@memberjunction/server 6.1.0-edge.3 → 6.1.0-edge.4

package/src/__tests__/ResolverBase.filterEscaping.test.ts

@@ -0,0 +1,147 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+import type { RunViewByNameInput } from '../generic/RunViewResolver.js';
+import type { PubSubEngine } from 'type-graphql';
+
+/**
+ * Both of `ResolverBase`'s own filter builders interpolated client-supplied values into the
+ * `ExtraFilter` text they hand to `RunView`:
+ *
+ * - `findBy` — reachable through `UserByEmail`, `FileByName`, `UserViewsByName`, and the
+ *   other by-value single-record resolvers.
+ * - `RunViewByNameGeneric` — the inline `Name='<ViewName>'` lookup.
+ *
+ * `ExtraFilter` does pass through `SQLExpressionValidator`, which rejects stacked statements,
+ * `UNION`, comments and `WAITFOR` — so the residual exposure was a same-clause boolean
+ * tautology rather than arbitrary SQL. These tests pin the escaping that closes it, and the
+ * fail-closed rule on the unquoted (numeric/boolean) slot, where a string value would BE
+ * SQL with no quote to break out of.
+ */
+
+const ENTITY_NAME = 'MJ: Users';
+
+/** Captures what the resolver asked `RunView` for. */
+type Captured = { params: RunViewParams | null };
+
+/**
+ * Minimal provider: the entity/field metadata `findBy` reads, plus a `RunView` that records
+ * its params. `Sequence` stands in for a numeric field (`NeedsQuotes` is false only for
+ * Number and Boolean TS types).
+ */
+function fakeProvider(captured: Captured, rows: Record<string, unknown>[] = []): DatabaseProviderBase {
+    return {
+        Entities: [
+            {
+                Name: ENTITY_NAME,
+                Fields: [
+                    { Name: 'Email', NeedsQuotes: true },
+                    { Name: 'Name', NeedsQuotes: true },
+                    { Name: 'Sequence', NeedsQuotes: false },
+                    { Name: 'IsActive', NeedsQuotes: false },
+                ],
+            },
+            {
+                Name: 'MJ: User Views',
+                Fields: [{ Name: 'Name', NeedsQuotes: true }],
+            },
+        ],
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the protected `findBy`. */
+class Probe extends ResolverBase {
+    public FindBy(provider: DatabaseProviderBase, entity: string, params: Record<string, unknown>) {
+        return this.findBy(provider, entity, params, fakeUser());
+    }
+}
+
+describe('ResolverBase.findBy — ExtraFilter escaping', () => {
+    it('doubles a single quote in a quoted value', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "o'brien@example.com" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'o''brien@example.com'");
+    });
+
+    it('renders a tautology attempt inert instead of terminating the literal', async () => {
+        const captured: Captured = { params: null };
+        // The payload closes the literal and appends its own predicate. Escaped, every quote
+        // it carries stays *inside* the literal, so the clause matches a (non-existent)
+        // address rather than every row.
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "x' OR '1'='1" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'x'' OR ''1''=''1'");
+        // Nothing outside the literal: exactly two unescaped quotes, the delimiters.
+        expect(captured.params?.ExtraFilter?.replace(/''/g, '')).toBe("Email = 'x OR 1=1'");
+    });
+
+    it('joins multiple params with AND, escaping each', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Email: "a'b", Name: "c'd" });
+
+        expect(captured.params?.ExtraFilter).toBe("Email = 'a''b' AND Name = 'c''d'");
+    });
+
+    it('leaves a genuinely numeric value unquoted', async () => {
+        const captured: Captured = { params: null };
+        await new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: 42 });
+
+        expect(captured.params?.ExtraFilter).toBe('Sequence = 42');
+    });
+
+    it('rejects a string aimed at an unquoted (numeric) field rather than emitting it as SQL', async () => {
+        const captured: Captured = { params: null };
+        // There is no quote to escape in an unquoted slot — the value lands in the clause as
+        // SQL. The only safe handling is to refuse it.
+        await expect(
+            new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: '1 OR 1=1' })
+        ).rejects.toThrow(/Sequence/);
+
+        expect(captured.params).toBeNull(); // never reached RunView
+    });
+
+    it('rejects a non-finite number in an unquoted field', async () => {
+        const captured: Captured = { params: null };
+        await expect(
+            new Probe().FindBy(fakeProvider(captured), ENTITY_NAME, { Sequence: Number.NaN })
+        ).rejects.toThrow(/Sequence/);
+    });
+
+    it('still rejects an unknown field name', async () => {
+        // Pre-existing behavior, pinned so the escaping rework cannot quietly drop it.
+        await expect(
+            new Probe().FindBy(fakeProvider({ params: null }), ENTITY_NAME, { NotAField: 'x' })
+        ).rejects.toThrow(/NotAField/);
+    });
+});
+
+describe('ResolverBase.RunViewByNameGeneric — view-name escaping', () => {
+    it('escapes the client-supplied view name', async () => {
+        const captured: Captured = { params: null };
+        const input = { ViewName: "My View' OR '1'='1" } as RunViewByNameInput;
+
+        // Empty Results short-circuits the method (returns null) once the lookup filter is built.
+        const result = await new Probe().RunViewByNameGeneric(
+            input,
+            fakeProvider(captured),
+            fakePayload(),
+            undefined as unknown as PubSubEngine // unused: the empty-result path returns before it is passed on
+        );
+
+        expect(result).toBeNull();
+        expect(captured.params?.EntityName).toBe('MJ: User Views');
+        expect(captured.params?.ExtraFilter).toBe("Name='My View'' OR ''1''=''1'");
+    });
+});

package/src/__tests__/SessionManager.test.ts

@@ -461,6 +461,61 @@ describe('SessionManager.Heartbeat', () => {
     });
 });
 
+describe('SessionManager.Heartbeat — bounded heartbeatLastWrite (Round 11 memory-leak fix)', () => {
+    // Regression coverage: heartbeatLastWrite used to be a plain, unbounded `Map`. SessionManager
+    // is constructed fresh by every resolver that needs one (AgentSessionResolver,
+    // RealtimeClientSessionResolver, RealtimeBridgeResolver) plus SessionJanitor's own instance, so
+    // each is itself a process-lifetime singleton with its own copy of the map. A session's
+    // heartbeats land through one resolver's instance, but the overwhelmingly common close path —
+    // a crashed tab, a dropped connection, anything that never round-trips an explicit close
+    // mutation — is reconciled by SessionJanitor's sweeps through ITS OWN SessionManager, which
+    // never touches the originating instance's map, so the entry was never deleted. The fix bounds
+    // the map with MJLruCache(maxSize 5_000, ttlMs 4h) so that scenario is capped instead of
+    // growing forever.
+
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    it('forces a fresh write once the 4h TTL elapses, even though CloseSession never ran on this instance', async () => {
+        const session = makeSessionEntity({ ID: 'session-ttl', Status: 'Active' });
+        const { provider } = makeProvider(() => session);
+        const mgr = new SessionManager();
+        const user = makeUser();
+
+        const first = await mgr.Heartbeat('session-ttl', user, provider);
+        expect(first).toBe(true);
+        expect(session.Save).toHaveBeenCalledTimes(1);
+
+        // Still within the coalescing window — no second write.
+        const second = await mgr.Heartbeat('session-ttl', user, provider);
+        expect(second).toBe(true);
+        expect(session.Save).toHaveBeenCalledTimes(1);
+
+        // Advance past the cache's 4h TTL backstop (well beyond the 3s coalescing window too).
+        vi.advanceTimersByTime(4 * 60 * 60 * 1000 + 1);
+
+        const third = await mgr.Heartbeat('session-ttl', user, provider);
+        expect(third).toBe(true);
+        // The TTL-expired entry forces a write again, exactly as a never-before-seen session would —
+        // proving the cache entry does not live forever when nothing on this instance ever calls
+        // CloseSession for it.
+        expect(session.Save).toHaveBeenCalledTimes(2);
+    });
+
+    it('is backed by a bounded MJLruCache, not a plain unbounded Map (structural regression guard)', () => {
+        const mgr = new SessionManager();
+        const internal = (mgr as unknown as { heartbeatLastWrite: { MaxSize: number; Size: number } })
+            .heartbeatLastWrite;
+        expect(internal.MaxSize).toBe(5_000);
+        expect(internal.Size).toBe(0);
+    });
+});
+
 describe('SessionManager.MarkIdle', () => {
     it('transitions Active → Idle', async () => {
         const session = makeSessionEntity({ ID: 'session-1', Status: 'Active' });

package/src/agentSessions/SessionManager.ts

@@ -1,4 +1,5 @@
 import { IMetadataProvider, UserInfo, LogError, RunView } from '@memberjunction/core';
+import { MJLruCache } from '@memberjunction/global';
 import {
     MJAIAgentSessionEntity,
     MJAIAgentSessionChannelEntity,
@@ -78,9 +79,10 @@ const HEARTBEAT_MIN_WRITE_INTERVAL_MS = 3_000;
  * `contextUser` and request-scoped `IMetadataProvider` so all entity operations run under the
  * correct identity/provider and never pin the process-global provider.
  *
- * The only in-memory state it holds is a small per-session last-heartbeat-write timestamp map used
- * purely to coalesce {@link Heartbeat} writes, plus the injected {@link RealtimeClientSessionService}
- * used by {@link finalizeObservabilityRuns}; it carries no user or provider state across calls.
+ * The only in-memory state it holds is a small per-session last-heartbeat-write timestamp cache used
+ * purely to coalesce {@link Heartbeat} writes (see {@link heartbeatLastWrite} for why it's bounded),
+ * plus the injected {@link RealtimeClientSessionService} used by {@link finalizeObservabilityRuns}; it
+ * carries no user or provider state across calls.
  *
  * Responsibilities:
  * - **Create** — authorize (`CanRun`), optionally mint a Conversation, persist an `Active` session.
@@ -94,8 +96,24 @@ const HEARTBEAT_MIN_WRITE_INTERVAL_MS = 3_000;
  * this layer, so close here only reconciles the durable record + channel rows.
  */
 export class SessionManager {
-    /** session ID (lowercased) → epoch ms of its last persisted `LastActiveAt` write. */
-    private heartbeatLastWrite = new Map<string, number>();
+    /**
+     * session ID (lowercased) → epoch ms of its last persisted `LastActiveAt` write. Written by
+     * {@link persistHeartbeat}, read by {@link heartbeatWriteDue}/{@link shouldForceWrite}, and
+     * normally deleted by {@link CloseSession}. Bounded with `MJLruCache` (rather than a plain `Map`)
+     * for the same reason as `RealtimeClientSessionService.promptRunWriteChains`: `SessionManager` is
+     * constructed fresh by every resolver that needs one (`AgentSessionResolver`,
+     * `RealtimeClientSessionResolver`, `RealtimeBridgeResolver`) plus `SessionJanitor`'s own instance,
+     * so each is itself a process-lifetime singleton with its own copy of this map. A session's
+     * heartbeats land through one resolver's instance, but the overwhelmingly common close path — a
+     * crashed tab, a dropped connection, any disconnect that never round-trips an explicit close
+     * mutation — is reconciled by `SessionJanitor`'s staleness/shutdown sweeps through ITS OWN
+     * `SessionManager`, which never touches the originating instance's map. The TTL/maxSize eviction
+     * here is what keeps that scenario bounded instead of an unbounded per-instance leak.
+     */
+    private readonly heartbeatLastWrite = new MJLruCache<string, number>({
+        maxSize: 5_000,
+        ttlMs: 4 * 60 * 60 * 1000, // 4h backstop — generous vs. the janitor's 15m staleness threshold
+    });
 
     /**
      * The {@link RealtimeClientSessionService} used to finalize a closing session's co-agent
@@ -169,7 +187,7 @@ export class SessionManager {
         if (!session) {
             return false;
         }
-        this.heartbeatLastWrite.delete(agentSessionID.toLowerCase());
+        this.heartbeatLastWrite.Delete(agentSessionID.toLowerCase());
 
         if (session.Status === 'Closed') {
             // Idempotent — already terminal. Still notify the channel-plugin host so a session
@@ -517,7 +535,7 @@ export class SessionManager {
 
     /** True once the per-session coalescing window has elapsed since the last persisted write. */
     private heartbeatWriteDue(key: string): boolean {
-        const last = this.heartbeatLastWrite.get(key);
+        const last = this.heartbeatLastWrite.Get(key);
         return last == null || (Date.now() - last) >= HEARTBEAT_MIN_WRITE_INTERVAL_MS;
     }
 
@@ -527,7 +545,7 @@ export class SessionManager {
      * swallowed by coalescing.
      */
     private shouldForceWrite(key: string, _provider: IMetadataProvider): boolean {
-        return !this.heartbeatLastWrite.has(key);
+        return !this.heartbeatLastWrite.Has(key);
     }
 
     /** Loads, bumps `LastActiveAt`, reactivates `Idle → Active`, saves, and records the write time. */
@@ -546,7 +564,7 @@ export class SessionManager {
         }
         const saved = await this.saveOrLog(session, 'Heartbeat');
         if (saved) {
-            this.heartbeatLastWrite.set(agentSessionID.toLowerCase(), Date.now());
+            this.heartbeatLastWrite.Set(agentSessionID.toLowerCase(), Date.now());
         }
         return saved;
     }

package/src/auth/index.ts

@@ -10,6 +10,7 @@ import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { initializeAuthProviders } from './initializeProviders.js';
 
 export * from './APIKeyScopeAuth.js';
+export * from './scopeLimitedPrincipal.js';
 export * from './actingContextResolver.js';
 export * from './AuthProviderEngine.js';
 export * from './AuthProviderCatalogRouter.js';

package/src/auth/scopeLimitedPrincipal.ts

@@ -0,0 +1,50 @@
+import { UserInfo } from '@memberjunction/core';
+
+/**
+ * True when a session's read authority is deliberately narrower than the role grant it
+ * authenticates with — i.e. the principal is confined by per-session scope rather than by
+ * its roles alone.
+ *
+ * Two such principals exist today, both from the magic-link surface:
+ *
+ * - **Anonymous magic-link guests** (`IsMagicLinkAnonymous`) authenticate as the *shared*
+ *   Anonymous principal, so their role grant is common to every guest. What separates one
+ *   guest from another is not the role — it is the per-session scope.
+ * - **Resource-scoped magic-link sessions** (`MagicLinkScope`) hold a normal role, pinned to
+ *   one shared resource (and its FK-reachable dependents) for the life of the session.
+ *
+ * In both cases the confinement is expressed as row-level-security filter tokens
+ * (`{{ScopeResourceID}}` / `{{ScopeResourceType}}`) that the entity-read path substitutes.
+ * That means the confinement only exists on code paths that go **through** entity
+ * permissions and RLS — `RunView`, `BaseEntity`, the generated resolvers. Any path that
+ * reaches the database *around* those layers (raw SQL on the read-only pool, for instance)
+ * sees no scope at all, so such a path must refuse these principals outright rather than
+ * assume a filter it never applies.
+ *
+ * Callers should treat a `true` result as "not permitted here", never as "apply a narrower
+ * filter" — a caller that could narrow correctly would not need this predicate.
+ *
+ * @param user the principal to classify. A missing principal returns `true`: an
+ *        unidentifiable session is the one case where the scope certainly cannot be
+ *        established, so it fails closed.
+ * @returns `true` when the principal is scope-limited (or unidentifiable), else `false`.
+ *
+ * @example
+ * ```typescript
+ * if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+ *     return this.buildErrorResult('Not permitted for scope-limited sessions.');
+ * }
+ * ```
+ */
+export function IsScopeLimitedPrincipal(user: UserInfo | undefined | null): boolean {
+    if (!user) {
+        return true; // no identifiable principal — fail closed
+    }
+    if (user.IsMagicLinkAnonymous) {
+        return true;
+    }
+    const scope = user.MagicLinkScope;
+    // An empty scope object carries no confinement; only a populated one does. (Truthiness
+    // of the object alone would classify `{}` as scoped and lock out a session that is not.)
+    return !!(scope?.ResourceID || scope?.ResourceType);
+}

package/src/context.ts

@@ -18,9 +18,10 @@ import { GetReadOnlyDataSource, GetReadWriteDataSource } from './util.js';
 import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
-import { DatabaseProviderBase, UserInfo, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
+import { DatabaseProviderBase, UserInfo, type IMetadataProvider, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
 import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { Metadata } from '@memberjunction/core';
+import { IdentityClaimEngineServer } from '@memberjunction/core-entities-server';
 import { UUIDsEqual } from '@memberjunction/global';
 import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
@@ -554,7 +555,30 @@ export const getUserPayload = async (
       });
     }
 
-    return { userRecord: sessionUser, email: sessionUser.Email, sessionId };
+    // The IdP's OIDC email_verified assertion, read off the JWKS-verified payload. Standard
+    // claim name across Auth0/Okta/Cognito/WorkOS; MSAL and others simply omit it (undefined).
+    const emailVerified = typeof payload.email_verified === 'boolean' ? payload.email_verified : undefined;
+
+    // Automatic claim-on-login — once per issued token (deduped, own prefix so it can't eat the
+    // audit's first-seen slot), fire-and-forget so it never adds latency. Discovers pending
+    // MJ: Identity Claims addressed to this user's email and redeems each through the FULL
+    // RedeemClaim gate (email/verification rules, atomic CAS, driver error handling), passing
+    // the IdP's email_verified assertion so an unverified email can never auto-claim.
+    // Anonymous magic-link guests are skipped: their principal is synthetic and per-session.
+    if (sessionUser.Email && !sessionUser.IsMagicLinkAnonymous && markSessionAuditSeen(sessionAuditKey('claims', payload))) {
+      // Pre-context auth path: per-request providers do not exist yet here, so the global is the
+      // only provider available — same posture as every other pre-context call on this path.
+      // The allowlist marker has to sit on the reference line itself; MultiProviderCompliance
+      // matches per-line, so a marker on its own line above is invisible to the scanner.
+      const claimProvider = Metadata.Provider as unknown as IMetadataProvider; // global-provider-ok: pre-context auth path
+      if (claimProvider) {
+        void IdentityClaimEngineServer.Instance.AutoClaimForUser(sessionUser, claimProvider, { EmailVerified: emailVerified }).catch(
+          (err) => console.warn(`Auto-claim on login failed for ${sessionUser.Email}: ${err instanceof Error ? err.message : err}`),
+        );
+      }
+    }
+
+    return { userRecord: sessionUser, email: sessionUser.Email, sessionId, emailVerified };
   } catch (error) {
     // An anonymous request presenting no credentials at all (a health check, a CORS
     // preflight-adjacent probe, a client mid-handshake) is routine, same as an expired

package/src/entitySubclasses/MJEntityPermissionEntityServer.server.ts

@@ -1,7 +1,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
 import { MJEntityPermissionEntity } from '@memberjunction/core-entities';
-import axios from 'axios';
+import { HttpPost } from '@memberjunction/network-utils';
 import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } from '../config.js';
 
 /**
@@ -59,23 +59,24 @@ export class MJEntityPermissionEntityServer extends MJEntityPermissionEntity {
   protected static async SubmitQueue(): Promise<void> {
     this._lastModifiedTime = null;
 
-    // now, use Axios to submit the queue to the API server
+    // now, submit the queue to the API server
     // Check if there's anything to submit
     if (this._entityIDQueue.length > 0) {
       try {
-        // Use Axios to submit the queue to the API server
-        const response = await axios.post(this.getSubmissionURL(), {
+        // The submission URL is our OWN CodeGen API (typically localhost) — deliberately NOT
+        // routed through the SSRF guard, which would block an internal address by design.
+        const response = await HttpPost<{ status?: string; errorMessage?: string }>(this.getSubmissionURL(), {
           entityIDArray: this._entityIDQueue,
         });
 
-        // Check the Axios response code implicitly and API response explicitly
-        if (response.status === 200 && response.data.status === 'ok') {
+        // Check the HTTP status implicitly and API response explicitly
+        if (response.Status === 200 && response.Data?.status === 'ok') {
           console.log('Queue submitted successfully.');
           // now, clear the queue and timer
           this.ClearQueue();
         } else {
           // Handle API indicating a failure
-          console.error('Failed to submit queue:', response.data.errorMessage || 'Unknown error');
+          console.error('Failed to submit queue:', response.Data?.errorMessage || 'Unknown error');
         }
       } catch (error) {
         // Handle errors here