@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.3

package/src/__tests__/uploadTokenManager.test.ts

@@ -0,0 +1,159 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { UploadTokenManager } from '../rest/UploadTokenManager.js';
+
+describe('UploadTokenManager', () => {
+  beforeEach(() => {
+    UploadTokenManager.Instance.Clear();
+    UploadTokenManager.Instance.maxFileSizeBytes = 100 * 1024 * 1024;
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 500 * 1024 * 1024;
+  });
+
+  it('stages and consumes a buffer atomically', () => {
+    const buf = Buffer.from('hello world raw binary', 'utf-8');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'test.txt',
+      mimeType: 'text/plain',
+      userId: 'user-123',
+    });
+
+    expect(token).toMatch(/^upt_[a-f0-9]{64}$/);
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(1);
+    expect(UploadTokenManager.Instance.TotalMemoryBytes).toBe(buf.length);
+
+    // Consume with matching user
+    const consumed = UploadTokenManager.Instance.Consume(token, 'user-123');
+    expect(consumed).not.toBeNull();
+    expect(consumed?.buffer.toString('utf-8')).toBe('hello world raw binary');
+    expect(consumed?.fileName).toBe('test.txt');
+    expect(consumed?.mimeType).toBe('text/plain');
+
+    // Single-use: consuming again must return null
+    expect(UploadTokenManager.Instance.Consume(token, 'user-123')).toBeNull();
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+    expect(UploadTokenManager.Instance.TotalMemoryBytes).toBe(0);
+  });
+
+  it('rejects claim by a different user and evicts token', () => {
+    const buf = Buffer.from('secret payload', 'utf-8');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'secret.pdf',
+      mimeType: 'application/pdf',
+      userId: 'user-authorized',
+    });
+
+    // Claim attempt by attacker
+    const result = UploadTokenManager.Instance.Consume(token, 'user-attacker');
+    expect(result).toBeNull();
+
+    // Token must be evicted after failed attempt
+    expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+    expect(UploadTokenManager.Instance.Consume(token, 'user-authorized')).toBeNull();
+  });
+
+  it('enforces single file size limit', () => {
+    UploadTokenManager.Instance.maxFileSizeBytes = 10;
+    const buf = Buffer.alloc(20);
+
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: buf,
+        fileName: 'huge.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-123',
+      });
+    }).toThrow(/exceeds maximum allowed file size/);
+  });
+
+  it('enforces pool memory capacity limit', () => {
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 50;
+
+    UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'file1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-123',
+    });
+
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: Buffer.alloc(30),
+        fileName: 'file2.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-123',
+      });
+    }).toThrow(/memory capacity reached/);
+  });
+
+  it('auto-evicts token after TTL expiry', async () => {
+    vi.useFakeTimers();
+    try {
+      const buf = Buffer.from('ephemeral data');
+      const token = UploadTokenManager.Instance.Stage({
+        buffer: buf,
+        fileName: 'temp.txt',
+        mimeType: 'text/plain',
+        userId: 'user-123',
+        ttlSeconds: 5,
+      });
+
+      expect(UploadTokenManager.Instance.ActiveCount).toBe(1);
+
+      // Fast-forward 6 seconds
+      vi.advanceTimersByTime(6000);
+
+      expect(UploadTokenManager.Instance.ActiveCount).toBe(0);
+      expect(UploadTokenManager.Instance.Consume(token, 'user-123')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('normalizes UUIDs when verifying claiming user', () => {
+    const buf = Buffer.from('uuid test data');
+    const token = UploadTokenManager.Instance.Stage({
+      buffer: buf,
+      fileName: 'uuid.txt',
+      mimeType: 'text/plain',
+      userId: '4A68B0D7-49EE-4D56-82DE-92F66627EE2B',
+    });
+
+    // Claim with lowercase UUID
+    const consumed = UploadTokenManager.Instance.Consume(token, '4a68b0d7-49ee-4d56-82de-92f66627ee2b');
+    expect(consumed).not.toBeNull();
+    expect(consumed?.buffer.toString('utf-8')).toBe('uuid test data');
+  });
+
+  it('enforces per-user memory quota independently of pool memory', () => {
+    UploadTokenManager.Instance.maxPoolMemoryBytes = 500;
+    UploadTokenManager.Instance.maxUserMemoryBytes = 40;
+
+    // User A stages 30 bytes (OK)
+    UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'userA_1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-A',
+    });
+
+    // User A tries to stage another 20 bytes (exceeds 40 byte user quota)
+    expect(() => {
+      UploadTokenManager.Instance.Stage({
+        buffer: Buffer.alloc(20),
+        fileName: 'userA_2.dat',
+        mimeType: 'application/octet-stream',
+        userId: 'user-A',
+      });
+    }).toThrow(/Per-user upload memory quota reached/);
+
+    // User B can still stage 30 bytes because User B has their own quota
+    const tokenB = UploadTokenManager.Instance.Stage({
+      buffer: Buffer.alloc(30),
+      fileName: 'userB_1.dat',
+      mimeType: 'application/octet-stream',
+      userId: 'user-B',
+    });
+    expect(tokenB).toBeDefined();
+  });
+});

package/src/auth/AuthProviderCatalogRouter.ts

@@ -0,0 +1,76 @@
+/**
+ * @fileoverview Unauthenticated provider-catalog endpoint.
+ *
+ * The browser must know which identity providers exist BEFORE it can authenticate, so this
+ * router is mounted ahead of the unified auth middleware — the same pattern the magic-link JWKS
+ * and widget-session routes already use.
+ *
+ * @module @memberjunction/server/auth
+ */
+
+import { Router, type Request, type Response } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError, type PublicAuthProviderCatalog } from '@memberjunction/core';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
+
+/** Mount path for the public catalog router. */
+export const AUTH_CATALOG_MOUNT_PATH = '/auth';
+
+/** Requests per window per IP. Generous — a browser makes one call per page load. */
+const DEFAULT_RATE_LIMIT_MAX = 60;
+
+/** Rate-limit window. */
+const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
+
+/**
+ * How long a browser may cache the catalog.
+ *
+ * Short by design: this drives the login screen, so an admin who enables a provider expects to
+ * see it without telling users to hard-refresh. A minute keeps the endpoint cheap without making
+ * configuration changes feel stuck.
+ */
+const CACHE_MAX_AGE_SECONDS = 60;
+
+/**
+ * Builds the unauthenticated `GET /auth/providers` router.
+ *
+ * **What it exposes.** Only `Active` + `ClientVisible` rows, projected to the public allow-list
+ * by {@link AuthProviderEngine.GetPublicCatalog}. Secret material is structurally unable to reach
+ * this response: `CredentialID` and `AdditionalConfiguration` are not part of the public shape,
+ * and non-primitive `ClientConfiguration` values are dropped rather than serialized.
+ *
+ * **Why publishing this is safe.** Every value here was already shipped to anonymous users — a
+ * single-provider SPA compiled its client ID, domain and issuer straight into its JavaScript
+ * bundle. This endpoint moves that same data behind one source of truth; it does not widen what
+ * an anonymous caller can learn.
+ *
+ * **Failure is empty, not an error.** If the catalog cannot be read, the endpoint returns an empty
+ * list so the browser falls back to its compiled `AUTH_TYPE` and the user can still sign in.
+ * Returning 500 would take the login screen down for a problem the client can route around.
+ */
+export function createAuthProviderCatalogRouter(): Router {
+  const router = Router();
+
+  const limiter = rateLimit({
+    windowMs: DEFAULT_RATE_LIMIT_WINDOW_MS,
+    limit: DEFAULT_RATE_LIMIT_MAX,
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: { providers: [] }
+  });
+
+  router.get('/providers', limiter, (_req: Request, res: Response) => {
+    try {
+      const body: PublicAuthProviderCatalog = { providers: AuthProviderEngine.Instance.GetPublicCatalog() };
+      res.set('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
+      res.status(200).json(body);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`[Auth] Failed to serve the public provider catalog: ${message}`);
+      const empty: PublicAuthProviderCatalog = { providers: [] };
+      res.status(200).json(empty);
+    }
+  });
+
+  return router;
+}

package/src/auth/AuthProviderEngine.ts

@@ -0,0 +1,253 @@
+/**
+ * @fileoverview Metadata-driven authentication provider catalog.
+ *
+ * Loads `MJ: Authentication Providers` rows and registers each one with the runtime
+ * `AuthProviderFactory`, resolving the concrete driver through `ClassFactory` by `DriverClass`.
+ * This is the auth subsystem's equivalent of the File Storage `ServerDriverKey` pattern:
+ * adding a provider is a subclass plus a row, never an edit to core code.
+ *
+ * @module @memberjunction/server/auth
+ */
+
+import {
+  BaseEngine,
+  BaseEnginePropertyConfig,
+  LogError,
+  LogStatusEx,
+  RegisterForStartup,
+  UserInfo,
+  type AuthProviderConfig,
+  type IMetadataProvider,
+  type PublicAuthProviderInfo
+} from '@memberjunction/core';
+import { MJAuthenticationProviderEntity } from '@memberjunction/core-entities';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { CredentialEngine } from '@memberjunction/credentials';
+
+/**
+ * Subsystem label used when this engine asks CredentialEngine to decrypt secret material,
+ * so credential-access auditing attributes the read to authentication.
+ */
+const CREDENTIAL_SUBSYSTEM = 'Authentication';
+
+/**
+ * Loads the authentication-provider catalog from metadata and registers it with the
+ * {@link AuthProviderFactory}.
+ *
+ * **Not `deferred`**: no authenticated request may be served before the catalog is registered,
+ * or tokens from a metadata-defined provider would be rejected during the startup window.
+ *
+ * **Severity is `warn`, not `fatal`**, and that is deliberate. This engine is one of two possible
+ * sources of providers — `initializeAuthProviders` also registers whatever `mj.config.cjs`
+ * declares. Making a catalog load failure fatal would turn a transient metadata problem into a
+ * total authentication outage for deployments that never adopted the table. The failure is
+ * logged loudly and the config-declared providers still stand.
+ */
+@RegisterForStartup({
+  priority: 20,
+  severity: 'warn',
+  deferred: false,
+  description: 'Loads the metadata authentication-provider catalog and registers it with AuthProviderFactory'
+})
+export class AuthProviderEngine extends BaseEngine<AuthProviderEngine> {
+  private _providers: MJAuthenticationProviderEntity[] = [];
+
+  public static get Instance(): AuthProviderEngine {
+    return super.getInstance<AuthProviderEngine>();
+  }
+
+  /**
+   * Loads Active providers only. Inactive rows are excluded at the query rather than filtered
+   * later, so a disabled provider is never even instantiated.
+   */
+  public async Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void> {
+    const configs: Partial<BaseEnginePropertyConfig>[] = [
+      {
+        PropertyName: '_providers',
+        EntityName: 'MJ: Authentication Providers',
+        Filter: `Status='Active'`,
+        OrderBy: 'Sequence ASC, Name ASC',
+        CacheLocal: true
+      }
+    ];
+    await this.Load(configs, provider, forceRefresh, contextUser);
+  }
+
+  /** Active providers from metadata, ordered for presentation. */
+  public get Providers(): MJAuthenticationProviderEntity[] {
+    return this.GetConfigData<MJAuthenticationProviderEntity>('_providers');
+  }
+
+  /**
+   * Startup hook: load the catalog, then register every row with the factory.
+   */
+  public async HandleStartup(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void> {
+    await this.Config(false, contextUser, provider);
+    await this.RegisterAll(contextUser);
+  }
+
+  /**
+   * Instantiates and registers every catalog row with the {@link AuthProviderFactory}.
+   *
+   * One bad row must not cost the deployment its other providers, so each registration is
+   * isolated: a failure is logged with the offending provider's name and the loop continues.
+   *
+   * @returns the number of providers successfully registered.
+   */
+  public async RegisterAll(contextUser?: UserInfo): Promise<number> {
+    const factory = AuthProviderFactory.Instance;
+    let registered = 0;
+
+    for (const row of this.Providers) {
+      try {
+        const config = await this.buildProviderConfig(row, contextUser);
+        factory.register(AuthProviderFactory.createProvider(config));
+        registered++;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        LogError(`[Auth] Could not register metadata provider '${row.Name}' (DriverClass '${row.DriverClass}'): ${message}`);
+      }
+    }
+
+    if (registered > 0) {
+      LogStatusEx({ message: `[Auth] Registered ${registered} provider(s) from metadata.`, verboseOnly: true });
+    }
+    return registered;
+  }
+
+  /**
+   * Projects a catalog row onto the runtime {@link AuthProviderConfig} the driver expects.
+   *
+   * `AdditionalConfiguration` is spread FIRST so that the modelled columns win over anything a
+   * driver-specific blob happens to repeat — the columns are the reviewable, described surface,
+   * and a JSON blob must not be able to silently redefine the issuer a token is validated against.
+   */
+  private async buildProviderConfig(row: MJAuthenticationProviderEntity, contextUser?: UserInfo): Promise<AuthProviderConfig> {
+    const additional = this.parseJsonColumn(row.AdditionalConfiguration, row.Name, 'AdditionalConfiguration');
+    const secrets = await this.resolveCredential(row, contextUser);
+
+    const config: AuthProviderConfig = {
+      ...additional,
+      ...secrets,
+      name: row.Name,
+      type: row.DriverClass
+    };
+
+    if (row.ClientID) config.clientId = row.ClientID;
+    if (row.Domain) config.domain = row.Domain;
+    if (row.Issuer) config.issuer = row.Issuer;
+    if (row.Audience) config.audience = row.Audience;
+    if (row.JWKSUri) config.jwksUri = row.JWKSUri;
+    if (row.Scopes) config.scopes = this.parseScopes(row.Scopes);
+
+    return config;
+  }
+
+  /**
+   * Splits the delimited `Scopes` column into the parsed list both projections publish.
+   *
+   * This is the single home of the delimiter convention: `buildProviderConfig` and
+   * `GetPublicCatalog` must agree on it, or the server would validate tokens against one scope
+   * set while telling the browser to request another.
+   */
+  private parseScopes(raw: string | null): string[] {
+    return raw ? raw.split(/[\s,]+/).filter((s) => s.length > 0) : [];
+  }
+
+  /**
+   * Decrypts the row's linked credential, when it has one.
+   *
+   * Almost every provider validates tokens against a public JWKS and needs no secret at all, so
+   * this is the uncommon path — present for confidential-client flows, management APIs, and SCIM.
+   */
+  private async resolveCredential(row: MJAuthenticationProviderEntity, contextUser?: UserInfo): Promise<Record<string, string>> {
+    if (!row.CredentialID || !row.Credential) {
+      return {};
+    }
+
+    await CredentialEngine.Instance.Config(false, contextUser);
+    const resolved = await CredentialEngine.Instance.getCredential(row.Credential, {
+      contextUser,
+      subsystem: CREDENTIAL_SUBSYSTEM
+    });
+    return resolved.values;
+  }
+
+  /**
+   * Parses a JSON configuration column, treating malformed content as absent.
+   *
+   * Throwing here would take down an otherwise-valid provider over a stray character in an
+   * optional extras blob, so the row is registered without the extras and the problem is logged.
+   */
+  private parseJsonColumn(raw: string | null, providerName: string, columnName: string): Record<string, unknown> {
+    if (!raw?.trim()) {
+      return {};
+    }
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return parsed as Record<string, unknown>;
+      }
+      LogError(`[Auth] ${columnName} on provider '${providerName}' is not a JSON object; ignoring it.`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`[Auth] ${columnName} on provider '${providerName}' is not valid JSON (${message}); ignoring it.`);
+    }
+    return {};
+  }
+
+  /**
+   * Projects the catalog to the PUBLIC shape served by the unauthenticated catalog endpoint.
+   *
+   * The projection is an explicit allow-list rather than a redaction of the full row: a column
+   * added to this entity later is invisible to anonymous callers until someone deliberately adds
+   * it here. `AdditionalConfiguration` and `CredentialID` are structurally absent, never merely
+   * omitted at serialization time.
+   */
+  public GetPublicCatalog(): PublicAuthProviderInfo[] {
+    return this.Providers.filter((row) => row.ClientVisible).map((row) => {
+      const info: PublicAuthProviderInfo = {
+        name: row.Name,
+        driverClass: row.DriverClass,
+        displayName: row.DisplayName ?? row.Name,
+        sequence: row.Sequence,
+        isDefault: row.IsDefault
+      };
+
+      if (row.Icon) info.icon = row.Icon;
+      if (row.ClientID) info.clientId = row.ClientID;
+      if (row.Issuer) info.issuer = row.Issuer;
+      if (row.Domain) info.domain = row.Domain;
+
+      // Published pre-parsed so the browser never re-derives the delimiter convention —
+      // the drivers hand this straight to SDK config typed string[].
+      const scopes = this.parseScopes(row.Scopes);
+      if (scopes.length > 0) info.scopes = scopes;
+
+      const clientConfig = this.parseJsonColumn(row.ClientConfiguration, row.Name, 'ClientConfiguration');
+      if (Object.keys(clientConfig).length > 0) {
+        info.clientConfiguration = this.toPublicClientConfig(clientConfig, row.Name);
+      }
+
+      return info;
+    });
+  }
+
+  /**
+   * Flattens a parsed `ClientConfiguration` blob to the primitive key/value shape the browser
+   * contract declares. Nested objects and arrays are dropped with a warning rather than passed
+   * through, so a structured blob (the shape a credential would take) cannot ride along to an
+   * anonymous caller.
+   */
+  private toPublicClientConfig(parsed: Record<string, unknown>, providerName: string): Record<string, string | number | boolean | null> {
+    const result: Record<string, string | number | boolean | null> = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (value === null || ['string', 'number', 'boolean'].includes(typeof value)) {
+        result[key] = value as string | number | boolean | null;
+      } else {
+        LogError(`[Auth] ClientConfiguration key '${key}' on provider '${providerName}' is not a primitive value; it was NOT published to the public catalog.`);
+      }
+    }
+    return result;
+  }
+}

package/src/auth/index.ts

@@ -11,6 +11,9 @@ import { initializeAuthProviders } from './initializeProviders.js';
 
 export * from './APIKeyScopeAuth.js';
 export * from './actingContextResolver.js';
+export * from './AuthProviderEngine.js';
+export * from './AuthProviderCatalogRouter.js';
+export { initializeAuthProviders, initializeAuthProvidersFromMetadata, refreshAuthProviders, validateAuthProvidersRegistered } from './initializeProviders.js';
 
 // This is a hard-coded forever constant due to internal migrations
 
@@ -191,6 +194,42 @@ export const getSystemUser = async (dataSource?: sql.ConnectionPool, attemptCach
   return systemUser;
 };
 
+/**
+ * Extracts the lowercased domain portion of an email address.
+ *
+ * @returns the domain, or an empty string when the value is not an email address (e.g. an IdP that
+ *          issues a bare username). Callers MUST treat an empty result as "cannot be authorized"
+ *          rather than as a wildcard.
+ */
+const extractEmailDomain = (email: string): string => {
+  const parts = email.split('@');
+  // Reject anything that isn't exactly local@domain — a value with 0 or 2+ '@' is not an address we
+  // can make a trust decision about.
+  if (parts.length !== 2) return '';
+  return parts[1].toLowerCase().trim();
+};
+
+/**
+ * Tests a domain against `userHandling.newUserAuthorizedDomains`, honoring `*` wildcards.
+ *
+ * Note that a pattern is matched in full, so `*.example.com` matches `mail.example.com` but NOT
+ * `example.com` — list both if you need both.
+ */
+const isDomainAuthorized = (domain: string): boolean =>
+  configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
+    // Convert wildcard domain patterns to regular expressions
+    const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
+    return regex.test(domain);
+  });
+
+/**
+ * Resolves a verified identity to an MJ `UserInfo`, optionally auto-provisioning a new user.
+ *
+ * @param requestDomain the hostname parsed from the request's `Origin` header. **Not used for any
+ *        authorization decision** — it is spoofable on non-browser requests, and new-user domain
+ *        authorization runs against the verified JWT's email domain instead. Retained for audit
+ *        logging and for the recursive retry call.
+ */
 export const verifyUserRecord = async (
   email?: string,
   firstName?: string,
@@ -211,23 +250,21 @@ export const verifyUserRecord = async (
   });
 
   if (!user) {
-    if (
-      configInfo.userHandling.autoCreateNewUsers &&
-      firstName &&
-      lastName &&
-      (requestDomain || configInfo.userHandling.newUserLimitedToAuthorizedDomains === false)
-    ) {
-      // check to see if the domain that we have a request coming in from matches one of the domains in the autoCreateNewUsersDomains setting
+    // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
+    // this condition. It was previously required here, which meant a non-browser client sending no
+    // Origin could never auto-provision while an attacker simply forged one — it gated entry without
+    // authorizing anything. Authorization happens below, against the verified identity's email domain.
+    if (configInfo.userHandling.autoCreateNewUsers && firstName && lastName) {
+      // SECURITY: authorize against the EMAIL DOMAIN of the cryptographically-verified identity,
+      // NOT the request `Origin` header. Origin is trivially spoofable on non-browser / bearer-token
+      // requests, so gating on it let a holder of any valid IdP token auto-provision an account under
+      // an authorized domain by sending a forged Origin. The email comes from the verified JWT.
+      const emailDomain: string = extractEmailDomain(email);
       let passesDomainCheck: boolean =
         configInfo.userHandling.newUserLimitedToAuthorizedDomains ===
         false; /*in this first condition, we are set up to NOT care about domain */
-      if (!passesDomainCheck && requestDomain) {
-        /*in this second condition, we check the domain against authorized domains*/
-        passesDomainCheck = configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
-          // Convert wildcard domain patterns to regular expressions
-          const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
-          return regex.test(requestDomain?.toLowerCase().trim());
-        });
+      if (!passesDomainCheck) {
+        passesDomainCheck = emailDomain.length > 0 && isDomainAuthorized(emailDomain);
       }
 
       if (passesDomainCheck) {
@@ -253,9 +290,16 @@ export const verifyUserRecord = async (
           UserCache.Instance.Users.push(user);
           console.warn(`   >>> New user ${email} created successfully!`);
         }
+      } else if (emailDomain.length === 0) {
+        // The verified identity carries no email domain at all — typically an IdP that issues a bare
+        // `preferred_username` with no `email` claim. There is nothing to match against, so the gate
+        // denies rather than falling back to anything spoofable.
+        console.warn(
+          `User ${email} not found in cache and will NOT be auto-created: the verified identity has no email domain (no '@'), so it cannot be matched against newUserAuthorizedDomains. This usually means the identity provider issues a username rather than an email address — configure it to emit an 'email' claim, or set newUserLimitedToAuthorizedDomains to false to disable domain checking.`
+        );
       } else {
         console.warn(
-          `User ${email} not found in cache. Request domain '${requestDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
+          `User ${email} not found in cache. Email domain '${emailDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. NOTE: this check is against the EMAIL DOMAIN of the verified identity, NOT the browser Origin — if newUserAuthorizedDomains lists frontend hostnames (e.g. 'app.example.com'), replace them with email domains (e.g. 'example.com'). To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`
         );
       }
     }