@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/widgetGuestElevation.test.ts

@@ -16,6 +16,7 @@ import {
   ResolveWidgetGuestRunContext,
   ElevateUserPayload,
   ResolveScopedAnonymousRunUser,
+  ResolveRecordingStoreUser,
 } from '../realtimeWidget/widgetGuestElevation.js';
 import type { UserPayload } from '../types.js';
 
@@ -99,6 +100,49 @@ describe('widgetGuestElevation — ResolveScopedAnonymousRunUser (issue #3371)',
   });
 });
 
+describe('widgetGuestElevation — ResolveRecordingStoreUser (#5195: UI-role users lost every recording)', () => {
+  const systemUser = { ID: 'system-1', Email: 'system@system.org' } as UserInfo;
+
+  function userWith(flags: Partial<UserInfo>): UserInfo {
+    return { ID: 'user-1', Email: 'someone@example.com', ...flags } as UserInfo;
+  }
+
+  beforeEach(() => {
+    getSystemUserMock.mockReset();
+    getSystemUserMock.mockReturnValue(systemUser);
+  });
+
+  it('runs a signed-in owner’s recording store as the SYSTEM user (the stock UI role cannot create MJ: Files)', () => {
+    expect(ResolveRecordingStoreUser(userWith({ IsMagicLinkAnonymous: false }))).toBe(systemUser);
+  });
+
+  it('runs a scoped anonymous magic-link session as the SYSTEM user, exactly as before', () => {
+    const scopedAnon = userWith({ IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'res-1' } });
+    expect(ResolveRecordingStoreUser(scopedAnon)).toBe(systemUser);
+  });
+
+  it('keeps an UNSCOPED anonymous session on the caller, exactly as before', () => {
+    const unscoped = userWith({ IsMagicLinkAnonymous: true, MagicLinkScope: undefined });
+    expect(ResolveRecordingStoreUser(unscoped)).toBe(unscoped);
+  });
+
+  it('keeps a PUBLIC WEB-WIDGET guest on the caller (their RLS read filter depends on it)', () => {
+    const widgetGuest = userWith({
+      IsMagicLinkAnonymous: true,
+      MagicLinkScope: { ResourceID: 'res-1' },
+      WidgetGuestContext: { WidgetID: 'widget-1' },
+    });
+    expect(ResolveRecordingStoreUser(widgetGuest)).toBe(widgetGuest);
+    expect(getSystemUserMock).not.toHaveBeenCalled();
+  });
+
+  it('FAILS CLOSED to the caller when no system user is available', () => {
+    getSystemUserMock.mockReturnValue(undefined);
+    const named = userWith({ IsMagicLinkAnonymous: false });
+    expect(ResolveRecordingStoreUser(named)).toBe(named);
+  });
+});
+
 describe('widgetGuestElevation — elevateUserPayload', () => {
   it('swaps in the elevated principal while preserving the guest sessionId for PubSub routing', () => {
     const guestPayload = payloadWith({ IsMagicLinkAnonymous: true });

package/src/agentSessions/BridgeHostInstance.ts

@@ -0,0 +1,32 @@
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { AIBridgeEngine } from '@memberjunction/ai-bridge-server';
+import { GetCurrentHostInstance } from './HostInstance.js';
+
+/**
+ * Gives the realtime bridge engine (`AIBridgeEngine`) this MJAPI instance's identity, the one its agent-session rows
+ * carry: `hostname:port:pid:bootId` ({@link GetCurrentHostInstance}). The engine stamps it into the `HostInstanceID`
+ * of each `MJ: AI Agent Session Bridges` row it creates, and its orphan reconcile closes only the bridges an earlier
+ * boot of this instance left, never another MJAPI's (#5310). Without it the engine's fallback identity applies, which
+ * names this process alone, so the reconcile would never find what an earlier boot left.
+ *
+ * `Serve` calls it right after `SetHostInstancePort`, before anything can start a bridge: a server extension may start
+ * a scheduled meeting bridge before the server listens.
+ */
+export function BindBridgeEngineHostInstance(): void {
+    AIBridgeEngine.Instance.SetHostInstanceIdentity(GetCurrentHostInstance());
+}
+
+/**
+ * Starts the realtime bridge engine's orphan reconcile: now, then every 10 minutes, it closes the bridges an earlier
+ * boot of this instance left `Connecting` or `Connected` (reason `Janitor`) and finalizes their co-agent runs.
+ *
+ * `Serve` calls it once the server listens on its port, where it starts the session janitor. Holding the port is what
+ * makes another boot of this instance a process that has ended; before that, an MJAPI started on a port another MJAPI
+ * still serves would take that one's live bridges for its own orphans.
+ *
+ * @param provider The server's metadata provider, for the reads and writes.
+ * @param systemUser The user the writes run as.
+ */
+export function StartBridgeOrphanReconciliation(provider: IMetadataProvider, systemUser: UserInfo): void {
+    AIBridgeEngine.Instance.StartOrphanReconciliation(systemUser, provider);
+}

package/src/agentSessions/HostInstance.ts

@@ -1,53 +1,149 @@
 import { hostname } from 'os';
 import { randomUUID } from 'crypto';
+import { LogError } from '@memberjunction/core';
+
+/** What follows an instance's prefix in a `HostInstanceID`: a process id, then a boot id. */
+const PID_AND_BOOT_ID = /^\d+:[^:]+$/;
 
 /**
- * Stable, per-process identity for this server node, used to anchor
- * {@link import('@memberjunction/core-entities').MJAIAgentSessionEntity} rows to the
- * instance that currently owns their in-memory sockets.
+ * Identity of one MJAPI instance and of one boot of it. A boot stamps its id into the `HostInstanceID` of the
+ * `MJ: AI Agent Sessions` rows it owns, and of the `MJ: AI Agent Session Bridges` rows the realtime bridge engine
+ * creates for it (see `BindBridgeEngineHostInstance`), so that after a restart the instance can tell the rows it left
+ * behind from another server's live ones.
  *
- * The shape is `${hostname}:${pid}:${bootId}` where:
- * - `hostname` and `pid` locate the OS process,
- * - `bootId` is a UUID generated **once** at module load, so two different boots of the
- *   *same* host (a crash/redeploy that reuses pid, or a long-lived host that restarts the
- *   process) produce **distinct** identities.
+ * An instance is one MJAPI on one host, named by the host and the port it serves on. Two MJAPIs running at the same
+ * time on one host can't serve on the same port, so they are two instances; an MJAPI that restarts serves on its port
+ * again, so it is the same instance. Each boot adds its process id and a UUID made at load:
+ * `hostname:port:pid:bootId`.
  *
- * This last property is what lets {@link import('./SessionJanitor').SessionJanitor} tell a
- * live session owned by *this* boot apart from an orphan left by a *previous* boot of the
- * same host: only the latter has a `HostInstanceID` that starts with `${hostname}:` but
- * carries a different `bootId`.
+ * A row stamped by another boot of this instance was left by a process that has ended, since this boot holds the
+ * port. A row of another instance (another port on this host, or another host) may belong to a server that is still
+ * running.
  */
-const BOOT_ID = randomUUID();
+export class HostInstanceIdentity {
+    /** The OS host name. */
+    public readonly HostName: string;
+
+    /**
+     * What tells this instance apart from the other MJAPIs on the host: the port it serves on, or `pid-<pid>` for a
+     * process that has not set one (see {@link SetHostInstancePort}).
+     */
+    public readonly InstanceKey: string;
+
+    /** The OS process id of this boot. */
+    public readonly ProcessID: number;
+
+    /** A UUID made once per boot, so two boots never share an id, even when the OS reuses a process id. */
+    public readonly BootID: string;
+
+    /**
+     * @param hostName The OS host name.
+     * @param instanceKey The port the instance serves on, or `pid-<pid>` for a process that serves none.
+     * @param processID The OS process id of this boot.
+     * @param bootID A UUID made once per boot.
+     */
+    constructor(hostName: string, instanceKey: string, processID: number, bootID: string) {
+        this.HostName = hostName;
+        this.InstanceKey = instanceKey;
+        this.ProcessID = processID;
+        this.BootID = bootID;
+    }
+
+    /** The id this boot stamps into the rows it owns: `hostname:port:pid:bootId`. */
+    public GetHostInstanceID(): string {
+        return `${this.GetInstancePrefix()}${this.ProcessID}:${this.BootID}`;
+    }
 
-/** Resolved host name captured once at load (cheap; avoids repeated syscalls). */
+    /** The prefix every boot of this instance shares and no other instance has: `hostname:port:`. */
+    public GetInstancePrefix(): string {
+        return `${this.HostName}:${this.InstanceKey}:`;
+    }
+
+    /**
+     * Whether a `HostInstanceID` was stamped by another boot of this instance: this instance's prefix, then a process
+     * id and a boot id, and not this boot's own id. That boot has ended, since this one holds the instance's port.
+     *
+     * False for this boot's id, for another instance's (another port on this host, or another host), for the format
+     * used before the port was added (`hostname:pid:bootId`), and for null. The match is exact: unlike a SQL `LIKE`,
+     * a `_` in a host name matches only `_`.
+     *
+     * @param hostInstanceID A row's `HostInstanceID`.
+     */
+    public IsPriorBoot(hostInstanceID: string | null | undefined): boolean {
+        if (!hostInstanceID || hostInstanceID === this.GetHostInstanceID()) {
+            return false;
+        }
+        const prefix = this.GetInstancePrefix();
+        return hostInstanceID.startsWith(prefix) && PID_AND_BOOT_ID.test(hostInstanceID.slice(prefix.length));
+    }
+}
+
+/** The OS host name, read once at load. */
 const HOST_NAME = hostname();
 
-/** The full, immutable host-instance identity string for this process. */
-const HOST_INSTANCE_ID = `${HOST_NAME}:${process.pid}:${BOOT_ID}`;
+/** This boot's id, made once at load. */
+const BOOT_ID = randomUUID();
+
+/** The instance key until {@link SetHostInstancePort} sets the port: this process alone. */
+let instanceKey = `pid-${process.pid}`;
+
+/** This process's identity, made on first use and fixed from then on. */
+let currentInstance: HostInstanceIdentity | null = null;
 
 /**
- * Returns this process's stable host-instance identity (`hostname:pid:bootId`).
- * Stamped into `AIAgentSession.HostInstanceID` at session create and read back by the
- * janitor for own-host orphan recovery.
+ * Names this process's MJAPI instance by the port it serves on. `Serve` calls it first, before anything stamps a row,
+ * so every `HostInstanceID` the server writes carries its port.
+ *
+ * Until it is called the instance is the process alone (`pid-<pid>`), and its startup recovery closes no other
+ * process's sessions. The identity is fixed once read: a later call with another port is logged and ignored, so the
+ * rows already stamped keep matching this process.
+ *
+ * @param port The port this MJAPI serves on (`graphqlPort`).
+ */
+export function SetHostInstancePort(port: number): void {
+    const key = String(port);
+    if (currentInstance && currentInstance.InstanceKey !== key) {
+        LogError(
+            `[HostInstance] Port ${key} was set after this process's identity (${currentInstance.GetHostInstanceID()}) ` +
+                `was in use; keeping that identity so the rows it stamped still match this process`,
+        );
+        return;
+    }
+    instanceKey = key;
+}
+
+/**
+ * This process's identity: the one place MJServer reads it, to stamp the rows it owns and to recover them after a
+ * restart. Made on first call from the host name, the port {@link SetHostInstancePort} set (or `pid-<pid>`), the
+ * process id and this boot's id.
+ */
+export function GetCurrentHostInstance(): HostInstanceIdentity {
+    if (!currentInstance) {
+        currentInstance = new HostInstanceIdentity(HOST_NAME, instanceKey, process.pid, BOOT_ID);
+    }
+    return currentInstance;
+}
+
+/**
+ * Returns this boot's id (`hostname:port:pid:bootId`), stamped into `AIAgentSession.HostInstanceID` at session
+ * create. Same as `GetCurrentHostInstance().GetHostInstanceID()`.
  */
 export function GetHostInstanceID(): string {
-    return HOST_INSTANCE_ID;
+    return GetCurrentHostInstance().GetHostInstanceID();
 }
 
 /**
- * Returns the host-name prefix (`hostname:`) used to match *any* session previously hosted
- * by this OS host, regardless of which boot created it. The janitor uses this to find rows
- * that belong to this host but to a *different* (older) boot — i.e. crash/redeploy orphans.
+ * Returns `hostname:`, the prefix of every `HostInstanceID` stamped on this host by any MJAPI.
+ *
+ * @deprecated Not an ownership test: several MJAPIs can run on one host. Match this instance's rows with
+ * {@link HostInstanceIdentity.GetInstancePrefix} and {@link HostInstanceIdentity.IsPriorBoot} on
+ * {@link GetCurrentHostInstance}.
  */
 export function GetHostNamePrefix(): string {
     return `${HOST_NAME}:`;
 }
 
-/**
- * Returns the UUID generated once at process start. Exposed primarily for diagnostics and
- * tests; the janitor compares against the full {@link GetHostInstanceID} rather than this
- * value directly.
- */
+/** Returns the UUID made once at process start. For diagnostics and tests. */
 export function GetBootID(): string {
     return BOOT_ID;
 }

package/src/agentSessions/ReturningVisitorRecap.ts

@@ -23,6 +23,7 @@
  */
 
 import { RunView, UserInfo, LogError, LogStatus, type IMetadataProvider } from '@memberjunction/core';
+import { ConversationEngine } from '@memberjunction/core-entities';
 import type { MJConversationEntity, MJConversationDetailEntity, MJAIAgentNoteEntity } from '@memberjunction/core-entities';
 import { AIEngine } from '@memberjunction/aiengine';
 import { AIPromptParams } from '@memberjunction/ai-core-plus';
@@ -152,14 +153,17 @@ async function recapAlreadyExists(conversationId: string, contextUser: UserInfo)
   return result.Success && (result.Results?.length ?? 0) > 0;
 }
 
-/** Builds a compact transcript string from the conversation's most-recent detail turns. */
+/**
+ * Builds a compact transcript string from the most recent detail turns in Main that no rerun replaced
+ * (a returning visitor's widget conversation has no forks). Returns undefined when there are none.
+ */
 async function loadTranscript(conversationId: string, contextUser: UserInfo): Promise<string | undefined> {
   const rv = new RunView();
   const result = await rv.RunView<MJConversationDetailEntity>(
     {
       EntityName: CONVERSATION_DETAILS_ENTITY,
-      ExtraFilter: `ConversationID = '${conversationId}'`,
-      OrderBy: '__mj_CreatedAt DESC',
+      ExtraFilter: ConversationEngine.LiveRowsFilter(ConversationEngine.ScopeFilter(ConversationEngine.TrunkScope(conversationId))),
+      OrderBy: 'Sequence DESC',
       MaxRows: MAX_TRANSCRIPT_TURNS,
       ResultType: 'entity_object',
     },