@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.3

package/LICENSE

@@ -1,7 +1,183 @@
-ISC License
+Business Source License 1.1
 
-Copyright (c) 2023 MemberJunction
+License text copyright (c) 2024 MariaDB plc, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB plc.
 
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+-----------------------------------------------------------------------------
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+Parameters
+
+Licensor:             Blue Cypress, Inc.
+
+Licensed Work:        MemberJunction.
+                      The Licensed Work is (c) 2023-2026 Blue Cypress, Inc.
+
+Additional Use Grant: Subject to the terms of this License, Licensor grants
+                      you the following additional rights to make Production
+                      Use of the Licensed Work.
+
+                      1. Internal Use
+
+                      You may make production use of the Licensed Work for
+                      your own internal business or organizational operations.
+
+                      2. Nonprofit Use
+
+                      If you are a Nonprofit, you may make production use of
+                      the Licensed Work for the operations and activities of
+                      your Organizational Family.
+
+                      3. MemberJunction Certified Program Use
+
+                      If you are authorized by Licensor under the
+                      MemberJunction Certified Program to provide professional
+                      services using the Licensed Work, you may make
+                      production use of the Licensed Work in providing such
+                      professional services to a client, provided that:
+
+                      (a) the Licensed Work is deployed in, and the applicable
+                      production use occurs within, an environment owned,
+                      leased, licensed, subscribed to, or otherwise controlled
+                      by that client; and
+
+                      (b) the production use is for that client's own internal
+                      business or organizational operations or is otherwise
+                      independently permitted to that client under this
+                      Additional Use Grant.
+
+                      4. Definitions Applicable to the Additional Use Grant
+
+                      "Affiliate" means, with respect to a specified Person,
+                      any other Person that directly or indirectly Controls,
+                      is Controlled by, or is under common Control with such
+                      specified Person.
+
+                      "Control" (including the terms "Controls," "Controlled
+                      by," and "under common Control with") means the direct
+                      or indirect possession of the power to direct or cause
+                      the direction of the management and policies of a
+                      Person, whether through ownership of voting interests,
+                      by contract, or otherwise.
+
+                      "Organizational Family" means, with respect to a Person,
+                      (a) such Person and its Affiliates, and (b) any
+                      nonprofit organization, governmental entity, chapter,
+                      division, local affiliate, regional affiliate, state
+                      affiliate, national affiliate, or other entity that is
+                      formally affiliated with such Person through governing
+                      documents, a charter, bylaws, a membership agreement, or
+                      another written organizational instrument, and is
+                      recognized under such documents as part of the same
+                      organizational structure.
+
+                      "Nonprofit" means a Person recognized by the Internal
+                      Revenue Service as exempt from federal income taxation
+                      under Section 501(c)(3), 501(c)(4), 501(c)(5), or
+                      501(c)(6) of the Internal Revenue Code, or a foreign
+                      organization recognized under substantially equivalent
+                      laws.
+
+                      A Person claiming eligibility as a Nonprofit shall, upon
+                      Licensor's reasonable request, provide documentation
+                      reasonably sufficient to demonstrate that it qualifies
+                      as a Nonprofit. If such Person materially misrepresents,
+                      or is unable to demonstrate, its qualification as a
+                      Nonprofit, the rights granted to such Person under
+                      Section 2 of this Additional Use Grant shall terminate.
+
+                      "MemberJunction Certified Program" means Licensor's
+                      then-current program for certifying and authorizing a
+                      Person to provide professional services using the
+                      Licensed Work.
+
+                      "Person" means any individual, corporation, limited
+                      liability company, partnership, association, nonprofit
+                      organization, governmental entity, or other legal or
+                      organizational entity.
+
+Change Date:          Four (4) years from the date the Licensed Work is first
+                      made available.
+
+Change License:       MIT License.
+
+For information about alternative licensing arrangements for the Licensed
+Work, please contact Blue Cypress, Inc.
+
+-----------------------------------------------------------------------------
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+-----------------------------------------------------------------------------
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License
+   can be included in a program with software provided under GPL Version 2.0
+   or a later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+-----------------------------------------------------------------------------
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.

package/dist/auth/AuthProviderCatalogRouter.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @fileoverview Unauthenticated provider-catalog endpoint.
+ *
+ * The browser must know which identity providers exist BEFORE it can authenticate, so this
+ * router is mounted ahead of the unified auth middleware — the same pattern the magic-link JWKS
+ * and widget-session routes already use.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { Router } from 'express';
+/** Mount path for the public catalog router. */
+export declare const AUTH_CATALOG_MOUNT_PATH = "/auth";
+/**
+ * Builds the unauthenticated `GET /auth/providers` router.
+ *
+ * **What it exposes.** Only `Active` + `ClientVisible` rows, projected to the public allow-list
+ * by {@link AuthProviderEngine.GetPublicCatalog}. Secret material is structurally unable to reach
+ * this response: `CredentialID` and `AdditionalConfiguration` are not part of the public shape,
+ * and non-primitive `ClientConfiguration` values are dropped rather than serialized.
+ *
+ * **Why publishing this is safe.** Every value here was already shipped to anonymous users — a
+ * single-provider SPA compiled its client ID, domain and issuer straight into its JavaScript
+ * bundle. This endpoint moves that same data behind one source of truth; it does not widen what
+ * an anonymous caller can learn.
+ *
+ * **Failure is empty, not an error.** If the catalog cannot be read, the endpoint returns an empty
+ * list so the browser falls back to its compiled `AUTH_TYPE` and the user can still sign in.
+ * Returning 500 would take the login screen down for a problem the client can route around.
+ */
+export declare function createAuthProviderCatalogRouter(): Router;
+//# sourceMappingURL=AuthProviderCatalogRouter.d.ts.map

package/dist/auth/AuthProviderCatalogRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProviderCatalogRouter.d.ts","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAK9D,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAiB/C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAyBxD"}

package/dist/auth/AuthProviderCatalogRouter.js

@@ -0,0 +1,69 @@
+/**
+ * @fileoverview Unauthenticated provider-catalog endpoint.
+ *
+ * The browser must know which identity providers exist BEFORE it can authenticate, so this
+ * router is mounted ahead of the unified auth middleware — the same pattern the magic-link JWKS
+ * and widget-session routes already use.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { Router } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError } from '@memberjunction/core';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
+/** Mount path for the public catalog router. */
+export const AUTH_CATALOG_MOUNT_PATH = '/auth';
+/** Requests per window per IP. Generous — a browser makes one call per page load. */
+const DEFAULT_RATE_LIMIT_MAX = 60;
+/** Rate-limit window. */
+const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
+/**
+ * How long a browser may cache the catalog.
+ *
+ * Short by design: this drives the login screen, so an admin who enables a provider expects to
+ * see it without telling users to hard-refresh. A minute keeps the endpoint cheap without making
+ * configuration changes feel stuck.
+ */
+const CACHE_MAX_AGE_SECONDS = 60;
+/**
+ * Builds the unauthenticated `GET /auth/providers` router.
+ *
+ * **What it exposes.** Only `Active` + `ClientVisible` rows, projected to the public allow-list
+ * by {@link AuthProviderEngine.GetPublicCatalog}. Secret material is structurally unable to reach
+ * this response: `CredentialID` and `AdditionalConfiguration` are not part of the public shape,
+ * and non-primitive `ClientConfiguration` values are dropped rather than serialized.
+ *
+ * **Why publishing this is safe.** Every value here was already shipped to anonymous users — a
+ * single-provider SPA compiled its client ID, domain and issuer straight into its JavaScript
+ * bundle. This endpoint moves that same data behind one source of truth; it does not widen what
+ * an anonymous caller can learn.
+ *
+ * **Failure is empty, not an error.** If the catalog cannot be read, the endpoint returns an empty
+ * list so the browser falls back to its compiled `AUTH_TYPE` and the user can still sign in.
+ * Returning 500 would take the login screen down for a problem the client can route around.
+ */
+export function createAuthProviderCatalogRouter() {
+    const router = Router();
+    const limiter = rateLimit({
+        windowMs: DEFAULT_RATE_LIMIT_WINDOW_MS,
+        limit: DEFAULT_RATE_LIMIT_MAX,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: { providers: [] }
+    });
+    router.get('/providers', limiter, (_req, res) => {
+        try {
+            const body = { providers: AuthProviderEngine.Instance.GetPublicCatalog() };
+            res.set('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
+            res.status(200).json(body);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            LogError(`[Auth] Failed to serve the public provider catalog: ${message}`);
+            const empty = { providers: [] };
+            res.status(200).json(empty);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=AuthProviderCatalogRouter.js.map

package/dist/auth/AuthProviderCatalogRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProviderCatalogRouter.js","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAkC,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,qFAAqF;AACrF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,yBAAyB;AACzB,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAA8B,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACtG,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,qBAAqB,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,uDAAuD,OAAO,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,GAA8B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/AuthProviderEngine.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview Metadata-driven authentication provider catalog.
+ *
+ * Loads `MJ: Authentication Providers` rows and registers each one with the runtime
+ * `AuthProviderFactory`, resolving the concrete driver through `ClassFactory` by `DriverClass`.
+ * This is the auth subsystem's equivalent of the File Storage `ServerDriverKey` pattern:
+ * adding a provider is a subclass plus a row, never an edit to core code.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { BaseEngine, UserInfo, type IMetadataProvider, type PublicAuthProviderInfo } from '@memberjunction/core';
+import { MJAuthenticationProviderEntity } from '@memberjunction/core-entities';
+/**
+ * Loads the authentication-provider catalog from metadata and registers it with the
+ * {@link AuthProviderFactory}.
+ *
+ * **Not `deferred`**: no authenticated request may be served before the catalog is registered,
+ * or tokens from a metadata-defined provider would be rejected during the startup window.
+ *
+ * **Severity is `warn`, not `fatal`**, and that is deliberate. This engine is one of two possible
+ * sources of providers — `initializeAuthProviders` also registers whatever `mj.config.cjs`
+ * declares. Making a catalog load failure fatal would turn a transient metadata problem into a
+ * total authentication outage for deployments that never adopted the table. The failure is
+ * logged loudly and the config-declared providers still stand.
+ */
+export declare class AuthProviderEngine extends BaseEngine<AuthProviderEngine> {
+    private _providers;
+    static get Instance(): AuthProviderEngine;
+    /**
+     * Loads Active providers only. Inactive rows are excluded at the query rather than filtered
+     * later, so a disabled provider is never even instantiated.
+     */
+    Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void>;
+    /** Active providers from metadata, ordered for presentation. */
+    get Providers(): MJAuthenticationProviderEntity[];
+    /**
+     * Startup hook: load the catalog, then register every row with the factory.
+     */
+    HandleStartup(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void>;
+    /**
+     * Instantiates and registers every catalog row with the {@link AuthProviderFactory}.
+     *
+     * One bad row must not cost the deployment its other providers, so each registration is
+     * isolated: a failure is logged with the offending provider's name and the loop continues.
+     *
+     * @returns the number of providers successfully registered.
+     */
+    RegisterAll(contextUser?: UserInfo): Promise<number>;
+    /**
+     * Projects a catalog row onto the runtime {@link AuthProviderConfig} the driver expects.
+     *
+     * `AdditionalConfiguration` is spread FIRST so that the modelled columns win over anything a
+     * driver-specific blob happens to repeat — the columns are the reviewable, described surface,
+     * and a JSON blob must not be able to silently redefine the issuer a token is validated against.
+     */
+    private buildProviderConfig;
+    /**
+     * Splits the delimited `Scopes` column into the parsed list both projections publish.
+     *
+     * This is the single home of the delimiter convention: `buildProviderConfig` and
+     * `GetPublicCatalog` must agree on it, or the server would validate tokens against one scope
+     * set while telling the browser to request another.
+     */
+    private parseScopes;
+    /**
+     * Decrypts the row's linked credential, when it has one.
+     *
+     * Almost every provider validates tokens against a public JWKS and needs no secret at all, so
+     * this is the uncommon path — present for confidential-client flows, management APIs, and SCIM.
+     */
+    private resolveCredential;
+    /**
+     * Parses a JSON configuration column, treating malformed content as absent.
+     *
+     * Throwing here would take down an otherwise-valid provider over a stray character in an
+     * optional extras blob, so the row is registered without the extras and the problem is logged.
+     */
+    private parseJsonColumn;
+    /**
+     * Projects the catalog to the PUBLIC shape served by the unauthenticated catalog endpoint.
+     *
+     * The projection is an explicit allow-list rather than a redaction of the full row: a column
+     * added to this entity later is invisible to anonymous callers until someone deliberately adds
+     * it here. `AdditionalConfiguration` and `CredentialID` are structurally absent, never merely
+     * omitted at serialization time.
+     */
+    GetPublicCatalog(): PublicAuthProviderInfo[];
+    /**
+     * Flattens a parsed `ClientConfiguration` blob to the primitive key/value shape the browser
+     * contract declares. Nested objects and arrays are dropped with a warning rather than passed
+     * through, so a structured blob (the shape a credential would take) cannot ride along to an
+     * anonymous caller.
+     */
+    private toPublicClientConfig;
+}
+//# sourceMappingURL=AuthProviderEngine.d.ts.map

package/dist/auth/AuthProviderEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProviderEngine.d.ts","sourceRoot":"","sources":["../../src/auth/AuthProviderEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,UAAU,EAKV,QAAQ,EAER,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAU/E;;;;;;;;;;;;GAYG;AACH,qBAMa,kBAAmB,SAAQ,UAAU,CAAC,kBAAkB,CAAC;IACpE,OAAO,CAAC,UAAU,CAAwC;IAE1D,WAAkB,QAAQ,IAAI,kBAAkB,CAE/C;IAED;;;OAGG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAahH,gEAAgE;IAChE,IAAW,SAAS,IAAI,8BAA8B,EAAE,CAEvD;IAED;;OAEG;IACU,aAAa,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/F;;;;;;;OAOG;IACU,WAAW,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBjE;;;;;;OAMG;YACW,mBAAmB;IAqBjC;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAInB;;;;;OAKG;YACW,iBAAiB;IAa/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;;OAOG;IACI,gBAAgB,IAAI,sBAAsB,EAAE;IA6BnD;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;CAW7B"}

package/dist/auth/AuthProviderEngine.js

@@ -0,0 +1,245 @@
+/**
+ * @fileoverview Metadata-driven authentication provider catalog.
+ *
+ * Loads `MJ: Authentication Providers` rows and registers each one with the runtime
+ * `AuthProviderFactory`, resolving the concrete driver through `ClassFactory` by `DriverClass`.
+ * This is the auth subsystem's equivalent of the File Storage `ServerDriverKey` pattern:
+ * adding a provider is a subclass plus a row, never an edit to core code.
+ *
+ * @module @memberjunction/server/auth
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEngine, LogError, LogStatusEx, RegisterForStartup } from '@memberjunction/core';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { CredentialEngine } from '@memberjunction/credentials';
+/**
+ * Subsystem label used when this engine asks CredentialEngine to decrypt secret material,
+ * so credential-access auditing attributes the read to authentication.
+ */
+const CREDENTIAL_SUBSYSTEM = 'Authentication';
+/**
+ * Loads the authentication-provider catalog from metadata and registers it with the
+ * {@link AuthProviderFactory}.
+ *
+ * **Not `deferred`**: no authenticated request may be served before the catalog is registered,
+ * or tokens from a metadata-defined provider would be rejected during the startup window.
+ *
+ * **Severity is `warn`, not `fatal`**, and that is deliberate. This engine is one of two possible
+ * sources of providers — `initializeAuthProviders` also registers whatever `mj.config.cjs`
+ * declares. Making a catalog load failure fatal would turn a transient metadata problem into a
+ * total authentication outage for deployments that never adopted the table. The failure is
+ * logged loudly and the config-declared providers still stand.
+ */
+let AuthProviderEngine = class AuthProviderEngine extends BaseEngine {
+    constructor() {
+        super(...arguments);
+        this._providers = [];
+    }
+    static get Instance() {
+        return super.getInstance();
+    }
+    /**
+     * Loads Active providers only. Inactive rows are excluded at the query rather than filtered
+     * later, so a disabled provider is never even instantiated.
+     */
+    async Config(forceRefresh, contextUser, provider) {
+        const configs = [
+            {
+                PropertyName: '_providers',
+                EntityName: 'MJ: Authentication Providers',
+                Filter: `Status='Active'`,
+                OrderBy: 'Sequence ASC, Name ASC',
+                CacheLocal: true
+            }
+        ];
+        await this.Load(configs, provider, forceRefresh, contextUser);
+    }
+    /** Active providers from metadata, ordered for presentation. */
+    get Providers() {
+        return this.GetConfigData('_providers');
+    }
+    /**
+     * Startup hook: load the catalog, then register every row with the factory.
+     */
+    async HandleStartup(contextUser, provider) {
+        await this.Config(false, contextUser, provider);
+        await this.RegisterAll(contextUser);
+    }
+    /**
+     * Instantiates and registers every catalog row with the {@link AuthProviderFactory}.
+     *
+     * One bad row must not cost the deployment its other providers, so each registration is
+     * isolated: a failure is logged with the offending provider's name and the loop continues.
+     *
+     * @returns the number of providers successfully registered.
+     */
+    async RegisterAll(contextUser) {
+        const factory = AuthProviderFactory.Instance;
+        let registered = 0;
+        for (const row of this.Providers) {
+            try {
+                const config = await this.buildProviderConfig(row, contextUser);
+                factory.register(AuthProviderFactory.createProvider(config));
+                registered++;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                LogError(`[Auth] Could not register metadata provider '${row.Name}' (DriverClass '${row.DriverClass}'): ${message}`);
+            }
+        }
+        if (registered > 0) {
+            LogStatusEx({ message: `[Auth] Registered ${registered} provider(s) from metadata.`, verboseOnly: true });
+        }
+        return registered;
+    }
+    /**
+     * Projects a catalog row onto the runtime {@link AuthProviderConfig} the driver expects.
+     *
+     * `AdditionalConfiguration` is spread FIRST so that the modelled columns win over anything a
+     * driver-specific blob happens to repeat — the columns are the reviewable, described surface,
+     * and a JSON blob must not be able to silently redefine the issuer a token is validated against.
+     */
+    async buildProviderConfig(row, contextUser) {
+        const additional = this.parseJsonColumn(row.AdditionalConfiguration, row.Name, 'AdditionalConfiguration');
+        const secrets = await this.resolveCredential(row, contextUser);
+        const config = {
+            ...additional,
+            ...secrets,
+            name: row.Name,
+            type: row.DriverClass
+        };
+        if (row.ClientID)
+            config.clientId = row.ClientID;
+        if (row.Domain)
+            config.domain = row.Domain;
+        if (row.Issuer)
+            config.issuer = row.Issuer;
+        if (row.Audience)
+            config.audience = row.Audience;
+        if (row.JWKSUri)
+            config.jwksUri = row.JWKSUri;
+        if (row.Scopes)
+            config.scopes = this.parseScopes(row.Scopes);
+        return config;
+    }
+    /**
+     * Splits the delimited `Scopes` column into the parsed list both projections publish.
+     *
+     * This is the single home of the delimiter convention: `buildProviderConfig` and
+     * `GetPublicCatalog` must agree on it, or the server would validate tokens against one scope
+     * set while telling the browser to request another.
+     */
+    parseScopes(raw) {
+        return raw ? raw.split(/[\s,]+/).filter((s) => s.length > 0) : [];
+    }
+    /**
+     * Decrypts the row's linked credential, when it has one.
+     *
+     * Almost every provider validates tokens against a public JWKS and needs no secret at all, so
+     * this is the uncommon path — present for confidential-client flows, management APIs, and SCIM.
+     */
+    async resolveCredential(row, contextUser) {
+        if (!row.CredentialID || !row.Credential) {
+            return {};
+        }
+        await CredentialEngine.Instance.Config(false, contextUser);
+        const resolved = await CredentialEngine.Instance.getCredential(row.Credential, {
+            contextUser,
+            subsystem: CREDENTIAL_SUBSYSTEM
+        });
+        return resolved.values;
+    }
+    /**
+     * Parses a JSON configuration column, treating malformed content as absent.
+     *
+     * Throwing here would take down an otherwise-valid provider over a stray character in an
+     * optional extras blob, so the row is registered without the extras and the problem is logged.
+     */
+    parseJsonColumn(raw, providerName, columnName) {
+        if (!raw?.trim()) {
+            return {};
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            LogError(`[Auth] ${columnName} on provider '${providerName}' is not a JSON object; ignoring it.`);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            LogError(`[Auth] ${columnName} on provider '${providerName}' is not valid JSON (${message}); ignoring it.`);
+        }
+        return {};
+    }
+    /**
+     * Projects the catalog to the PUBLIC shape served by the unauthenticated catalog endpoint.
+     *
+     * The projection is an explicit allow-list rather than a redaction of the full row: a column
+     * added to this entity later is invisible to anonymous callers until someone deliberately adds
+     * it here. `AdditionalConfiguration` and `CredentialID` are structurally absent, never merely
+     * omitted at serialization time.
+     */
+    GetPublicCatalog() {
+        return this.Providers.filter((row) => row.ClientVisible).map((row) => {
+            const info = {
+                name: row.Name,
+                driverClass: row.DriverClass,
+                displayName: row.DisplayName ?? row.Name,
+                sequence: row.Sequence,
+                isDefault: row.IsDefault
+            };
+            if (row.Icon)
+                info.icon = row.Icon;
+            if (row.ClientID)
+                info.clientId = row.ClientID;
+            if (row.Issuer)
+                info.issuer = row.Issuer;
+            if (row.Domain)
+                info.domain = row.Domain;
+            // Published pre-parsed so the browser never re-derives the delimiter convention —
+            // the drivers hand this straight to SDK config typed string[].
+            const scopes = this.parseScopes(row.Scopes);
+            if (scopes.length > 0)
+                info.scopes = scopes;
+            const clientConfig = this.parseJsonColumn(row.ClientConfiguration, row.Name, 'ClientConfiguration');
+            if (Object.keys(clientConfig).length > 0) {
+                info.clientConfiguration = this.toPublicClientConfig(clientConfig, row.Name);
+            }
+            return info;
+        });
+    }
+    /**
+     * Flattens a parsed `ClientConfiguration` blob to the primitive key/value shape the browser
+     * contract declares. Nested objects and arrays are dropped with a warning rather than passed
+     * through, so a structured blob (the shape a credential would take) cannot ride along to an
+     * anonymous caller.
+     */
+    toPublicClientConfig(parsed, providerName) {
+        const result = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (value === null || ['string', 'number', 'boolean'].includes(typeof value)) {
+                result[key] = value;
+            }
+            else {
+                LogError(`[Auth] ClientConfiguration key '${key}' on provider '${providerName}' is not a primitive value; it was NOT published to the public catalog.`);
+            }
+        }
+        return result;
+    }
+};
+AuthProviderEngine = __decorate([
+    RegisterForStartup({
+        priority: 20,
+        severity: 'warn',
+        deferred: false,
+        description: 'Loads the metadata authentication-provider catalog and registers it with AuthProviderFactory'
+    })
+], AuthProviderEngine);
+export { AuthProviderEngine };
+//# sourceMappingURL=AuthProviderEngine.js.map

package/dist/auth/AuthProviderEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProviderEngine.js","sourceRoot":"","sources":["../../src/auth/AuthProviderEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;AAEH,OAAO,EACL,UAAU,EAEV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAKnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D;;;GAGG;AACH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;;;;;;;;;;GAYG;AAOI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,UAA8B;IAA/D;;QACG,eAAU,GAAqC,EAAE,CAAC;IAwM5D,CAAC;IAtMQ,MAAM,KAAK,QAAQ;QACxB,OAAO,KAAK,CAAC,WAAW,EAAsB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC9F,MAAM,OAAO,GAAwC;YACnD;gBACE,YAAY,EAAE,YAAY;gBAC1B,UAAU,EAAE,8BAA8B;gBAC1C,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI;aACjB;SACF,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,gEAAgE;IAChE,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,aAAa,CAAiC,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,WAAsB,EAAE,QAA4B;QAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,WAAW,CAAC,WAAsB;QAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7D,UAAU,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,QAAQ,CAAC,gDAAgD,GAAG,CAAC,IAAI,mBAAmB,GAAG,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,WAAW,CAAC,EAAE,OAAO,EAAE,qBAAqB,UAAU,6BAA6B,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAmC,EAAE,WAAsB;QAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAuB;YACjC,GAAG,UAAU;YACb,GAAG,OAAO;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,WAAW;SACtB,CAAC;QAEF,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,GAAkB;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAmC,EAAE,WAAsB;QACzF,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE;YAC7E,WAAW;YACX,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAkB,EAAE,YAAoB,EAAE,UAAkB;QAClF,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAiC,CAAC;YAC3C,CAAC;YACD,QAAQ,CAAC,UAAU,UAAU,iBAAiB,YAAY,sCAAsC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,UAAU,UAAU,iBAAiB,YAAY,wBAAwB,OAAO,iBAAiB,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;OAOG;IACI,gBAAgB;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACnE,MAAM,IAAI,GAA2B;gBACnC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI;gBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACnC,IAAI,GAAG,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC/C,IAAI,GAAG,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAEzC,kFAAkF;YAClF,+DAA+D;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACpG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,MAA+B,EAAE,YAAoB;QAChF,MAAM,MAAM,GAAqD,EAAE,CAAC;QACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,KAAyC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mCAAmC,GAAG,kBAAkB,YAAY,yEAAyE,CAAC,CAAC;YAC1J,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAzMY,kBAAkB;IAN9B,kBAAkB,CAAC;QAClB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8FAA8F;KAC5G,CAAC;GACW,kBAAkB,CAyM9B"}