@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.7

package/src/config.ts

@@ -25,6 +25,14 @@ const userHandlingInfoSchema = z.object({
   newUserRoles: z.array(z.string()).optional().default([]),
   updateCacheWhenNotFound: z.boolean().optional().default(false),
   updateCacheWhenNotFoundDelay: z.number().optional().default(30000),
+  /**
+   * The internal user whose context creates new user records. Matched against `User.Name` FIRST,
+   * then `User.Email` — so either spelling of an existing user resolves. On a stock database the
+   * system user is `Name='System'` / `Email='not.set@nowhere.com'`; both reach it.
+   *
+   * When unset, or when the value matches no user, resolution falls back to the system user and
+   * then to the lowest-ID active Owner. See `src/auth/principals.ts`.
+   */
   contextUserForNewUserCreation: z.string().optional().default(''),
   CreateUserApplicationRecords: z.boolean().optional().default(false),
   UserApplications: z.array(z.string()).optional().default([]),
@@ -328,7 +336,11 @@ const magicLinkSchema = z.object({
    * from attaching a privileged role (e.g. Owner) to an external magic-link user.
    */
   grantableRoleNames: z.array(z.string()).optional().default([]),
-  /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+  /**
+   * The internal user whose context provisions magic-link users, matched against `User.Name` then
+   * `User.Email` (falls back to `userHandling.contextUserForNewUserCreation`, then to the system
+   * user, then to the lowest-ID active Owner).
+   */
   contextUserForProvisioning: z.string().optional(),
   /**
    * Guard against bolting an external magic-link role/app onto an EXISTING account
@@ -391,7 +403,10 @@ const widgetSchema = z.object({
   rateLimitWindowMs: z.coerce.number().optional().default(60_000),
   /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
   voiceDefaultMaxSessionMinutes: z.coerce.number().optional().default(10),
-  /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+  /**
+   * The internal user whose context READS widget config at mint time, matched against `User.Name`
+   * then `User.Email` (falls back to the system user, then the lowest-ID active Owner).
+   */
   contextUserForLookup: z.string().optional(),
   /**
    * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
@@ -524,11 +539,17 @@ const telephonySchema = z.object({
   teams: teamsMeetingsSchema.optional(),
 }).passthrough();
 
+const realtimeSchema = z.object({
+  /** Master switch. When false (default), the WebRTC SDP broker router is not mounted. */
+  enabled: zodBooleanWithTransforms().default(false),
+}).passthrough();
+
 const configInfoSchema = z.object({
   userHandling: userHandlingInfoSchema,
   magicLink: magicLinkSchema.optional().default({}),
   widget: widgetSchema.optional().default({}),
   telephony: telephonySchema.optional().default({}),
+  realtime: realtimeSchema.optional().default({}),
   databaseSettings: databaseSettingsInfoSchema,
   viewingSystem: viewingSystemInfoSchema.optional(),
   restApiOptions: restApiOptionsSchema.optional().default({}),
@@ -583,6 +604,7 @@ export type UserHandlingInfo = z.infer<typeof userHandlingInfoSchema>;
 export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type WidgetConfig = z.infer<typeof widgetSchema>;
 export type TelephonyConfig = z.infer<typeof telephonySchema>;
+export type RealtimeConfig = z.infer<typeof realtimeSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
 export type RingCentralTelephonyConfig = z.infer<typeof ringcentralTelephonySchema>;
@@ -648,10 +670,23 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     autoCreateNewUsers: true,
     newUserLimitedToAuthorizedDomains: false,
     newUserAuthorizedDomains: [],
-    newUserRoles: ['UI', 'Developer'],
+    // 'UI' ONLY, deliberately (issue #4260). Auto-provisioning is on by default above, with no
+    // domain restriction, so this list is the standing authority of anyone the configured IdP will
+    // issue a token for. On the baseline seed 'Developer' and 'Integration' hold unfiltered
+    // CanUpdate on ~439 of the database's ~446 entities, so defaulting every such identity into
+    // either grants broad data-plane access no host should hand out by default. (The MJ: Users
+    // escalation this list also used to guard against — writing your own Type to 'Owner' — is now
+    // closed at the entity layer regardless of role: see MJUserEntityServer in
+    // @memberjunction/core-entities-server.) 'UI' carries the end-user surface (conversations,
+    // views, dashboards, settings) and no write on MJ: Users. Hosts that need more grant it
+    // per-deployment.
+    newUserRoles: ['UI'],
     updateCacheWhenNotFound: true,
     updateCacheWhenNotFoundDelay: 5000,
-    contextUserForNewUserCreation: 'not.set@nowhere.com',
+    // The seeded system user, named by `Name`. Its Email ('not.set@nowhere.com') resolves too —
+    // resolution tries both columns — but naming it this way keeps the default readable as what it
+    // is, rather than as an address nobody can receive mail at.
+    contextUserForNewUserCreation: 'System',
     CreateUserApplicationRecords: true,
     UserApplications: []
   },
@@ -716,6 +751,11 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
     maxConcurrentRuns: 3
   },
 
+  // Realtime WebRTC SDP broker defaults (off by default)
+  realtime: {
+    enabled: parseBooleanEnv(process.env.MJ_REALTIME_ENABLED),
+  },
+
   // Telemetry defaults — on unless the operator turns it off via MJ_TELEMETRY_ENABLED.
   //
   // The env read lives HERE rather than in telemetrySchema for the same reason as

package/src/entitySubclasses/MJEntityPermissionEntityServer.server.ts

@@ -1,13 +1,26 @@
-import { RegisterClass } from '@memberjunction/global';
-import { BaseEntity, EntityDeleteOptions, EntitySaveOptions } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { BaseEntity, EntityDeleteOptions, EntitySaveOptions, IMetadataProvider } from '@memberjunction/core';
 import { MJEntityPermissionEntity } from '@memberjunction/core-entities';
 import { HttpPost } from '@memberjunction/network-utils';
+import { ReconcileFieldPermissionsQuietly } from '@memberjunction/core-entities-server';
 import { ___codeGenAPIPort, ___codeGenAPISubmissionDelay, ___codeGenAPIURL } from '../config.js';
 
 /**
  * Server-side only class that extends the entity permissions object to watch for changes to entity permissions, build a queue of entities that have been changed, and then from time to time, submit
  * them to an API server that will execute the underlying permission changes at the database level.
- * 
+ *
+ * It is also the field-level-security lifecycle adapter for entity-permission changes. Snapshot
+ * initialization creates field-permission rows for the roles holding entity access AT THE TIME
+ * the flag is flipped; a role granted access afterwards has none, and on an enabled entity a
+ * field with no rows is denied — so that role would pass the entity gate and then see zero
+ * fields, which reads as a broken screen rather than a permissions gap. The reverse matters
+ * too: a role that loses entity access leaves rows that can no longer affect any decision.
+ *
+ * Both responsibilities live here because `ClassFactory` resolves ONE class per entity name.
+ * A second `@RegisterClass(BaseEntity, 'MJ: Entity Permissions')` in another package would not
+ * compose with this one — priority auto-increments by load order, so whichever loaded last
+ * would silently displace the other.
+ *
  * This class is within the memberjunction/server package because it is closely coupled to other aspects of what
  * happens in the server. That's why it is not in the core-entities-server package.
  */
@@ -88,19 +101,65 @@ export class MJEntityPermissionEntityServer extends MJEntityPermissionEntity {
     }
   }
 
-  override Save(options?: EntitySaveOptions): Promise<boolean> {
+  override async Save(options?: EntitySaveOptions): Promise<boolean> {
     // simply queue up the entity ID
     if (this.Dirty || options?.IgnoreDirtyState) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
 
-    return super.Save(options);
+    // Capture before the save — afterwards nothing is dirty and the dirty check reads false.
+    const affectsFieldSecurity = this.affectsFieldPermissionRows();
+
+    if (!(await super.Save(options))) return false;
+
+    if (affectsFieldSecurity) await this.reconcileFieldPermissions(this.EntityID);
+    return true;
   }
 
   override async Delete(options: EntityDeleteOptions): Promise<boolean> {
+    // Capture before the delete — afterwards this record's EntityID is gone.
+    const targetEntityID = this.EntityID;
+
     const success = await super.Delete(options);
 
     // simply queue up the entity ID if the delete worked
-    if (success) MJEntityPermissionEntityServer.AddToQueue(this.EntityID);
+    if (success) {
+      MJEntityPermissionEntityServer.AddToQueue(targetEntityID);
+      await this.reconcileFieldPermissions(targetEntityID);
+    }
 
     return success;
   }
+
+  /**
+   * Whether this save can change which field-permission rows should exist.
+   *
+   * Only the access flags and the role matter — the field-permission delta keys off a role's
+   * effective entity-level access, so an edit to an RLS filter changes nothing here. A new
+   * record always counts, since it may be the grant that brings a role into scope.
+   */
+  protected affectsFieldPermissionRows(): boolean {
+    if (!this.IsSaved) return true;
+
+    return ['Type', 'CanRead', 'CanUpdate', 'CanCreate', 'RoleID'].some(
+      (fieldName) => this.GetFieldByName(fieldName)?.Dirty === true
+    );
+  }
+
+  /**
+   * Reconciles the target entity's field-permission rows, when that entity has field security
+   * switched on. The flag check keeps this free for the overwhelming majority of permission
+   * edits, which are on entities that never opted in.
+   *
+   * Runs AFTER the permission write commits, and failures are logged rather than thrown: the
+   * save that triggered it has already succeeded, so reporting it as failed would be wrong.
+   * Missing rows fail closed until the next reconciliation.
+   */
+  protected async reconcileFieldPermissions(entityID: string): Promise<void> {
+    if (!entityID) return;
+
+    const provider = this.ProviderToUse as unknown as IMetadataProvider;
+    const entityInfo = provider?.Entities?.find((e) => UUIDsEqual(e.ID, entityID));
+    if (!entityInfo?.EnableFieldLevelSecurity) return;
+
+    await ReconcileFieldPermissionsQuietly(entityInfo, provider, this.ContextCurrentUser);
+  }
 }