@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.3

package/src/auth/initializeProviders.ts

@@ -1,16 +1,45 @@
 import { configInfo } from '../config.js';
-import { AuthProviderConfig, LogError } from '@memberjunction/core';
+import { AuthProviderConfig, LogError, LogStatus, LogStatusEx, UserInfo, type IMetadataProvider } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
 
 /**
- * Initialize authentication providers from configuration
+ * Initialize authentication providers from configuration.
+ *
+ * Registers everything declared in `mj.config.cjs`'s `authProviders` array. This remains the
+ * baseline path and runs on every boot: it needs no database, so it is what lets the server
+ * authenticate even when metadata is unreachable.
+ *
+ * Providers defined in the `MJ: Authentication Providers` catalog are layered on top by
+ * {@link initializeAuthProvidersFromMetadata}, which runs later in startup once a database
+ * connection and a system user exist.
  */
 export function initializeAuthProviders(): void {
   const factory = AuthProviderFactory.Instance;
-  
+
   // Clear any existing providers
   factory.clear();
 
+  // Environment-derived providers are DEFAULTS: each provider class maps its own variables via
+  // the ConfigFromEnvironment hook, and they apply only when the config file declares no
+  // providers of its own. That mirrors the previous behaviour exactly — the env block used to sit
+  // in DEFAULT_SERVER_CONFIG, and mergeConfigs replaces (rather than concatenates) arrays, so an
+  // explicit `authProviders` in mj.config.cjs has always suppressed the env-derived set.
+  //
+  // Written back into configInfo.authProviders rather than kept local because that array is the
+  // live registry other code reads and appends to (registerMagicLinkAuthProvider pushes into it so
+  // a later re-initialize keeps magic-link).
+  if (!configInfo.authProviders || configInfo.authProviders.length === 0) {
+    const discovered = AuthProviderFactory.DiscoverFromEnvironment();
+    if (discovered.length > 0) {
+      configInfo.authProviders = discovered;
+      LogStatusEx({
+        message: `[Auth] Configured ${discovered.length} provider(s) from environment variables: ${discovered.map((p) => p.name).join(', ')}`,
+        verboseOnly: true
+      });
+    }
+  }
+
   // Initialize providers from authProviders config
   if (configInfo.authProviders && configInfo.authProviders.length > 0) {
     for (const providerConfig of configInfo.authProviders) {
@@ -26,8 +55,100 @@ export function initializeAuthProviders(): void {
     }
   }
 
-  // Validate we have at least one provider
-  if (!factory.hasProviders()) {
-    LogError('No authentication providers configured. Please configure authProviders array in mj.config.cjs');
+  // NOTE: the "no providers configured" check deliberately does NOT live here any more — see
+  // validateAuthProvidersRegistered(). A metadata-only deployment legitimately has an empty
+  // authProviders array at this point, and erroring here would cry wolf on every boot.
+}
+
+/**
+ * Layers the metadata provider catalog on top of the config-declared providers.
+ *
+ * Called after the data provider and system user are available. Metadata rows are registered in
+ * addition to — not instead of — the config-declared ones: a deployment mid-migration may
+ * legitimately have both, and a name collision resolves to the metadata row because it registers
+ * last and `AuthProviderFactory.register` keys by provider name.
+ *
+ * Never throws. An unreachable or empty catalog leaves the config-declared providers exactly as
+ * they were, which is what makes adopting this feature a no-op for existing deployments and keeps
+ * a metadata problem from turning into a lockout.
+ *
+ * @returns the number of providers registered from metadata.
+ */
+export async function initializeAuthProvidersFromMetadata(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  try {
+    await AuthProviderEngine.Instance.Config(false, contextUser, provider);
+    const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+    if (count > 0) {
+      LogStatus(`[Auth] ${count} authentication provider(s) registered from metadata.`);
+    }
+    return count;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    LogError(`[Auth] Could not load the authentication provider catalog from metadata (${message}). Continuing with providers from mj.config.cjs.`);
+    return 0;
+  }
+}
+
+/**
+ * Rebuilds the provider registry from scratch: config-declared providers first, then the
+ * metadata catalog layered on top — the same two-source order as startup.
+ *
+ * This is THE entry point for reacting to a catalog edit at runtime (an admin page's Save
+ * button, a future invalidation hook). A full rebuild is required because the factory caches
+ * issuer→provider resolutions, so an edited row would otherwise keep serving its old
+ * configuration until the process restarted. It lives here rather than on `AuthProviderEngine`
+ * because a bare `factory.clear()` + metadata re-registration would silently drop everything
+ * the config path registered — magic-link included — and no caller should have to know to put
+ * those back. `initializeAuthProviders()` clears the factory itself, so no separate clear step
+ * exists for a caller to forget.
+ *
+ * **Failure policy: abort-before-mutate.** Everything that can throw — the catalog reload and
+ * the permission probe on its result — runs BEFORE the factory is touched, so a failed refresh
+ * leaves the registry serving the previous (stale but complete) provider set and surfaces the
+ * error to the caller. This is deliberately the opposite of `initializeAuthProvidersFromMetadata`,
+ * which swallows metadata failures: at boot there is no previous registry to preserve and a
+ * metadata problem must not become a lockout, while at refresh time there is one and the caller
+ * (an admin UI) wants the error. That difference in failure policy is why this function does not
+ * simply delegate to its sibling.
+ *
+ * Known limitation, acceptable for an admin-triggered operation: metadata providers are absent
+ * from the registry for the duration of `RegisterAll`'s per-row config builds (config-declared
+ * providers are restored synchronously). A request bearing a metadata-declared IdP's token in
+ * that window is rejected. If a caller ever needs an atomic swap, build the configs first and
+ * register them in one synchronous pass.
+ *
+ * @returns the number of providers registered from metadata after the refresh.
+ */
+export async function refreshAuthProviders(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  await AuthProviderEngine.Instance.Config(true, contextUser, provider);
+
+  // Probe the reloaded catalog BEFORE clearing anything: reading Providers throws
+  // PermissionConstrainedError when the load was skipped for permission reasons, and that
+  // failure must abort the refresh while the registry is still intact.
+  const pendingRows = AuthProviderEngine.Instance.Providers.length;
+
+  initializeAuthProviders();
+  const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+  LogStatus(
+    `[Auth] Provider registry refreshed — ${count} of ${pendingRows} metadata provider(s) registered on top of the config-declared set.`
+  );
+  return count;
+}
+
+/**
+ * Reports whether any provider is registered, from either source, and logs a diagnostic when none
+ * is.
+ *
+ * Split out from {@link initializeAuthProviders} because "no providers" is only genuinely wrong
+ * once BOTH sources have had their turn.
+ */
+export function validateAuthProvidersRegistered(): boolean {
+  const hasProviders = AuthProviderFactory.Instance.hasProviders();
+  if (!hasProviders) {
+    LogError(
+      'No authentication providers are configured. Define them in the "MJ: Authentication Providers" metadata entity, ' +
+        'or in the authProviders array in mj.config.cjs.'
+    );
   }
-}
+  return hasProviders;
+}

package/src/config.ts

@@ -7,7 +7,19 @@ const explorer = cosmiconfigSync('mj', { searchStrategy: 'global' });
 
 const userHandlingInfoSchema = z.object({
   autoCreateNewUsers: z.boolean().optional().default(false),
+  /** When true, auto-provisioning is restricted to the domains in `newUserAuthorizedDomains`. */
   newUserLimitedToAuthorizedDomains: z.boolean().optional().default(false),
+  /**
+   * Authorized **email domains** for auto-provisioned users — e.g. `['example.com', '*.example.org']`.
+   *
+   * These are matched against the domain of the email address in the verified identity token, NOT
+   * against the browser `Origin` / frontend hostname. If you are upgrading from a build that
+   * compared these to the request origin, replace any frontend hostnames here (`app.example.com`,
+   * `localhost`) with the email domains your users actually sign in with.
+   *
+   * `*` wildcards are supported and match in full: `*.example.com` matches `mail.example.com` but
+   * NOT `example.com` — list both if you need both.
+   */
   newUserAuthorizedDomains: z.array(z.string()).optional().default([]),
   newUserRoles: z.array(z.string()).optional().default([]),
   updateCacheWhenNotFound: z.boolean().optional().default(false),
@@ -131,6 +143,23 @@ const scheduledJobsSchema = z.object({
   staleLockCleanupInterval: z.number().optional().default(300000), // 5 minutes in ms
 });
 
+/**
+ * Integration sync worker (PR 1 item 8). When enabled, this process polls
+ * `CompanyIntegrationRun` for `Status='Queued'` rows, atomically claims them, executes
+ * the sync, and releases. The claim sproc is the mutual exclusion, so any number of
+ * processes may run a worker against the same database.
+ */
+const integrationSyncWorkerSchema = z.object({
+  /** Master switch — off by default so existing deployments keep running syncs inline. */
+  enabled: z.boolean().optional().default(false),
+  /** Email of the user the worker executes syncs as. */
+  systemUserEmail: z.string().optional().default('system@memberjunction.org'),
+  /** How often to poll the queue, in ms. */
+  pollingIntervalMs: z.number().optional().default(15000),
+  /** Maximum runs this worker executes concurrently. */
+  maxConcurrentRuns: z.number().optional().default(3),
+});
+
 const queryDialectSchema = z.object({
   /** When true, saving a Query entity auto-generates QuerySQL entries for configured target dialects */
   autoConvertOnSave: zodBooleanWithTransforms().default(false),
@@ -501,6 +530,7 @@ const configInfoSchema = z.object({
   authProviders: z.array(authProviderSchema).optional(),
   componentRegistries: z.array(componentRegistrySchema).optional(),
   scheduledJobs: scheduledJobsSchema.optional().default({}),
+  integrationSyncWorker: integrationSyncWorkerSchema.optional().default({}),
   telemetry: telemetrySchema.optional().default({}),
   queryDialects: queryDialectSchema.optional().default({}),
   multiTenancy: multiTenancySchema.optional().default({}),
@@ -559,6 +589,7 @@ export type SqlLoggingInfo = z.infer<typeof sqlLoggingSchema>;
 export type AuthProviderConfig = z.infer<typeof authProviderSchema>;
 export type ComponentRegistryConfig = z.infer<typeof componentRegistrySchema>;
 export type ScheduledJobsConfig = z.infer<typeof scheduledJobsSchema>;
+export type IntegrationSyncWorkerConfig = z.infer<typeof integrationSyncWorkerSchema>;
 export type TelemetryConfig = z.infer<typeof telemetrySchema>;
 export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
@@ -671,6 +702,14 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     staleLockCleanupInterval: 300000
   },
 
+  // Integration sync worker defaults (off — syncs run inline unless a worker is enabled)
+  integrationSyncWorker: {
+    enabled: false,
+    systemUserEmail: 'not.set@nowhere.com',
+    pollingIntervalMs: 15000,
+    maxConcurrentRuns: 3
+  },
+
   // Telemetry defaults
   telemetry: {
     enabled: true,
@@ -696,42 +735,22 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     },
   },
 
-  // Auth providers (environment-driven)
-  authProviders: [
-    // Microsoft Azure AD / Entra ID
-    process.env.TENANT_ID && process.env.WEB_CLIENT_ID ? {
-      name: 'azure',
-      type: 'msal',
-      issuer: `https://login.microsoftonline.com/${process.env.TENANT_ID}/v2.0`,
-      audience: process.env.WEB_CLIENT_ID,
-      jwksUri: `https://login.microsoftonline.com/${process.env.TENANT_ID}/discovery/v2.0/keys`,
-      clientId: process.env.WEB_CLIENT_ID,
-      tenantId: process.env.TENANT_ID
-    } : null,
-
-    // Auth0
-    process.env.AUTH0_DOMAIN && process.env.AUTH0_CLIENT_ID ? {
-      name: 'auth0',
-      type: 'auth0',
-      issuer: `https://${process.env.AUTH0_DOMAIN}/`,
-      audience: process.env.AUTH0_CLIENT_ID,
-      jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
-      clientId: process.env.AUTH0_CLIENT_ID,
-      clientSecret: process.env.AUTH0_CLIENT_SECRET,
-      domain: process.env.AUTH0_DOMAIN
-    } : null,
-    // AWS Cognito
-    process.env.COGNITO_USER_POOL_ID && process.env.COGNITO_CLIENT_ID && process.env.AWS_REGION ? {
-      name: 'cognito',
-      type: 'cognito',
-      issuer: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}`,
-      audience: process.env.COGNITO_CLIENT_ID,
-      jwksUri: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
-      clientId: process.env.COGNITO_CLIENT_ID,
-      region: process.env.AWS_REGION,
-      userPoolId: process.env.COGNITO_USER_POOL_ID
-    } : null,
-  ].filter(Boolean),
+  // Auth providers.
+  //
+  // Empty by design. This used to be a hard-coded block that enumerated Entra / Auth0 / Cognito
+  // inline and built each config from its environment variables. That made env-var configuration
+  // a closed domain: a third-party provider could register a driver class and take a metadata row
+  // or an explicit entry here, but it could never offer the "set two variables and you're done"
+  // experience, because the enumeration lived in core.
+  //
+  // Each provider class now owns its own mapping via the optional static
+  // `ConfigFromEnvironment` (see IEnvironmentConfigurableProvider in @memberjunction/auth-providers),
+  // and `initializeAuthProviders()` collects them through the ClassFactory registry.
+  //
+  // Discovery cannot happen here: this literal is evaluated when config.ts is imported, which is
+  // BEFORE @memberjunction/auth-providers loads and the driver classes register. It is deferred to
+  // registration time, where the registry is populated.
+  authProviders: [],
 };
 
 /**