@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.3

package/src/resolvers/UserResolver.ts

@@ -1,54 +1,46 @@
-import { AppContext, Arg, Ctx, FieldResolver, Int, PubSub, PubSubEngine, Query, Resolver, Root } from '@memberjunction/server';
+import { AppContext, Arg, Ctx, Field, Int, ObjectType, PubSub, PubSubEngine, Query, Resolver } from '@memberjunction/server';
+import { IMetadataProvider, RunView, UserInfo } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import { MJUser_, MJUserRole_, MJUserResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';
+import {
+  AssertRoleLoadSucceeded,
+  RequireContextUser,
+  RequireLoadedUser,
+  RequireRoleProvider,
+  UserIdExtraFilter,
+} from './currentUserRoles.js';
+
+/**
+ * CurrentUser payload. Extends the generated user type with a first-class `Roles`
+ * field — child-array FieldResolvers (`MJUserRoles_UserIDArray`) are no longer
+ * generated. Roles come from the request's `UserInfo` (so magic-link anonymous
+ * sessions keep their synthesized roles) or from a RunView on `MJ: User Roles`.
+ */
+@ObjectType()
+export class CurrentUserType extends MJUser_ {
+  @Field(() => [MJUserRole_])
+  Roles: MJUserRole_[];
+}
+
+type RoleSource = {
+  ID?: string;
+  UserID: string;
+  RoleID: string;
+  RoleName?: string;
+  Role?: string;
+  __mj_CreatedAt?: Date;
+  __mj_UpdatedAt?: Date;
+};
 
 @Resolver(MJUser_)
 export class UserResolver extends MJUserResolverBase {
 
-  /**
-   * Roles for the current user row.
-   *
-   * Overrides the generated field resolver to support ANONYMOUS magic-link sessions: those
-   * resolve to a shared Anonymous principal that holds NO roles in the database (by design —
-   * persisting them would let anonymous sessions accrete privileges across links). The roles
-   * are synthesized per-request in {@link buildMagicLinkSessionUser} and live only on the
-   * request's `UserInfo`. For the session's OWN user row we serve those synthesized roles
-   * directly, skipping the generated DB query (which returns empty) and its `MJ: User Roles`
-   * read-permission check (which the restricted anon role wouldn't pass). Every other case —
-   * named users, named magic-link users, listing other users' roles — falls through to the
-   * generated resolver unchanged, so there is no behavioral or security change off this path.
-   */
-  @FieldResolver(() => [MJUserRole_])
-  async MJUserRoles_UserIDArray(@Root() mjuser_: MJUser_, @Ctx() context: AppContext, @PubSub() pubSub: PubSubEngine) {
-    const sessionUser = context.userPayload?.userRecord;
-    if (sessionUser?.IsMagicLinkAnonymous && UUIDsEqual(mjuser_.ID, sessionUser.ID)) {
-      const now = new Date();
-      // Build rows with the entity's RAW field names, then run them through the same
-      // name→code-name mapping the generated resolver uses (e.g. __mj_CreatedAt →
-      // _mj__CreatedAt). Returning raw names directly trips GraphQL's non-nullable check.
-      const rows = (sessionUser.UserRoles ?? []).map((r: { UserID: string; RoleID: string; RoleName?: string; Role?: string }) => ({
-        ID: sessionUser.ID,
-        UserID: r.UserID,
-        RoleID: r.RoleID,
-        User: sessionUser.Name,
-        Role: r.RoleName ?? r.Role,
-        __mj_CreatedAt: now,
-        __mj_UpdatedAt: now,
-      }));
-      return this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, sessionUser);
-    }
-    return super.MJUserRoles_UserIDArray(mjuser_, context, pubSub);
-  }
-  @Query(() => MJUser_)
-  async CurrentUser(@Ctx() context: AppContext) {
-    // Check API key scope authorization for user read (self)
+  @Query(() => CurrentUserType)
+  async CurrentUser(@Ctx() context: AppContext): Promise<CurrentUserType> {
     await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
 
-    // If userRecord is already available (e.g., from API key auth or system auth),
-    // use it directly instead of looking up by email again
     if (context.userPayload.userRecord) {
-      // Convert UserInfo to the GraphQL response format
       const userRecord = context.userPayload.userRecord;
       const userData = {
         ID: userRecord.ID,
@@ -65,30 +57,29 @@ export class UserResolver extends MJUserResolverBase {
         LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
         __mj_CreatedAt: userRecord.__mj_CreatedAt,
         __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
-        // Include the UserRoles sub-array for the GraphQL response
-        MJUserRoles_UserIDArray: userRecord.UserRoles?.map((r: { ID: string; UserID: string; RoleID: string; RoleName?: string; __mj_CreatedAt?: Date; __mj_UpdatedAt?: Date }) => ({
-          ID: r.ID,
-          UserID: r.UserID,
-          RoleID: r.RoleID,
-          User: userRecord.Name,
-          Role: r.RoleName,
-          __mj_CreatedAt: r.__mj_CreatedAt,
-          __mj_UpdatedAt: r.__mj_UpdatedAt,
-        })) || [],
       };
       console.log('CurrentUser (from userRecord)', userData.Email);
-      return this.MapFieldNamesToCodeNames('MJ: Users', userData);
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      const mapped = await this.MapFieldNamesToCodeNames('MJ: Users', userData, userRecord, provider) as MJUser_;
+      return {
+        ...mapped,
+        Roles: await this.mapRolesFromUserInfo(userRecord.UserRoles ?? [], userRecord, userRecord, provider),
+      };
     }
 
-    // Fall back to email lookup for JWT-based auth
-    const result = await this.UserByEmail(context.userPayload.email, context);
-    console.log('CurrentUser (from email lookup)', result?.Email);
-    return result;
+    const result = RequireLoadedUser(
+      await this.UserByEmail(context.userPayload.email, context),
+      context.userPayload.email,
+    );
+    console.log('CurrentUser (from email lookup)', result.Email);
+    return {
+      ...result,
+      Roles: await this.loadRolesForUser(result, context),
+    };
   }
 
   @Query(() => MJUser_)
   async UserByID(@Arg('ID', () => Int) ID: number, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', ID.toString(), userPayload);
 
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
@@ -98,7 +89,6 @@ export class UserResolver extends MJUserResolverBase {
 
   @Query(() => MJUser_)
   async UserByEmployeeID(@Arg('EmployeeID', () => Int) EmployeeID: number, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', EmployeeID.toString(), userPayload);
 
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
@@ -108,14 +98,63 @@ export class UserResolver extends MJUserResolverBase {
 
   @Query(() => MJUser_)
   async UserByEmail(@Arg('Email', () => String) Email: string, @Ctx() { providers, userPayload }: AppContext) {
-    // Check API key scope authorization for user read
     await this.CheckAPIKeyScopeAuthorization('user:read', Email, userPayload);
 
-    // const searchEmail = userEmailMap[Email] ?? Email;
     const searchEmail = Email;
     const provider = GetReadOnlyProvider(providers, {allowFallbackToReadWrite: true})
     const returnVal = super.safeFirstArrayElement(await this.findBy(provider, 'MJ: Users', { Email: searchEmail }, userPayload.userRecord));
     return this.MapFieldNamesToCodeNames('MJ: Users', returnVal);
   }
+
+  /**
+   * Magic-link anonymous sessions hold synthesized roles on UserInfo that are
+   * not persisted. Always prefer those when the requested row is the session
+   * user. Everyone else loads `MJ: User Roles` via RunView.
+   */
+  private async loadRolesForUser(user: MJUser_, context: AppContext): Promise<MJUserRole_[]> {
+    const contextUser = RequireContextUser(this.GetUserFromPayload(context.userPayload));
+
+    if (contextUser.IsMagicLinkAnonymous && UUIDsEqual(user.ID, contextUser.ID)) {
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      return await this.mapRolesFromUserInfo(contextUser.UserRoles ?? [], contextUser, contextUser, provider);
+    }
+
+    const provider = RequireRoleProvider(
+      GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true }),
+    );
+    const rv = RunView.FromMetadataProvider(provider);
+    const result = await rv.RunView<RoleSource>({
+      EntityName: 'MJ: User Roles',
+      ExtraFilter: UserIdExtraFilter(user.ID),
+      ResultType: 'simple',
+    }, contextUser);
+
+    AssertRoleLoadSucceeded(result, user.ID);
+    return await this.ArrayMapFieldNamesToCodeNames(
+      'MJ: User Roles',
+      result.Results ?? [],
+      contextUser,
+      provider,
+    ) as MJUserRole_[];
+  }
+
+  private async mapRolesFromUserInfo(
+    roles: RoleSource[],
+    user: { ID: string; Name?: string },
+    contextUser?: UserInfo,
+    provider?: IMetadataProvider,
+  ): Promise<MJUserRole_[]> {
+    const now = new Date();
+    const rows = roles.map((r) => ({
+      ID: r.ID ?? user.ID,
+      UserID: r.UserID,
+      RoleID: r.RoleID,
+      User: user.Name,
+      Role: r.RoleName ?? r.Role,
+      __mj_CreatedAt: r.__mj_CreatedAt ?? now,
+      __mj_UpdatedAt: r.__mj_UpdatedAt ?? now,
+    }));
+    return await this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, contextUser, provider) as MJUserRole_[];
+  }
 }
 export default UserResolver;

package/src/resolvers/currentUserRoles.ts

@@ -0,0 +1,47 @@
+import { LogError } from '@memberjunction/core';
+
+/**
+ * Guards and filter builders for CurrentUser role loading.
+ * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
+ * without importing generated GraphQL types or the Apollo config bootstrap.
+ */
+
+export function RequireLoadedUser<T extends { ID?: string }>(
+  user: T | null | undefined,
+  email: string | undefined,
+): T & { ID: string } {
+  if (!user?.ID) {
+    throw new Error(`CurrentUser: no user found for email '${email ?? ''}'`);
+  }
+  return user as T & { ID: string };
+}
+
+export function RequireContextUser<T>(user: T | null | undefined): T {
+  if (!user) {
+    throw new Error('CurrentUser: authenticated context user is required to load roles');
+  }
+  return user;
+}
+
+export function RequireRoleProvider<T>(provider: T | null | undefined): T {
+  if (!provider) {
+    throw new Error('CurrentUser: no data provider available to load roles');
+  }
+  return provider;
+}
+
+/** Quote-escape a server-resolved user id for an ExtraFilter literal. */
+export function UserIdExtraFilter(userId: string): string {
+  return `UserID='${userId.replace(/'/g, "''")}'`;
+}
+
+export function AssertRoleLoadSucceeded(
+  result: { Success: boolean; ErrorMessage?: string | null },
+  userId: string,
+): void {
+  if (!result.Success) {
+    const message = result.ErrorMessage ?? 'unknown error';
+    LogError(`CurrentUser: failed to load roles for user ${userId}: ${message}`);
+    throw new Error(`CurrentUser: failed to load roles: ${message}`);
+  }
+}

package/src/rest/MediaAccessKeys.ts

@@ -24,6 +24,9 @@ import jwt from 'jsonwebtoken';
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
 export const MEDIA_ACCESS_TOKEN_TYPE = 'media-access';
 
+/** The upload staging token's `typ` claim. */
+export const MEDIA_UPLOAD_ACCESS_TOKEN_TYPE = 'media-upload';
+
 /** Default media-access token lifetime (hours). Long enough to cover a full playback session. */
 export const MEDIA_ACCESS_DEFAULT_TTL_HOURS = 4;
 
@@ -64,7 +67,13 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
 
   /** Resolves the signing secret once, preferring the deployment's symmetric key. */
   private ensureSecret(): void {
-    if (this._initialized) {
+    if (this._initialized && this.secret) {
+      return;
+    }
+    const store = this.GetGlobalObjectStore();
+    if (store && typeof store['___MEDIA_ACCESS_SECRET___'] === 'string') {
+      this.secret = store['___MEDIA_ACCESS_SECRET___'];
+      this._initialized = true;
       return;
     }
     const configured = process.env.MJ_BASE_ENCRYPTION_KEY?.trim();
@@ -78,6 +87,9 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
         'MJ_BASE_ENCRYPTION_KEY for stable signing.',
       );
     }
+    if (store) {
+      store['___MEDIA_ACCESS_SECRET___'] = this.secret;
+    }
     this._initialized = true;
   }
 
@@ -95,6 +107,39 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     return { Token: token, ExpiresAt: expiresAt };
   }
 
+  /**
+   * Mints a signed upload staging token for a user, expiring after `ttlMinutes` (default 10 minutes).
+   */
+  public SignUpload(userId: string, ttlMinutes: number = 10): { Token: string; ExpiresAt: Date } {
+    this.ensureSecret();
+    const claims = { fileId: '*', userId, typ: MEDIA_UPLOAD_ACCESS_TOKEN_TYPE };
+    const expiresInSeconds = Math.floor(ttlMinutes * 60);
+    const token = jwt.sign(claims, this.secret, { algorithm: 'HS256', expiresIn: expiresInSeconds });
+    const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
+    return { Token: token, ExpiresAt: expiresAt };
+  }
+
+  /**
+   * Verifies an upload staging token.
+   */
+  public VerifyUpload(token: string): { Valid: boolean; UserId?: string; Error?: string } {
+    this.ensureSecret();
+    try {
+      const decoded = jwt.verify(token, this.secret, { algorithms: ['HS256'] });
+      if (
+        typeof decoded === 'object' && decoded !== null &&
+        (decoded as { typ?: unknown }).typ === MEDIA_UPLOAD_ACCESS_TOKEN_TYPE &&
+        typeof (decoded as { userId?: unknown }).userId === 'string'
+      ) {
+        return { Valid: true, UserId: (decoded as { userId: string }).userId };
+      }
+      return { Valid: false, Error: 'Invalid token payload format or claim mismatch' };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { Valid: false, Error: msg };
+    }
+  }
+
   /**
    * Verifies a token's signature, expiry, and `typ`. Returns the typed claims on
    * success. Never throws — an invalid/expired/malformed token returns `{ Valid: false }`.
@@ -119,3 +164,4 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     }
   }
 }
+

package/src/rest/MediaStreamHandler.ts

@@ -25,6 +25,7 @@ import { FileStorageEngine } from '@memberjunction/storage';
 import type { FileStorageBase, ByteRange } from '@memberjunction/storage';
 import { getSystemUser } from '../auth/index.js';
 import { MediaAccessKeyManager } from './MediaAccessKeys.js';
+import { UploadTokenManager } from './UploadTokenManager.js';
 import { parseRange, parseRangeHeaderLoose } from './mediaRange.js';
 
 /** A located bytes source for a file: the driver + the provider key to read. */
@@ -32,21 +33,110 @@ interface FileBytesSource {
   driver: FileStorageBase;
   providerKey: string;
   contentType: string;
+  fileName: string;
 }
 
-
 /**
- * Builds the Express router exposing `GET /media/:fileId`. Stateless — verification
- * and byte-source resolution happen per request.
+ * Builds the Express router exposing:
+ * - `GET /media/:fileId` and `GET /media/:fileId/:filename` (Range streaming)
+ * - `POST /media/upload-stage` (Raw binary upload staging)
  */
 export function createMediaStreamRouter(): Router {
   const router = express.Router();
+
+  router.post(
+    '/upload-stage',
+    express.raw({ type: () => true, limit: '100mb' }),
+    async (req: Request, res: Response) => {
+      await handleUploadStageRequest(req, res);
+    }
+  );
+
   router.get('/:fileId', async (req: Request, res: Response) => {
     await handleMediaRequest(req, res);
   });
+  router.get('/:fileId/:filename', async (req: Request, res: Response) => {
+    await handleMediaRequest(req, res);
+  });
   return router;
 }
 
+/**
+ * Authenticated raw binary upload staging handler (`POST /media/upload-stage`).
+ *
+ * Accepts raw file binary bytes directly in request body, stages in UploadTokenManager
+ * memory cache, and returns an ephemeral single-use upload token for the GraphQL mutation.
+ *
+ * Security: Requires a cryptographically signed media-upload token minted by `CreateUploadStageToken`
+ * (verified via `MediaAccessKeyManager.Instance.VerifyUpload`).
+ */
+async function handleUploadStageRequest(req: Request, res: Response): Promise<void> {
+  // Never let CDNs or shared caches retain upload endpoints
+  res.setHeader('Cache-Control', 'private, no-store');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // 1. Resolve signed upload token strictly from Authorization header (avoids bearer token in URL logs)
+  const authHeader = req.headers.authorization || '';
+  const token = authHeader.startsWith('Bearer ') ? authHeader.substring(7).trim() : authHeader.trim();
+
+  if (!token) {
+    console.warn('[MediaStreamHandler] POST /media/upload-stage: Missing or empty Authorization header');
+    res.status(401).json({ Success: false, ErrorMessage: 'Authorization header with Bearer token required.' });
+    return;
+  }
+
+  // Cryptographically verify token signature, expiry, and 'media-upload' typ claim
+  const uploadVerify = MediaAccessKeyManager.Instance.VerifyUpload(token);
+  if (!uploadVerify.Valid || !uploadVerify.UserId) {
+    console.warn(`[MediaStreamHandler] POST /media/upload-stage: Token verification failed: ${uploadVerify.Error || 'invalid or expired'}`);
+    res.status(401).json({ Success: false, ErrorMessage: `Invalid or expired upload token: ${uploadVerify.Error || 'unauthorized'}` });
+    return;
+  }
+
+  const userId = uploadVerify.UserId;
+
+  // 2. Validate binary body
+  const buffer = req.body as Buffer;
+  if (!buffer || !Buffer.isBuffer(buffer) || buffer.length === 0) {
+    res.status(400).json({ Success: false, ErrorMessage: 'Empty or invalid file payload.' });
+    return;
+  }
+
+  // 3. Extract and sanitize metadata
+  const rawFileName = (req.headers['x-file-name'] as string) || (req.query.fileName as string) || 'upload.bin';
+  let fileName = 'upload.bin';
+  try {
+    fileName = decodeURIComponent(rawFileName);
+  } catch {
+    fileName = rawFileName;
+  }
+  // Sanitize filename: remove directory traversal, leading slashes, control chars
+  fileName = fileName.replace(/[/\\]+/g, '_').replace(/^\.+/, '').replace(/[\x00-\x1f\x7f]/g, '').trim() || 'upload.bin';
+
+  const mimeType = (req.headers['content-type'] as string) || (req.query.mimeType as string) || 'application/octet-stream';
+
+  try {
+    const uploadToken = UploadTokenManager.Instance.Stage({
+      buffer,
+      fileName,
+      mimeType,
+      userId,
+    });
+
+    res.status(200).json({
+      Success: true,
+      UploadToken: uploadToken,
+      FileName: fileName,
+      MimeType: mimeType,
+      ContentLength: buffer.length,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    LogError(`[MediaStream] Upload staging failed for '${fileName}': ${message}`);
+    res.status(400).json({ Success: false, ErrorMessage: message });
+  }
+}
+
 /** Top-level request handler: verify token → resolve bytes → stream/buffer with Range support. */
 async function handleMediaRequest(req: Request, res: Response): Promise<void> {
   // Express type defs allow req.params values to be string | string[]; normalize to string
@@ -136,6 +226,7 @@ async function resolveFileBytesSource(fileId: string): Promise<FileBytesSource |
     driver,
     providerKey: file.ProviderKey,
     contentType: file.ContentType ?? 'application/octet-stream',
+    fileName: file.Name || 'file',
   };
 }
 
@@ -166,6 +257,8 @@ async function serveViaStream(res: Response, source: FileBytesSource, rangeHeade
 
   res.setHeader('Accept-Ranges', 'bytes');
   res.setHeader('Content-Type', result.ContentType ?? source.contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
   if (result.ContentLength != null) {
     res.setHeader('Content-Length', String(result.ContentLength));
   }
@@ -198,6 +291,8 @@ async function serveViaBuffer(res: Response, source: FileBytesSource, rangeHeade
 
   res.setHeader('Accept-Ranges', 'bytes');
   res.setHeader('Content-Type', source.contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
 
   if (!rangeHeader) {
     res.status(200);