@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.3

package/src/__tests__/resolverBase.rls.test.ts

@@ -16,6 +16,9 @@ const { mockUserCacheUsers } = vi.hoisted(() => ({
 // Stub external deps before imports
 vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
     SQLServerDataProvider: class {},
+}));
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
     UserCache: {
         get Users() { return mockUserCacheUsers; },
     },

package/src/__tests__/secretRedactor.failOpen.test.ts

@@ -0,0 +1,135 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { IMetadataProvider } from '@memberjunction/core';
+import { redactArg, ResetUnboundCrudInputWarnings } from '../logging/secretRedactor.js';
+
+/**
+ * `redactArg` binds a GraphQL input type to an entity by NAME:
+ *
+ * ```ts
+ * const match = /^(Create|Update|Delete)(?<name>.+)Input$/.exec(inputTypeName);
+ * const entity = provider.Entities.find((e) => e.ClassName === match.groups.name);
+ * ```
+ *
+ * Codegen inputs embed the entity ClassName (`CreateMJCredentialInput` → `MJCredential`)
+ * so the lookup succeeds. Hand-written resolver inputs do not (`CreateConnectionInput`
+ * → `Connection`, which is no entity), so the lookup fails, no encrypted-field names
+ * are contributed, and the arg falls through to `shortenForLog` with values intact.
+ *
+ * The boot audit tests only the NAME pattern, so it classifies these as metadata-bound
+ * and stays silent — the reason the gap went unnoticed. These tests pin both the
+ * fail-open behaviour and the warning that now surfaces it.
+ */
+
+const SECRET = 'sk-live-CREDENTIAL-PAYLOAD';
+
+/** Minimal provider exposing one entity with one encrypted column. */
+function providerWith(entities: { ClassName: string; EncryptedFields: { Name: string }[] }[]): IMetadataProvider {
+    return { Entities: entities } as unknown as IMetadataProvider;
+}
+
+const CREDENTIAL_ENTITY = providerWith([
+    { ClassName: 'MJCredential', EncryptedFields: [{ Name: 'Values' }] },
+]);
+
+beforeEach(() => {
+    ResetUnboundCrudInputWarnings();
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('redactArg — entity-bound inputs (the codegen case)', () => {
+    it('redacts an encrypted column, keeping the rest', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Name: 'Stripe', Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        }) as Record<string, unknown>;
+
+        expect(out.Values).toBe('<redacted>');
+        expect(out.Name).toBe('Stripe');
+    });
+
+    it('emits no warning, because the binding resolved', () => {
+        redactArg({
+            inputTypeName: 'CreateMJCredentialInput',
+            rawValue: { Values: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(),
+        });
+        expect(console.warn).not.toHaveBeenCalled();
+    });
+});
+
+describe('redactArg — name matches the convention but no entity exists', () => {
+    const unbound = {
+        inputTypeName: 'CreateConnectionInput',
+        rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+        provider: CREDENTIAL_ENTITY,
+        noLogParameter: false,
+        noLogFields: new Set<string>(),
+    };
+
+    it('falls open — values are logged, which is the defect being surfaced', () => {
+        const out = redactArg({ ...unbound });
+        // Documents current behaviour: no entity binding and no @NoLog means no
+        // redaction source, so the value survives into the log.
+        expect(JSON.stringify(out)).toContain(SECRET);
+    });
+
+    it('now warns, naming the input type and what to do about it', () => {
+        redactArg({ ...unbound });
+
+        expect(console.warn).toHaveBeenCalledTimes(1);
+        const message = vi.mocked(console.warn).mock.calls[0][0] as string;
+        expect(message).toContain('CreateConnectionInput');
+        expect(message).toContain('@NoLog');
+        // The warning itself must not become a second leak.
+        expect(message).not.toContain(SECRET);
+    });
+
+    it('warns only once per input type, however hot the mutation is', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        redactArg({ ...unbound });
+        expect(console.warn).toHaveBeenCalledTimes(1);
+    });
+
+    it('warns separately for a different unbound input type', () => {
+        redactArg({ ...unbound });
+        redactArg({ ...unbound, inputTypeName: 'CreateScheduleInput' });
+        expect(console.warn).toHaveBeenCalledTimes(2);
+    });
+});
+
+describe('redactArg — @NoLog closes the gap the metadata cannot', () => {
+    it('redacts a marked field on an input with no entity binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: false,
+            noLogFields: new Set(['CredentialValues']),
+        }) as Record<string, unknown>;
+
+        expect(out.CredentialValues).toBe('<redacted>');
+        expect(out.CredentialName).toBe('acme');
+        expect(JSON.stringify(out)).not.toContain(SECRET);
+    });
+
+    it('a parameter-level mark redacts the whole arg regardless of binding', () => {
+        const out = redactArg({
+            inputTypeName: 'CreateConnectionInput',
+            rawValue: { CredentialValues: SECRET },
+            provider: CREDENTIAL_ENTITY,
+            noLogParameter: true,
+            noLogFields: new Set(),
+        });
+        expect(out).toBe('<redacted>');
+    });
+});

package/src/__tests__/uploadTokenManager.test.ts

@@ -0,0 +1,159 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { UploadTokenManager } from '../rest/UploadTokenManager.js';
+
+describe('UploadTokenManager', () => {
+  beforeEach(() => {
+    UploadTokenManager.Instance.Clear();
+    UploadTokenManager.Instance.maxFileSizeBytes = 100 * 1024 * 1024;
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 500 * 1024 * 1024;
+  });
+
+  it('stages and consumes a buffer atomically', () => {
+    const buf = Buffer.from('hello world raw binary', 'utf-8');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'test.txt',
+      mimeType: 'text/plain',
+      userId: 'user-123',
+    });
+
+    expect(token).toMatch(/^upt_[a-f0-9]{64}$/);
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(1);
+    expect(UploadTokenManager.Instance.TotalMemoryBytes).toBe(buf.length);
+
+    // Consume with matching user
+    const consumed = UploadTokenManager.Instance.Consume(token, 'user-123');
+    expect(consumed).not.toBeNull();
+    expect(consumed?.buffer.toString('utf-8')).toBe('hello world raw binary');
+    expect(consumed?.fileName).toBe('test.txt');
+    expect(consumed?.mimeType).toBe('text/plain');
+
+    // Single-use: consuming again must return null
+    expect(UploadTokenManager.Instance.Consume(token, 'user-123')).toBeNull();
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+    expect(UploadTokenManager.Instance.TotalMemoryBytes).toBe(0);
+  });
+
+  it('rejects claim by a different user and evicts token', () => {
+    const buf = Buffer.from('secret payload', 'utf-8');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'secret.pdf',
+      mimeType: 'application/pdf',
+      userId: 'user-authorized',
+    });
+
+    // Claim attempt by attacker
+    const result = UploadTokenManager.Instance.Consume(token, 'user-attacker');
+    expect(result).toBeNull();
+
+    // Token must be evicted after failed attempt
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+    expect(UploadTokenManager.Instance.Consume(token, 'user-authorized')).toBeNull();
+  });
+
+  it('enforces single file size limit', () => {
+    UploadTokenManager.Instance.maxFileSizeBytes = 10;
+    const buf = Buffer.alloc(20);
+
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: buf,
+        fileName: 'huge.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-123',
+      });
+    }).toThrow(/exceeds maximum allowed file size/);
+  });
+
+  it('enforces pool memory capacity limit', () => {
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 50;
+
+    UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'file1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-123',
+    });
+
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: Buffer.alloc(30),
+        fileName: 'file2.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-123',
+      });
+    }).toThrow(/memory capacity reached/);
+  });
+
+  it('auto-evicts token after TTL expiry', async () => {
+    vi.useFakeTimers();
+    try {
+      const buf = Buffer.from('ephemeral data');
+      const token = UploadTokenManager.Instance.Stage({
+        buffer: buf,
+        fileName: 'temp.txt',
+        mimeType: 'text/plain',
+        userId: 'user-123',
+        ttlSeconds: 5,
+      });
+
+      expect(UploadTokenManager.Instance.ActiveCount).toBe(1);
+
+      // Fast-forward 6 seconds
+      vi.advanceTimersByTime(6000);
+
+      expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+      expect(UploadTokenManager.Instance.Consume(token, 'user-123')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('normalizes UUIDs when verifying claiming user', () => {
+    const buf = Buffer.from('uuid test data');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'uuid.txt',
+      mimeType: 'text/plain',
+      userId: '4A68B0D7-49EE-4D56-82DE-92F66627EE2B',
+    });
+
+    // Claim with lowercase UUID
+    const consumed = UploadTokenManager.Instance.Consume(token, '4a68b0d7-49ee-4d56-82de-92f66627ee2b');
+    expect(consumed).not.toBeNull();
+    expect(consumed?.buffer.toString('utf-8')).toBe('uuid test data');
+  });
+
+  it('enforces per-user memory quota independently of pool memory', () => {
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 500;
+    UploadTokenManager.Instance.maxUserMemoryBytes = 40;
+
+    // User A stages 30 bytes (OK)
+    UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'userA_1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-A',
+    });
+
+    // User A tries to stage another 20 bytes (exceeds 40 byte user quota)
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: Buffer.alloc(20),
+        fileName: 'userA_2.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-A',
+      });
+    }).toThrow(/Per-user upload memory quota reached/);
+
+    // User B can still stage 30 bytes because User B has their own quota
+    const tokenB = UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'userB_1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-B',
+    });
+    expect(tokenB).toBeDefined();
+  });
+});

package/src/__tests__/widgetGuestElevation.test.ts

@@ -4,7 +4,7 @@ import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
 // Controls what UserCache.Instance.GetSystemUser() serves — undefined simulates an unpopulated
 // cache (no system user available), the fail-closed path.
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+vi.mock('@memberjunction/generic-database-provider', () => ({
   UserCache: {
     get Instance() {
       return { GetSystemUser: getSystemUserMock };

package/src/auth/AuthProviderCatalogRouter.ts

@@ -0,0 +1,76 @@
+/**
+ * @fileoverview Unauthenticated provider-catalog endpoint.
+ *
+ * The browser must know which identity providers exist BEFORE it can authenticate, so this
+ * router is mounted ahead of the unified auth middleware — the same pattern the magic-link JWKS
+ * and widget-session routes already use.
+ *
+ * @module @memberjunction/server/auth
+ */
+
+import { Router, type Request, type Response } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError, type PublicAuthProviderCatalog } from '@memberjunction/core';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
+
+/** Mount path for the public catalog router. */
+export const AUTH_CATALOG_MOUNT_PATH = '/auth';
+
+/** Requests per window per IP. Generous — a browser makes one call per page load. */
+const DEFAULT_RATE_LIMIT_MAX = 60;
+
+/** Rate-limit window. */
+const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
+
+/**
+ * How long a browser may cache the catalog.
+ *
+ * Short by design: this drives the login screen, so an admin who enables a provider expects to
+ * see it without telling users to hard-refresh. A minute keeps the endpoint cheap without making
+ * configuration changes feel stuck.
+ */
+const CACHE_MAX_AGE_SECONDS = 60;
+
+/**
+ * Builds the unauthenticated `GET /auth/providers` router.
+ *
+ * **What it exposes.** Only `Active` + `ClientVisible` rows, projected to the public allow-list
+ * by {@link AuthProviderEngine.GetPublicCatalog}. Secret material is structurally unable to reach
+ * this response: `CredentialID` and `AdditionalConfiguration` are not part of the public shape,
+ * and non-primitive `ClientConfiguration` values are dropped rather than serialized.
+ *
+ * **Why publishing this is safe.** Every value here was already shipped to anonymous users — a
+ * single-provider SPA compiled its client ID, domain and issuer straight into its JavaScript
+ * bundle. This endpoint moves that same data behind one source of truth; it does not widen what
+ * an anonymous caller can learn.
+ *
+ * **Failure is empty, not an error.** If the catalog cannot be read, the endpoint returns an empty
+ * list so the browser falls back to its compiled `AUTH_TYPE` and the user can still sign in.
+ * Returning 500 would take the login screen down for a problem the client can route around.
+ */
+export function createAuthProviderCatalogRouter(): Router {
+  const router = Router();
+
+  const limiter = rateLimit({
+    windowMs: DEFAULT_RATE_LIMIT_WINDOW_MS,
+    limit: DEFAULT_RATE_LIMIT_MAX,
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: { providers: [] }
+  });
+
+  router.get('/providers', limiter, (_req: Request, res: Response) => {
+    try {
+      const body: PublicAuthProviderCatalog = { providers: AuthProviderEngine.Instance.GetPublicCatalog() };
+      res.set('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
+      res.status(200).json(body);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`[Auth] Failed to serve the public provider catalog: ${message}`);
+      const empty: PublicAuthProviderCatalog = { providers: [] };
+      res.status(200).json(empty);
+    }
+  });
+
+  return router;
+}

package/src/auth/AuthProviderEngine.ts

@@ -0,0 +1,253 @@
+/**
+ * @fileoverview Metadata-driven authentication provider catalog.
+ *
+ * Loads `MJ: Authentication Providers` rows and registers each one with the runtime
+ * `AuthProviderFactory`, resolving the concrete driver through `ClassFactory` by `DriverClass`.
+ * This is the auth subsystem's equivalent of the File Storage `ServerDriverKey` pattern:
+ * adding a provider is a subclass plus a row, never an edit to core code.
+ *
+ * @module @memberjunction/server/auth
+ */
+
+import {
+  BaseEngine,
+  BaseEnginePropertyConfig,
+  LogError,
+  LogStatusEx,
+  RegisterForStartup,
+  UserInfo,
+  type AuthProviderConfig,
+  type IMetadataProvider,
+  type PublicAuthProviderInfo
+} from '@memberjunction/core';
+import { MJAuthenticationProviderEntity } from '@memberjunction/core-entities';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { CredentialEngine } from '@memberjunction/credentials';
+
+/**
+ * Subsystem label used when this engine asks CredentialEngine to decrypt secret material,
+ * so credential-access auditing attributes the read to authentication.
+ */
+const CREDENTIAL_SUBSYSTEM = 'Authentication';
+
+/**
+ * Loads the authentication-provider catalog from metadata and registers it with the
+ * {@link AuthProviderFactory}.
+ *
+ * **Not `deferred`**: no authenticated request may be served before the catalog is registered,
+ * or tokens from a metadata-defined provider would be rejected during the startup window.
+ *
+ * **Severity is `warn`, not `fatal`**, and that is deliberate. This engine is one of two possible
+ * sources of providers — `initializeAuthProviders` also registers whatever `mj.config.cjs`
+ * declares. Making a catalog load failure fatal would turn a transient metadata problem into a
+ * total authentication outage for deployments that never adopted the table. The failure is
+ * logged loudly and the config-declared providers still stand.
+ */
+@RegisterForStartup({
+  priority: 20,
+  severity: 'warn',
+  deferred: false,
+  description: 'Loads the metadata authentication-provider catalog and registers it with AuthProviderFactory'
+})
+export class AuthProviderEngine extends BaseEngine<AuthProviderEngine> {
+  private _providers: MJAuthenticationProviderEntity[] = [];
+
+  public static get Instance(): AuthProviderEngine {
+    return super.getInstance<AuthProviderEngine>();
+  }
+
+  /**
+   * Loads Active providers only. Inactive rows are excluded at the query rather than filtered
+   * later, so a disabled provider is never even instantiated.
+   */
+  public async Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void> {
+    const configs: Partial<BaseEnginePropertyConfig>[] = [
+      {
+        PropertyName: '_providers',
+        EntityName: 'MJ: Authentication Providers',
+        Filter: `Status='Active'`,
+        OrderBy: 'Sequence ASC, Name ASC',
+        CacheLocal: true
+      }
+    ];
+    await this.Load(configs, provider, forceRefresh, contextUser);
+  }
+
+  /** Active providers from metadata, ordered for presentation. */
+  public get Providers(): MJAuthenticationProviderEntity[] {
+    return this.GetConfigData<MJAuthenticationProviderEntity>('_providers');
+  }
+
+  /**
+   * Startup hook: load the catalog, then register every row with the factory.
+   */
+  public async HandleStartup(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void> {
+    await this.Config(false, contextUser, provider);
+    await this.RegisterAll(contextUser);
+  }
+
+  /**
+   * Instantiates and registers every catalog row with the {@link AuthProviderFactory}.
+   *
+   * One bad row must not cost the deployment its other providers, so each registration is
+   * isolated: a failure is logged with the offending provider's name and the loop continues.
+   *
+   * @returns the number of providers successfully registered.
+   */
+  public async RegisterAll(contextUser?: UserInfo): Promise<number> {
+    const factory = AuthProviderFactory.Instance;
+    let registered = 0;
+
+    for (const row of this.Providers) {
+      try {
+        const config = await this.buildProviderConfig(row, contextUser);
+        factory.register(AuthProviderFactory.createProvider(config));
+        registered++;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        LogError(`[Auth] Could not register metadata provider '${row.Name}' (DriverClass '${row.DriverClass}'): ${message}`);
+      }
+    }
+
+    if (registered > 0) {
+      LogStatusEx({ message: `[Auth] Registered ${registered} provider(s) from metadata.`, verboseOnly: true });
+    }
+    return registered;
+  }
+
+  /**
+   * Projects a catalog row onto the runtime {@link AuthProviderConfig} the driver expects.
+   *
+   * `AdditionalConfiguration` is spread FIRST so that the modelled columns win over anything a
+   * driver-specific blob happens to repeat — the columns are the reviewable, described surface,
+   * and a JSON blob must not be able to silently redefine the issuer a token is validated against.
+   */
+  private async buildProviderConfig(row: MJAuthenticationProviderEntity, contextUser?: UserInfo): Promise<AuthProviderConfig> {
+    const additional = this.parseJsonColumn(row.AdditionalConfiguration, row.Name, 'AdditionalConfiguration');
+    const secrets = await this.resolveCredential(row, contextUser);
+
+    const config: AuthProviderConfig = {
+      ...additional,
+      ...secrets,
+      name: row.Name,
+      type: row.DriverClass
+    };
+
+    if (row.ClientID) config.clientId = row.ClientID;
+    if (row.Domain) config.domain = row.Domain;
+    if (row.Issuer) config.issuer = row.Issuer;
+    if (row.Audience) config.audience = row.Audience;
+    if (row.JWKSUri) config.jwksUri = row.JWKSUri;
+    if (row.Scopes) config.scopes = this.parseScopes(row.Scopes);
+
+    return config;
+  }
+
+  /**
+   * Splits the delimited `Scopes` column into the parsed list both projections publish.
+   *
+   * This is the single home of the delimiter convention: `buildProviderConfig` and
+   * `GetPublicCatalog` must agree on it, or the server would validate tokens against one scope
+   * set while telling the browser to request another.
+   */
+  private parseScopes(raw: string | null): string[] {
+    return raw ? raw.split(/[\s,]+/).filter((s) => s.length > 0) : [];
+  }
+
+  /**
+   * Decrypts the row's linked credential, when it has one.
+   *
+   * Almost every provider validates tokens against a public JWKS and needs no secret at all, so
+   * this is the uncommon path — present for confidential-client flows, management APIs, and SCIM.
+   */
+  private async resolveCredential(row: MJAuthenticationProviderEntity, contextUser?: UserInfo): Promise<Record<string, string>> {
+    if (!row.CredentialID || !row.Credential) {
+      return {};
+    }
+
+    await CredentialEngine.Instance.Config(false, contextUser);
+    const resolved = await CredentialEngine.Instance.getCredential(row.Credential, {
+      contextUser,
+      subsystem: CREDENTIAL_SUBSYSTEM
+    });
+    return resolved.values;
+  }
+
+  /**
+   * Parses a JSON configuration column, treating malformed content as absent.
+   *
+   * Throwing here would take down an otherwise-valid provider over a stray character in an
+   * optional extras blob, so the row is registered without the extras and the problem is logged.
+   */
+  private parseJsonColumn(raw: string | null, providerName: string, columnName: string): Record<string, unknown> {
+    if (!raw?.trim()) {
+      return {};
+    }
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return parsed as Record<string, unknown>;
+      }
+      LogError(`[Auth] ${columnName} on provider '${providerName}' is not a JSON object; ignoring it.`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`[Auth] ${columnName} on provider '${providerName}' is not valid JSON (${message}); ignoring it.`);
+    }
+    return {};
+  }
+
+  /**
+   * Projects the catalog to the PUBLIC shape served by the unauthenticated catalog endpoint.
+   *
+   * The projection is an explicit allow-list rather than a redaction of the full row: a column
+   * added to this entity later is invisible to anonymous callers until someone deliberately adds
+   * it here. `AdditionalConfiguration` and `CredentialID` are structurally absent, never merely
+   * omitted at serialization time.
+   */
+  public GetPublicCatalog(): PublicAuthProviderInfo[] {
+    return this.Providers.filter((row) => row.ClientVisible).map((row) => {
+      const info: PublicAuthProviderInfo = {
+        name: row.Name,
+        driverClass: row.DriverClass,
+        displayName: row.DisplayName ?? row.Name,
+        sequence: row.Sequence,
+        isDefault: row.IsDefault
+      };
+
+      if (row.Icon) info.icon = row.Icon;
+      if (row.ClientID) info.clientId = row.ClientID;
+      if (row.Issuer) info.issuer = row.Issuer;
+      if (row.Domain) info.domain = row.Domain;
+
+      // Published pre-parsed so the browser never re-derives the delimiter convention —
+      // the drivers hand this straight to SDK config typed string[].
+      const scopes = this.parseScopes(row.Scopes);
+      if (scopes.length > 0) info.scopes = scopes;
+
+      const clientConfig = this.parseJsonColumn(row.ClientConfiguration, row.Name, 'ClientConfiguration');
+      if (Object.keys(clientConfig).length > 0) {
+        info.clientConfiguration = this.toPublicClientConfig(clientConfig, row.Name);
+      }
+
+      return info;
+    });
+  }
+
+  /**
+   * Flattens a parsed `ClientConfiguration` blob to the primitive key/value shape the browser
+   * contract declares. Nested objects and arrays are dropped with a warning rather than passed
+   * through, so a structured blob (the shape a credential would take) cannot ride along to an
+   * anonymous caller.
+   */
+  private toPublicClientConfig(parsed: Record<string, unknown>, providerName: string): Record<string, string | number | boolean | null> {
+    const result: Record<string, string | number | boolean | null> = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (value === null || ['string', 'number', 'boolean'].includes(typeof value)) {
+        result[key] = value as string | number | boolean | null;
+      } else {
+        LogError(`[Auth] ClientConfiguration key '${key}' on provider '${providerName}' is not a primitive value; it was NOT published to the public catalog.`);
+      }
+    }
+    return result;
+  }
+}

package/src/auth/exampleNewUserSubClass.ts

@@ -1,7 +1,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { Metadata, RunView, LogError, EntitySaveOptions } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { configInfo } from '../config.js';
 import { MJUserEntity } from '@memberjunction/core-entities';