@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/agentSessions/SessionManager.ts

@@ -12,6 +12,8 @@ import { GetHostInstanceID } from './HostInstance.js';
 import { WriteReturningVisitorRecap } from './ReturningVisitorRecap.js';
 import { SessionRunIDVerifier, SessionRunIDs } from './SessionRunIDVerifier.js';
 import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
+import { RecordingAssemblyScheduler } from '../realtimeSessions/RecordingAssemblyScheduler.js';
+import { ResolveSessionScopeIdentity } from '../realtimeSessions/sessionAccess.js';
 
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
 const SESSION_ENTITY = 'MJ: AI Agent Sessions';
@@ -152,11 +154,13 @@ export class SessionManager {
     /**
      * Authorize and create a new session. Flow:
      * 1. `CanRun` check on the agent — denied → {@link SessionAuthorizationError}, no row written.
-     * 2. Resolve the conversation (use the supplied one, or create+link a fresh Conversation).
+     * 2. Resolve the conversation (use the supplied one, or create+link a fresh Conversation). An anonymous
+     *    caller may only supply a conversation stamped with its own scope identity.
      * 3. Persist the `AIAgentSession` as `Active`, stamped with this host and `LastActiveAt = now`.
      *
      * @returns the saved {@link MJAIAgentSessionEntity}.
-     * @throws {SessionAuthorizationError} when the user may not run the agent.
+     * @throws {SessionAuthorizationError} when the user may not run the agent, or an anonymous caller supplies a
+     *   conversation that is not its own.
      * @throws {Error} when conversation creation or session save fails.
      */
     public async CreateSession(
@@ -165,6 +169,9 @@ export class SessionManager {
         provider: IMetadataProvider,
     ): Promise<MJAIAgentSessionEntity> {
         await this.assertCanRun(input.agentID, contextUser);
+        if (input.conversationID && contextUser.IsMagicLinkAnonymous) {
+            await this.assertAnonymousOwnsConversation(input.conversationID, contextUser, provider);
+        }
 
         const conversationID = input.conversationID
             ?? await this.createConversation(input, contextUser, provider);
@@ -212,6 +219,13 @@ export class SessionManager {
         if (!closed) {
             return false;
         }
+        if (session.RecordingStartedAt) {
+            // A client-direct recording is assembled only after the grace period while its call is open
+            // (a hidden tab must not rewrite recording.wav on every switch; see RealtimeRecordingHandler).
+            // The call has ended now, so assemble it right away. The ledger's claim arbitrates instances,
+            // and a recording with nothing to assemble (none, or server-bridged) is simply not claimable.
+            RecordingAssemblyScheduler.Instance.ScheduleAssembly(agentSessionID, 0, false);
+        }
         await this.disconnectChannels(agentSessionID, contextUser, provider, preloadedChannels);
         await this.finalizeObservabilityRuns(session, contextUser, provider);
         await this.notifyChannelPluginsSessionClosed(agentSessionID, closeReason);
@@ -440,6 +454,23 @@ export class SessionManager {
 
     // ----- internals -------------------------------------------------------------------------
 
+    /**
+     * Throws {@link SessionAuthorizationError} unless the anonymous caller owns the conversation it wants to bind a
+     * new session to: the conversation, read as the caller, loads, and its `ExternalID` equals the caller's scope
+     * identity ({@link ResolveSessionScopeIdentity}). A caller with no scope identity is refused. Every anonymous
+     * visitor shares one Anonymous user, so row-level security alone may let one visitor read another's
+     * conversation; without this check the new session row and its relays would point into that conversation.
+     */
+    private async assertAnonymousOwnsConversation(conversationID: string, contextUser: UserInfo, provider: IMetadataProvider): Promise<void> {
+        const conversation = await provider.GetEntityObject<MJConversationEntity>(CONVERSATION_ENTITY, contextUser);
+        const loaded = await conversation.Load(conversationID);
+        const scopeIdentity = ResolveSessionScopeIdentity(contextUser);
+        if (!loaded || !scopeIdentity || conversation.ExternalID !== scopeIdentity) {
+            LogError(`SessionManager.CreateSession: refused anonymous user ${contextUser.ID} binding a session to conversation ${conversationID} (${loaded ? 'not its own' : 'not readable'}).`);
+            throw new SessionAuthorizationError('Not authorized to start a session on this conversation.');
+        }
+    }
+
     /** Throws {@link SessionAuthorizationError} unless the user has `CanRun` on the agent. */
     private async assertCanRun(agentID: string, contextUser: UserInfo): Promise<void> {
         const canRun = await AIAgentPermissionHelper.HasPermission(agentID, contextUser, 'run');
@@ -460,13 +491,13 @@ export class SessionManager {
         conversation.NewRecord();
         conversation.UserID = input.userID;
         conversation.Name = 'Agent Session';
-        // For a magic-link-anonymous principal (e.g. a public web-widget voice guest), stamp the
-        // session's conversation with the signed per-session scope so the Widget Guest RLS filters
-        // ({{ScopeResourceID}}) isolate this session — and everything chained to it (AI Agent
-        // Sessions via ConversationID, Session Channels via the session) — from other guests
-        // sharing the Anonymous UserID. No-op for named principals (no scope → default ExternalID).
-        if (contextUser.MagicLinkScope?.ResourceID) {
-            conversation.ExternalID = contextUser.MagicLinkScope.ResourceID;
+        // Stamp the scope identity AuthorizeSessionAccess compares against (one rule, one place:
+        // ResolveSessionScopeIdentity) — the token's resource scope when it has one, else an anonymous
+        // visitor's mj_sid. This isolates anonymous visitors that share the Anonymous UserID, and keeps
+        // the {{ScopeResourceID}} RLS filters matching the visitor's own rows. No-op for unscoped named principals.
+        const scopeIdentity = ResolveSessionScopeIdentity(contextUser);
+        if (scopeIdentity) {
+            conversation.ExternalID = scopeIdentity;
         }
 
         // Returning-visitor memory (RV1/RV2/RV4) for the VOICE path: the widget guest token carries the
@@ -530,7 +561,11 @@ export class SessionManager {
         return session;
     }
 
-    /** Loads a session entity by ID, returning null when it cannot be loaded. */
+    /**
+     * Loads a session entity by ID, returning null when it cannot be loaded. The lifecycle saves that
+     * follow cannot write back the recording ledger's columns: those have `AllowUpdateAPI=0`, so they are
+     * not parameters of `spUpdateAIAgentSession` (#5294, #6010).
+     */
     private async loadSession(
         agentSessionID: string,
         contextUser: UserInfo,

package/src/apiRoot.ts

@@ -0,0 +1,78 @@
+/**
+ * MJAPI's base path: the single prefix every route MJAPI serves is mounted under (MJ #5674).
+ *
+ * MJAPI does not know where a proxy exposes it. Behind a proxy that forwards a prefix WITHOUT stripping it
+ * (CloudFront `/api/*` → MJAPI), MJAPI must listen under that prefix, so the host sets
+ * `MJAPI_BASE_PATH=/api`. Behind a stripping proxy, or with no proxy, it stays `/`. Every mount and every
+ * URL handed to a browser, an email or a webhook provider goes through {@link ApiRoute}, so one setting moves
+ * them all. CI enforces this (`check:api-root` and `__tests__/apiRootBoot.test.ts`).
+ *
+ * `GRAPHQL_ROOT_PATH` is a separate thing: only where Apollo listens. Do not derive routes from it.
+ *
+ * At the default base path `/` every value here is byte-identical to the root-mounted paths MJAPI always used.
+ */
+import { TrimTrailingSlashes } from '@memberjunction/global';
+import { configInfo } from './config.js';
+
+/** Options for {@link ApiRoute}. */
+export interface ApiRouteOptions {
+    /** Return the public absolute URL (`MJAPI_PUBLIC_URL` + subpath) instead of the server mount path. */
+    absolute?: boolean; // case-violation-ok-legacy-back-compat: the `{ absolute: true }` option shape is the documented #5674 contract
+}
+
+/**
+ * Normalizes a base-path value to a prefix with no trailing slash: `''` for `/`, `'/api'` for `/api/` or
+ * `/api`. Throws on a value that does not start with `/`, since Express would mount it nowhere.
+ */
+export function NormalizeApiRootPath(rootPath: string | undefined): string {
+    const trimmed = (rootPath ?? '').trim();
+    if (trimmed && !trimmed.startsWith('/')) {
+        throw new Error(`MJAPI_BASE_PATH must start with '/', got '${trimmed}'`);
+    }
+    return TrimTrailingSlashes(trimmed);
+}
+
+function assertSubpath(subpath: string): void {
+    if (typeof subpath !== 'string' || !subpath.startsWith('/')) {
+        throw new Error(`ApiRoute subpath must start with '/', got '${String(subpath)}'`);
+    }
+}
+
+/** Joins a base path and a subpath relative to it. Pure, so tests can drive any base path. */
+export function JoinApiRoute(apiRootPath: string, subpath: string): string {
+    assertSubpath(subpath);
+    return `${NormalizeApiRootPath(apiRootPath)}${subpath}`;
+}
+
+/** The running server's base path (`MJAPI_BASE_PATH`, no trailing slash; `''` at `/`). */
+export function ApiRootPath(): string {
+    return NormalizeApiRootPath(configInfo.apiBasePath);
+}
+
+/**
+ * The server's configured public URL, derived exactly as it always has been: `MJAPI_PUBLIC_URL`, else
+ * `baseUrl:graphqlPort` + `graphqlRootPath`. Unchanged and untrimmed on purpose: it is the magic-link JWT
+ * issuer and the `publicUrl` handed to OAuth and server extensions, and changing it would invalidate issued
+ * tokens. Build URLs with `ApiRoute(subpath, { absolute: true })`, not from this.
+ */
+export function ConfiguredPublicUrl(): string {
+    return configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${configInfo.graphqlRootPath || ''}`;
+}
+
+/**
+ * The path (or, with `{ absolute: true }`, the public URL) of a route under MJAPI's base path.
+ *
+ * `subpath` is relative to the base path and must start with `/`.
+ * - `ApiRoute('/media')` → `/media` at base `/`, `/api/media` at `MJAPI_BASE_PATH=/api`.
+ * - `ApiRoute('/media/abc', { absolute: true })` → `${MJAPI_PUBLIC_URL}/media/abc`. `MJAPI_PUBLIC_URL` is
+ *   wherever the world reaches MJAPI (prefix included), so the base path is never added to it. Without it,
+ *   the local fallback is `baseUrl:graphqlPort` + the base path.
+ */
+export function ApiRoute(subpath: string, options?: ApiRouteOptions): string {
+    if (!options?.absolute) {
+        return JoinApiRoute(ApiRootPath(), subpath);
+    }
+    assertSubpath(subpath);
+    const base = configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${ApiRootPath()}`;
+    return `${TrimTrailingSlashes(base)}${subpath}`;
+}

package/src/auth/AuthProviderCatalogRouter.ts

@@ -12,6 +12,8 @@ import { Router, type Request, type Response } from 'express';
 import { rateLimit } from 'express-rate-limit';
 import { LogError, type PublicAuthProviderCatalog } from '@memberjunction/core';
 import { AuthProviderEngine } from './AuthProviderEngine.js';
+import { EMPTY_PUBLIC_LOGIN_SCREEN, LoginScreenEngine } from './LoginScreenEngine.js';
+import { AttachLocalDevAuthRoutes } from './localDevAuth.js';
 
 /** Mount path for the public catalog router. */
 export const AUTH_CATALOG_MOUNT_PATH = '/auth';
@@ -72,6 +74,33 @@ export function CreateAuthProviderCatalogRouter(): Router {
     }
   });
 
+  /**
+   * `GET /auth/login-screen`: the default theme's PUBLISHED sign-in page, logos and seeds, for the login
+   * screen to draw before anyone signs in. Its own rate-limit budget (a 429 must answer in this route's
+   * shape), the catalog's cache window, and the same failure rule: empty, never an error.
+   */
+  const loginScreenLimiter = rateLimit({
+    windowMs: DEFAULT_RATE_LIMIT_WINDOW_MS,
+    limit: DEFAULT_RATE_LIMIT_MAX,
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: EMPTY_PUBLIC_LOGIN_SCREEN
+  });
+
+  router.get('/login-screen', loginScreenLimiter, (_req: Request, res: Response) => {
+    try {
+      const body = LoginScreenEngine.Instance.GetPublicLoginScreen();
+      res.set('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
+      res.status(200).json(body);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      LogError(`[Auth] Failed to serve the public login screen: ${message}`);
+      res.status(200).json(EMPTY_PUBLIC_LOGIN_SCREEN);
+    }
+  });
+
+  AttachLocalDevAuthRoutes(router);
+
   return router;
 }
 

package/src/auth/LoginScreenEngine.ts

@@ -0,0 +1,50 @@
+/**
+ * @fileoverview Caches the default theme for the public login-screen route.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { BaseEngine, BaseEnginePropertyConfig, RegisterForStartup, UserInfo, type IMetadataProvider } from '@memberjunction/core';
+import { MJThemeEntity } from '@memberjunction/core-entities';
+import { PublicLoginScreenFromTheme, type PublicLoginScreen } from '@memberjunction/theme-engine';
+
+/** What the route serves when there is no default theme, or it cannot be read. */
+export const EMPTY_PUBLIC_LOGIN_SCREEN: Readonly<PublicLoginScreen> = { ThemeName: null, Design: null, Seeds: null, Logos: {} };
+
+/**
+ * Holds the default Active theme, so `GET /auth/login-screen` answers every anonymous page load from
+ * memory. Saving a theme refreshes it, so a publish in Login Studio reaches the login screen without a
+ * restart. Severity `warn`: a failed load must not stop the server; the route then serves the stock page.
+ */
+@RegisterForStartup({
+  priority: 20,
+  severity: 'warn',
+  deferred: false,
+  description: 'Caches the default theme that GET /auth/login-screen serves to the login screen'
+})
+export class LoginScreenEngine extends BaseEngine<LoginScreenEngine> {
+  private _defaultThemes: MJThemeEntity[] = [];
+
+  public static get Instance(): LoginScreenEngine {
+    return super.getInstance<LoginScreenEngine>();
+  }
+
+  public async Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void> {
+    const configs: Partial<BaseEnginePropertyConfig>[] = [
+      {
+        PropertyName: '_defaultThemes',
+        EntityName: 'MJ: Themes',
+        // One default is enforced by the app, not the schema; the most recently changed one wins (as in Login Studio).
+        Filter: `IsDefault = 1 AND Status = 'Active'`,
+        OrderBy: '__mj_UpdatedAt DESC',
+        CacheLocal: true
+      }
+    ];
+    await this.Load(configs, provider, forceRefresh, contextUser);
+  }
+
+  /** The default theme's public projection: its PUBLISHED design (never the draft), seeds and logos made safe. */
+  public GetPublicLoginScreen(): PublicLoginScreen {
+    const theme = this.GetConfigData<MJThemeEntity>('_defaultThemes')[0];
+    return theme ? PublicLoginScreenFromTheme(theme) : EMPTY_PUBLIC_LOGIN_SCREEN;
+  }
+}

package/src/auth/index.ts

@@ -2,7 +2,7 @@ import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import { configInfo } from '../config.js';
 import { UserCache } from '@memberjunction/generic-database-provider';
 import sql from 'mssql';
-import { DatabaseProviderBase, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, LogError, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { MJGlobal } from '@memberjunction/global';
 import { MJUserEntity, MJUserEntityType } from '@memberjunction/core-entities';
@@ -13,6 +13,7 @@ export * from './APIKeyScopeAuth.js';
 export * from './scopeLimitedPrincipal.js';
 export * from './actingContextResolver.js';
 export * from './AuthProviderEngine.js';
+export * from './LoginScreenEngine.js';
 export * from './AuthProviderCatalogRouter.js';
 export { InitializeAuthProviders, initializeAuthProviders, InitializeAuthProvidersFromMetadata, initializeAuthProvidersFromMetadata, RefreshAuthProviders, refreshAuthProviders, ValidateAuthProvidersRegistered, validateAuthProvidersRegistered } from './initializeProviders.js';
 
@@ -253,11 +254,63 @@ export const VerifyUserRecord = async (
 ): Promise<UserInfo | undefined> => {
   if (!email) return undefined;
 
-  // FindUser, not Users.find: a user this process has not loaded yet (created seconds ago on
-  // another server) is looked up in the database instead of being treated as nonexistent.
-  let user = await UserCache.Instance.FindUser({ Email: email });
+  // Collect ALL matches rather than taking .find()'s first hit. Two User rows can share an email
+  // case-insensitively (see the duplicate-provisioning path below), and .find() then resolved to
+  // whichever row happened to sit earlier in UserCache.Instance.Users — i.e. database row order.
+  // That order changes when the cache is rebuilt, so an MJAPI restart silently moved a user onto a
+  // different record: their conversations, artifacts, items shared with them and their profile
+  // picture (UserImageURL lives on the User row) all vanished at once, and came back if the order
+  // flipped again. Observed in production 2026-09-15. Resolution must not depend on row order.
+  const emailMatches = UserCache.Instance.Users.filter((u) => {
+    if (!u.Email || u.Email.trim() === '') {
+      // this condition should never occur. If it doesn throw a console error including the user id
+      // DB requires non-null but this is just an extra check and we could in theory have a blank string in the DB
+      console.error(`SYSTEM METADATA ISSUE: User ${u.ID} has no email address`);
+      return false;
+    } else return u.Email.toLowerCase().trim() === email.toLowerCase().trim();
+  });
+
+  if (emailMatches.length > 1) {
+    // Deterministic tie-break by ID so every process and every restart agrees, and a LOUD error
+    // because this is a data problem an operator has to resolve — silently picking a row is what
+    // made it look like data loss to the customer. Sorting by ID is arbitrary but stable; the point
+    // is that it never changes, not that it picks the "right" one.
+    emailMatches.sort((a, b) => a.ID.localeCompare(b.ID));
+    LogError(
+      `AMBIGUOUS LOGIN: ${emailMatches.length} User records share the email '${email}' ` +
+        `(case-insensitively): ${emailMatches.map((u) => `${u.ID} (${u.Email})`).join(', ')}. ` +
+        `Resolving to ${emailMatches[0].ID} by stable ID order. Until the duplicates are merged, ` +
+        `content owned by the other records is invisible to this login. Find every affected user ` +
+        `with: SELECT LOWER(Email), COUNT(*) FROM __mj.[User] GROUP BY LOWER(Email) HAVING COUNT(*) > 1`
+    );
+  }
+
+  // Nothing cached: ask FindUser, which reads the database for a user this process has not loaded
+  // yet (created seconds ago on another server) instead of treating them as nonexistent.
+  let user = emailMatches[0] ?? (await UserCache.Instance.FindUser({ Email: email }));
 
   if (!user) {
+    // REFRESH THE CACHE BEFORE PROVISIONING. This block used to sit AFTER the auto-create below,
+    // gated on `!user`, so it could only ever run when creation had already failed or was not
+    // attempted. That made it dead code in the exact case it exists to handle: a user who IS in the
+    // database but is NOT yet in this process's UserCache. Users provisioned out of band (an admin,
+    // an invite, a direct insert) are absent from the cache until it is rebuilt, so the lookup above
+    // missed and auto-create minted a SECOND record for someone who already had one — which is how
+    // the duplicate emails that Fix 1 above has to tolerate get created in the first place.
+    // Observed in production: three users created 2026-09-14 18:18, a duplicate for one of them
+    // created 2026-09-15 01:38 on that user's next sign-in.
+    //
+    // The recursive call passes attemptCacheUpdateIfNeeded=false, so the second pass skips straight
+    // to auto-create if the refreshed cache still has no match. Auto-provisioning of genuinely new
+    // users is therefore unchanged — it just no longer runs before we have looked properly.
+    if (configInfo.userHandling.updateCacheWhenNotFound && dataSource && attemptCacheUpdateIfNeeded) {
+      console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
+
+      await refreshUserCache();
+
+      return VerifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false);
+    }
+
     // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
     // this condition. It was previously required here, which meant a non-browser client sending no
     // Origin could never auto-provision while an attacker simply forged one — it gated entry without
@@ -312,14 +365,6 @@ export const VerifyUserRecord = async (
       }
     }
 
-    if (!user && configInfo.userHandling.updateCacheWhenNotFound && dataSource && attemptCacheUpdateIfNeeded) {
-      // if we get here that means in the above, if we were attempting to create a new user, it did not work, or it wasn't attempted and we have a config that asks us to auto update the cache
-      console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
-
-      await refreshUserCache();
-
-      return VerifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false); // try one more time but do not update cache next time if not found
-    }
   }
 
   return user;

package/src/auth/initializeProviders.ts

@@ -1,8 +1,35 @@
 import { configInfo } from '../config.js';
 import { AuthProviderConfig, LogError, LogStatus, LogStatusEx, UserInfo, type IMetadataProvider } from '@memberjunction/core';
-import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { AuthProviderFactory, LocalDevProvider } from '@memberjunction/auth-providers';
 import { AuthProviderEngine } from './AuthProviderEngine.js';
 
+/**
+ * Returns true when local development auth is enabled via `MJ_DEV_AUTH_ENABLED=true`
+ * or `configInfo.devAuth?.enabled === true`.
+ */
+export function IsLocalDevAuthEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const rawEnv = env.MJ_DEV_AUTH_ENABLED?.trim().toLowerCase();
+  if (rawEnv === 'true' || rawEnv === '1') {
+    return true;
+  }
+  if (rawEnv === 'false' || rawEnv === '0') {
+    return false;
+  }
+  return configInfo?.devAuth?.enabled === true;
+}
+
+/**
+ * Enforces the production safety invariant: throws a fatal error if local dev auth
+ * is enabled while `NODE_ENV === 'production'`.
+ */
+export function AssertLocalDevAuthAllowed(env: NodeJS.ProcessEnv = process.env): void {
+  if (IsLocalDevAuthEnabled(env) && env.NODE_ENV?.trim().toLowerCase() === 'production') {
+    throw new Error(
+      '[SECURITY] Local dev auth (MJ_DEV_AUTH_ENABLED) is strictly forbidden when NODE_ENV=production. Refusing to start.'
+    );
+  }
+}
+
 /**
  * Initialize authentication providers from configuration.
  *
@@ -15,6 +42,8 @@ import { AuthProviderEngine } from './AuthProviderEngine.js';
  * connection and a system user exist.
  */
 export function InitializeAuthProviders(): void {
+  AssertLocalDevAuthAllowed();
+
   const factory = AuthProviderFactory.Instance;
 
   // Clear any existing providers
@@ -40,6 +69,19 @@ export function InitializeAuthProviders(): void {
     }
   }
 
+  if (IsLocalDevAuthEnabled()) {
+    configInfo.authProviders = configInfo.authProviders ?? [];
+    if (!configInfo.authProviders.some((p) => p.type === 'local' || p.name === 'local')) {
+      const localConfig = LocalDevProvider.ConfigFromEnvironment({
+        ...process.env,
+        MJ_DEV_AUTH_ENABLED: 'true',
+      });
+      if (localConfig) {
+        configInfo.authProviders.push(localConfig);
+      }
+    }
+  }
+
   // Initialize providers from authProviders config
   if (configInfo.authProviders && configInfo.authProviders.length > 0) {
     for (const providerConfig of configInfo.authProviders) {