@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/src/rest/MediaAccessKeys.ts

@@ -24,6 +24,9 @@ import jwt from 'jsonwebtoken';
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
 export const MEDIA_ACCESS_TOKEN_TYPE = 'media-access';
 
+/** The upload staging token's `typ` claim. */
+export const MEDIA_UPLOAD_ACCESS_TOKEN_TYPE = 'media-upload';
+
 /** Default media-access token lifetime (hours). Long enough to cover a full playback session. */
 export const MEDIA_ACCESS_DEFAULT_TTL_HOURS = 4;
 
@@ -64,7 +67,13 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
 
   /** Resolves the signing secret once, preferring the deployment's symmetric key. */
   private ensureSecret(): void {
-    if (this._initialized) {
+    if (this._initialized && this.secret) {
+      return;
+    }
+    const store = this.GetGlobalObjectStore();
+    if (store && typeof store['___MEDIA_ACCESS_SECRET___'] === 'string') {
+      this.secret = store['___MEDIA_ACCESS_SECRET___'];
+      this._initialized = true;
       return;
     }
     const configured = process.env.MJ_BASE_ENCRYPTION_KEY?.trim();
@@ -78,6 +87,9 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
         'MJ_BASE_ENCRYPTION_KEY for stable signing.',
       );
     }
+    if (store) {
+      store['___MEDIA_ACCESS_SECRET___'] = this.secret;
+    }
     this._initialized = true;
   }
 
@@ -95,6 +107,39 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     return { Token: token, ExpiresAt: expiresAt };
   }
 
+  /**
+   * Mints a signed upload staging token for a user, expiring after `ttlMinutes` (default 10 minutes).
+   */
+  public SignUpload(userId: string, ttlMinutes: number = 10): { Token: string; ExpiresAt: Date } {
+    this.ensureSecret();
+    const claims = { fileId: '*', userId, typ: MEDIA_UPLOAD_ACCESS_TOKEN_TYPE };
+    const expiresInSeconds = Math.floor(ttlMinutes * 60);
+    const token = jwt.sign(claims, this.secret, { algorithm: 'HS256', expiresIn: expiresInSeconds });
+    const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
+    return { Token: token, ExpiresAt: expiresAt };
+  }
+
+  /**
+   * Verifies an upload staging token.
+   */
+  public VerifyUpload(token: string): { Valid: boolean; UserId?: string; Error?: string } {
+    this.ensureSecret();
+    try {
+      const decoded = jwt.verify(token, this.secret, { algorithms: ['HS256'] });
+      if (
+        typeof decoded === 'object' && decoded !== null &&
+        (decoded as { typ?: unknown }).typ === MEDIA_UPLOAD_ACCESS_TOKEN_TYPE &&
+        typeof (decoded as { userId?: unknown }).userId === 'string'
+      ) {
+        return { Valid: true, UserId: (decoded as { userId: string }).userId };
+      }
+      return { Valid: false, Error: 'Invalid token payload format or claim mismatch' };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { Valid: false, Error: msg };
+    }
+  }
+
   /**
    * Verifies a token's signature, expiry, and `typ`. Returns the typed claims on
    * success. Never throws — an invalid/expired/malformed token returns `{ Valid: false }`.
@@ -119,3 +164,4 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     }
   }
 }
+

package/src/rest/MediaStreamHandler.ts

@@ -25,6 +25,7 @@ import { FileStorageEngine } from '@memberjunction/storage';
 import type { FileStorageBase, ByteRange } from '@memberjunction/storage';
 import { getSystemUser } from '../auth/index.js';
 import { MediaAccessKeyManager } from './MediaAccessKeys.js';
+import { UploadTokenManager } from './UploadTokenManager.js';
 import { parseRange, parseRangeHeaderLoose } from './mediaRange.js';
 
 /** A located bytes source for a file: the driver + the provider key to read. */
@@ -32,21 +33,110 @@ interface FileBytesSource {
   driver: FileStorageBase;
   providerKey: string;
   contentType: string;
+  fileName: string;
 }
 
-
 /**
- * Builds the Express router exposing `GET /media/:fileId`. Stateless — verification
- * and byte-source resolution happen per request.
+ * Builds the Express router exposing:
+ * - `GET /media/:fileId` and `GET /media/:fileId/:filename` (Range streaming)
+ * - `POST /media/upload-stage` (Raw binary upload staging)
  */
 export function createMediaStreamRouter(): Router {
   const router = express.Router();
+
+  router.post(
+    '/upload-stage',
+    express.raw({ type: () => true, limit: '100mb' }),
+    async (req: Request, res: Response) => {
+      await handleUploadStageRequest(req, res);
+    }
+  );
+
   router.get('/:fileId', async (req: Request, res: Response) => {
     await handleMediaRequest(req, res);
   });
+  router.get('/:fileId/:filename', async (req: Request, res: Response) => {
+    await handleMediaRequest(req, res);
+  });
   return router;
 }
 
+/**
+ * Authenticated raw binary upload staging handler (`POST /media/upload-stage`).
+ *
+ * Accepts raw file binary bytes directly in request body, stages in UploadTokenManager
+ * memory cache, and returns an ephemeral single-use upload token for the GraphQL mutation.
+ *
+ * Security: Requires a cryptographically signed media-upload token minted by `CreateUploadStageToken`
+ * (verified via `MediaAccessKeyManager.Instance.VerifyUpload`).
+ */
+async function handleUploadStageRequest(req: Request, res: Response): Promise<void> {
+  // Never let CDNs or shared caches retain upload endpoints
+  res.setHeader('Cache-Control', 'private, no-store');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // 1. Resolve signed upload token strictly from Authorization header (avoids bearer token in URL logs)
+  const authHeader = req.headers.authorization || '';
+  const token = authHeader.startsWith('Bearer ') ? authHeader.substring(7).trim() : authHeader.trim();
+
+  if (!token) {
+    console.warn('[MediaStreamHandler] POST /media/upload-stage: Missing or empty Authorization header');
+    res.status(401).json({ Success: false, ErrorMessage: 'Authorization header with Bearer token required.' });
+    return;
+  }
+
+  // Cryptographically verify token signature, expiry, and 'media-upload' typ claim
+  const uploadVerify = MediaAccessKeyManager.Instance.VerifyUpload(token);
+  if (!uploadVerify.Valid || !uploadVerify.UserId) {
+    console.warn(`[MediaStreamHandler] POST /media/upload-stage: Token verification failed: ${uploadVerify.Error || 'invalid or expired'}`);
+    res.status(401).json({ Success: false, ErrorMessage: `Invalid or expired upload token: ${uploadVerify.Error || 'unauthorized'}` });
+    return;
+  }
+
+  const userId = uploadVerify.UserId;
+
+  // 2. Validate binary body
+  const buffer = req.body as Buffer;
+  if (!buffer || !Buffer.isBuffer(buffer) || buffer.length === 0) {
+    res.status(400).json({ Success: false, ErrorMessage: 'Empty or invalid file payload.' });
+    return;
+  }
+
+  // 3. Extract and sanitize metadata
+  const rawFileName = (req.headers['x-file-name'] as string) || (req.query.fileName as string) || 'upload.bin';
+  let fileName = 'upload.bin';
+  try {
+    fileName = decodeURIComponent(rawFileName);
+  } catch {
+    fileName = rawFileName;
+  }
+  // Sanitize filename: remove directory traversal, leading slashes, control chars
+  fileName = fileName.replace(/[/\\]+/g, '_').replace(/^\.+/, '').replace(/[\x00-\x1f\x7f]/g, '').trim() || 'upload.bin';
+
+  const mimeType = (req.headers['content-type'] as string) || (req.query.mimeType as string) || 'application/octet-stream';
+
+  try {
+    const uploadToken = UploadTokenManager.Instance.Stage({
+      buffer,
+      fileName,
+      mimeType,
+      userId,
+    });
+
+    res.status(200).json({
+      Success: true,
+      UploadToken: uploadToken,
+      FileName: fileName,
+      MimeType: mimeType,
+      ContentLength: buffer.length,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    LogError(`[MediaStream] Upload staging failed for '${fileName}': ${message}`);
+    res.status(400).json({ Success: false, ErrorMessage: message });
+  }
+}
+
 /** Top-level request handler: verify token → resolve bytes → stream/buffer with Range support. */
 async function handleMediaRequest(req: Request, res: Response): Promise<void> {
   // Express type defs allow req.params values to be string | string[]; normalize to string
@@ -136,6 +226,7 @@ async function resolveFileBytesSource(fileId: string): Promise<FileBytesSource |
     driver,
     providerKey: file.ProviderKey,
     contentType: file.ContentType ?? 'application/octet-stream',
+    fileName: file.Name || 'file',
   };
 }
 
@@ -166,6 +257,8 @@ async function serveViaStream(res: Response, source: FileBytesSource, rangeHeade
 
   res.setHeader('Accept-Ranges', 'bytes');
   res.setHeader('Content-Type', result.ContentType ?? source.contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
   if (result.ContentLength != null) {
     res.setHeader('Content-Length', String(result.ContentLength));
   }
@@ -198,6 +291,8 @@ async function serveViaBuffer(res: Response, source: FileBytesSource, rangeHeade
 
   res.setHeader('Accept-Ranges', 'bytes');
   res.setHeader('Content-Type', source.contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
 
   if (!rangeHeader) {
     res.status(200);

package/src/rest/OAuthCallbackHandler.ts

@@ -14,7 +14,7 @@
 
 import express from 'express';
 import { LogError, LogStatus, RunView, UserInfo } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
+import { IsValidUUID, UUIDsEqual } from '@memberjunction/global';
 import { UserCache } from '@memberjunction/generic-database-provider';
 import { OAuthManager, MCPClientManager } from '@memberjunction/ai-mcp-client';
 import type { MCPServerOAuthConfig } from '@memberjunction/ai-mcp-client';
@@ -38,6 +38,23 @@ export interface OAuthCallbackHandlerOptions {
     successRedirectUrl?: string;
     /** URL to redirect to after failed authorization */
     errorRedirectUrl?: string;
+    /**
+     * Origins a caller-supplied `frontendReturnUrl` is allowed to point at, so the OAuth callback
+     * cannot be turned into an open redirect from the trusted MJAPI origin. Normally wired to
+     * `cors.allowedOrigins`. Pass `['*']` to allow any origin — MJ's backward-compatible default
+     * CORS posture, and what a deployment that has not narrowed `cors.allowedOrigins` gets.
+     *
+     * REQUIRED on purpose. An optional field defaulting to allow-all is fail-open: a construction
+     * site that forgets it loses the open-redirect protection silently, with nothing to notice.
+     * Being required makes that a compile error instead. The handler is not exported from this
+     * package's barrel and the package declares no subpath exports, so no consumer outside MJServer
+     * can construct it — revisit this if it is ever added to the public API.
+     *
+     * Injected rather than read from `configInfo` directly so this module has no import-time
+     * dependency on configuration loading — importing the config module validates the whole config
+     * as a side effect, which makes this handler unimportable in any context without one.
+     */
+    allowedFrontendOrigins: string[];
 }
 
 /**
@@ -46,10 +63,15 @@ export interface OAuthCallbackHandlerOptions {
  * The callback endpoint is unauthenticated because it's called by external auth servers.
  * It uses the state parameter to look up the authorization context and validate the flow.
  *
+ * NOTE: `allowedFrontendOrigins` is what prevents the callback becoming an open redirect, and is
+ * required so it cannot be forgotten. Wire it to `configInfo.cors?.allowedOrigins`; `['*']` allows
+ * any origin, matching MJ's default CORS posture.
+ *
  * @example
  * ```typescript
  * const oauthHandler = new OAuthCallbackHandler({
- *     publicUrl: 'https://api.example.com'
+ *     publicUrl: 'https://api.example.com',
+ *     allowedFrontendOrigins: configInfo.cors?.allowedOrigins ?? ['*']
  * });
  *
  * // Mount unauthenticated callback route
@@ -348,7 +370,10 @@ export class OAuthCallbackHandler {
      * @param res - Express response
      */
     private async initiateFlow(req: express.Request, res: express.Response): Promise<void> {
-        const { connectionId, additionalScopes, frontendReturnUrl } = req.body;
+        // Coerce request-body values to strings up front. A JSON body can carry arrays/objects, and
+        // passing those downstream unvalidated turns a bad request into a confusing internal failure.
+        const connectionId: string = typeof req.body?.connectionId === 'string' ? req.body.connectionId : '';
+        const { additionalScopes, frontendReturnUrl } = req.body;
         const contextUser = req['mjUser'] as UserInfo;
 
         if (!contextUser) {
@@ -368,6 +393,29 @@ export class OAuthCallbackHandler {
             return;
         }
 
+        // connectionId is a record ID (UUID). Reject anything else at the boundary so it can never
+        // reach a SQL filter or downstream consumer as injectable input.
+        if (!IsValidUUID(connectionId)) {
+            res.status(400).json({
+                success: false,
+                errorCode: 'invalid_request',
+                errorMessage: 'connectionId must be a valid record identifier'
+            });
+            return;
+        }
+
+        // Reject a disallowed return URL here rather than at the callback. Otherwise the caller only
+        // finds out after the whole OAuth round trip, by being silently sent to the default page.
+        // An absent value is acceptable — see isFrontendReturnUrlAcceptable.
+        if (!this.isFrontendReturnUrlAcceptable(frontendReturnUrl)) {
+            res.status(400).json({
+                success: false,
+                errorCode: 'invalid_request',
+                errorMessage: 'frontendReturnUrl is not an allowed redirect target'
+            });
+            return;
+        }
+
         try {
             // Load connection and server config
             const config = await this.loadConnectionConfig(connectionId, contextUser);
@@ -644,10 +692,13 @@ export class OAuthCallbackHandler {
         try {
             const rv = new RunView();
 
-            // Get connection to get server ID
+            // Get connection to get server ID.
+            // connectionId is caller-supplied (POST /oauth/initiate body). MJ ExtraFilter is a raw
+            // SQL fragment, so single quotes MUST be doubled to prevent injection — matching the
+            // escaping used for stateParameter in loadAuthorizationState().
             const connResult = await rv.RunView<{ MCPServerID: string }>({
                 EntityName: ENTITY_MCP_SERVER_CONNECTIONS,
-                ExtraFilter: `ID='${connectionId}'`,
+                ExtraFilter: `ID='${connectionId.replace(/'/g, "''")}'`,
                 Fields: ['MCPServerID'],
                 ResultType: 'simple'
             }, contextUser);
@@ -696,32 +747,93 @@ export class OAuthCallbackHandler {
         }
     }
 
+    /**
+     * Validates that a caller-supplied frontend return URL points at an allowed origin, so the
+     * OAuth callback cannot be turned into an open redirect from the trusted MJAPI origin.
+     *
+     * Allowed when: the allowlist is "allow all" (`['*']`, the backward-compatible default),
+     * the URL's origin is in `options.allowedFrontendOrigins`, or it matches the origin of a
+     * built-in success/error redirect URL. Anything else is rejected and the caller falls back to
+     * the default redirect page.
+     */
+    private isFrontendReturnUrlAllowed(url: URL): boolean {
+        const allowed = this.options.allowedFrontendOrigins;
+        if (allowed.includes('*')) {
+            return true;
+        }
+        if (allowed.includes(url.origin)) {
+            return true;
+        }
+        for (const builtIn of [this.options.successRedirectUrl, this.options.errorRedirectUrl]) {
+            try {
+                if (builtIn && new URL(builtIn).origin === url.origin) {
+                    return true;
+                }
+            } catch {
+                // Ignore an unparseable built-in URL and keep checking.
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Parses a caller-supplied return URL and applies {@link isFrontendReturnUrlAllowed}.
+     *
+     * @returns the parsed URL when it is well-formed AND points at an allowed origin, otherwise null.
+     */
+    private parseAllowedFrontendReturnUrl(frontendReturnUrl: string): URL | null {
+        let url: URL;
+        try {
+            url = new URL(frontendReturnUrl);
+        } catch {
+            LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
+            return null;
+        }
+        if (!this.isFrontendReturnUrlAllowed(url)) {
+            LogError(`[OAuth Callback] frontend return URL '${frontendReturnUrl}' origin not allowed, falling back to default`);
+            return null;
+        }
+        return url;
+    }
+
+    /**
+     * Boundary check for `/oauth/initiate` — validates the return URL before it is persisted onto
+     * the authorization state, so a caller gets a 400 instead of a silent fallback later.
+     *
+     * An ABSENT value (undefined / null / empty string) is acceptable: it means "no return URL", and
+     * every downstream consumer treats it that way via a truthiness check. Only a value the caller
+     * actually supplied is validated — otherwise omitting the field, or sending an empty one, would
+     * newly fail a request that has always worked.
+     */
+    private isFrontendReturnUrlAcceptable(frontendReturnUrl: unknown): boolean {
+        if (!frontendReturnUrl) {
+            return true;
+        }
+        return typeof frontendReturnUrl === 'string' && this.parseAllowedFrontendReturnUrl(frontendReturnUrl) !== null;
+    }
+
     /**
      * Redirects to success page with state info.
      * If a frontend return URL is provided, redirects there instead of the default success page.
      */
     private redirectToSuccess(res: express.Response, state: string, connectionId: string, frontendReturnUrl?: string): void {
-        // If frontend return URL is provided, redirect there with success parameters
-        if (frontendReturnUrl) {
-            try {
-                const url = new URL(frontendReturnUrl);
-                url.searchParams.set('oauth', 'success');
-                url.searchParams.set('state', state);
-                url.searchParams.set('connectionId', connectionId);
-                LogStatus(`[OAuth Callback] Redirecting to frontend URL: ${url.toString()}`);
-                res.redirect(302, url.toString());
-                return;
-            } catch (error) {
-                LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
-                // Fall through to default redirect
-            }
+        // If frontend return URL is provided and points at an allowed origin, redirect there with
+        // success parameters. Anything else falls through to the built-in page.
+        const url = frontendReturnUrl ? this.parseAllowedFrontendReturnUrl(frontendReturnUrl) : null;
+        if (url) {
+            url.searchParams.set('oauth', 'success');
+            url.searchParams.set('state', state);
+            url.searchParams.set('connectionId', connectionId);
+            LogStatus(`[OAuth Callback] Redirecting to frontend URL: ${url.toString()}`);
+            res.redirect(302, url.toString());
+            return;
         }
 
         // Default: redirect to built-in success page
-        const url = new URL(this.options.successRedirectUrl!);
-        url.searchParams.set('state', state);
-        url.searchParams.set('connectionId', connectionId);
-        res.redirect(302, url.toString());
+        const defaultUrl = new URL(this.options.successRedirectUrl!);
+        defaultUrl.searchParams.set('state', state);
+        defaultUrl.searchParams.set('connectionId', connectionId);
+        res.redirect(302, defaultUrl.toString());
     }
 
     /**
@@ -729,27 +841,23 @@ export class OAuthCallbackHandler {
      * If a frontend return URL is provided, redirects there instead of the default error page.
      */
     private redirectToError(res: express.Response, errorCode: string, errorMessage: string, frontendReturnUrl?: string): void {
-        // If frontend return URL is provided, redirect there with error parameters
-        if (frontendReturnUrl) {
-            try {
-                const url = new URL(frontendReturnUrl);
-                url.searchParams.set('oauth', 'error');
-                url.searchParams.set('error', errorCode);
-                url.searchParams.set('error_description', errorMessage);
-                LogStatus(`[OAuth Callback] Redirecting to frontend URL with error: ${url.toString()}`);
-                res.redirect(302, url.toString());
-                return;
-            } catch (error) {
-                LogError(`[OAuth Callback] Invalid frontend return URL '${frontendReturnUrl}', falling back to default`);
-                // Fall through to default redirect
-            }
+        // If frontend return URL is provided and points at an allowed origin, redirect there with
+        // error parameters. Anything else falls through to the built-in page.
+        const url = frontendReturnUrl ? this.parseAllowedFrontendReturnUrl(frontendReturnUrl) : null;
+        if (url) {
+            url.searchParams.set('oauth', 'error');
+            url.searchParams.set('error', errorCode);
+            url.searchParams.set('error_description', errorMessage);
+            LogStatus(`[OAuth Callback] Redirecting to frontend URL with error: ${url.toString()}`);
+            res.redirect(302, url.toString());
+            return;
         }
 
         // Default: redirect to built-in error page
-        const url = new URL(this.options.errorRedirectUrl!);
-        url.searchParams.set('error', errorCode);
-        url.searchParams.set('error_description', errorMessage);
-        res.redirect(302, url.toString());
+        const defaultUrl = new URL(this.options.errorRedirectUrl!);
+        defaultUrl.searchParams.set('error', errorCode);
+        defaultUrl.searchParams.set('error_description', errorMessage);
+        res.redirect(302, defaultUrl.toString());
     }
 
     /**