@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.5

package/src/__tests__/serverExtensionHostOverlay.test.ts

@@ -0,0 +1,66 @@
+/**
+ * A host mj.config.cjs serverExtensions[] entry may be a partial OVERLAY of an extension an Open App
+ * package publishes: only DriverClass is required. The schema used to require RootPath and default
+ * Enabled to true, so `{ DriverClass, OwnsCORS: false }` failed config parsing at startup, and an
+ * overlay that omitted Enabled re-enabled an extension its package ships disabled. Completeness is
+ * checked after the merge instead.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// config.ts evaluates `configInfo = LoadConfig()` at module load, and it rejects a configuration
+// carrying no database credentials. Stubbing only the cosmiconfig search lets the module import so the
+// REAL ServerExtensionSchema is under test (same pattern as newUserRolesDefault.test.ts).
+vi.mock('cosmiconfig', () => ({
+    cosmiconfigSync: () => ({
+        search: () => ({
+            filepath: '/test/mj.config.cjs',
+            isEmpty: false,
+            config: { dbUsername: 'test-user', dbPassword: 'test-password', dbDatabase: 'test-db' },
+        }),
+    }),
+}));
+
+import { MergeServerExtensionConfigs, PrepareServerExtensionConfigs } from '@memberjunction/server-extensions-core';
+import type { ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import { ServerExtensionSchema } from '../config.js';
+
+const published: ServerExtensionConfig = {
+    Enabled: true,
+    DriverClass: 'BallotEdge',
+    RootPath: '/vote',
+    OwnsCORS: true,
+    Settings: { RateLimitMax: 20 },
+};
+
+describe('host serverExtensions[] overlay schema', () => {
+    it('accepts an overlay that names only DriverClass and the fields it overrides', () => {
+        const parsed = ServerExtensionSchema.safeParse({ DriverClass: 'BallotEdge', OwnsCORS: false });
+        expect(parsed.success).toBe(true);
+        expect(parsed.success && parsed.data.RootPath).toBeUndefined();
+        expect(parsed.success && parsed.data.Enabled).toBeUndefined();
+    });
+
+    it('merges the overlay onto the published entry without losing RootPath or Enabled', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'BallotEdge', OwnsCORS: false, Settings: { RateLimitMax: 2000 } });
+        const [merged] = MergeServerExtensionConfigs([published], [overlay as ServerExtensionConfig]);
+        expect(merged).toMatchObject({ DriverClass: 'BallotEdge', RootPath: '/vote', Enabled: true, OwnsCORS: false });
+        expect(merged.Settings).toEqual({ RateLimitMax: 2000 });
+    });
+
+    it('does not re-enable an extension the package ships disabled', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'BallotEdge', Settings: { RateLimitMax: 5 } });
+        const [merged] = MergeServerExtensionConfigs([{ ...published, Enabled: false }], [overlay as ServerExtensionConfig]);
+        expect(merged.Enabled).toBe(false);
+    });
+
+    it('still rejects a host-only entry without a RootPath, after the merge', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'NotPublishedAnywhere' });
+        const problems: string[] = [];
+        const prepared = PrepareServerExtensionConfigs(
+            MergeServerExtensionConfigs([published], [overlay as ServerExtensionConfig]),
+            { onInvalid: (message: string) => problems.push(message) },
+        );
+        expect(prepared.map(c => c.DriverClass)).toEqual(['BallotEdge']);
+        expect(problems.some(p => p.includes('NotPublishedAnywhere') && p.includes('RootPath is empty'))).toBe(true);
+    });
+});

package/src/__tests__/serverExtensionReservedRoots.test.ts

@@ -1,8 +1,8 @@
 /**
  * Pins the reserved-root set passed into prepareServerExtensionConfigs.
- * A new public mount in index.ts / a drifted `*_MOUNT_PATH` constant is a
- * contract failure — this file reads those sources as text so it never loads
- * `config.ts`.
+ * A drifted `*_MOUNT_PATH` constant is a contract failure — this file reads those
+ * sources as text so it never loads `config.ts`. That every core mount is reserved
+ * is checked against the real mounts in apiRootBoot.test.ts.
  */
 import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'node:fs';
@@ -26,11 +26,6 @@ function exportedStringConst(relativeFile: string, name: string): string {
     return match[1];
 }
 
-function indexContainsLiteralPath(path: string): boolean {
-    const src = readFileSync(join(SRC, 'index.ts'), 'utf8');
-    return src.includes(`'${path}'`) || src.includes(`\`${path}\``) || src.includes(path.replace(/^\//, ''));
-}
-
 describe('coreReservedServerExtensionRoots', () => {
     it('stays in lockstep with exported *_MOUNT_PATH constants', () => {
         expect(CORE_CONSTANT_RESERVED_SERVER_EXTENSION_ROOTS).toEqual([
@@ -40,92 +35,11 @@ describe('coreReservedServerExtensionRoots', () => {
         ]);
     });
 
-    it('includes the literal pre-auth paths serve() registers without a constant', () => {
-        const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        for (const path of CORE_STATIC_RESERVED_SERVER_EXTENSION_ROOTS) {
-            if (path === '/health') {
-                expect(indexSrc, `${path} missing from serve()`).toContain("'/health/extensions'");
-            } else if (path === '/realtime') {
-                expect(indexSrc, `${path} missing from serve()`).toMatch(/REALTIME_SDP_EXCHANGE_PATH|'\/realtime'/);
-            } else if (path === '/realtime-proxy') {
-                expect(indexSrc, `${path} missing from serve()`).toContain('/realtime-proxy');
-            } else {
-                expect(indexSrc, `${path} missing from serve()`).toContain(`'${path}'`);
-            }
-        }
-        expect(indexContainsLiteralPath('/healthcheck')).toBe(true);
-    });
-
-    it('structurally guarantees every pre-auth app.use / app.get / app.post mount in index.ts is reserved', () => {
-        const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        const authMiddlewareIndex = indexSrc.indexOf('app.use(CreateUnifiedAuthMiddleware');
-        expect(authMiddlewareIndex).toBeGreaterThan(0);
-        const preAuthSrc = indexSrc.substring(0, authMiddlewareIndex);
-
-        const mountRegex = /app\.(?:use|get|post)\s*\(\s*([^,\s)]+)/g;
-        const reservedRoots = CoreReservedServerExtensionRoots('/');
-
-        // Explicit allowlist of known non-path middleware mounts (e.g. app.use(mw), app.use(cors()), app.use(compression(...)))
-        const knownNonPathTokens = [
-            'cors',
-            'express.',
-            'compression',
-            'cookieParser',
-            'CreateUnifiedAuthMiddleware',
-            'mw',
-        ];
-        const isKnownNonPath = (t: string): boolean =>
-            knownNonPathTokens.some(k => t === k || t.startsWith(k));
-
-        // Strip single-line and multi-line comments so comments like `app.use(...)` are not treated as code
-        const cleanPreAuthSrc = preAuthSrc.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, '');
-
-        let match: RegExpExecArray | null;
-        const mountedTokens: string[] = [];
-        while ((match = mountRegex.exec(cleanPreAuthSrc)) !== null) {
-            mountedTokens.push(match[1].trim());
-        }
-
-        expect(mountedTokens.length).toBeGreaterThan(0);
-
-        const knownConstants: Record<string, string> = {
-            REALTIME_SDP_EXCHANGE_PATH: '/realtime',
-            // Public verify-link routes for realtime identity verification; under the reserved '/realtime' root.
-            REALTIME_VERIFY_MOUNT_PATH: '/realtime/verify',
-            MAGIC_LINK_MOUNT_PATH: '/magic-link',
-            WIDGET_MOUNT_PATH: '/widget',
-            AUTH_CATALOG_MOUNT_PATH: '/auth',
-        };
-
-        for (const token of mountedTokens) {
-            const isLiteralPath = token.startsWith("'") || token.startsWith('"') || token.startsWith('`');
-            const isPathConstant = /^[A-Z0-9_]+_PATH$/.test(token) || token in knownConstants;
-            if (!isLiteralPath && !isPathConstant) {
-                if (isKnownNonPath(token)) {
-                    continue;
-                }
-                throw new Error(`Unrecognized pre-auth mount argument '${token}' in index.ts. If this is a non-path middleware, add it to knownNonPathTokens; if it is a route, reserve its prefix or map its constant.`);
-            }
-
-            let pathPrefix: string;
-            if (isLiteralPath) {
-                pathPrefix = token.slice(1, -1);
-            } else if (token in knownConstants) {
-                pathPrefix = knownConstants[token];
-            } else {
-                throw new Error(`Unrecognized pre-auth mount constant '${token}' in index.ts. If this is a new pre-auth route, map its constant or reserve its prefix.`);
-            }
-
-            const isCovered = reservedRoots.some(root => pathPrefix === root || pathPrefix.startsWith(`${root}/`));
-            expect(isCovered, `Pre-auth mount '${pathPrefix}' (from token '${token}') must be covered by reserved roots`).toBe(true);
-        }
-    });
-
-    it('includes graphqlRootPath and every core mount', () => {
-        const roots = CoreReservedServerExtensionRoots('/api');
+    it('includes every core mount, and no longer graphqlRootPath', () => {
+        const roots = CoreReservedServerExtensionRoots();
+        expect(roots).not.toContain('/api');
         expect(roots).toEqual(
             expect.arrayContaining([
-                '/api',
                 '/auth',
                 '/magic-link',
                 '/widget',
@@ -141,7 +55,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('closes the F-M2 bypasses: cased /auth and sibling /healthcheck', () => {
-        const extra = CoreReservedServerExtensionRoots('/');
+        const extra = CoreReservedServerExtensionRoots();
         expect(validateServerExtensionRootPath('/Auth', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/healthcheck', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/Healthcheck', extra)).toMatch(/reserved prefix/);
@@ -157,10 +71,9 @@ describe('coreReservedServerExtensionRoots', () => {
         expect(validateServerExtensionRootPath('/meetings/teams', extra)).toBeNull();
     });
 
-    it('reserves a non-default graphqlRootPath and its nested paths', () => {
-        const extra = CoreReservedServerExtensionRoots('/api');
-        expect(validateServerExtensionRootPath('/api', extra)).toMatch(/reserved prefix/);
-        expect(validateServerExtensionRootPath('/api/graphql', extra)).toMatch(/reserved prefix/);
-        expect(validateServerExtensionRootPath('/apiv2', extra)).toBeNull();
+    it('lets extensions sit under the GraphQL path (#5674): RootPaths are relative to MJAPI_BASE_PATH', () => {
+        const extra = CoreReservedServerExtensionRoots();
+        expect(validateServerExtensionRootPath('/api', extra)).toBeNull();
+        expect(validateServerExtensionRootPath('/forms', extra)).toBeNull();
     });
 });

package/src/__tests__/sharedCache.test.ts

@@ -45,7 +45,7 @@ import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import type { CacheSettingsConfig } from '../config.js';
 
 function settings(overrides: Partial<CacheSettingsConfig>): CacheSettingsConfig {
-    return { maxMemoryMB: 150, maxPercentOfCachePerEntity: 50, defaultTTLSeconds: 0, evictionSweepIntervalSeconds: 300, verboseLogging: false, engineSweepIntervalSeconds: 300, ...overrides };
+    return { maxMemoryMB: 150, maxPercentOfCachePerEntity: 50, maxEntryPercentOfCache: 'auto', defaultTTLSeconds: 0, evictionSweepIntervalSeconds: 300, verboseLogging: false, engineSweepIntervalSeconds: 300, ...overrides };
 }
 
 function event(overrides: Partial<CacheChangedEvent>): CacheChangedEvent {
@@ -117,9 +117,11 @@ describe('shared cache configuration', () => {
     });
 
     it('maps cacheSettings onto LocalCacheManager settings', () => {
-        expect(CacheManagerConfigFromSettings(settings({ maxMemoryMB: 10, maxPercentOfCachePerEntity: 20, defaultTTLSeconds: 5, evictionSweepIntervalSeconds: 7, verboseLogging: true })))
-            .toEqual({ maxSizeBytes: 10 * 1024 * 1024, maxPercentOfCachePerEntity: 20, defaultTTLMs: 5000, evictionSweepIntervalMs: 7000, verboseLogging: true });
+        expect(CacheManagerConfigFromSettings(settings({ maxMemoryMB: 10, maxPercentOfCachePerEntity: 20, maxEntryPercentOfCache: 40, defaultTTLSeconds: 5, evictionSweepIntervalSeconds: 7, verboseLogging: true })))
+            .toEqual({ maxSizeBytes: 10 * 1024 * 1024, maxPercentOfCachePerEntity: 20, maxEntryPercentOfCache: 40, defaultTTLMs: 5000, evictionSweepIntervalMs: 7000, verboseLogging: true });
         expect(CacheManagerConfigFromSettings(undefined).maxSizeBytes).toBe(150 * 1024 * 1024);
+        // The per-entry ceiling reaches the cache, and an unset one is derived rather than a fixed fraction.
+        expect(CacheManagerConfigFromSettings(undefined).maxEntryPercentOfCache).toBe('auto');
     });
 
     it('starts the engine sweep at the configured interval, off when 0', () => {