@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/fieldSecurityFixtures.ts

@@ -0,0 +1,91 @@
+/**
+ * Shared field-security fixtures for the transport tests: an `Employees` entity whose `Salary`
+ * and `Base Salary` only the HR role may read, plus users holding either role.
+ *
+ * Built from real `EntityInfo` / `UserInfo` objects so the denied sets come from the same
+ * aggregation production uses, not from a stub.
+ */
+import { EntityInfo, FieldSecurityClientInputMessage, UserInfo, UserRoleInfo } from '@memberjunction/core';
+
+export const HR_ROLE_ID = 'A0000000-0000-0000-0000-000000000001';
+export const INTERN_ROLE_ID = 'A0000000-0000-0000-0000-000000000003';
+export const EMPLOYEES_ENTITY_ID = 'entity-employees';
+export const EMPLOYEES_ENTITY_NAME = 'Employees';
+
+/** The salary an HR user may read and an intern may not. Distinctive so a leak is easy to spot. */
+export const SECRET_SALARY = 987654.32;
+
+function openTo(fieldId: string, roles: string[] = [HR_ROLE_ID, INTERN_ROLE_ID]): Record<string, unknown>[] {
+    return roles.map((roleId, i) => ({
+        ID: `${fieldId}-open-${i}`,
+        EntityFieldID: fieldId,
+        RoleID: roleId,
+        ReadAccess: 'Allow',
+        UpdateAccess: 'Allow',
+        CreateAccess: 'Allow',
+    }));
+}
+
+/** Init data for the `Employees` entity. `withFls: false` switches field security off entirely. */
+export function EmployeeEntityInit(withFls = true): Record<string, unknown> {
+    const field = (id: string, sequence: number, name: string, type: string, extra: Record<string, unknown> = {}) => ({
+        ID: id, EntityID: EMPLOYEES_ENTITY_ID, Sequence: sequence, Name: name, Entity: EMPLOYEES_ENTITY_NAME, Type: type, ...extra,
+    });
+    return {
+        ID: EMPLOYEES_ENTITY_ID,
+        Name: EMPLOYEES_ENTITY_NAME,
+        SchemaName: 'dbo',
+        BaseTable: 'Employee',
+        BaseView: 'vwEmployees',
+        IncludeInAPI: true,
+        AllowCreateAPI: true,
+        AllowUpdateAPI: true,
+        AllowDeleteAPI: true,
+        EnableFieldLevelSecurity: withFls,
+        Permissions: [
+            { EntityID: EMPLOYEES_ENTITY_ID, RoleID: HR_ROLE_ID, CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true },
+            { EntityID: EMPLOYEES_ENTITY_ID, RoleID: INTERN_ROLE_ID, CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true },
+        ],
+        Fields: [
+            field('f-id', 1, 'ID', 'uniqueidentifier', { IsPrimaryKey: true }),
+            field('f-name', 2, 'Name', 'nvarchar', { EntityFieldPermissions: openTo('f-name') }),
+            field('f-salary', 3, 'Salary', 'money', { EntityFieldPermissions: openTo('f-salary', [HR_ROLE_ID]) }),
+            field('f-base-salary', 4, 'Base Salary', 'money', { EntityFieldPermissions: openTo('f-base-salary', [HR_ROLE_ID]) }),
+            field('f-notes', 5, 'Notes', 'nvarchar', { EntityFieldPermissions: openTo('f-notes') }),
+        ],
+    };
+}
+
+export function EmployeeEntity(withFls = true): EntityInfo {
+    return new EntityInfo(EmployeeEntityInit(withFls));
+}
+
+export function BuildUser(roleIds: string[], id = 'user-1'): UserInfo {
+    const u = new UserInfo();
+    u.ID = id;
+    u.Name = 'Test User';
+    u.Email = `${id}@test.com`;
+    u.IsActive = true;
+    (u as unknown as Record<string, unknown>)['_UserRoles'] =
+        roleIds.map(rid => new UserRoleInfo({ UserID: id, RoleID: rid, Role: `Role-${rid}` }));
+    return u;
+}
+
+export const Intern = (): UserInfo => BuildUser([INTERN_ROLE_ID], 'intern-1');
+export const HRUser = (): UserInfo => BuildUser([HR_ROLE_ID], 'hr-1');
+
+/** A full-width employee row: what a system-identity load, or a save's re-read, returns. */
+export function FullWidthEmployeeRow(): Record<string, unknown> {
+    return { ID: 'emp-1', Name: 'Ada', Salary: SECRET_SALARY, 'Base Salary': SECRET_SALARY, Notes: 'n' };
+}
+
+/** The refusal text for a key, identical whether the key is denied or names no field. */
+export function RefusalFor(key: string): string {
+    return FieldSecurityClientInputMessage(key, EMPLOYEES_ENTITY_NAME);
+}
+
+/** A metadata source the projection accepts; Record Changes resolution is never reached for Employees. */
+export const NoRecordChangesMetadata = {
+    Entities: [] as EntityInfo[],
+    EntityByID: (): EntityInfo | undefined => undefined,
+};

package/src/__tests__/globalCors.test.ts

@@ -0,0 +1,217 @@
+/**
+ * MJServer's global CORS middleware vs. server extensions that own their CORS policy.
+ *
+ * Reproduces the BizApps Voting ballot-edge failure: the global middleware ran ahead of the
+ * extension, reflected any origin onto the extension's refusals, and answered every preflight
+ * with 204 so the extension's own OPTIONS handler never ran. Runs a real Express app on an
+ * ephemeral port so the preflight is Express's and `cors`'s own behavior, not a mock.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import express, { type Application } from 'express';
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { readFileSync } from 'node:fs';
+import { GetCorsOwningServerExtensionRoots, type ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import cors from 'cors';
+import { CreateExtensionOwnedPreflightFallback, CreateGlobalCorsMiddleware } from '../globalCors.js';
+
+const ALLOWED_BALLOT_ORIGIN = 'https://vote.example.org';
+const OTHER_ORIGIN = 'https://evil.example.com';
+
+/** A ballot-style edge: its own per-resource origin policy and its own preflight answer. */
+function mountBallotExtension(app: Application): void {
+    const router = express.Router();
+    router.use((req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && origin !== ALLOWED_BALLOT_ORIGIN) {
+            res.status(403).json({ error: 'origin not allowed for this ballot' });
+            return;
+        }
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            res.setHeader('Access-Control-Allow-Methods', 'POST');
+            res.setHeader('X-Ballot-Preflight', 'extension');
+            res.status(200).end();
+            return;
+        }
+        next();
+    });
+    router.post('/cast', (_req, res) => { res.json({ ok: true }); });
+    app.use('/ballot', router);
+}
+
+let server: Server | undefined;
+
+afterEach(async () => {
+    if (server) {
+        await new Promise<void>((resolve) => server!.close(() => resolve()));
+        server = undefined;
+    }
+});
+
+async function startApp(extensions: ServerExtensionConfig[]): Promise<string> {
+    const app = express();
+    app.disable('x-powered-by');
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, GetCorsOwningServerExtensionRoots(extensions)));
+    mountBallotExtension(app);
+    app.get('/core', (_req, res) => { res.json({ ok: true }); });
+    server = app.listen(0, '127.0.0.1');
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+const ballotConfig = (ownsCors: boolean | undefined): ServerExtensionConfig => ({
+    Enabled: true,
+    DriverClass: 'BallotEdge',
+    RootPath: '/ballot',
+    Phase: 'pre-auth',
+    ...(ownsCors === undefined ? {} : { OwnsCORS: ownsCors }),
+    Settings: {},
+});
+
+describe('CreateGlobalCorsMiddleware', () => {
+    it('without OwnsCORS, global CORS answers the preflight and the extension never sees it (the bug)', async () => {
+        const base = await startApp([ballotConfig(undefined)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('x-ballot-preflight')).toBeNull();
+    });
+
+    it('with OwnsCORS, the preflight reaches the extension, which refuses a foreign origin without CORS headers', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('with OwnsCORS, the extension answers its own preflight for its allowed origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: ALLOWED_BALLOT_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+        expect(res.headers.get('access-control-allow-origin')).toBe(ALLOWED_BALLOT_ORIGIN);
+        // The global policy's max-age would only be there if global CORS had run.
+        expect(res.headers.get('access-control-max-age')).toBeNull();
+    });
+
+    it('with OwnsCORS, a foreign-origin refusal on a normal request carries no reflected origin', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/ballot/cast`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(res.status).toBe(403);
+        expect(res.headers.get('access-control-allow-origin')).toBeNull();
+    });
+
+    it('keeps global CORS on every path the extension does not own', async () => {
+        const base = await startApp([ballotConfig(true)]);
+        const res = await fetch(`${base}/core`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'GET' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+        expect(res.headers.get('access-control-max-age')).toBe('86400');
+    });
+
+    it('ignores OwnsCORS on a disabled extension', async () => {
+        const base = await startApp([{ ...ballotConfig(true), Enabled: false }]);
+        const res = await fetch(`${base}/ballot/cast`, {
+            method: 'OPTIONS',
+            headers: { Origin: OTHER_ORIGIN, 'Access-Control-Request-Method': 'POST' },
+        });
+        expect(res.status).toBe(204);
+    });
+
+    it('never sends credentials under the wildcard, even when allowCredentials is true', async () => {
+        const app = express();
+        app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'], allowCredentials: true }));
+        app.get('/core', (_req, res) => { res.json({ ok: true }); });
+        server = app.listen(0, '127.0.0.1');
+        await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+        const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+        const res = await fetch(`${base}/core`, { headers: { Origin: OTHER_ORIGIN } });
+        expect(res.headers.get('access-control-allow-credentials')).toBeNull();
+    });
+});
+
+/**
+ * The real mount order: global CORS → extensions → (fallback) → the GraphQL mount at `/`, whose own
+ * `cors()` approves every origin. The webhook extension owns its CORS but has no OPTIONS handler.
+ */
+async function startAppWithGraphQLMount(withFallback: boolean): Promise<string> {
+    const extensions: ServerExtensionConfig[] = [
+        ballotConfig(true),
+        { Enabled: true, DriverClass: 'Webhook', RootPath: '/webhook', Phase: 'pre-auth', OwnsCORS: true, Settings: {} },
+    ];
+    const ownedRoots = GetCorsOwningServerExtensionRoots(extensions);
+    const app = express();
+    app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, ownedRoots));
+    mountBallotExtension(app);
+    app.post('/webhook/events', (_req, res) => { res.json({ received: true }); });
+    if (withFallback) {
+        app.use(CreateExtensionOwnedPreflightFallback(ownedRoots));
+    }
+    app.use('/', cors(), (_req, res) => { res.json({ graphql: true }); });
+    server = app.listen(0, '127.0.0.1');
+    await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
+    return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+}
+
+async function preflight(url: string, origin: string): Promise<Response> {
+    return fetch(url, { method: 'OPTIONS', headers: { Origin: origin, 'Access-Control-Request-Method': 'POST' } });
+}
+
+describe('CreateExtensionOwnedPreflightFallback', () => {
+    it('without it, an unanswered preflight under an owned root falls through to the GraphQL cors() and is approved for any origin (the bug)', async () => {
+        const base = await startAppWithGraphQLMount(false);
+        const res = await preflight(`${base}/webhook/events`, OTHER_ORIGIN);
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe('*');
+    });
+
+    it('refuses an unanswered preflight under an owned root with a bare 404', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        for (const path of ['/webhook/events', '/WEBHOOK/Events', '/webhook/', '/webhook/no-such-route']) {
+            const res = await preflight(`${base}${path}`, OTHER_ORIGIN);
+            expect(res.status, path).toBe(404);
+            expect(res.headers.get('access-control-allow-origin'), path).toBeNull();
+        }
+    });
+
+    it('leaves an extension that answers its own preflight in charge', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const res = await preflight(`${base}/ballot/cast`, ALLOWED_BALLOT_ORIGIN);
+        expect(res.status).toBe(200);
+        expect(res.headers.get('x-ballot-preflight')).toBe('extension');
+    });
+
+    it('touches neither non-preflight requests under an owned root nor preflights elsewhere', async () => {
+        const base = await startAppWithGraphQLMount(true);
+        const post = await fetch(`${base}/webhook/events`, { method: 'POST', headers: { Origin: OTHER_ORIGIN } });
+        expect(post.status).toBe(200);
+        const sibling = await preflight(`${base}/webhookx/events`, OTHER_ORIGIN);
+        expect(sibling.status).toBe(204);
+        expect(sibling.headers.get('access-control-allow-origin')).toBe(OTHER_ORIGIN);
+    });
+});
+
+describe('X-Powered-By', () => {
+    it('CreateApp and Serve() both disable X-Powered-By', () => {
+        // Read as text so this test never loads config.ts / the full server graph.
+        const src = readFileSync(new URL('../index.ts', import.meta.url), 'utf8');
+        // Both the default app factory and Serve() (for host-supplied apps) disable the header.
+        expect(src.match(/app\.disable\('x-powered-by'\)/g)?.length ?? 0).toBeGreaterThanOrEqual(2);
+    });
+});

package/src/__tests__/localDevAuth.test.ts

@@ -0,0 +1,196 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import type { Request } from 'express';
+import jwt from 'jsonwebtoken';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { UserInfo } from '@memberjunction/core';
+
+vi.mock('../config.js', () => ({
+  configInfo: {
+    devAuth: { enabled: false },
+    magicLink: {},
+    authProviders: [],
+  },
+}));
+
+import {
+  AssertLocalDevAuthAllowed,
+  IsLocalDevAuthEnabled,
+  IsLoopbackAddress,
+  MintLocalDevJwt,
+  RegisterLocalDevAuthProvider,
+  VerifyLocalhostRequest,
+} from '../auth/localDevAuth.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+
+function createMockRequest(overrides: {
+  remoteAddress?: string;
+  host?: string;
+  origin?: string;
+  referer?: string;
+  xff?: string;
+}): Request {
+  const headers: Record<string, string | undefined> = {
+    host: overrides.host ?? 'localhost:4000',
+    origin: overrides.origin,
+    referer: overrides.referer,
+    'x-forwarded-for': overrides.xff,
+  };
+  return {
+    headers,
+    hostname: (overrides.host ?? 'localhost:4000').split(':')[0],
+    ip: overrides.remoteAddress ?? '127.0.0.1',
+    socket: {
+      remoteAddress: overrides.remoteAddress ?? '127.0.0.1',
+    },
+  } as unknown as Request;
+}
+
+describe('localDevAuth security invariants', () => {
+  beforeEach(() => {
+    AuthProviderFactory.Instance.clear();
+  });
+
+  it('IsLocalDevAuthEnabled detects MJ_DEV_AUTH_ENABLED=true or 1', () => {
+    expect(IsLocalDevAuthEnabled({})).toBe(false);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: 'false' })).toBe(false);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: 'true' })).toBe(true);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: '1' })).toBe(true);
+  });
+
+  it('AssertLocalDevAuthAllowed fails loudly when NODE_ENV=production', () => {
+    expect(() =>
+      AssertLocalDevAuthAllowed({
+        MJ_DEV_AUTH_ENABLED: 'true',
+        NODE_ENV: 'development',
+      })
+    ).not.toThrow();
+
+    expect(() =>
+      AssertLocalDevAuthAllowed({
+        MJ_DEV_AUTH_ENABLED: 'true',
+        NODE_ENV: 'production',
+      })
+    ).toThrow(/strictly forbidden when NODE_ENV=production/);
+  });
+
+  it('IsLoopbackAddress accepts loopback and conditional Docker local bridge IPs', () => {
+    expect(IsLoopbackAddress('127.0.0.1', false)).toBe(true);
+    expect(IsLoopbackAddress('::1', false)).toBe(true);
+    expect(IsLoopbackAddress('::ffff:127.0.0.1', false)).toBe(true);
+    expect(IsLoopbackAddress('192.168.65.1', false)).toBe(false);
+    expect(IsLoopbackAddress('192.168.65.1', true)).toBe(true);
+    expect(IsLoopbackAddress('172.18.0.1', true)).toBe(true);
+    expect(IsLoopbackAddress('192.168.1.42', true)).toBe(false);
+    expect(IsLoopbackAddress('203.0.113.10', true)).toBe(false);
+  });
+
+  it('VerifyLocalhostRequest allows genuine localhost requests and blocks non-localhost vectors', () => {
+    // 1. Standard localhost IPv4 and IPv6
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000', origin: 'http://localhost:4202' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(true);
+
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '::1', host: '127.0.0.1:4000', origin: 'http://127.0.0.1:4202' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(true);
+
+    // 2. Docker Desktop host-gateway when Host is localhost, inside container, and no XFF is present
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '::ffff:192.168.65.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'development', MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE: 'true' }
+      ).Allowed
+    ).toBe(true);
+
+    // 2b. Rejects Docker bridge IPs when NOT running inside a container
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '172.18.0.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'development', MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE: 'false' }
+      ).Allowed
+    ).toBe(false);
+
+    // 2c. Rejects non-gateway RFC1918 172.16.0.0/12 addresses even inside a container
+    expect(IsLoopbackAddress('172.20.10.5', true)).toBe(false);
+
+    // 3. Rejects in production even from 127.0.0.1
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'production' }
+      ).Allowed
+    ).toBe(false);
+
+    // 4. Rejects LAN IP on socket
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '192.168.1.50', host: 'localhost:4000' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 5. Rejects non-localhost Host header
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: '192.168.1.50:4000' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 6. Rejects external X-Forwarded-For
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000', xff: '203.0.113.5' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 7. Rejects external Origin
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({
+          remoteAddress: '127.0.0.1',
+          host: 'localhost:4000',
+          origin: 'https://attacker.example.com',
+        }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+  });
+
+  it('MintLocalDevJwt mints an RS256 token verifiable by the registered LocalDevProvider', () => {
+    MagicLinkKeyManager.Instance.Initialize();
+    RegisterLocalDevAuthProvider('http://localhost:4000');
+
+    const mockUser = new UserInfo(undefined, {
+      ID: '11111111-2222-3333-4444-555555555555',
+      Name: 'Admin User',
+      Email: 'admin@memberjunction.org',
+      FirstName: 'Admin',
+      LastName: 'User',
+      IsActive: true,
+      Type: 'Owner',
+      UserRoles: [],
+    });
+
+    const { token, claims } = MintLocalDevJwt(mockUser, 'http://localhost:4000');
+    expect(claims.iss).toBe('http://localhost:4000/local-dev');
+    expect(claims.aud).toBe('mj-local-dev');
+    expect(claims.email).toBe('admin@memberjunction.org');
+    expect(claims['mj_magic_link']).toBeUndefined();
+
+    const provider = AuthProviderFactory.Instance.getByIssuer('http://localhost:4000/local-dev');
+    expect(provider).toBeDefined();
+    const decoded = jwt.decode(token) as jwt.JwtPayload;
+    const userInfo = provider!.extractUserInfo(decoded);
+    expect(userInfo.email).toBe('admin@memberjunction.org');
+    expect(userInfo.firstName).toBe('Admin');
+    expect(userInfo.lastName).toBe('User');
+  });
+});