@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/src/auth/magicLink/magicLinkCore.ts

@@ -13,25 +13,40 @@ import type { MagicLinkJWTClaims, MagicLinkScopeEntry, RedeemErrorCode } from '.
 export const MAGIC_LINK_TOKEN_PREFIX = 'mj_ml_';
 
 /** Generates a cryptographically random raw magic-link token. */
-export function generateRawToken(): string {
+export function GenerateRawToken(): string {
   return MAGIC_LINK_TOKEN_PREFIX + randomBytes(32).toString('hex');
 }
 
+/** @deprecated Use {@link GenerateRawToken}. */
+export function generateRawToken(): string {
+  return GenerateRawToken();
+}
+
 /** Generates an opaque per-session id (anonymous-session forensics correlation). */
-export function generateSessionId(): string {
+export function GenerateSessionId(): string {
   return randomBytes(16).toString('base64url');
 }
 
+/** @deprecated Use {@link GenerateSessionId}. */
+export function generateSessionId(): string {
+  return GenerateSessionId();
+}
+
 /**
  * SHA-256 hash of a raw token, base64url-encoded — only the hash is ever
  * persisted. base64url (43 chars) is shorter than hex (64 chars), URL-safe, and
  * carries the full 256 bits. Both write (CreateInvite) and read (RedeemInvite)
  * paths call this, so the encoding stays internally consistent.
  */
-export function hashToken(rawToken: string): string {
+export function HashToken(rawToken: string): string {
   return createHash('sha256').update(rawToken).digest('base64url');
 }
 
+/** @deprecated Use {@link HashToken}. */
+export function hashToken(rawToken: string): string {
+  return HashToken(rawToken);
+}
+
 /** Minimal shape of an invite needed for redemption eligibility. */
 export interface InviteEvaluationInput {
   Status: string;
@@ -54,7 +69,7 @@ function normalizeName(name: string): string {
  * (including an external user already holding a restricted magic-link session)
  * from minting invites.
  */
-export function canIssueInvites(
+export function CanIssueInvites(
   userType: string | null | undefined,
   userRoleNames: readonly string[],
   issuerRoleNames: readonly string[],
@@ -69,13 +84,22 @@ export function canIssueInvites(
   return userRoleNames.some((r) => allowed.has(normalizeName(r)));
 }
 
+/** @deprecated Use {@link CanIssueInvites}. */
+export function canIssueInvites(
+  userType: string | null | undefined,
+  userRoleNames: readonly string[],
+  issuerRoleNames: readonly string[],
+): boolean {
+  return CanIssueInvites(userType, userRoleNames, issuerRoleNames);
+}
+
 /**
  * Pure check for WHAT role an invite may grant. The restricted role is always
  * grantable; any other role must be explicitly listed in `grantableRoleNames`.
  * Applied to every caller (Owners included) so a privileged role can never be
  * attached to an external magic-link user unless the deployment opts in.
  */
-export function isRoleGrantable(
+export function IsRoleGrantable(
   roleName: string | null | undefined,
   restrictedRoleName: string,
   grantableRoleNames: readonly string[],
@@ -88,8 +112,17 @@ export function isRoleGrantable(
   return allowed.has(target);
 }
 
+/** @deprecated Use {@link IsRoleGrantable}. */
+export function isRoleGrantable(
+  roleName: string | null | undefined,
+  restrictedRoleName: string,
+  grantableRoleNames: readonly string[],
+): boolean {
+  return IsRoleGrantable(roleName, restrictedRoleName, grantableRoleNames);
+}
+
 /** Pure redemption-eligibility check. Returns ok + an error code when not. */
-export function evaluateInvite(invite: InviteEvaluationInput, nowMs: number): { ok: boolean; errorCode?: RedeemErrorCode } {
+export function EvaluateInvite(invite: InviteEvaluationInput, nowMs: number): { ok: boolean; errorCode?: RedeemErrorCode } {
   if (invite.Status === 'Revoked') {
     return { ok: false, errorCode: 'revoked' };
   }
@@ -106,75 +139,43 @@ export function evaluateInvite(invite: InviteEvaluationInput, nowMs: number): {
   return { ok: true };
 }
 
-/** SQL dialect for {@link buildConsumeInviteSQL}. */
-export type ConsumeInviteDialect = 'sqlserver' | 'postgresql';
+/** @deprecated Use {@link EvaluateInvite}. */
+export function evaluateInvite(invite: InviteEvaluationInput, nowMs: number): { ok: boolean; errorCode?: RedeemErrorCode } {
+  return EvaluateInvite(invite, nowMs);
+}
 
-/** SQL Server table identifier — bracket-quoted `[schema].[table]` (word chars only). */
-const QUALIFIED_TABLE_PATTERN = /^\[\w+\]\.\[\w+\]$/;
 /** PostgreSQL table identifier — `schema.table` (word chars only); auto-quoted downstream. */
 const QUALIFIED_TABLE_PATTERN_PG = /^\w+\.\w+$/;
 
 /**
- * Builds the atomic compare-and-swap UPDATE that consumes one use of an invite,
- * in the given SQL dialect.
- *
- * The WHERE clause re-checks every eligibility condition at the DB level, so the
- * increment and the guard are a single atomic operation: concurrent redemptions
- * of a single-use link race on the row and exactly one matches. This is what
- * actually enforces single-use — the JS-side `evaluateInvite` is only a friendly
- * pre-check. The matched row's ID is returned to the caller (via `OUTPUT` on SQL
- * Server, `RETURNING` on PostgreSQL) so it can detect a win (exactly one row).
+ * Builds the PostgreSQL atomic compare-and-swap UPDATE that consumes one use of an invite.
  *
- * The invite ID MUST be bound as a parameter by the caller (`@p0` on SQL Server,
- * `$1` on PostgreSQL) — it is never interpolated into the string, so this builder
- * is injection-safe regardless of the ID's contents.
+ * PostgreSQL only. SQL Server consumes through the granted `spConsumeMagicLinkInvite` procedure,
+ * because its runtime roles are never granted table DML (#4753). PostgreSQL needs neither: its
+ * runtime roles hold INSERT/UPDATE/DELETE on every `__mj` table
+ * (V202605040300__v5.33.x__Unblock_PostgreSQL_End_To_End.pg-only.sql), and no PG counterpart of
+ * the procedure exists — the release-time converter leaves `CREATE PROCEDURE` unhandled.
  *
- * **SQL Server** — `OUTPUT` goes `INTO` a table variable (not a bare OUTPUT):
- * SQL Server forbids a bare OUTPUT clause on a table that has enabled triggers,
- * and CodeGen adds an `__mj_UpdatedAt` trigger to every MJ table. The trailing
- * SELECT returns the matched row(s) regardless of trigger behavior.
+ * The WHERE re-checks every eligibility condition (the same predicate as the procedure), so the
+ * increment and the guard are one atomic statement: concurrent redemptions of a single-use link
+ * serialize on the row lock and exactly one matches. `RETURNING ID` yields the row iff the guard
+ * matched. The invite ID MUST be bound by the caller as `$1` — it is never interpolated.
  *
- * **PostgreSQL** — the `UPDATE … WHERE` guard IS itself the atomic single-use
- * gate: the row is locked for the UPDATE's duration, so concurrent redemptions
- * serialize and only the first matching `Status='Active' AND UseCount < MaxUses`
- * wins; `RETURNING` yields the row iff the guard matched (equivalent to the SS
- * `OUTPUT`-into-table win-detect). PascalCase identifiers are auto-quoted by
- * `PostgreSQLDataProvider.ExecuteSQL`, so the table is passed unquoted (`schema.table`).
- *
- * `qualifiedTable` is asserted to match the dialect's whitelist pattern before
- * interpolation. The caller derives it from `EntityInfo` (never user input), so
- * this is defense-in-depth: even a future careless caller cannot turn this into
- * an injection vector — a non-conforming table throws.
- *
- * @param qualifiedTable  `[schema].[table]` (sqlserver) or `schema.table` (postgresql) for MagicLinkInvite
- * @param dialect         target SQL dialect (defaults to `'sqlserver'`)
+ * `qualifiedTable` is `schema.table` unquoted (PostgreSQLDataProvider.ExecuteSQL auto-quotes the
+ * PascalCase identifiers) and is asserted against a whitelist before interpolation — the caller
+ * never passes user input, so this is defense-in-depth.
  */
-export function buildConsumeInviteSQL(qualifiedTable: string, dialect: ConsumeInviteDialect = 'sqlserver'): string {
-  if (dialect === 'postgresql') {
-    if (!QUALIFIED_TABLE_PATTERN_PG.test(qualifiedTable)) {
-      throw new Error(`buildConsumeInviteSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
-    }
-    return (
-      `UPDATE ${qualifiedTable} ` +
-      `SET UseCount = UseCount + 1, ` +
-      `ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc')), ` +
-      `Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END ` +
-      `WHERE ID = $1 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > (now() AT TIME ZONE 'utc') ` +
-      `RETURNING ID;`
-    );
-  }
-  if (!QUALIFIED_TABLE_PATTERN.test(qualifiedTable)) {
-    throw new Error(`buildConsumeInviteSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
+export function BuildConsumeInvitePostgresSQL(qualifiedTable: string): string {
+  if (!QUALIFIED_TABLE_PATTERN_PG.test(qualifiedTable)) {
+    throw new Error(`BuildConsumeInvitePostgresSQL: refusing to build SQL for non-whitelisted table identifier '${qualifiedTable}'.`);
   }
   return (
-    `DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER); ` +
     `UPDATE ${qualifiedTable} ` +
     `SET UseCount = UseCount + 1, ` +
-    `ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME()), ` +
+    `ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc')), ` +
     `Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END ` +
-    `OUTPUT INSERTED.ID INTO @consumed ` +
-    `WHERE ID = @p0 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > SYSUTCDATETIME(); ` +
-    `SELECT ID FROM @consumed;`
+    `WHERE ID = $1 AND Status = 'Active' AND UseCount < MaxUses AND ExpiresAt > (now() AT TIME ZONE 'utc') ` +
+    `RETURNING ID;`
   );
 }
 
@@ -184,7 +185,7 @@ export function buildConsumeInviteSQL(qualifiedTable: string, dialect: ConsumeIn
  * of scopes across multiple redeemed links — carried in the re-minted JWT, never as
  * roles on a shared user, so anonymous sessions can't accrete into a superuser.
  */
-export function unionScopes(prior: readonly MagicLinkScopeEntry[] | undefined, next: MagicLinkScopeEntry): MagicLinkScopeEntry[] {
+export function UnionScopes(prior: readonly MagicLinkScopeEntry[] | undefined, next: MagicLinkScopeEntry): MagicLinkScopeEntry[] {
   const result = [...(prior ?? [])];
   if (!result.some((s) => s.inviteId === next.inviteId)) {
     result.push(next);
@@ -192,8 +193,13 @@ export function unionScopes(prior: readonly MagicLinkScopeEntry[] | undefined, n
   return result;
 }
 
+/** @deprecated Use {@link UnionScopes}. */
+export function unionScopes(prior: readonly MagicLinkScopeEntry[] | undefined, next: MagicLinkScopeEntry): MagicLinkScopeEntry[] {
+  return UnionScopes(prior, next);
+}
+
 /** Builds the session-token claims (pure). */
-export function buildSessionClaims(args: {
+export function BuildSessionClaims(args: {
   issuer: string;
   audience: string;
   inviteId: string;
@@ -236,9 +242,35 @@ export function buildSessionClaims(args: {
     mj_app_id: args.applicationId,
     mj_role: args.roleName,
     mj_invited_by: args.invitedByUserId,
-    mj_scopes: unionScopes(args.priorScopes, scopeEntry),
+    mj_scopes: UnionScopes(args.priorScopes, scopeEntry),
     mj_anon: args.anonymous ? true : undefined,
     mj_sid: args.sessionId,
     mj_magic_link: true,
   };
 }
+
+/** @deprecated Use {@link BuildSessionClaims}. */
+export function buildSessionClaims(args: {
+  issuer: string;
+  audience: string;
+  inviteId: string;
+  email: string;
+  firstName?: string;
+  lastName?: string;
+  applicationId: string;
+  roleName: string;
+  invitedByUserId?: string;
+  /** True for anonymous sessions — the server enforces scope from mj_scopes, not roles. */
+  anonymous?: boolean;
+  /** Opaque per-session id (anonymous forensics correlation). */
+  sessionId?: string;
+  /** Prior session's scope union to carry forward (multi-link anonymous sessions). */
+  priorScopes?: readonly MagicLinkScopeEntry[];
+  /** Resource-share/embed scope for this link's entry. */
+  resourceType?: string;
+  resourceId?: string;
+  nowSeconds: number;
+  ttlSeconds: number;
+}): MagicLinkJWTClaims {
+  return BuildSessionClaims(args);
+}

package/src/auth/magicLink/redeemLanding.ts

@@ -5,7 +5,7 @@
  */
 
 /** Minimal HTML-escape for safe interpolation into attribute/text content. */
-export function escapeHtml(s: string): string {
+export function EscapeHtml(s: string): string {
   return s
     .replace(/&/g, '&')
     .replace(/</g, '&lt;')
@@ -14,6 +14,11 @@ export function escapeHtml(s: string): string {
     .replace(/'/g, '&#39;');
 }
 
+/** @deprecated Use {@link EscapeHtml}. */
+export function escapeHtml(s: string): string {
+  return EscapeHtml(s);
+}
+
 /**
  * Builds the redemption landing page served by `GET /magic-link/redeem`.
  *
@@ -27,9 +32,9 @@ export function escapeHtml(s: string): string {
  * @param token       the raw magic-link token (embedded in a hidden field)
  * @param actionPath  the same-origin path the form POSTs to (e.g. `/magic-link/redeem`)
  */
-export function buildRedeemLandingHtml(token: string, actionPath: string): string {
-  const t = escapeHtml(token);
-  const action = escapeHtml(actionPath);
+export function BuildRedeemLandingHtml(token: string, actionPath: string): string {
+  const t = EscapeHtml(token);
+  const action = EscapeHtml(actionPath);
   // Hardcoded colors are intentional here — this is a standalone server-rendered
   // HTML response, not Angular component CSS, so the design-token rule doesn't apply.
   return `<!doctype html>
@@ -60,3 +65,8 @@ export function buildRedeemLandingHtml(token: string, actionPath: string): strin
 </body>
 </html>`;
 }
+
+/** @deprecated Use {@link BuildRedeemLandingHtml}. */
+export function buildRedeemLandingHtml(token: string, actionPath: string): string {
+  return BuildRedeemLandingHtml(token, actionPath);
+}

package/src/auth/magicLink/types.ts

@@ -10,14 +10,14 @@
  */
 export interface MagicLinkScopeEntry {
   /** The invite that granted this scope entry. */
-  inviteId: string;
+  inviteId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The Application this entry grants access to. */
-  appId: string;
+  appId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The role name this entry carries (email/app-session links). */
-  role?: string;
+  role?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
   /** For resource-share/embed links: the shared resource's type + id. */
-  resourceType?: string;
-  resourceId?: string;
+  resourceType?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  resourceId?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /**
@@ -27,25 +27,25 @@ export interface MagicLinkScopeEntry {
  */
 export interface MagicLinkJWTClaims {
   /** Issuer — MJ's public URL; resolves to the registered `magic-link` auth provider. */
-  iss: string;
+  iss: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Audience — the configured magic-link audience (default `mj-magic-link`). */
-  aud: string;
+  aud: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Subject — `magic-link|<inviteId>`. */
-  sub: string;
+  sub: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Issued-at (epoch seconds). */
-  iat: number;
+  iat: number;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Expiry (epoch seconds). */
-  exp: number;
-  email: string;
-  given_name?: string;
-  family_name?: string;
-  name?: string;
+  exp: number;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  email: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  given_name?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
+  family_name?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
+  name?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The single Application this session is scoped to. */
-  mj_app_id: string;
+  mj_app_id: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** The restricted role name assigned to this user (informational; enforcement is server-side via the role's entity permissions). */
-  mj_role: string;
+  mj_role: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** UserID of the internal user who issued the invite (attribution/audit). Absent on links whose inviter could not be resolved. */
-  mj_invited_by?: string;
+  mj_invited_by?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Per-session scope UNION (Phase 4+). Each entry is one redeemed link's grant.
    * The server enforces anonymous sessions against THIS set (not the user's role
@@ -53,81 +53,81 @@ export interface MagicLinkJWTClaims {
    * different scopes without accretion. For email sessions the singular mj_app_id/
    * mj_role remain authoritative; this carries the union when links are stacked.
    */
-  mj_scopes?: MagicLinkScopeEntry[];
+  mj_scopes?: MagicLinkScopeEntry[];  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** True when this session resolves to the shared Anonymous principal (claims-based enforcement). */
-  mj_anon?: boolean;
+  mj_anon?: boolean;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Opaque per-session id — correlates one anonymous session's activity across audit rows without a real user. */
-  mj_sid?: string;
+  mj_sid?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Public web widget instance id (additive — set only for widget guest sessions
    * minted by WidgetSessionService). Binds the synthesized guest principal to one
    * widget instance so its pinned agent / guest role can be locked down. Absent on
    * ordinary magic-link sessions.
    */
-  mj_widget_id?: string;
+  mj_widget_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Host-asserted visitor email for a widget `host-identity` session (additive). The
    * authoritative `email`/`sub` still resolve the constrained shared Anonymous principal;
    * this carries WHO the host says the visitor is, for the agent to look up their account —
    * without granting that account's permissions. Absent on anonymous/ordinary sessions.
    */
-  mj_host_email?: string;
+  mj_host_email?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Returning-visitor anchor for a widget guest session (additive, RV1). Carried so the VOICE path —
    * whose conversation is created server-side — can stamp the same Conversation.VisitorKey the text
    * path stamps client-side. Present only when the widget remembers returning visitors.
    */
-  mj_visitor_key?: string;
+  mj_visitor_key?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** The prior conversation this visit chains from (RV2), for the voice path to stamp Conversation.LastConversationID. */
-  mj_last_conversation_id?: string;
+  mj_last_conversation_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Resolved polymorphic identity entity id (RV4), for the voice path to stamp the existing Conversation.LinkedEntityID / AIAgentSession.LinkedEntityID. */
-  mj_linked_entity_id?: string;
+  mj_linked_entity_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Resolved polymorphic identity record id (RV4), for the voice path to stamp the existing Conversation.LinkedRecordID / AIAgentSession.LinkedRecordID. */
-  mj_linked_record_id?: string;
+  mj_linked_record_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Marks the session as magic-link so the Explorer can confine the UI. */
-  mj_magic_link: true;
+  mj_magic_link: true;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
 }
 
 /** Parameters for creating a magic-link invite (POST /magic-link/create). */
 export interface CreateMagicLinkInviteParams {
   /** Recipient email — becomes the provisioned user's email. */
-  email: string;
+  email: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The Application the invite grants access to. */
-  applicationId: string;
+  ApplicationId: string;
   /** Restricted role to assign. Defaults to the configured `restrictedRoleName`. */
-  roleId?: string;
+  RoleId?: string;
   /** Hours until the link expires. Defaults to config `defaultExpiresInHours`. */
-  expiresInHours?: number;
+  ExpiresInHours?: number;
   /** Maximum redemptions. Defaults to 1 (single-use). */
-  maxUses?: number;
+  MaxUses?: number;
   /** Optional given/family name to seed the provisioned user. */
-  firstName?: string;
-  lastName?: string;
+  firstName?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  lastName?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Result of creating an invite. */
 export interface CreateMagicLinkInviteResult {
-  success: boolean;
-  inviteId?: string;
+  success: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  inviteId?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Full redemption URL to share. */
-  redemptionUrl?: string;
+  redemptionUrl?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /**
    * The raw token, returned ONLY when no email provider is configured (so the
    * caller can deliver the link out of band). Never returned once email send
    * succeeds, and never persisted.
    */
-  rawToken?: string;
+  rawToken?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Whether the invite email was dispatched. */
-  emailSent?: boolean;
+  emailSent?: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** ISO expiry timestamp. */
-  expiresAt?: string;
-  error?: string;
+  expiresAt?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  error?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /**
    * Set when the request was rejected for authorization reasons:
    * `forbidden` — caller may not issue invites; `invalid_role` — the requested
    * role is not grantable via magic-link. Drives the HTTP status in the router.
    */
-  errorCode?: 'forbidden' | 'invalid_role';
+  errorCode?: 'forbidden' | 'invalid_role';  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
 }
 
 /** Why a redemption failed. */
@@ -139,25 +139,25 @@ export type RedeemErrorCode = 'not_found' | 'expired' | 'consumed' | 'revoked' |
  * all fields optional because the API/JSON flow may omit them.
  */
 export interface RedeemAuditContext {
-  ipAddress?: string;
-  userAgent?: string;
-  origin?: string;
+  ipAddress?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  userAgent?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  origin?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Result of redeeming an invite. */
 export interface RedeemMagicLinkResult {
-  success: boolean;
+  success: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The minted session JWT (RS256). */
-  token?: string;
+  token?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** ISO expiry of the session token. */
-  expiresAt?: string;
+  expiresAt?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application the session is scoped to. */
-  applicationId?: string;
+  applicationId?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application's display name (used to deep-link the browser into that app). */
-  applicationName?: string;
+  applicationName?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application's URL path slug (preferred for deep-linking; falls back to name). */
-  applicationPath?: string;
-  email?: string;
-  error?: string;
-  errorCode?: RedeemErrorCode;
+  applicationPath?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  email?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  error?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  errorCode?: RedeemErrorCode;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
 }

package/src/auth/newUsers.ts

@@ -5,7 +5,7 @@ import { configInfo } from "../config.js";
 import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 
 export class NewUserBase {
-    public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {
+    public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {  // case-violation-ok-legacy-back-compat: a subclass overrides this; a stub preserves CALLING the old name but not OVERRIDING it
         try {
             const contextUser: UserInfo | null = ResolveConfiguredPrincipal(
                 configInfo?.userHandling?.contextUserForNewUserCreation,

package/src/auth/principals.ts

@@ -116,7 +116,7 @@ function lowestActiveById<T extends ResolvablePrincipal>(matches: readonly T[]):
  * @param users      the candidate pool, normally `UserCache.Users`
  * @param systemUserId the deployment's system user ID (`UserCache.Instance.SYSTEM_USER_ID`)
  */
-export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
+export function ResolvePrincipalFrom<T extends ResolvablePrincipal>(
     candidate: string | undefined,
     users: readonly T[],
     systemUserId: string,
@@ -156,6 +156,15 @@ export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
     };
 }
 
+/** @deprecated Use {@link ResolvePrincipalFrom}. */
+export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
+    candidate: string | undefined,
+    users: readonly T[],
+    systemUserId: string,
+): PrincipalResolution<T> {
+    return ResolvePrincipalFrom(candidate, users, systemUserId);
+}
+
 /**
  * Why a configured candidate yielded nothing. The two causes need opposite fixes, so the message
  * has to tell them apart: "no such user" is a typo or the wrong column, while "matched, but
@@ -230,7 +239,7 @@ export function ReportedMisconfigurationCount(): number {
  *          handle null rather than assume a principal is always available
  */
 export function ResolveConfiguredPrincipal(candidate: string | undefined, purpose: string): UserInfo | null {
-    const resolution = resolvePrincipalFrom(candidate, UserCache.Instance.Users, UserCache.Instance.SYSTEM_USER_ID);
+    const resolution = ResolvePrincipalFrom(candidate, UserCache.Instance.Users, UserCache.Instance.SYSTEM_USER_ID);
 
     if (resolution.warning) {
         const key = `${purpose} :: ${candidate ?? ''}`;

package/src/cache.ts

@@ -2,9 +2,12 @@ import { LRUCache } from 'lru-cache';
 
 const oneHourMs = 60 * 60 * 1000;
 
-export const authCache = new LRUCache({
+export const AuthCache = new LRUCache({
   max: 50000,
   ttl: oneHourMs,
   ttlAutopurge: false,
 });
 
+/** @deprecated Use {@link AuthCache}. */
+export const authCache = AuthCache;
+

package/src/config.ts

@@ -230,6 +230,29 @@ const cacheSettingsSchema = z.object({
   evictionSweepIntervalSeconds: z.number().optional().default(300),
   /** Enable verbose cache logging (hits, misses, evictions). Default: false. */
   verboseLogging: z.boolean().optional().default(false),
+  /**
+   * Entity names whose FULL ROW may ride along with a cache-invalidation broadcast.
+   *
+   * The cache-invalidation subscription is delivered to EVERY connected client with no per-user
+   * filter (see CacheInvalidationResolver), so any row named here is disclosed to every signed-in
+   * session, whatever row-level security or tenant scoping would otherwise apply to reading it.
+   *
+   * Defaults to `[]`: invalidation still carries the entity name and primary key, which is all a
+   * client needs to evict, and the client re-fetches through the normal read path where access
+   * control applies. Listing an entity re-enables the apply-in-place optimisation for it — correct
+   * only for reference data every signed-in user is allowed to read.
+   *
+   * What the re-fetch costs depends on the consumer. `ConversationEngine` re-reads the ONE record
+   * by primary key. `BaseEngine` (every engine subclass with `AutoRefresh`, the default) applies a
+   * remote save in place only when the row is present, so without it a remote save falls through to
+   * a full reload of each matching config — a `RunView` of that entity, not a keyed read. Remote
+   * deletes still apply in place from the primary key. Engine-cached reference entities that every
+   * signed-in user may read are the ones worth listing here.
+   *
+   * `['*']` opts every entity in, restoring the previous behaviour. Only safe on a deployment where
+   * every signed-in user may read every row of every entity.
+   */
+  recordDataBroadcastEntities: z.array(z.string()).optional().default([]),
 });
 
 const loggingSettingsSchema = z.object({
@@ -812,9 +835,14 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
  * startup summary `Config` line. Declared before `configInfo` so the assignment
  * inside `loadConfig()` (invoked below) is not in its temporal dead zone.
  */
-export let configFilePath: string | undefined;
+export let ConfigFilePath: string | undefined;
 
-export const configInfo: ConfigInfo = loadConfig();
+export {
+  /** @deprecated Use {@link ConfigFilePath} instead. */
+  ConfigFilePath as configFilePath,
+};
+
+export const configInfo: ConfigInfo = LoadConfig();  // case-violation-ok-legacy-back-compat: the PascalCase name is already taken in this scope
 
 export const {
   dbUsername,
@@ -841,7 +869,7 @@ export const {
   restApiOptions: RESTApiOptions,
 } = configInfo;
 
-export function loadConfig() {
+export function LoadConfig() {
   const configSearchResult = explorer.search(process.cwd());
 
   // Start with DEFAULT_SERVER_CONFIG as base
@@ -851,7 +879,7 @@ export function loadConfig() {
   if (configSearchResult && !configSearchResult.isEmpty) {
     // Resolved config-file path. Surfaced in the startup summary `Config` line at standard
     // level (see StartupLogger). Demoted to verbose-only here to avoid a duplicate inline line.
-    configFilePath = configSearchResult.filepath;
+    ConfigFilePath = configSearchResult.filepath;
     LogStatusEx({ message: `Config file found at ${configSearchResult.filepath}`, verboseOnly: true });
 
     // Merge user config with defaults (user config takes precedence)
@@ -868,3 +896,8 @@ export function loadConfig() {
   }
   return configParsing.data;
 }
+
+/** @deprecated Use {@link LoadConfig}. */
+export function loadConfig() {
+  return LoadConfig();
+}