@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.3

package/src/rest/OAuthCallbackHandler.ts

@@ -14,8 +14,8 @@
 
 import express from 'express';
 import { LogError, LogStatus, RunView, UserInfo } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { IsValidUUID, UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { OAuthManager, MCPClientManager } from '@memberjunction/ai-mcp-client';
 import type { MCPServerOAuthConfig } from '@memberjunction/ai-mcp-client';
 
@@ -38,6 +38,23 @@ export interface OAuthCallbackHandlerOptions {
     successRedirectUrl?: string;
     /** URL to redirect to after failed authorization */
     errorRedirectUrl?: string;
+    /**
+     * Origins a caller-supplied `frontendReturnUrl` is allowed to point at, so the OAuth callback
+     * cannot be turned into an open redirect from the trusted MJAPI origin. Normally wired to
+     * `cors.allowedOrigins`. Pass `['*']` to allow any origin — MJ's backward-compatible default
+     * CORS posture, and what a deployment that has not narrowed `cors.allowedOrigins` gets.
+     *
+     * REQUIRED on purpose. An optional field defaulting to allow-all is fail-open: a construction
+     * site that forgets it loses the open-redirect protection silently, with nothing to notice.
+     * Being required makes that a compile error instead. The handler is not exported from this
+     * package's barrel and the package declares no subpath exports, so no consumer outside MJServer
+     * can construct it — revisit this if it is ever added to the public API.
+     *
+     * Injected rather than read from `configInfo` directly so this module has no import-time
+     * dependency on configuration loading — importing the config module validates the whole config
+     * as a side effect, which makes this handler unimportable in any context without one.
+     */
+    allowedFrontendOrigins: string[];
 }
 
 /**
@@ -46,10 +63,15 @@ export interface OAuthCallbackHandlerOptions {
  * The callback endpoint is unauthenticated because it's called by external auth servers.
  * It uses the state parameter to look up the authorization context and validate the flow.
  *
+ * NOTE: `allowedFrontendOrigins` is what prevents the callback becoming an open redirect, and is
+ * required so it cannot be forgotten. Wire it to `configInfo.cors?.allowedOrigins`; `['*']` allows
+ * any origin, matching MJ's default CORS posture.
+ *
  * @example
  * ```typescript
  * const oauthHandler = new OAuthCallbackHandler({
- *     publicUrl: 'https://api.example.com'
+ *     publicUrl: 'https://api.example.com',
+ *     allowedFrontendOrigins: configInfo.cors?.allowedOrigins ?? ['*']
  * });
  *
  * // Mount unauthenticated callback route
@@ -348,7 +370,10 @@ export class OAuthCallbackHandler {
      * @param res - Express response
      */
     private async initiateFlow(req: express.Request, res: express.Response): Promise<void> {
-        const { connectionId, additionalScopes, frontendReturnUrl } = req.body;
+        // Coerce request-body values to strings up front. A JSON body can carry arrays/objects, and
+        // passing those downstream unvalidated turns a bad request into a confusing internal failure.
+        const connectionId: string = typeof req.body?.connectionId === 'string' ? req.body.connectionId : '';
+        const { additionalScopes, frontendReturnUrl } = req.body;
         const contextUser = req['mjUser'] as UserInfo;
 
         if (!contextUser) {
@@ -368,6 +393,29 @@ export class OAuthCallbackHandler {
             return;
         }
 
+        // connectionId is a record ID (UUID). Reject anything else at the boundary so it can never
+        // reach a SQL filter or downstream consumer as injectable input.
+        if (!IsValidUUID(connectionId)) {
+            res.status(400).json({
+                success: false,
+                errorCode: 'invalid_request',
+                errorMessage: 'connectionId must be a valid record identifier'
+            });
+            return;
+        }
+
+        // Reject a disallowed return URL here rather than at the callback. Otherwise the caller only
+        // finds out after the whole OAuth round trip, by being silently sent to the default page.
+        // An absent value is acceptable — see isFrontendReturnUrlAcceptable.
+        if (!this.isFrontendReturnUrlAcceptable(frontendReturnUrl)) {
+            res.status(400).json({
+                success: false,
+                errorCode: 'invalid_request',
+                errorMessage: 'frontendReturnUrl is not an allowed redirect target'
+            });
+            return;
+        }
+
         try {
             // Load connection and server config
             const config = await this.loadConnectionConfig(connectionId, contextUser);
@@ -644,10 +692,13 @@ export class OAuthCallbackHandler {
         try {
             const rv = new RunView();
 
-            // Get connection to get server ID
+            // Get connection to get server ID.
+            // connectionId is caller-supplied (POST /oauth/initiate body). MJ ExtraFilter is a raw
+            // SQL fragment, so single quotes MUST be doubled to prevent injection — matching the
+            // escaping used for stateParameter in loadAuthorizationState().
             const connResult = await rv.RunView<{ MCPServerID: string }>({
                 EntityName: ENTITY_MCP_SERVER_CONNECTIONS,
-                ExtraFilter: `ID='${connectionId}'`,
+                ExtraFilter: `ID='${connectionId.replace(/'/g, "''")}'`,
                 Fields: ['MCPServerID'],
                 ResultType: 'simple'
             }, contextUser);
@@ -696,32 +747,93 @@ export class OAuthCallbackHandler {
         }
     }
 
+    /**
+     * Validates that a caller-supplied frontend return URL points at an allowed origin, so the
+     * OAuth callback cannot be turned into an open redirect from the trusted MJAPI origin.
+     *
+     * Allowed when: the allowlist is "allow all" (`['*']`, the backward-compatible default),
+     * the URL's origin is in `options.allowedFrontendOrigins`, or it matches the origin of a
+     * built-in success/error redirect URL. Anything else is rejected and the caller falls back to
+     * the default redirect page.
+     */
+    private isFrontendReturnUrlAllowed(url: URL): boolean {
+        const allowed = this.options.allowedFrontendOrigins;
+        if (allowed.includes('*')) {
+            return true;
+        }
+        if (allowed.includes(url.origin)) {
+            return true;
+        }
+        for (const builtIn of [this.options.successRedirectUrl, this.options.errorRedirectUrl]) {
+            try {
+                if (builtIn && new URL(builtIn).origin === url.origin) {
+                    return true;
+                }
+            } catch {
+                // Ignore an unparseable built-in URL and keep checking.
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Parses a caller-supplied return URL and applies {@link isFrontendReturnUrlAllowed}.
+     *
+     * @returns the parsed URL when it is well-formed AND points at an allowed origin, otherwise null.
+     */
+    private parseAllowedFrontendReturnUrl(frontendReturnUrl: string): URL | null {
+        let url: URL;
+        try {
+            url = new URL(frontendReturnUrl);
+        } catch {
+            LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
+            return null;
+        }
+        if (!this.isFrontendReturnUrlAllowed(url)) {
+            LogError(`[OAuth Callback] frontend return URL '${frontendReturnUrl}' origin not allowed, falling back to default`);
+            return null;
+        }
+        return url;
+    }
+
+    /**
+     * Boundary check for `/oauth/initiate` — validates the return URL before it is persisted onto
+     * the authorization state, so a caller gets a 400 instead of a silent fallback later.
+     *
+     * An ABSENT value (undefined / null / empty string) is acceptable: it means "no return URL", and
+     * every downstream consumer treats it that way via a truthiness check. Only a value the caller
+     * actually supplied is validated — otherwise omitting the field, or sending an empty one, would
+     * newly fail a request that has always worked.
+     */
+    private isFrontendReturnUrlAcceptable(frontendReturnUrl: unknown): boolean {
+        if (!frontendReturnUrl) {
+            return true;
+        }
+        return typeof frontendReturnUrl === 'string' && this.parseAllowedFrontendReturnUrl(frontendReturnUrl) !== null;
+    }
+
     /**
      * Redirects to success page with state info.
      * If a frontend return URL is provided, redirects there instead of the default success page.
      */
     private redirectToSuccess(res: express.Response, state: string, connectionId: string, frontendReturnUrl?: string): void {
-        // If frontend return URL is provided, redirect there with success parameters
-        if (frontendReturnUrl) {
-            try {
-                const url = new URL(frontendReturnUrl);
-                url.searchParams.set('oauth', 'success');
-                url.searchParams.set('state', state);
-                url.searchParams.set('connectionId', connectionId);
-                LogStatus(`[OAuth Callback] Redirecting to frontend URL: ${url.toString()}`);
-                res.redirect(302, url.toString());
-                return;
-            } catch (error) {
-                LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
-                // Fall through to default redirect
-            }
+        // If frontend return URL is provided and points at an allowed origin, redirect there with
+        // success parameters. Anything else falls through to the built-in page.
+        const url = frontendReturnUrl ? this.parseAllowedFrontendReturnUrl(frontendReturnUrl) : null;
+        if (url) {
+            url.searchParams.set('oauth', 'success');
+            url.searchParams.set('state', state);
+            url.searchParams.set('connectionId', connectionId);
+            LogStatus(`[OAuth Callback] Redirecting to frontend URL: ${url.toString()}`);
+            res.redirect(302, url.toString());
+            return;
         }
 
         // Default: redirect to built-in success page
-        const url = new URL(this.options.successRedirectUrl!);
-        url.searchParams.set('state', state);
-        url.searchParams.set('connectionId', connectionId);
-        res.redirect(302, url.toString());
+        const defaultUrl = new URL(this.options.successRedirectUrl!);
+        defaultUrl.searchParams.set('state', state);
+        defaultUrl.searchParams.set('connectionId', connectionId);
+        res.redirect(302, defaultUrl.toString());
     }
 
     /**
@@ -729,27 +841,23 @@ export class OAuthCallbackHandler {
      * If a frontend return URL is provided, redirects there instead of the default error page.
      */
     private redirectToError(res: express.Response, errorCode: string, errorMessage: string, frontendReturnUrl?: string): void {
-        // If frontend return URL is provided, redirect there with error parameters
-        if (frontendReturnUrl) {
-            try {
-                const url = new URL(frontendReturnUrl);
-                url.searchParams.set('oauth', 'error');
-                url.searchParams.set('error', errorCode);
-                url.searchParams.set('error_description', errorMessage);
-                LogStatus(`[OAuth Callback] Redirecting to frontend URL with error: ${url.toString()}`);
-                res.redirect(302, url.toString());
-                return;
-            } catch (error) {
-                LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
-                // Fall through to default redirect
-            }
+        // If frontend return URL is provided and points at an allowed origin, redirect there with
+        // error parameters. Anything else falls through to the built-in page.
+        const url = frontendReturnUrl ? this.parseAllowedFrontendReturnUrl(frontendReturnUrl) : null;
+        if (url) {
+            url.searchParams.set('oauth', 'error');
+            url.searchParams.set('error', errorCode);
+            url.searchParams.set('error_description', errorMessage);
+            LogStatus(`[OAuth Callback] Redirecting to frontend URL with error: ${url.toString()}`);
+            res.redirect(302, url.toString());
+            return;
         }
 
         // Default: redirect to built-in error page
-        const url = new URL(this.options.errorRedirectUrl!);
-        url.searchParams.set('error', errorCode);
-        url.searchParams.set('error_description', errorMessage);
-        res.redirect(302, url.toString());
+        const defaultUrl = new URL(this.options.errorRedirectUrl!);
+        defaultUrl.searchParams.set('error', errorCode);
+        defaultUrl.searchParams.set('error_description', errorMessage);
+        res.redirect(302, defaultUrl.toString());
     }
 
     /**

package/src/rest/SignatureWebhookHandler.ts

@@ -14,7 +14,7 @@
 import express from 'express';
 import BodyParser from 'body-parser';
 import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { SignatureEngine } from '@memberjunction/esignature/server';
 
 /**

package/src/rest/UploadTokenManager.ts

@@ -0,0 +1,211 @@
+/**
+ * @fileoverview Ephemeral in-memory staged upload token manager.
+ *
+ * Provides a secure, single-use, time-to-live (TTL) bounded staging area for raw
+ * binary upload buffers received via REST streaming before being committed through
+ * the GraphQL `UploadStorageFile` pipeline.
+ *
+ * Security properties:
+ * - Single-use nonce: Token and buffer are atomically destroyed on first consumption.
+ * - User binding: Tokens are bound to the authenticated User ID that uploaded them.
+ * - Auto-eviction: Abandoned tokens are automatically evicted from RAM after the TTL.
+ * - Memory caps: Enforces per-file max size (default 100MB) and total pool capacity (default 500MB).
+ *
+ * @module @memberjunction/server/rest/UploadTokenManager
+ */
+
+import { BaseSingleton, UUIDsEqual } from '@memberjunction/global';
+import { LogError } from '@memberjunction/core';
+import { randomBytes } from 'node:crypto';
+
+/**
+ * An ephemeral in-memory staged upload record.
+ */
+export interface StagedUploadEntry {
+  token: string;
+  buffer: Buffer;
+  fileName: string;
+  mimeType: string;
+  contentLength: number;
+  userId: string;
+  createdAt: number;
+  expiresAt: number;
+  timer: NodeJS.Timeout;
+}
+
+/**
+ * Ephemeral In-Memory Staged Upload Token Manager.
+ *
+ * Architecture & Deployment Topology Note:
+ * This implementation maintains staged buffers in-process RAM with a 5-minute sliding TTL.
+ * In a clustered/multi-replica deployment behind a load balancer, sticky sessions (or routing
+ * the subsequent GraphQL `UploadStorageFile` commit to the same node) are recommended.
+ * For shared-memory multi-node clustering, an external ephemeral store (such as Redis)
+ * can be plugged in behind this interface.
+ */
+export class UploadTokenManager extends BaseSingleton<UploadTokenManager> {
+  private readonly _staged = new Map<string, StagedUploadEntry>();
+  private _totalMemoryBytes = 0;
+
+  public defaultTtlSeconds = 300; // 5 minutes
+  public maxFileSizeBytes = 100 * 1024 * 1024; // 100 MB
+  public maxUserMemoryBytes = 150 * 1024 * 1024; // 150 MB per user
+  public maxPoolMemoryBytes = 500 * 1024 * 1024; // 500 MB
+
+  // Public constructor required by BaseSingleton
+  public constructor() {
+    super();
+  }
+
+  public static get Instance(): UploadTokenManager {
+    return UploadTokenManager.getInstance<UploadTokenManager>();
+  }
+
+  /**
+   * Calculates total active staged bytes currently held for a given user.
+   */
+  public GetUserMemoryBytes(userId: string): number {
+    let total = 0;
+    for (const entry of this._staged.values()) {
+      if (UUIDsEqual(entry.userId, userId)) {
+        total += entry.contentLength;
+      }
+    }
+    return total;
+  }
+
+  /**
+   * Stages a raw binary buffer in RAM, returning a single-use cryptographic token.
+   *
+   * @throws Error if buffer exceeds single file limit, per-user quota, or global pool memory capacity.
+   */
+  public Stage(params: {
+    buffer: Buffer;
+    fileName: string;
+    mimeType: string;
+    userId: string;
+    ttlSeconds?: number;
+  }): string {
+    const size = params.buffer.length;
+
+    if (size > this.maxFileSizeBytes) {
+      throw new Error(
+        `Staged upload exceeds maximum allowed file size of ${Math.round(this.maxFileSizeBytes / (1024 * 1024))}MB (received ${Math.round(size / (1024 * 1024))}MB).`
+      );
+    }
+
+    const userCurrentBytes = this.GetUserMemoryBytes(params.userId);
+    if (userCurrentBytes + size > this.maxUserMemoryBytes) {
+      throw new Error(
+        `Per-user upload memory quota reached (${Math.round(userCurrentBytes / (1024 * 1024))}MB / ${Math.round(this.maxUserMemoryBytes / (1024 * 1024))}MB used). Please wait for active uploads to finalize.`
+      );
+    }
+
+    if (this._totalMemoryBytes + size > this.maxPoolMemoryBytes) {
+      throw new Error(
+        `Staged upload memory capacity reached (${Math.round(this._totalMemoryBytes / (1024 * 1024))}MB / ${Math.round(this.maxPoolMemoryBytes / (1024 * 1024))}MB used). Please try again shortly.`
+      );
+    }
+
+    const token = 'upt_' + randomBytes(32).toString('hex');
+    const ttl = params.ttlSeconds || this.defaultTtlSeconds;
+    const now = Date.now();
+    const expiresAt = now + ttl * 1000;
+
+    const timer = setTimeout(() => {
+      this.Evict(token);
+    }, ttl * 1000);
+
+    // Unref timer so it doesn't hold open process shutdown in tests or CLI
+    if (typeof timer.unref === 'function') {
+      timer.unref();
+    }
+
+    const entry: StagedUploadEntry = {
+      token,
+      buffer: params.buffer,
+      fileName: params.fileName,
+      mimeType: params.mimeType,
+      contentLength: size,
+      userId: params.userId,
+      createdAt: now,
+      expiresAt,
+      timer,
+    };
+
+    this._staged.set(token, entry);
+    this._totalMemoryBytes += size;
+
+    return token;
+  }
+
+  /**
+   * Atomically consumes and evicts a staged upload token.
+   *
+   * @param token The staged upload token.
+   * @param claimingUserId The user ID claiming this token. If provided, must match the user who uploaded it.
+   * @returns The staged buffer and metadata, or null if the token is invalid, expired, or claimed by the wrong user.
+   */
+  public Consume(
+    token: string,
+    claimingUserId?: string
+  ): { buffer: Buffer; fileName: string; mimeType: string; contentLength: number } | null {
+    if (!token || !this._staged.has(token)) {
+      return null;
+    }
+
+    const entry = this._staged.get(token)!;
+
+    // Security check: verify user ownership using UUIDsEqual for robust ID normalization
+    if (claimingUserId && entry.userId && !UUIDsEqual(entry.userId, claimingUserId)) {
+      LogError(`[UploadTokenManager] Security violation: User '${claimingUserId}' attempted to claim upload token owned by User '${entry.userId}'.`);
+      // Evict immediately to prevent further probing
+      this.Evict(token);
+      return null;
+    }
+
+    // Atomic consumption & memory reclamation
+    this.Evict(token);
+
+    return {
+      buffer: entry.buffer,
+      fileName: entry.fileName,
+      mimeType: entry.mimeType,
+      contentLength: entry.contentLength,
+    };
+  }
+
+  /**
+   * Evicts a token from RAM and reclaims memory.
+   */
+  public Evict(token: string): boolean {
+    const entry = this._staged.get(token);
+    if (!entry) {
+      return false;
+    }
+
+    clearTimeout(entry.timer);
+    this._staged.delete(token);
+    this._totalMemoryBytes = Math.max(0, this._totalMemoryBytes - entry.contentLength);
+    return true;
+  }
+
+  /** Total RAM in bytes currently consumed by all active staged uploads. */
+  public get TotalMemoryBytes(): number {
+    return this._totalMemoryBytes;
+  }
+
+  /** Count of currently active staged uploads. */
+  public get ActiveCount(): number {
+    return this._staged.size;
+  }
+
+  /** Clears all active staged uploads. */
+  public Clear(): void {
+    for (const [, entry] of this._staged) {
+      clearTimeout(entry.timer);
+    }
+    this._staged.clear();
+    this._totalMemoryBytes = 0;
+  }
+}

package/src/services/DurableEntityActionTaskSubmitter.ts

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview MJServer's implementation of the `DurableEntityActionSubmitter` seam.
+ *
+ * Turns one After* entity-action dispatch into a single-node durable task graph, which is D14's
+ * whole answer to "run this durably": not a new queue, the substrate that already has a claim
+ * protocol, restart recovery and orphan reclaim.
+ *
+ * Registered at boot beside the dispatcher, because the two are one capability — a submitter with
+ * no dispatcher writes rows nobody picks up, which is worse than staying inline.
+ *
+ * @module @memberjunction/server
+ */
+import type {
+    DurableEntityActionRequest,
+    DurableEntityActionSubmission,
+    DurableEntityActionSubmitter,
+} from '@memberjunction/actions-base';
+import { LogError } from '@memberjunction/core';
+import { TaskNode, type TaskGraphSpec } from '@memberjunction/ai-core-plus';
+import { MJEnvironmentEntityExtended } from '@memberjunction/core-entities';
+import { TaskGraphService, type ProviderFactory } from '@memberjunction/task-graph';
+
+export class DurableEntityActionTaskSubmitter implements DurableEntityActionSubmitter {
+    /**
+     * @param environmentID which environment the tasks belong to. Defaults to the platform default
+     *   because a save has no environment of its own to inherit — the record's entity is global, and
+     *   inventing a per-save environment would put a durable dispatch somewhere nobody looks.
+     */
+    constructor(
+        private readonly providerFactory: ProviderFactory,
+        private readonly environmentID: string = MJEnvironmentEntityExtended.DefaultEnvironmentID,
+    ) {}
+
+    public async Submit(request: DurableEntityActionRequest): Promise<DurableEntityActionSubmission> {
+        try {
+            const spec: TaskGraphSpec = {
+                workflowName: `${request.ActionName} — ${request.EntityName}`,
+                reasoning:
+                    `Durable dispatch of entity action binding ${request.EntityActionID} on ` +
+                    `${request.EntityName} (${request.RecordID}), fired by ${request.InvocationType}.`,
+                tasks: [
+                    TaskNode.Action(
+                        {
+                            tempId: 'action',
+                            name: request.ActionName,
+                            description: `Run ${request.ActionName} for ${request.EntityName} ${request.RecordID}.`,
+                            dependsOn: [],
+                            inputPayload: request.RedactedParams,
+                        },
+                        { actionName: request.ActionName },
+                    ),
+                ],
+                // Nothing to say to anyone: this graph exists because a record was saved, not
+                // because a person asked a question. Defaulting to 'message' would post an
+                // orphaned result into whichever conversation happened to be nearby.
+                continuation: 'none',
+                // The point of the exercise. A one-node graph constant-folds to in-run execution by
+                // default (D9), which is exactly the fire-and-forget behaviour being escaped.
+                durable: true,
+            };
+
+            const provider = await this.providerFactory.CreateProvider();
+            const result = await new TaskGraphService().Submit(spec, {
+                EnvironmentID: this.environmentID,
+                ContextUser: request.ContextUser,
+                Provider: provider,
+            });
+
+            return result.Success
+                ? { Success: true, ParentTaskID: result.ParentTaskID }
+                : { Success: false, ErrorMessage: result.ErrorMessage };
+        } catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            LogError(`[DurableEntityActionTaskSubmitter] Submission failed for binding ${request.EntityActionID}: ${message}`);
+            return { Success: false, ErrorMessage: message };
+        }
+    }
+}