@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/src/auth/initializeProviders.ts

@@ -1,16 +1,45 @@
 import { configInfo } from '../config.js';
-import { AuthProviderConfig, LogError } from '@memberjunction/core';
+import { AuthProviderConfig, LogError, LogStatus, LogStatusEx, UserInfo, type IMetadataProvider } from '@memberjunction/core';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { AuthProviderEngine } from './AuthProviderEngine.js';
 
 /**
- * Initialize authentication providers from configuration
+ * Initialize authentication providers from configuration.
+ *
+ * Registers everything declared in `mj.config.cjs`'s `authProviders` array. This remains the
+ * baseline path and runs on every boot: it needs no database, so it is what lets the server
+ * authenticate even when metadata is unreachable.
+ *
+ * Providers defined in the `MJ: Authentication Providers` catalog are layered on top by
+ * {@link initializeAuthProvidersFromMetadata}, which runs later in startup once a database
+ * connection and a system user exist.
  */
 export function initializeAuthProviders(): void {
   const factory = AuthProviderFactory.Instance;
-  
+
   // Clear any existing providers
   factory.clear();
 
+  // Environment-derived providers are DEFAULTS: each provider class maps its own variables via
+  // the ConfigFromEnvironment hook, and they apply only when the config file declares no
+  // providers of its own. That mirrors the previous behaviour exactly — the env block used to sit
+  // in DEFAULT_SERVER_CONFIG, and mergeConfigs replaces (rather than concatenates) arrays, so an
+  // explicit `authProviders` in mj.config.cjs has always suppressed the env-derived set.
+  //
+  // Written back into configInfo.authProviders rather than kept local because that array is the
+  // live registry other code reads and appends to (registerMagicLinkAuthProvider pushes into it so
+  // a later re-initialize keeps magic-link).
+  if (!configInfo.authProviders || configInfo.authProviders.length === 0) {
+    const discovered = AuthProviderFactory.DiscoverFromEnvironment();
+    if (discovered.length > 0) {
+      configInfo.authProviders = discovered;
+      LogStatusEx({
+        message: `[Auth] Configured ${discovered.length} provider(s) from environment variables: ${discovered.map((p) => p.name).join(', ')}`,
+        verboseOnly: true
+      });
+    }
+  }
+
   // Initialize providers from authProviders config
   if (configInfo.authProviders && configInfo.authProviders.length > 0) {
     for (const providerConfig of configInfo.authProviders) {
@@ -26,8 +55,100 @@ export function initializeAuthProviders(): void {
     }
   }
 
-  // Validate we have at least one provider
-  if (!factory.hasProviders()) {
-    LogError('No authentication providers configured. Please configure authProviders array in mj.config.cjs');
+  // NOTE: the "no providers configured" check deliberately does NOT live here any more — see
+  // validateAuthProvidersRegistered(). A metadata-only deployment legitimately has an empty
+  // authProviders array at this point, and erroring here would cry wolf on every boot.
+}
+
+/**
+ * Layers the metadata provider catalog on top of the config-declared providers.
+ *
+ * Called after the data provider and system user are available. Metadata rows are registered in
+ * addition to — not instead of — the config-declared ones: a deployment mid-migration may
+ * legitimately have both, and a name collision resolves to the metadata row because it registers
+ * last and `AuthProviderFactory.register` keys by provider name.
+ *
+ * Never throws. An unreachable or empty catalog leaves the config-declared providers exactly as
+ * they were, which is what makes adopting this feature a no-op for existing deployments and keeps
+ * a metadata problem from turning into a lockout.
+ *
+ * @returns the number of providers registered from metadata.
+ */
+export async function initializeAuthProvidersFromMetadata(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  try {
+    await AuthProviderEngine.Instance.Config(false, contextUser, provider);
+    const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+    if (count > 0) {
+      LogStatus(`[Auth] ${count} authentication provider(s) registered from metadata.`);
+    }
+    return count;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    LogError(`[Auth] Could not load the authentication provider catalog from metadata (${message}). Continuing with providers from mj.config.cjs.`);
+    return 0;
+  }
+}
+
+/**
+ * Rebuilds the provider registry from scratch: config-declared providers first, then the
+ * metadata catalog layered on top — the same two-source order as startup.
+ *
+ * This is THE entry point for reacting to a catalog edit at runtime (an admin page's Save
+ * button, a future invalidation hook). A full rebuild is required because the factory caches
+ * issuer→provider resolutions, so an edited row would otherwise keep serving its old
+ * configuration until the process restarted. It lives here rather than on `AuthProviderEngine`
+ * because a bare `factory.clear()` + metadata re-registration would silently drop everything
+ * the config path registered — magic-link included — and no caller should have to know to put
+ * those back. `initializeAuthProviders()` clears the factory itself, so no separate clear step
+ * exists for a caller to forget.
+ *
+ * **Failure policy: abort-before-mutate.** Everything that can throw — the catalog reload and
+ * the permission probe on its result — runs BEFORE the factory is touched, so a failed refresh
+ * leaves the registry serving the previous (stale but complete) provider set and surfaces the
+ * error to the caller. This is deliberately the opposite of `initializeAuthProvidersFromMetadata`,
+ * which swallows metadata failures: at boot there is no previous registry to preserve and a
+ * metadata problem must not become a lockout, while at refresh time there is one and the caller
+ * (an admin UI) wants the error. That difference in failure policy is why this function does not
+ * simply delegate to its sibling.
+ *
+ * Known limitation, acceptable for an admin-triggered operation: metadata providers are absent
+ * from the registry for the duration of `RegisterAll`'s per-row config builds (config-declared
+ * providers are restored synchronously). A request bearing a metadata-declared IdP's token in
+ * that window is rejected. If a caller ever needs an atomic swap, build the configs first and
+ * register them in one synchronous pass.
+ *
+ * @returns the number of providers registered from metadata after the refresh.
+ */
+export async function refreshAuthProviders(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number> {
+  await AuthProviderEngine.Instance.Config(true, contextUser, provider);
+
+  // Probe the reloaded catalog BEFORE clearing anything: reading Providers throws
+  // PermissionConstrainedError when the load was skipped for permission reasons, and that
+  // failure must abort the refresh while the registry is still intact.
+  const pendingRows = AuthProviderEngine.Instance.Providers.length;
+
+  initializeAuthProviders();
+  const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
+  LogStatus(
+    `[Auth] Provider registry refreshed — ${count} of ${pendingRows} metadata provider(s) registered on top of the config-declared set.`
+  );
+  return count;
+}
+
+/**
+ * Reports whether any provider is registered, from either source, and logs a diagnostic when none
+ * is.
+ *
+ * Split out from {@link initializeAuthProviders} because "no providers" is only genuinely wrong
+ * once BOTH sources have had their turn.
+ */
+export function validateAuthProvidersRegistered(): boolean {
+  const hasProviders = AuthProviderFactory.Instance.hasProviders();
+  if (!hasProviders) {
+    LogError(
+      'No authentication providers are configured. Define them in the "MJ: Authentication Providers" metadata entity, ' +
+        'or in the authProviders array in mj.config.cjs.'
+    );
   }
-}
+  return hasProviders;
+}

package/src/auth/scopeLimitedPrincipal.ts

@@ -0,0 +1,50 @@
+import { UserInfo } from '@memberjunction/core';
+
+/**
+ * True when a session's read authority is deliberately narrower than the role grant it
+ * authenticates with — i.e. the principal is confined by per-session scope rather than by
+ * its roles alone.
+ *
+ * Two such principals exist today, both from the magic-link surface:
+ *
+ * - **Anonymous magic-link guests** (`IsMagicLinkAnonymous`) authenticate as the *shared*
+ *   Anonymous principal, so their role grant is common to every guest. What separates one
+ *   guest from another is not the role — it is the per-session scope.
+ * - **Resource-scoped magic-link sessions** (`MagicLinkScope`) hold a normal role, pinned to
+ *   one shared resource (and its FK-reachable dependents) for the life of the session.
+ *
+ * In both cases the confinement is expressed as row-level-security filter tokens
+ * (`{{ScopeResourceID}}` / `{{ScopeResourceType}}`) that the entity-read path substitutes.
+ * That means the confinement only exists on code paths that go **through** entity
+ * permissions and RLS — `RunView`, `BaseEntity`, the generated resolvers. Any path that
+ * reaches the database *around* those layers (raw SQL on the read-only pool, for instance)
+ * sees no scope at all, so such a path must refuse these principals outright rather than
+ * assume a filter it never applies.
+ *
+ * Callers should treat a `true` result as "not permitted here", never as "apply a narrower
+ * filter" — a caller that could narrow correctly would not need this predicate.
+ *
+ * @param user the principal to classify. A missing principal returns `true`: an
+ *        unidentifiable session is the one case where the scope certainly cannot be
+ *        established, so it fails closed.
+ * @returns `true` when the principal is scope-limited (or unidentifiable), else `false`.
+ *
+ * @example
+ * ```typescript
+ * if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+ *     return this.buildErrorResult('Not permitted for scope-limited sessions.');
+ * }
+ * ```
+ */
+export function IsScopeLimitedPrincipal(user: UserInfo | undefined | null): boolean {
+    if (!user) {
+        return true; // no identifiable principal — fail closed
+    }
+    if (user.IsMagicLinkAnonymous) {
+        return true;
+    }
+    const scope = user.MagicLinkScope;
+    // An empty scope object carries no confinement; only a populated one does. (Truthiness
+    // of the object alone would classify `{}` as scoped and lock out a session that is not.)
+    return !!(scope?.ResourceID || scope?.ResourceType);
+}

package/src/config.ts

@@ -7,7 +7,19 @@ const explorer = cosmiconfigSync('mj', { searchStrategy: 'global' });
 
 const userHandlingInfoSchema = z.object({
   autoCreateNewUsers: z.boolean().optional().default(false),
+  /** When true, auto-provisioning is restricted to the domains in `newUserAuthorizedDomains`. */
   newUserLimitedToAuthorizedDomains: z.boolean().optional().default(false),
+  /**
+   * Authorized **email domains** for auto-provisioned users — e.g. `['example.com', '*.example.org']`.
+   *
+   * These are matched against the domain of the email address in the verified identity token, NOT
+   * against the browser `Origin` / frontend hostname. If you are upgrading from a build that
+   * compared these to the request origin, replace any frontend hostnames here (`app.example.com`,
+   * `localhost`) with the email domains your users actually sign in with.
+   *
+   * `*` wildcards are supported and match in full: `*.example.com` matches `mail.example.com` but
+   * NOT `example.com` — list both if you need both.
+   */
   newUserAuthorizedDomains: z.array(z.string()).optional().default([]),
   newUserRoles: z.array(z.string()).optional().default([]),
   updateCacheWhenNotFound: z.boolean().optional().default(false),
@@ -131,6 +143,23 @@ const scheduledJobsSchema = z.object({
   staleLockCleanupInterval: z.number().optional().default(300000), // 5 minutes in ms
 });
 
+/**
+ * Integration sync worker (PR 1 item 8). When enabled, this process polls
+ * `CompanyIntegrationRun` for `Status='Queued'` rows, atomically claims them, executes
+ * the sync, and releases. The claim sproc is the mutual exclusion, so any number of
+ * processes may run a worker against the same database.
+ */
+const integrationSyncWorkerSchema = z.object({
+  /** Master switch — off by default so existing deployments keep running syncs inline. */
+  enabled: z.boolean().optional().default(false),
+  /** Email of the user the worker executes syncs as. */
+  systemUserEmail: z.string().optional().default('system@memberjunction.org'),
+  /** How often to poll the queue, in ms. */
+  pollingIntervalMs: z.number().optional().default(15000),
+  /** Maximum runs this worker executes concurrently. */
+  maxConcurrentRuns: z.number().optional().default(3),
+});
+
 const queryDialectSchema = z.object({
   /** When true, saving a Query entity auto-generates QuerySQL entries for configured target dialects */
   autoConvertOnSave: zodBooleanWithTransforms().default(false),
@@ -501,6 +530,7 @@ const configInfoSchema = z.object({
   authProviders: z.array(authProviderSchema).optional(),
   componentRegistries: z.array(componentRegistrySchema).optional(),
   scheduledJobs: scheduledJobsSchema.optional().default({}),
+  integrationSyncWorker: integrationSyncWorkerSchema.optional().default({}),
   telemetry: telemetrySchema.optional().default({}),
   queryDialects: queryDialectSchema.optional().default({}),
   multiTenancy: multiTenancySchema.optional().default({}),
@@ -559,6 +589,7 @@ export type SqlLoggingInfo = z.infer<typeof sqlLoggingSchema>;
 export type AuthProviderConfig = z.infer<typeof authProviderSchema>;
 export type ComponentRegistryConfig = z.infer<typeof componentRegistrySchema>;
 export type ScheduledJobsConfig = z.infer<typeof scheduledJobsSchema>;
+export type IntegrationSyncWorkerConfig = z.infer<typeof integrationSyncWorkerSchema>;
 export type TelemetryConfig = z.infer<typeof telemetrySchema>;
 export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
@@ -671,6 +702,14 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     staleLockCleanupInterval: 300000
   },
 
+  // Integration sync worker defaults (off — syncs run inline unless a worker is enabled)
+  integrationSyncWorker: {
+    enabled: false,
+    systemUserEmail: 'not.set@nowhere.com',
+    pollingIntervalMs: 15000,
+    maxConcurrentRuns: 3
+  },
+
   // Telemetry defaults
   telemetry: {
     enabled: true,
@@ -696,42 +735,22 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     },
   },
 
-  // Auth providers (environment-driven)
-  authProviders: [
-    // Microsoft Azure AD / Entra ID
-    process.env.TENANT_ID && process.env.WEB_CLIENT_ID ? {
-      name: 'azure',
-      type: 'msal',
-      issuer: `https://login.microsoftonline.com/${process.env.TENANT_ID}/v2.0`,
-      audience: process.env.WEB_CLIENT_ID,
-      jwksUri: `https://login.microsoftonline.com/${process.env.TENANT_ID}/discovery/v2.0/keys`,
-      clientId: process.env.WEB_CLIENT_ID,
-      tenantId: process.env.TENANT_ID
-    } : null,
-
-    // Auth0
-    process.env.AUTH0_DOMAIN && process.env.AUTH0_CLIENT_ID ? {
-      name: 'auth0',
-      type: 'auth0',
-      issuer: `https://${process.env.AUTH0_DOMAIN}/`,
-      audience: process.env.AUTH0_CLIENT_ID,
-      jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
-      clientId: process.env.AUTH0_CLIENT_ID,
-      clientSecret: process.env.AUTH0_CLIENT_SECRET,
-      domain: process.env.AUTH0_DOMAIN
-    } : null,
-    // AWS Cognito
-    process.env.COGNITO_USER_POOL_ID && process.env.COGNITO_CLIENT_ID && process.env.AWS_REGION ? {
-      name: 'cognito',
-      type: 'cognito',
-      issuer: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}`,
-      audience: process.env.COGNITO_CLIENT_ID,
-      jwksUri: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
-      clientId: process.env.COGNITO_CLIENT_ID,
-      region: process.env.AWS_REGION,
-      userPoolId: process.env.COGNITO_USER_POOL_ID
-    } : null,
-  ].filter(Boolean),
+  // Auth providers.
+  //
+  // Empty by design. This used to be a hard-coded block that enumerated Entra / Auth0 / Cognito
+  // inline and built each config from its environment variables. That made env-var configuration
+  // a closed domain: a third-party provider could register a driver class and take a metadata row
+  // or an explicit entry here, but it could never offer the "set two variables and you're done"
+  // experience, because the enumeration lived in core.
+  //
+  // Each provider class now owns its own mapping via the optional static
+  // `ConfigFromEnvironment` (see IEnvironmentConfigurableProvider in @memberjunction/auth-providers),
+  // and `initializeAuthProviders()` collects them through the ClassFactory registry.
+  //
+  // Discovery cannot happen here: this literal is evaluated when config.ts is imported, which is
+  // BEFORE @memberjunction/auth-providers loads and the driver classes register. It is deferred to
+  // registration time, where the registry is populated.
+  authProviders: [],
 };
 
 /**

package/src/context.ts

@@ -18,9 +18,10 @@ import { GetReadOnlyDataSource, GetReadWriteDataSource } from './util.js';
 import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
-import { DatabaseProviderBase, UserInfo, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
+import { DatabaseProviderBase, UserInfo, type IMetadataProvider, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
 import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { Metadata } from '@memberjunction/core';
+import { IdentityClaimEngineServer } from '@memberjunction/core-entities-server';
 import { UUIDsEqual } from '@memberjunction/global';
 import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
@@ -554,7 +555,30 @@ export const getUserPayload = async (
       });
     }
 
-    return { userRecord: sessionUser, email: sessionUser.Email, sessionId };
+    // The IdP's OIDC email_verified assertion, read off the JWKS-verified payload. Standard
+    // claim name across Auth0/Okta/Cognito/WorkOS; MSAL and others simply omit it (undefined).
+    const emailVerified = typeof payload.email_verified === 'boolean' ? payload.email_verified : undefined;
+
+    // Automatic claim-on-login — once per issued token (deduped, own prefix so it can't eat the
+    // audit's first-seen slot), fire-and-forget so it never adds latency. Discovers pending
+    // MJ: Identity Claims addressed to this user's email and redeems each through the FULL
+    // RedeemClaim gate (email/verification rules, atomic CAS, driver error handling), passing
+    // the IdP's email_verified assertion so an unverified email can never auto-claim.
+    // Anonymous magic-link guests are skipped: their principal is synthetic and per-session.
+    if (sessionUser.Email && !sessionUser.IsMagicLinkAnonymous && markSessionAuditSeen(sessionAuditKey('claims', payload))) {
+      // Pre-context auth path: per-request providers do not exist yet here, so the global is the
+      // only provider available — same posture as every other pre-context call on this path.
+      // The allowlist marker has to sit on the reference line itself; MultiProviderCompliance
+      // matches per-line, so a marker on its own line above is invisible to the scanner.
+      const claimProvider = Metadata.Provider as unknown as IMetadataProvider; // global-provider-ok: pre-context auth path
+      if (claimProvider) {
+        void IdentityClaimEngineServer.Instance.AutoClaimForUser(sessionUser, claimProvider, { EmailVerified: emailVerified }).catch(
+          (err) => console.warn(`Auto-claim on login failed for ${sessionUser.Email}: ${err instanceof Error ? err.message : err}`),
+        );
+      }
+    }
+
+    return { userRecord: sessionUser, email: sessionUser.Email, sessionId, emailVerified };
   } catch (error) {
     // An anonymous request presenting no credentials at all (a health check, a CORS
     // preflight-adjacent probe, a client mid-handshake) is routine, same as an expired

package/src/entitySubclasses/MJEntityPermissionEntityServer.server.ts

@@ -1,7 +1,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
 import { MJEntityPermissionEntity } from '@memberjunction/core-entities';
-import axios from 'axios';
+import { HttpPost } from '@memberjunction/network-utils';
 import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } from '../config.js';
 
 /**
@@ -59,23 +59,24 @@ export class MJEntityPermissionEntityServer extends MJEntityPermissionEntity {
   protected static async SubmitQueue(): Promise<void> {
     this._lastModifiedTime = null;
 
-    // now, use Axios to submit the queue to the API server
+    // now, submit the queue to the API server
     // Check if there's anything to submit
     if (this._entityIDQueue.length > 0) {
       try {
-        // Use Axios to submit the queue to the API server
-        const response = await axios.post(this.getSubmissionURL(), {
+        // The submission URL is our OWN CodeGen API (typically localhost) — deliberately NOT
+        // routed through the SSRF guard, which would block an internal address by design.
+        const response = await HttpPost<{ status?: string; errorMessage?: string }>(this.getSubmissionURL(), {
           entityIDArray: this._entityIDQueue,
         });
 
-        // Check the Axios response code implicitly and API response explicitly
-        if (response.status === 200 && response.data.status === 'ok') {
+        // Check the HTTP status implicitly and API response explicitly
+        if (response.Status === 200 && response.Data?.status === 'ok') {
           console.log('Queue submitted successfully.');
           // now, clear the queue and timer
           this.ClearQueue();
         } else {
           // Handle API indicating a failure
-          console.error('Failed to submit queue:', response.data.errorMessage || 'Unknown error');
+          console.error('Failed to submit queue:', response.Data?.errorMessage || 'Unknown error');
         }
       } catch (error) {
         // Handle errors here