@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.3

package/src/auth/index.ts

@@ -1,8 +1,8 @@
 import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import { configInfo } from '../config.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import sql from 'mssql';
-import { Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { MJGlobal } from '@memberjunction/global';
 import { MJUserEntity, MJUserEntityType } from '@memberjunction/core-entities';
@@ -11,6 +11,9 @@ import { initializeAuthProviders } from './initializeProviders.js';
 
 export * from './APIKeyScopeAuth.js';
 export * from './actingContextResolver.js';
+export * from './AuthProviderEngine.js';
+export * from './AuthProviderCatalogRouter.js';
+export { initializeAuthProviders, initializeAuthProvidersFromMetadata, refreshAuthProviders, validateAuthProvidersRegistered } from './initializeProviders.js';
 
 // This is a hard-coded forever constant due to internal migrations
 
@@ -21,9 +24,13 @@ class MissingAuthError extends Error {
   }
 }
 
-const refreshUserCache = async (dataSource?: sql.ConnectionPool) => {
+const refreshUserCache = async () => {
   const startTime: number = Date.now();
-  await UserCache.Instance.Refresh(dataSource);
+  // UserCache is process-global in this phase, and so is the provider MJServer configures at
+  // bootstrap — the callers below only hold a ConnectionPool, which they use purely as a
+  // "the database is reachable" gate before asking for a refresh.
+  const provider = Metadata.Provider as unknown as DatabaseProviderBase; // global-provider-ok: server auth path; runs under the server's single default provider
+  await UserCache.Instance.Refresh(provider);
   const endTime: number = Date.now();
   const elapsed: number = endTime - startTime;
 
@@ -179,7 +186,7 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
     if (dataSource && attemptCacheUpdateIfNeeded) {
       console.warn(`System user not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
       return getSystemUser(dataSource, false); // try one more time but do not update cache next time if not found
     }
     throw new Error(`System user ID '${UserCache.Instance.SYSTEM_USER_ID}' not found in database`);
@@ -187,6 +194,42 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
   return systemUser;
 };
 
+/**
+ * Extracts the lowercased domain portion of an email address.
+ *
+ * @returns the domain, or an empty string when the value is not an email address (e.g. an IdP that
+ *          issues a bare username). Callers MUST treat an empty result as "cannot be authorized"
+ *          rather than as a wildcard.
+ */
+const extractEmailDomain = (email: string): string => {
+  const parts = email.split('@');
+  // Reject anything that isn't exactly local@domain — a value with 0 or 2+ '@' is not an address we
+  // can make a trust decision about.
+  if (parts.length !== 2) return '';
+  return parts[1].toLowerCase().trim();
+};
+
+/**
+ * Tests a domain against `userHandling.newUserAuthorizedDomains`, honoring `*` wildcards.
+ *
+ * Note that a pattern is matched in full, so `*.example.com` matches `mail.example.com` but NOT
+ * `example.com` — list both if you need both.
+ */
+const isDomainAuthorized = (domain: string): boolean =>
+  configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
+    // Convert wildcard domain patterns to regular expressions
+    const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
+    return regex.test(domain);
+  });
+
+/**
+ * Resolves a verified identity to an MJ `UserInfo`, optionally auto-provisioning a new user.
+ *
+ * @param requestDomain the hostname parsed from the request's `Origin` header. **Not used for any
+ *        authorization decision** — it is spoofable on non-browser requests, and new-user domain
+ *        authorization runs against the verified JWT's email domain instead. Retained for audit
+ *        logging and for the recursive retry call.
+ */
 export const verifyUserRecord = async (
   email?: string,
   firstName?: string,
@@ -207,23 +250,21 @@ export const verifyUserRecord = async (
   });
 
   if (!user) {
-    if (
-      configInfo.userHandling.autoCreateNewUsers &&
-      firstName &&
-      lastName &&
-      (requestDomain || configInfo.userHandling.newUserLimitedToAuthorizedDomains === false)
-    ) {
-      // check to see if the domain that we have a request coming in from matches one of the domains in the autoCreateNewUsersDomains setting
+    // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
+    // this condition. It was previously required here, which meant a non-browser client sending no
+    // Origin could never auto-provision while an attacker simply forged one — it gated entry without
+    // authorizing anything. Authorization happens below, against the verified identity's email domain.
+    if (configInfo.userHandling.autoCreateNewUsers && firstName && lastName) {
+      // SECURITY: authorize against the EMAIL DOMAIN of the cryptographically-verified identity,
+      // NOT the request `Origin` header. Origin is trivially spoofable on non-browser / bearer-token
+      // requests, so gating on it let a holder of any valid IdP token auto-provision an account under
+      // an authorized domain by sending a forged Origin. The email comes from the verified JWT.
+      const emailDomain: string = extractEmailDomain(email);
       let passesDomainCheck: boolean =
         configInfo.userHandling.newUserLimitedToAuthorizedDomains ===
         false; /*in this first condition, we are set up to NOT care about domain */
-      if (!passesDomainCheck && requestDomain) {
-        /*in this second condition, we check the domain against authorized domains*/
-        passesDomainCheck = configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
-          // Convert wildcard domain patterns to regular expressions
-          const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
-          return regex.test(requestDomain?.toLowerCase().trim());
-        });
+      if (!passesDomainCheck) {
+        passesDomainCheck = emailDomain.length > 0 && isDomainAuthorized(emailDomain);
       }
 
       if (passesDomainCheck) {
@@ -249,9 +290,16 @@ export const verifyUserRecord = async (
           UserCache.Instance.Users.push(user);
           console.warn(`   >>> New user ${email} created successfully!`);
         }
+      } else if (emailDomain.length === 0) {
+        // The verified identity carries no email domain at all — typically an IdP that issues a bare
+        // `preferred_username` with no `email` claim. There is nothing to match against, so the gate
+        // denies rather than falling back to anything spoofable.
+        console.warn(
+          `User ${email} not found in cache and will NOT be auto-created: the verified identity has no email domain (no '@'), so it cannot be matched against newUserAuthorizedDomains. This usually means the identity provider issues a username rather than an email address — configure it to emit an 'email' claim, or set newUserLimitedToAuthorizedDomains to false to disable domain checking.`
+        );
       } else {
         console.warn(
-          `User ${email} not found in cache. Request domain '${requestDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
+          `User ${email} not found in cache. Email domain '${emailDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. NOTE: this check is against the EMAIL DOMAIN of the verified identity, NOT the browser Origin — if newUserAuthorizedDomains lists frontend hostnames (e.g. 'app.example.com'), replace them with email domains (e.g. 'example.com'). To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
         );
       }
     }
@@ -260,7 +308,7 @@ export const verifyUserRecord = async (
       // if we get here that means in the above, if we were attempting to create a new user, it did not work, or it wasn't attempted and we have a config that asks us to auto update the cache
       console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
 
-      await refreshUserCache(dataSource);
+      await refreshUserCache();
 
       return verifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false); // try one more time but do not update cache next time if not found
     }

package/src/auth/initializeProviders.ts

@@ -1,16 +1,45 @@
 import { configInfo } from '../config.js';
-import { AuthProviderConfig, LogError } from '@memberjunction/core';
+import { AuthProviderConfig, LogError, LogStatus, LogStatusEx, UserInfo, type IMetadataProvider } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
 
 /**
- * Initialize authentication providers from configuration
+ * Initialize authentication providers from configuration.
+ *
+ * Registers everything declared in `mj.config.cjs`'s `authProviders` array. This remains the
+ * baseline path and runs on every boot: it needs no database, so it is what lets the server
+ * authenticate even when metadata is unreachable.
+ *
+ * Providers defined in the `MJ: Authentication Providers` catalog are layered on top by
+ * {@link initializeAuthProvidersFromMetadata}, which runs later in startup once a database
+ * connection and a system user exist.
  */
 export function initializeAuthProviders(): void {
   const factory = AuthProviderFactory.Instance;
-  
+
   // Clear any existing providers
   factory.clear();
 
+  // Environment-derived providers are DEFAULTS: each provider class maps its own variables via
+  // the ConfigFromEnvironment hook, and they apply only when the config file declares no
+  // providers of its own. That mirrors the previous behaviour exactly — the env block used to sit
+  // in DEFAULT_SERVER_CONFIG, and mergeConfigs replaces (rather than concatenates) arrays, so an
+  // explicit `authProviders` in mj.config.cjs has always suppressed the env-derived set.
+  //
+  // Written back into configInfo.authProviders rather than kept local because that array is the
+  // live registry other code reads and appends to (registerMagicLinkAuthProvider pushes into it so
+  // a later re-initialize keeps magic-link).
+  if (!configInfo.authProviders || configInfo.authProviders.length === 0) {
+    const discovered = AuthProviderFactory.DiscoverFromEnvironment();
+    if (discovered.length > 0) {
+      configInfo.authProviders = discovered;
+      LogStatusEx({
+        message: `[Auth] Configured ${discovered.length} provider(s) from environment variables: ${discovered.map((p) => p.name).join(', ')}`,
+        verboseOnly: true
+      });
+    }
+  }
+
   // Initialize providers from authProviders config
   if (configInfo.authProviders && configInfo.authProviders.length > 0) {
     for (const providerConfig of configInfo.authProviders) {
@@ -26,8 +55,100 @@ export function initializeAuthProviders(): void {
     }
   }
 
-  // Validate we have at least one provider
-  if (!factory.hasProviders()) {
-    LogError('No authentication providers configured. Please configure authProviders array in mj.config.cjs');
+  // NOTE: the "no providers configured" check deliberately does NOT live here any more — see
+  // validateAuthProvidersRegistered(). A metadata-only deployment legitimately has an empty
+  // authProviders array at this point, and erroring here would cry wolf on every boot.
+}
+
+/**
+ * Layers the metadata provider catalog on top of the config-declared providers.
+ *
+ * Called after the data provider and system user are available. Metadata rows are registered in
+ * addition to — not instead of — the config-declared ones: a deployment mid-migration may
+ * legitimately have both, and a name collision resolves to the metadata row because it registers
+ * last and `AuthProviderFactory.register` keys by provider name.
+ *
+ * Never throws. An unreachable or empty catalog leaves the config-declared providers exactly as
+ * they were, which is what makes adopting this feature a no-op for existing deployments and keeps
+ * a metadata problem from turning into a lockout.
+ *
+ * @returns the number of providers registered from metadata.
+ */
+export async function initializeAuthProvidersFromMetadata(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  try {
+    await AuthProviderEngine.Instance.Config(false, contextUser, provider);
+    const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+    if (count > 0) {
+      LogStatus(`[Auth] ${count} authentication provider(s) registered from metadata.`);
+    }
+    return count;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    LogError(`[Auth] Could not load the authentication provider catalog from metadata (${message}). Continuing with providers from mj.config.cjs.`);
+    return 0;
+  }
+}
+
+/**
+ * Rebuilds the provider registry from scratch: config-declared providers first, then the
+ * metadata catalog layered on top — the same two-source order as startup.
+ *
+ * This is THE entry point for reacting to a catalog edit at runtime (an admin page's Save
+ * button, a future invalidation hook). A full rebuild is required because the factory caches
+ * issuer→provider resolutions, so an edited row would otherwise keep serving its old
+ * configuration until the process restarted. It lives here rather than on `AuthProviderEngine`
+ * because a bare `factory.clear()` + metadata re-registration would silently drop everything
+ * the config path registered — magic-link included — and no caller should have to know to put
+ * those back. `initializeAuthProviders()` clears the factory itself, so no separate clear step
+ * exists for a caller to forget.
+ *
+ * **Failure policy: abort-before-mutate.** Everything that can throw — the catalog reload and
+ * the permission probe on its result — runs BEFORE the factory is touched, so a failed refresh
+ * leaves the registry serving the previous (stale but complete) provider set and surfaces the
+ * error to the caller. This is deliberately the opposite of `initializeAuthProvidersFromMetadata`,
+ * which swallows metadata failures: at boot there is no previous registry to preserve and a
+ * metadata problem must not become a lockout, while at refresh time there is one and the caller
+ * (an admin UI) wants the error. That difference in failure policy is why this function does not
+ * simply delegate to its sibling.
+ *
+ * Known limitation, acceptable for an admin-triggered operation: metadata providers are absent
+ * from the registry for the duration of `RegisterAll`'s per-row config builds (config-declared
+ * providers are restored synchronously). A request bearing a metadata-declared IdP's token in
+ * that window is rejected. If a caller ever needs an atomic swap, build the configs first and
+ * register them in one synchronous pass.
+ *
+ * @returns the number of providers registered from metadata after the refresh.
+ */
+export async function refreshAuthProviders(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  await AuthProviderEngine.Instance.Config(true, contextUser, provider);
+
+  // Probe the reloaded catalog BEFORE clearing anything: reading Providers throws
+  // PermissionConstrainedError when the load was skipped for permission reasons, and that
+  // failure must abort the refresh while the registry is still intact.
+  const pendingRows = AuthProviderEngine.Instance.Providers.length;
+
+  initializeAuthProviders();
+  const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+  LogStatus(
+    `[Auth] Provider registry refreshed — ${count} of ${pendingRows} metadata provider(s) registered on top of the config-declared set.`
+  );
+  return count;
+}
+
+/**
+ * Reports whether any provider is registered, from either source, and logs a diagnostic when none
+ * is.
+ *
+ * Split out from {@link initializeAuthProviders} because "no providers" is only genuinely wrong
+ * once BOTH sources have had their turn.
+ */
+export function validateAuthProvidersRegistered(): boolean {
+  const hasProviders = AuthProviderFactory.Instance.hasProviders();
+  if (!hasProviders) {
+    LogError(
+      'No authentication providers are configured. Define them in the "MJ: Authentication Providers" metadata entity, ' +
+        'or in the authProviders array in mj.config.cjs.'
+    );
   }
-}
+  return hasProviders;
+}

package/src/auth/magicLink/MagicLinkService.ts

@@ -29,7 +29,7 @@ import {
   type MJUserEntityType,
   type MJApplicationRoleEntity,
 } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo, type MagicLinkConfig } from '../../config.js';

package/src/auth/newUsers.ts

@@ -1,6 +1,6 @@
 import { ApplicationInfo, DatabaseProviderBase, EntitySaveOptions, LogError, LogStatus, Metadata, RunView, RunViewResult, UserInfo } from "@memberjunction/core";
 import { RegisterClass } from "@memberjunction/global";
-import { UserCache } from "@memberjunction/sqlserver-dataprovider";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { configInfo } from "../config.js";
 import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 

package/src/config.ts

@@ -7,7 +7,19 @@ const explorer = cosmiconfigSync('mj', { searchStrategy: 'global' });
 
 const userHandlingInfoSchema = z.object({
   autoCreateNewUsers: z.boolean().optional().default(false),
+  /** When true, auto-provisioning is restricted to the domains in `newUserAuthorizedDomains`. */
   newUserLimitedToAuthorizedDomains: z.boolean().optional().default(false),
+  /**
+   * Authorized **email domains** for auto-provisioned users — e.g. `['example.com', '*.example.org']`.
+   *
+   * These are matched against the domain of the email address in the verified identity token, NOT
+   * against the browser `Origin` / frontend hostname. If you are upgrading from a build that
+   * compared these to the request origin, replace any frontend hostnames here (`app.example.com`,
+   * `localhost`) with the email domains your users actually sign in with.
+   *
+   * `*` wildcards are supported and match in full: `*.example.com` matches `mail.example.com` but
+   * NOT `example.com` — list both if you need both.
+   */
   newUserAuthorizedDomains: z.array(z.string()).optional().default([]),
   newUserRoles: z.array(z.string()).optional().default([]),
   updateCacheWhenNotFound: z.boolean().optional().default(false),
@@ -131,6 +143,23 @@ const scheduledJobsSchema = z.object({
   staleLockCleanupInterval: z.number().optional().default(300000), // 5 minutes in ms
 });
 
+/**
+ * Integration sync worker (PR 1 item 8). When enabled, this process polls
+ * `CompanyIntegrationRun` for `Status='Queued'` rows, atomically claims them, executes
+ * the sync, and releases. The claim sproc is the mutual exclusion, so any number of
+ * processes may run a worker against the same database.
+ */
+const integrationSyncWorkerSchema = z.object({
+  /** Master switch — off by default so existing deployments keep running syncs inline. */
+  enabled: z.boolean().optional().default(false),
+  /** Email of the user the worker executes syncs as. */
+  systemUserEmail: z.string().optional().default('system@memberjunction.org'),
+  /** How often to poll the queue, in ms. */
+  pollingIntervalMs: z.number().optional().default(15000),
+  /** Maximum runs this worker executes concurrently. */
+  maxConcurrentRuns: z.number().optional().default(3),
+});
+
 const queryDialectSchema = z.object({
   /** When true, saving a Query entity auto-generates QuerySQL entries for configured target dialects */
   autoConvertOnSave: zodBooleanWithTransforms().default(false),
@@ -501,6 +530,7 @@ const configInfoSchema = z.object({
   authProviders: z.array(authProviderSchema).optional(),
   componentRegistries: z.array(componentRegistrySchema).optional(),
   scheduledJobs: scheduledJobsSchema.optional().default({}),
+  integrationSyncWorker: integrationSyncWorkerSchema.optional().default({}),
   telemetry: telemetrySchema.optional().default({}),
   queryDialects: queryDialectSchema.optional().default({}),
   multiTenancy: multiTenancySchema.optional().default({}),
@@ -559,6 +589,7 @@ export type SqlLoggingInfo = z.infer<typeof sqlLoggingSchema>;
 export type AuthProviderConfig = z.infer<typeof authProviderSchema>;
 export type ComponentRegistryConfig = z.infer<typeof componentRegistrySchema>;
 export type ScheduledJobsConfig = z.infer<typeof scheduledJobsSchema>;
+export type IntegrationSyncWorkerConfig = z.infer<typeof integrationSyncWorkerSchema>;
 export type TelemetryConfig = z.infer<typeof telemetrySchema>;
 export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
@@ -671,6 +702,14 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     staleLockCleanupInterval: 300000
   },
 
+  // Integration sync worker defaults (off — syncs run inline unless a worker is enabled)
+  integrationSyncWorker: {
+    enabled: false,
+    systemUserEmail: 'not.set@nowhere.com',
+    pollingIntervalMs: 15000,
+    maxConcurrentRuns: 3
+  },
+
   // Telemetry defaults
   telemetry: {
     enabled: true,
@@ -696,42 +735,22 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     },
   },
 
-  // Auth providers (environment-driven)
-  authProviders: [
-    // Microsoft Azure AD / Entra ID
-    process.env.TENANT_ID && process.env.WEB_CLIENT_ID ? {
-      name: 'azure',
-      type: 'msal',
-      issuer: `https://login.microsoftonline.com/${process.env.TENANT_ID}/v2.0`,
-      audience: process.env.WEB_CLIENT_ID,
-      jwksUri: `https://login.microsoftonline.com/${process.env.TENANT_ID}/discovery/v2.0/keys`,
-      clientId: process.env.WEB_CLIENT_ID,
-      tenantId: process.env.TENANT_ID
-    } : null,
-
-    // Auth0
-    process.env.AUTH0_DOMAIN && process.env.AUTH0_CLIENT_ID ? {
-      name: 'auth0',
-      type: 'auth0',
-      issuer: `https://${process.env.AUTH0_DOMAIN}/`,
-      audience: process.env.AUTH0_CLIENT_ID,
-      jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
-      clientId: process.env.AUTH0_CLIENT_ID,
-      clientSecret: process.env.AUTH0_CLIENT_SECRET,
-      domain: process.env.AUTH0_DOMAIN
-    } : null,
-    // AWS Cognito
-    process.env.COGNITO_USER_POOL_ID && process.env.COGNITO_CLIENT_ID && process.env.AWS_REGION ? {
-      name: 'cognito',
-      type: 'cognito',
-      issuer: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}`,
-      audience: process.env.COGNITO_CLIENT_ID,
-      jwksUri: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
-      clientId: process.env.COGNITO_CLIENT_ID,
-      region: process.env.AWS_REGION,
-      userPoolId: process.env.COGNITO_USER_POOL_ID
-    } : null,
-  ].filter(Boolean),
+  // Auth providers.
+  //
+  // Empty by design. This used to be a hard-coded block that enumerated Entra / Auth0 / Cognito
+  // inline and built each config from its environment variables. That made env-var configuration
+  // a closed domain: a third-party provider could register a driver class and take a metadata row
+  // or an explicit entry here, but it could never offer the "set two variables and you're done"
+  // experience, because the enumeration lived in core.
+  //
+  // Each provider class now owns its own mapping via the optional static
+  // `ConfigFromEnvironment` (see IEnvironmentConfigurableProvider in @memberjunction/auth-providers),
+  // and `initializeAuthProviders()` collects them through the ClassFactory registry.
+  //
+  // Discovery cannot happen here: this literal is evaluated when config.ts is imported, which is
+  // BEFORE @memberjunction/auth-providers loads and the driver classes register. It is deferred to
+  // registration time, where the registry is populated.
+  authProviders: [],
 };
 
 /**

package/src/context.ts

@@ -19,10 +19,10 @@ import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
 import { DatabaseProviderBase, UserInfo, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
-import { SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { Metadata } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
-import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
+import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 
 // ── Session / login audit (Phase 3) ───────────────────────────────────────────