqual(original);
+    });
+
+    it('leaves rows without __mj_ fields structurally unchanged', () => {
+        const mapper = new FieldMapper();
+        const row = { ID: 'a1', Name: 'Cat' };
+
+        expect(mapper.MapFields({ ...row })).toEqual(row);
+    });
+});
+
+describe('transport mapping against FROZEN cache rows', () => {
+    // The cache deep-freezes rows it hands out (LocalCacheManager freeze-on-write), so the
+    // resolver's input is frozen in the deployment that matters — MJAPI on the in-memory
+    // storage provider. That turns the copy from a precaution into a requirement.
+    it('copy-then-map works on a frozen row', () => {
+        const mapper = new FieldMapper();
+        const cachedRow = Object.freeze({ ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' }) as Record<string, unknown>;
+
+        const wireRow = mapper.MapFields({ ...cachedRow })!;
+
+        expect(wireRow._mj__CreatedAt).toBe('T0');
+        expect(wireRow.__mj_CreatedAt).toBeUndefined();
+        // The copy is mutable, so the encrypted-field filter can still redact in place.
+        expect(Object.isFrozen(wireRow)).toBe(false);
+        // And the frozen cached row is untouched.
+        expect(cachedRow.__mj_CreatedAt).toBe('T0');
+    });
+
+    it('in-place mapping of a frozen row THROWS — silent corruption is now impossible', () => {
+        // This is the safety net the freeze adds on top of the copy: if a future refactor
+        // reverts to in-place mapping, it fails loudly at the offending line instead of
+        // quietly rewriting process-wide state.
+        const mapper = new FieldMapper();
+        const cachedRow = Object.freeze({ ID: 'a1', __mj_CreatedAt: 'T0' }) as Record<string, unknown>;
+
+        expect(() => mapper.MapFields(cachedRow)).toThrow(TypeError);
+    });
+});
+
+/**
+ * The BATCH path (`RunViewsGenericInternal`), which the single-view tests above do not reach
+ * (PR #3425 review, finding M8).
+ *
+ * This is the path multi-view clients actually take — MJExplorer batches its view loads — so
+ * leaving it uncovered meant the original corruption bug could be reintroduced on the more
+ * heavily used of the two legs with CI still green.
+ */
+class BatchProbe extends ResolverBase {
+    public filteredRows: Record<string, unknown>[] | null = null;
+
+    protected override async ArrayFilterEncryptedFieldsForAPI(
+        _entityName: string,
+        dataObjectArray: Record<string, unknown>[]
+    ): Promise<Record<string, unknown>[]> {
+        this.filteredRows = dataObjectArray;
+        return dataObjectArray;
+    }
+
+    public RunBatch(provider: DatabaseProviderBase, viewInfos: MJUserViewEntityExtended[], userPayload: UserPayload) {
+        return this.RunViewsGenericInternal(
+            viewInfos.map(viewInfo => ({ provider, viewInfo, userPayload, resultType: 'simple' })) as never
+        );
+    }
+}
+
+/** Batch provider: `RunViews` returns one result per param, in order. */
+function fakeBatchProvider(rowsPerView: CachedRow[][]): DatabaseProviderBase {
+    return {
+        Entities: [{ Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] }],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? { Name: ENTITY_NAME } : undefined),
+        RunViews: async (params: RunViewParams[]): Promise<RunViewResult[]> =>
+            params.map((_p, i) => {
+                const rows = rowsPerView[i] ?? [];
+                return { Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult;
+            }),
+    } as unknown as DatabaseProviderBase;
+}
+
+describe('ResolverBase.RunViewsGenericInternal (batch) — cache safety', () => {
+    it('leaves every view\'s cache-held rows untouched while returning transport keys', async () => {
+        const viewARow: CachedRow = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+        const viewBRow: CachedRow = { ID: 'b1', Name: 'Dog', __mj_CreatedAt: 'T2', __mj_UpdatedAt: 'T3' };
+        const probe = new BatchProbe();
+
+        const results = await probe.RunBatch(
+            fakeBatchProvider([[viewARow], [viewBRow]]),
+            [fakeViewInfo(), fakeViewInfo()],
+            fakePayload()
+        );
+
+        // Both source rows keep entity field names — the assertion that fails on a revert
+        // to in-place mapping in the batch loop.
+        expect(viewARow.__mj_CreatedAt).toBe('T0');
+        expect(viewARow._mj__CreatedAt).toBeUndefined();
+        expect(viewBRow.__mj_CreatedAt).toBe('T2');
+        expect(viewBRow._mj__CreatedAt).toBeUndefined();
+
+        // ...and both outgoing views carry the aliases, on objects that are not the cached ones.
+        const wireA = results[0].Results as Record<string, unknown>[];
+        const wireB = results[1].Results as Record<string, unknown>[];
+        expect(wireA[0]._mj__CreatedAt).toBe('T0');
+        expect(wireB[0]._mj__CreatedAt).toBe('T2');
+        expect(wireA[0]).not.toBe(viewARow);
+        expect(wireB[0]).not.toBe(viewBRow);
+    });
+
+    it('maps FROZEN cache rows rather than throwing on them', async () => {
+        // The shape the cache actually hands out on a hit.
+        const frozenRow = Object.freeze({ ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' }) as CachedRow;
+        const probe = new BatchProbe();
+
+        const results = await probe.RunBatch(
+            fakeBatchProvider([[frozenRow]]),
+            [fakeViewInfo()],
+            fakePayload()
+        );
+
+        expect((results[0].Results as Record<string, unknown>[])[0]._mj__CreatedAt).toBe('T0');
+        expect(frozenRow.__mj_CreatedAt).toBe('T0');
+    });
+
+    it('hands the encrypted-field filter copies, not the cached rows', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+        const probe = new BatchProbe();
+
+        await probe.RunBatch(fakeBatchProvider([[cachedRow]]), [fakeViewInfo()], fakePayload());
+
+        expect(probe.filteredRows).not.toBeNull();
+        expect(probe.filteredRows![0]).not.toBe(cachedRow);
+    });
+});

package/src/__tests__/SessionManager.test.ts

@@ -43,7 +43,7 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
 // --- Partial mock: control ONLY UserCache.GetSystemUser (the scoped-anonymous elevation seam,
 //     issue #3371); everything else in the data provider stays real ---
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+vi.mock('@memberjunction/generic-database-provider', async (importOriginal) => {
     const actual = await importOriginal<Record<string, unknown>>();
     return {
         ...actual,

package/src/__tests__/WidgetSessionService.test.ts

@@ -8,7 +8,7 @@ import { describe, it, expect, vi } from 'vitest';
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
     Instance: { Users: [], UserByName: () => undefined, GetSystemUser: () => undefined },
     Users: [],

package/src/__tests__/databaseAbstraction.test.ts

@@ -100,6 +100,7 @@ vi.mock('@memberjunction/core', () => ({
 // Inline the actual implementation here so the env-var-handling tests below
 // exercise the genuine behavior (they're testing this function).
 vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [], GetSystemUser: vi.fn() } },
   resolveDbPlatformFromEnv: (envVarName: string = 'DB_PLATFORM'): 'sqlserver' | 'postgresql' | undefined => {
     const raw = process.env[envVarName];
     if (raw === undefined) return undefined;
@@ -117,7 +118,6 @@ vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
   SQLServerDataProvider: vi.fn(),
   SQLServerProviderConfigData: vi.fn(),
   setupSQLServerClient: vi.fn(),
-  UserCache: { Instance: { Users: [], GetSystemUser: vi.fn() } },
 }));
 
 vi.mock('@memberjunction/api-keys', () => ({

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -4,7 +4,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 // data-provider and communication stacks in at module load. Stub those out;
 // this suite only exercises provisioning's console-log behavior, so
 // @memberjunction/core (the logging implementation) stays real.
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: { Instance: { Users: [] } },
 }));
 vi.mock('@memberjunction/communication-engine', () => ({

package/src/__tests__/resolverBase.rls.test.ts

@@ -16,6 +16,9 @@ const { mockUserCacheUsers } = vi.hoisted(() => ({
 // Stub external deps before imports
 vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
     SQLServerDataProvider: class {},
+}));
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
     UserCache: {
         get Users() { return mockUserCacheUsers; },
     },

package/src/__tests__/secretRedactor.failOpen.test.ts

@@ -0,0 +1,135 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg, ResetUnboundCrudInputWarnings } from '../logging/secretRedactor.js';
+
+/**
+ * `redactArg` binds a GraphQL input type to an entity by NAME:
+ *
+ * ```ts
+ * const match = /^(Create|Update|Delete)(?<name>.+)Input$/.exec(inputTypeName);
+ * const entity = provider.Entities.find((e) => e.ClassName === match.groups.name);
+ * ```
+ *
+ * Codegen inputs embed the entity ClassName (`CreateMJCredentialInput` → `MJCredential`)
+ * so the lookup succeeds. Hand-written resolver inputs do not (`CreateConnectionInput`
+ * → `Connection`, which is no entity), so the lookup fails, no encrypted-field names
+ * are contributed, and the arg falls through to `shortenForLog` with values intact.
+ *
+ * The boot audit tests only the NAME pattern, so it classifies these as metadata-bound
+ * and stays silent — the reason the gap went unnoticed. These tests pin both the
+ * fail-open behaviour and the warning that now surfaces it.
+ */
+
+const SECRET = 'sk-live-CREDENTIAL-PAYLOAD';
+
+/** Minimal provider exposing one entity with one encrypted column. */
+function providerWith(entities: { ClassName: string; EncryptedFields: { Name: string }[] }[]): IMetadataProvider {
+    return { Entities: entities } as unknown as IMetadataProvider;
+}
+
+const CREDENTIAL_ENTITY = providerWith([
+    { ClassName: 'MJCredential', EncryptedFields: [{ Name: 'Values' }] },
+]);
+
+beforeEach(() => {
+    ResetUnboundCrudInputWarnings();
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('redactArg — entity-bound inputs (the codegen case)', () => {
+    it('redacts an encrypted column, keeping the rest', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Name: 'Stripe', Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        }) as Record<string, unknown>;
+
+        expect(out.Values).toBe('<redacted>');
+        expect(out.Name).toBe('Stripe');
+    });
+
+    it('emits no warning, because the binding resolved', () => {
+        redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        });
+        expect(console.warn).not.toHaveBeenCalled();
+    });
+});
+
+describe('redactArg — name matches the convention but no entity exists', () => {
+    const unbound = {
+        inputTypeName: 'CreateConnectionInput',
+        rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+        provider: CREDENTIAL_ENTITY,
+        noLogParameter: false,
+        noLogFields: new Set<string>(),
+    };
+
+    it('falls open — values are logged, which is the defect being surfaced', () => {
+        const out = redactArg({ ...unbound });
+        // Documents current behaviour: no entity binding and no @NoLog means no
+        // redaction source, so the value survives into the log.
+        expect(JSON.stringify(out)).toContain(SECRET);
+    });
+
+    it('now warns, naming the input type and what to do about it', () => {
+        redactArg({ ...unbound });
+
+        expect(console.warn).toHaveBeenCalledTimes(1);
+        const message = vi.mocked(console.warn).mock.calls[0][0] as string;
+        expect(message).toContain('CreateConnectionInput');
+        expect(message).toContain('@NoLog');
+        // The warning itself must not become a second leak.
+        expect(message).not.toContain(SECRET);
+    });
+
+    it('warns only once per input type, however hot the mutation is', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        expect(console.warn).toHaveBeenCalledTimes(1);
+    });
+
+    it('warns separately for a different unbound input type', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound, inputTypeName: 'CreateScheduleInput' });
+        expect(console.warn).toHaveBeenCalledTimes(2);
+    });
+});
+
+describe('redactArg — @NoLog closes the gap the metadata cannot', () => {
+    it('redacts a marked field on an input with no entity binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(['CredentialValues']),
+        }) as Record<string, unknown>;
+
+        expect(out.CredentialValues).toBe('<redacted>');
+        expect(out.CredentialName).toBe('acme');
+        expect(JSON.stringify(out)).not.toContain(SECRET);
+    });
+
+    it('a parameter-level mark redacts the whole arg regardless of binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: true,
+            noLogFields: new Set(),
+        });
+        expect(out).toBe('<redacted>');
+    });
+});

package/src/__tests__/widgetGuestElevation.test.ts

@@ -4,7 +4,7 @@ import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
 // Controls what UserCache.Instance.GetSystemUser() serves — undefined simulates an unpopulated
 // cache (no system user available), the fail-closed path.
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
     get Instance() {
       return { GetSystemUser: getSystemUserMock };

package/src/auth/exampleNewUserSubClass.ts

@@ -1,7 +1,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { Metadata, RunView, LogError, EntitySaveOptions } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { configInfo } from '../config.js';
 import { MJUserEntity } from '@memberjunction/core-entities';
 

package/src/auth/index.ts

@@ -1,8 +1,8 @@
 import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import { configInfo } from '../config.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import sql from 'mssql';
-import { Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { MJGlobal } from '@memberjunction/global';
 import { MJUserEntity, MJUserEntityType } from '@memberjunction/core-entities';
@@ -21,9 +21,13 @@ class MissingAuthError extends Error {
   }
 }
 
-const refreshUserCache = async (dataSource?: sql.ConnectionPool) => {
+const refreshUserCache = async () => {
   const startTime: number = Date.now();
-  await UserCache.Instance.Refresh(dataSource);
+  // UserCache is process-global in this phase, and so is the provider MJServer configures at
+  // bootstrap — the callers below only hold a ConnectionPool, which they use purely as a
+  // "the database is reachable" gate before asking for a refresh.
+  const provider = Metadata.Provider as unknown as DatabaseProviderBase; // global-provider-ok: server auth path; runs under the server's single default provider
+  await UserCache.Instance.Refresh(provider);
   const endTime: number = Date.now();
   const elapsed: number = endTime - startTime;
 
@@ -179,7 +183,7 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
     if (dataSource && attemptCacheUpdateIfNeeded) {
       console.warn(`System user not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
       return getSystemUser(dataSource, false); // try one more time but do not update cache next time if not found
     }
     throw new Error(`System user ID '${UserCache.Instance.SYSTEM_USER_ID}' not found in database`);
@@ -260,7 +264,7 @@ export const verifyUserRecord = async (
       // if we get here that means in the above, if we were attempting to create a new user, it did not work, or it wasn't attempted and we have a config that asks us to auto update the cache
       console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
 
       return verifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false); // try one more time but do not update cache next time if not found
     }

package/src/auth/magicLink/MagicLinkService.ts

@@ -29,7 +29,7 @@ import {
   type MJUserEntityType,
   type MJApplicationRoleEntity,
 } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo, type MagicLinkConfig } from '../../config.js';

package/src/auth/newUsers.ts

@@ -1,6 +1,6 @@
 import { ApplicationInfo, DatabaseProviderBase, EntitySaveOptions, LogError, LogStatus, Metadata, RunView, RunViewResult, UserInfo } from "@memberjunction/core";
 import { RegisterClass } from "@memberjunction/global";
-import { UserCache } from "@memberjunction/sqlserver-dataprovider";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { configInfo } from "../config.js";
 import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 

package/src/context.ts

@@ -19,10 +19,10 @@ import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
 import { DatabaseProviderBase, UserInfo, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
-import { SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { Metadata } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
-import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
+import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 
 // ── Session / login audit (Phase 3) ───────────────────────────────────────────