@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/src/resolvers/FileResolver.ts

@@ -41,6 +41,7 @@ import { FieldMapper } from '@memberjunction/graphql-dataprovider';
 import { GetReadOnlyProvider } from '../util.js';
 import { configInfo } from '../config.js';
 import { MediaAccessKeyManager } from '../rest/MediaAccessKeys.js';
+import { UploadTokenManager } from '../rest/UploadTokenManager.js';
 import { deriveSidecarPath, parsePeaksSidecar } from './peaksSidecar.js';
 
 @InputType()
@@ -49,6 +50,63 @@ export class CreateUploadURLInput {
   FileID: string;
 }
 
+@InputType()
+export class UploadStorageFileInput {
+  @Field(() => String, { nullable: true })
+  FileName?: string;
+
+  @Field(() => String, { nullable: true })
+  Base64Data?: string;
+
+  @Field(() => String, { nullable: true })
+  UploadToken?: string;
+
+  @Field(() => String, { nullable: true })
+  MimeType?: string;
+
+  @Field(() => String, { nullable: true })
+  AccountID?: string;
+
+  @Field(() => String, { nullable: true })
+  CategoryID?: string;
+
+  @Field(() => String, { nullable: true })
+  Description?: string;
+
+  @Field(() => String, { nullable: true })
+  PathPrefix?: string;
+}
+
+@ObjectType()
+export class UploadStorageFilePayload {
+  @Field(() => Boolean)
+  Success: boolean;
+
+  @Field(() => String, { nullable: true })
+  FileID?: string;
+
+  @Field(() => MJFile_, { nullable: true })
+  File?: MJFile_;
+
+  @Field(() => String, { nullable: true })
+  ErrorMessage?: string;
+}
+
+@ObjectType()
+export class CreateUploadStageTokenPayload {
+  @Field(() => Boolean)
+  Success: boolean;
+
+  @Field(() => String, { nullable: true })
+  Token?: string;
+
+  @Field(() => String, { nullable: true })
+  Url?: string;
+
+  @Field(() => String, { nullable: true })
+  ErrorMessage?: string;
+}
+
 @ObjectType()
 export class CreateFilePayload {
   @Field(() => MJFile_)
@@ -414,7 +472,8 @@ export class FileResolver extends FileResolverBase {
 
       // Access authorized — mint the capability token.
       const { Token, ExpiresAt } = MediaAccessKeyManager.Instance.Sign(fileId, contextUser.ID);
-      const url = `${this.resolvePublicBaseUrl()}/media/${encodeURIComponent(fileId)}?token=${encodeURIComponent(Token)}`;
+      const fileNameSuffix = fileEntity.Name ? `/${encodeURIComponent(fileEntity.Name)}` : '';
+      const url = `${this.resolvePublicBaseUrl()}/media/${encodeURIComponent(fileId)}${fileNameSuffix}?token=${encodeURIComponent(Token)}`;
 
       // Best-effort: surface precomputed waveform peaks from a peaks.json sidecar beside the file, so
       // the player renders the real waveform instantly without fetching/decoding the audio. Never
@@ -573,6 +632,85 @@ export class FileResolver extends FileResolverBase {
     return { File, UploadUrl, NameExists };
   }
 
+  /**
+   * Direct server-side file upload using MJ Storage subsystem.
+   * Uploads file contents directly via the configured storage driver (Box, Azure, S3, Google Drive, Dropbox, etc.)
+   * and creates/persists the MJ: Files database record.
+   */
+  @Mutation(() => UploadStorageFilePayload)
+  async UploadStorageFile(
+    @Arg('input', () => UploadStorageFileInput) input: UploadStorageFileInput,
+    @Ctx() context: AppContext
+  ): Promise<UploadStorageFilePayload> {
+    try {
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      const user = this.GetUserFromPayload(context.userPayload);
+
+      // Permission check on MJ: Files
+      const fileEntity = await provider.GetEntityObject<MJFileEntity>('MJ: Files', user);
+      fileEntity.CheckPermissions(EntityPermissionType.Create, true);
+
+      let buffer: Buffer;
+      let fileName: string = input.FileName || 'file';
+      let mimeType: string = input.MimeType || 'application/octet-stream';
+
+      if (input.UploadToken) {
+        const staged = UploadTokenManager.Instance.Consume(input.UploadToken, user.ID);
+        if (!staged) {
+          return {
+            Success: false,
+            ErrorMessage: 'Upload token is invalid, expired, or has already been used.',
+          };
+        }
+        buffer = staged.buffer;
+        fileName = input.FileName || staged.fileName || 'file';
+        mimeType = input.MimeType || staged.mimeType || 'application/octet-stream';
+      } else if (input.Base64Data) {
+        buffer = Buffer.from(input.Base64Data, 'base64');
+      } else {
+        return {
+          Success: false,
+          ErrorMessage: 'Either UploadToken or Base64Data must be provided.',
+        };
+      }
+
+      // Ensure FileStorageEngine is configured under the user context
+      await FileStorageEngine.Instance.Config(false, user, provider);
+      if (input.AccountID && !FileStorageEngine.Instance.GetAccountById(input.AccountID)) {
+        await FileStorageEngine.Instance.Config(true, user, provider);
+      }
+
+      const uploadResult = await FileStorageEngine.Instance.UploadFile({
+        content: buffer,
+        fileName,
+        mimeType,
+        contextUser: user,
+        storageAccountId: input.AccountID,
+        categoryID: input.CategoryID,
+        description: input.Description,
+        pathPrefix: input.PathPrefix,
+        provider,
+      });
+
+      const loaded = await fileEntity.Load(uploadResult.FileID);
+      const mapper = new FieldMapper();
+      const File = loaded ? (mapper.MapFields({ ...fileEntity.GetAll() }) as unknown as MJFile_) : undefined;
+
+      return {
+        Success: true,
+        FileID: uploadResult.FileID,
+        File,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`UploadStorageFile failed for '${input.FileName}': ${message}`);
+      return {
+        Success: false,
+        ErrorMessage: message,
+      };
+    }
+  }
+
   @FieldResolver(() => String)
   async DownloadUrl(@Root() file: MJFile_, @Ctx() context: AppContext) {
     const md = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
@@ -580,6 +718,19 @@ export class FileResolver extends FileResolverBase {
     const fileEntity = await md.GetEntityObject<MJFileEntity>('MJ: Files', user);
     fileEntity.CheckPermissions(EntityPermissionType.Read, true);
 
+    await FileStorageEngine.Instance.Config(false, user, md);
+    let accounts = FileStorageEngine.Instance.GetAccountsByProviderID(file.ProviderID);
+    if (accounts.length === 0) {
+      await FileStorageEngine.Instance.Config(true, user, md);
+      accounts = FileStorageEngine.Instance.GetAccountsByProviderID(file.ProviderID);
+    }
+
+    if (accounts.length > 0) {
+      const account = accounts[0];
+      const driver = await FileStorageEngine.Instance.GetDriver(account.ID, user);
+      return await driver.CreatePreAuthDownloadUrl(file.ProviderKey ?? file.Name);
+    }
+
     const providerEntity = await md.GetEntityObject<MJFileStorageProviderEntity>('MJ: File Storage Providers', user);
     await providerEntity.Load(file.ProviderID);
 
@@ -734,16 +885,13 @@ export class FileResolver extends FileResolverBase {
     const md = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
     const user = this.GetUserFromPayload(context.userPayload);
 
-    // Load the account and its provider
-    const { account, provider: providerEntity } = await this.loadAccountAndProvider(input.AccountID, context);
-
     // Check permissions
     const fileEntity = await md.GetEntityObject<MJFileEntity>('MJ: Files', user);
     fileEntity.CheckPermissions(EntityPermissionType.Read, true);
 
-    // Create download URL with extended user context (includes account for credential lookup)
-    const userContext = this.buildExtendedUserContext(context, account);
-    const downloadUrl = await createDownloadUrl(providerEntity, input.ObjectName, userContext);
+    await FileStorageEngine.Instance.Config(false, user, md);
+    const driver = await FileStorageEngine.Instance.GetDriver(input.AccountID, user);
+    const downloadUrl = await driver.CreatePreAuthDownloadUrl(input.ObjectName);
     return downloadUrl;
   }
 
@@ -762,67 +910,79 @@ export class FileResolver extends FileResolverBase {
    * @see CreateFile for the legacy path that also creates a File entity record.
    */
   @Mutation(() => CreatePreAuthUploadUrlPayload)
-  async CreatePreAuthUploadUrl(@Arg('input', () => CreatePreAuthUploadUrlInput) input: CreatePreAuthUploadUrlInput, @Ctx() context: AppContext) {
+  async CreatePreAuthUploadUrl(
+    @Arg('input', () => CreatePreAuthUploadUrlInput) input: CreatePreAuthUploadUrlInput,
+    @Ctx() context: AppContext
+  ): Promise<CreatePreAuthUploadUrlPayload> {
     const md = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
     const user = this.GetUserFromPayload(context.userPayload);
 
-    // Load the account and its provider
-    const { account, provider: providerEntity } = await this.loadAccountAndProvider(input.AccountID, context);
-
     // Check permissions
     const fileEntity = await md.GetEntityObject<MJFileEntity>('MJ: Files', user);
     fileEntity.CheckPermissions(EntityPermissionType.Create, true);
 
-    // Create upload URL with extended user context (includes account for credential lookup)
-    const userContext = this.buildExtendedUserContext(context, account);
-    const { UploadUrl, updatedInput } = await createUploadUrl(
-      providerEntity,
-      {
-        ID: '', // Not needed for direct upload
-        Name: input.ObjectName,
-        ProviderID: providerEntity.ID,
-        ContentType: input.ContentType,
-      },
-      userContext,
-    );
-
-    // Extract ProviderKey if it exists (spread into updatedInput by createUploadUrl)
-    const providerKey = (updatedInput as { ProviderKey?: string }).ProviderKey;
+    await FileStorageEngine.Instance.Config(false, user, md);
+    const driver = await FileStorageEngine.Instance.GetDriver(input.AccountID, user);
+    if (!driver.SupportsPreAuthUpload) {
+      throw new Error(`Storage provider '${driver.constructor.name}' does not support pre-authenticated direct uploads.`);
+    }
+
+    const result = await driver.CreatePreAuthUploadUrl(input.ObjectName);
 
     return {
-      UploadUrl,
-      ProviderKey: providerKey,
+      UploadUrl: result.UploadUrl,
+      ProviderKey: result.ProviderKey,
     };
   }
 
+  /**
+   * Mints a cryptographically signed, short-lived media-upload token for staging raw binary files.
+   * Checks user permissions on `MJ: Files` before issuing.
+   */
+  @Mutation(() => CreateUploadStageTokenPayload)
+  async CreateUploadStageToken(
+    @Ctx() context: AppContext
+  ): Promise<CreateUploadStageTokenPayload> {
+    try {
+      const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+      const user = this.GetUserFromPayload(context.userPayload);
+
+      // Permission check on MJ: Files
+      const fileEntity = await provider.GetEntityObject<MJFileEntity>('MJ: Files', user);
+      fileEntity.CheckPermissions(EntityPermissionType.Create, true);
+
+      const mint = MediaAccessKeyManager.Instance.SignUpload(user.ID);
+
+      return {
+        Success: true,
+        Token: mint.Token,
+        Url: '/media/upload-stage',
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        Success: false,
+        ErrorMessage: message,
+      };
+    }
+  }
+
   @Mutation(() => Boolean)
   async DeleteStorageObject(@Arg('input', () => DeleteStorageObjectInput) input: DeleteStorageObjectInput, @Ctx() context: AppContext) {
-    console.log('[FileResolver] DeleteStorageObject called:', input);
-
     const md = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
     const user = this.GetUserFromPayload(context.userPayload);
 
     // Load the account and its provider
     const { account, provider: providerEntity } = await this.loadAccountAndProvider(input.AccountID, context);
 
-    console.log('[FileResolver] Provider loaded:', {
-      providerID: providerEntity.ID,
-      providerName: providerEntity.Name,
-      serverDriverKey: providerEntity.ServerDriverKey,
-    });
-
     // Check permissions
     const fileEntity = await md.GetEntityObject<MJFileEntity>('MJ: Files', user);
     fileEntity.CheckPermissions(EntityPermissionType.Delete, true);
 
-    console.log('[FileResolver] Permissions checked, calling deleteObject...');
-
     // Delete the object with extended user context (includes account for credential lookup)
     const userContext = this.buildExtendedUserContext(context, account);
     const success = await deleteObject(providerEntity, input.ObjectName, userContext);
 
-    console.log('[FileResolver] deleteObject returned:', success);
-
     return success;
   }
 

package/src/resolvers/IdentityClaimRedemptionResolver.ts

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview GraphQL redemption surface for MJ: Identity Claims.
+ *
+ * Exposes the server-side claim lifecycle (`IdentityClaimEngineServer`) to authenticated
+ * clients: list my pending claims, redeem one claim (optionally with the emailed verification
+ * token), and redeem everything pending for my email in one call. This is the surface the
+ * claim emails' `/claims/redeem?id=..&token=..` links land on (via the Explorer redeem page).
+ *
+ * Security posture:
+ * - Authentication is required (the engine refuses without a user); authorization is the
+ *   engine's own gate — email match or timing-safe token match, further constrained by the
+ *   claim type's Configuration and the IdP's `email_verified` assertion carried on
+ *   `UserPayload.emailVerified`.
+ * - A small in-memory fixed-window rate limit bounds redemption attempts per user, since
+ *   GraphQL mutations get no per-operation limit from the transport tier.
+ *
+ * @module @memberjunction/server/resolvers/IdentityClaimRedemptionResolver
+ */
+import { Arg, Ctx, Field, Mutation, ObjectType, Query, Resolver } from 'type-graphql';
+import { UserInfo } from '@memberjunction/core';
+import { IdentityClaimEngineServer } from '@memberjunction/core-entities-server';
+import { AppContext } from '../types.js';
+import { GetReadWriteProvider } from '../util.js';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+@ObjectType()
+export class IdentityClaimRedemptionResult {
+  @Field()
+  Success: boolean;
+
+  @Field({ nullable: true })
+  ErrorMessage?: string;
+
+  @Field({ nullable: true })
+  ClaimID?: string;
+
+  /** JSON-serialized driver result data (shape is driver-specific) */
+  @Field({ nullable: true })
+  Data?: string;
+}
+
+@ObjectType()
+export class PendingIdentityClaim {
+  @Field()
+  ID: string;
+
+  @Field()
+  ClaimTypeID: string;
+
+  @Field({ nullable: true })
+  ClaimTypeName?: string;
+
+  @Field({ nullable: true })
+  EntityID?: string;
+
+  @Field({ nullable: true })
+  RecordID?: string;
+
+  @Field()
+  Status: string;
+
+  @Field()
+  ExpiresAt: Date;
+}
+
+/**
+ * Fixed-window per-user attempt limiter for redemption mutations. Redemption is a
+ * human-interactive flow — a handful of attempts per minute is generous; dozens is
+ * token guessing.
+ */
+const REDEEM_WINDOW_MS = 60_000;
+const REDEEM_MAX_ATTEMPTS_PER_WINDOW = 10;
+const REDEEM_ATTEMPTS_CACHE_MAX = 10_000;
+const redeemAttempts = new Map<string, { windowStart: number; count: number }>();
+
+function redeemRateLimitExceeded(userId: string): boolean {
+  const now = Date.now();
+  const entry = redeemAttempts.get(userId);
+  if (!entry || now - entry.windowStart >= REDEEM_WINDOW_MS) {
+    if (redeemAttempts.size >= REDEEM_ATTEMPTS_CACHE_MAX) {
+      // Bounded map: evict the oldest insertion rather than growing without limit.
+      const oldest = redeemAttempts.keys().next().value;
+      if (oldest !== undefined) {
+        redeemAttempts.delete(oldest);
+      }
+    }
+    redeemAttempts.set(userId, { windowStart: now, count: 1 });
+    return false;
+  }
+  entry.count++;
+  return entry.count > REDEEM_MAX_ATTEMPTS_PER_WINDOW;
+}
+
+@Resolver()
+export class IdentityClaimRedemptionResolver extends ResolverBase {
+  /**
+   * Lists the caller's pending, unexpired identity claims (matched on their normalized email).
+   */
+  @Query(() => [PendingIdentityClaim])
+  async GetMyPendingIdentityClaims(@Ctx() ctx: AppContext): Promise<PendingIdentityClaim[]> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', 'read', ctx.userPayload);
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const claims = await engine.GetPendingClaimsForEmail(user.Email, user, provider);
+    return claims.map((c) => ({
+      ID: c.ID,
+      ClaimTypeID: c.ClaimTypeID,
+      ClaimTypeName: engine.GetClaimTypeByID(c.ClaimTypeID)?.Name,
+      EntityID: c.EntityID ?? undefined,
+      RecordID: c.RecordID ?? undefined,
+      Status: c.Status,
+      ExpiresAt: c.ExpiresAt,
+    }));
+  }
+
+  /**
+   * Redeems a single identity claim for the authenticated caller. The engine enforces the
+   * authorization gate: email match (subject to the IdP's email_verified assertion and the
+   * claim type's Configuration) OR the emailed verification token.
+   */
+  @Mutation(() => IdentityClaimRedemptionResult)
+  async RedeemIdentityClaim(
+    @Arg('ClaimID') claimID: string,
+    @Ctx() ctx: AppContext,
+    @Arg('Token', { nullable: true }) token?: string,
+  ): Promise<IdentityClaimRedemptionResult> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', claimID, ctx.userPayload);
+
+    if (redeemRateLimitExceeded(user.ID)) {
+      return { Success: false, ErrorMessage: 'Too many redemption attempts — please wait a minute and try again', ClaimID: claimID };
+    }
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const result = await engine.RedeemClaim(claimID, user, provider, token ?? undefined, {
+      EmailVerified: ctx.userPayload.emailVerified,
+    });
+    return {
+      Success: result.Success,
+      ErrorMessage: result.ErrorMessage,
+      ClaimID: claimID,
+      Data: result.Data ? JSON.stringify(result.Data) : undefined,
+    };
+  }
+
+  /**
+   * Discovers and redeems every pending claim addressed to the caller's email — the on-demand
+   * form of the automatic claim-on-login sweep. Each redemption runs through the full engine
+   * gate; failures are returned per-claim, never thrown.
+   */
+  @Mutation(() => [IdentityClaimRedemptionResult])
+  async AutoClaimPendingIdentityClaims(@Ctx() ctx: AppContext): Promise<IdentityClaimRedemptionResult[]> {
+    const user = ctx.userPayload.userRecord as UserInfo;
+    if (!user) {
+      throw new Error('User is not authenticated');
+    }
+    await this.CheckAPIKeyScopeAuthorization('identity:claims', 'auto', ctx.userPayload);
+
+    if (redeemRateLimitExceeded(user.ID)) {
+      return [{ Success: false, ErrorMessage: 'Too many redemption attempts — please wait a minute and try again' }];
+    }
+
+    const engine = IdentityClaimEngineServer.Instance;
+    await engine.Config(false, user);
+    const provider = GetReadWriteProvider(ctx.providers);
+    const results = await engine.AutoClaimForUser(user, provider, { EmailVerified: ctx.userPayload.emailVerified });
+    return results.map((r) => ({
+      Success: r.Success,
+      ErrorMessage: r.ErrorMessage,
+      Data: r.Data ? JSON.stringify(r.Data) : undefined,
+    }));
+  }
+}