@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/realtimeSessions/subscriptionAuthorization.ts

@@ -61,7 +61,9 @@ export function RealtimeSessionEventsFilter(data: {
         return false;
     }
     const decision = AuthorizeSessionAccess(
-        { SessionUserID: payload.OwnerUserID, ConversationExternalID: payload.ScopeKey },
+        // Readability is per caller and was proven when this subscription opened (it only receives events for
+        // that one session); the snapshot carries just the stamp, so a null ScopeKey stays usable by that owner.
+        { SessionUserID: payload.OwnerUserID, ConversationExternalID: payload.ScopeKey, ConversationReadable: true },
         connectionPrincipal(context),
     );
     return decision.Allowed;
@@ -105,7 +107,7 @@ export async function AuthorizeRealtimeSessionSubscription(
         throw new Error(REFUSAL_MESSAGE);
     }
     const decision = AuthorizeSessionAccess(
-        { SessionUserID: loaded.Session.UserID, ConversationExternalID: loaded.ConversationExternalID },
+        { SessionUserID: loaded.Session.UserID, ConversationExternalID: loaded.ConversationExternalID, ConversationReadable: loaded.ConversationReadable },
         principal,
     );
     if (decision.Allowed === false) {

package/src/realtimeSessions/verificationWorkflow.ts

@@ -90,6 +90,8 @@ export interface SessionSnapshot {
     OwnerUserID: string;
     /** `Conversation.ExternalID` (anonymous scope id), or null. */
     ConversationExternalID: string | null;
+    /** Whether the caller could read the session's conversation. */
+    ConversationReadable: boolean;
     Status: 'Active' | 'Idle' | 'Closed';
     /** `AIAgentSession.Config` as stored. */
     ConfigRaw: string | null;
@@ -660,7 +662,7 @@ export class RealtimeSessionVerificationWorkflow {
             return notFound;
         }
         const decision = AuthorizeSessionAccess(
-            { SessionUserID: session.OwnerUserID, ConversationExternalID: session.ConversationExternalID },
+            { SessionUserID: session.OwnerUserID, ConversationExternalID: session.ConversationExternalID, ConversationReadable: session.ConversationReadable },
             caller.ContextUser,
         );
         if (decision.Allowed === false) {

package/src/realtimeWidget/WidgetRouter.ts

@@ -13,10 +13,11 @@
 import { Router, json, type Request, type Response } from 'express';
 import { rateLimit, ipKeyGenerator } from 'express-rate-limit';
 import { LogStatus } from '@memberjunction/core';
+import type { ProofPublicJwk } from '@memberjunction/global';
 import { configInfo, type WidgetConfig } from '../config.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { RegisterMagicLinkAuthProvider } from '../auth/magicLink/MagicLinkRouter.js';
-import { WidgetSessionService, type MintGuestSessionResult } from './WidgetSessionService.js';
+import { WidgetSessionService, WIDGET_REFRESH_PATH, type MintGuestSessionResult } from './WidgetSessionService.js';
 import { LooksLikeBot } from './widgetCore.js';
 
 /** The mount path for the widget public router (`/widget`). */
@@ -54,7 +55,9 @@ function ensureWidgetSigning(publicUrl: string, widgetConfig: WidgetConfig): voi
 export function CreateWidgetHandler(publicUrl: string, config: WidgetConfig): { publicRouter: Router; authenticatedRouter: Router } {
   ensureWidgetSigning(publicUrl, config);
 
-  const service = new WidgetSessionService(publicUrl, config);
+  // A widget may hand an anonymous guest only a scope-isolated role (MJ#6043); the opt-in list is the one
+  // magic-link invites already use, so an admin declares "safe for anonymous visitors" in one place.
+  const service = new WidgetSessionService(publicUrl, config, { GrantableRoleNames: configInfo.magicLink?.grantableRoleNames ?? [] });
 
   // Per-instance DYNAMIC mint limiter (W6 hardening): keyed by (widgetKey + IP) so each widget
   // deployment gets its own bucket and one abusive IP can't exhaust a shared instance's budget for
@@ -80,7 +83,7 @@ export function CreateWidgetHandler(publicUrl: string, config: WidgetConfig): {
     await handleMint(service, req, res, false);
   });
 
-  publicRouter.post('/session/refresh', json(), mintLimiter, async (req: Request, res: Response) => {
+  publicRouter.post(WIDGET_REFRESH_PATH, json(), mintLimiter, async (req: Request, res: Response) => {
     await handleMint(service, req, res, true);
   });
 
@@ -171,14 +174,26 @@ async function handleUpgrade(service: WidgetSessionService, req: Request, res: R
   res.status(status).json(result);
 }
 
+/** Extracts a raw JWT from an `Authorization: Bearer <token>` header, or undefined when absent/malformed. */
+function extractBearerToken(authHeader: string | undefined): string | undefined {
+  if (!authHeader) {
+    return undefined;
+  }
+  const match = /^Bearer\s+(\S+)$/i.exec(authHeader.trim());
+  const token = match?.[1]?.trim();
+  return token && token.length > 0 ? token : undefined;
+}
+
 /** Shared mint/refresh handler — parses the request, calls the service, maps the status. */
 async function handleMint(service: WidgetSessionService, req: Request, res: Response, refresh: boolean): Promise<void> {
-  const body = (req.body ?? {}) as { widgetKey?: string; hostAssertion?: string; visitorKey?: string };
+  const body = (req.body ?? {}) as { widgetKey?: string; hostAssertion?: string; visitorKey?: string; proofKey?: unknown };
   const widgetKey = typeof body.widgetKey === 'string' ? body.widgetKey : '';
   if (!widgetKey) {
     res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
     return;
   }
+  // The service validates the key's shape (ToProofPublicJwk) and refuses anything that is not a public P-256 JWK.
+  const proofKey = body.proofKey === undefined ? undefined : (body.proofKey as ProofPublicJwk);
 
   // W6 hardening: coarse bot/automation rejection before any DB lookup or token mint. Returns the same
   // 403 as a policy rejection so a probe can't distinguish "bot-blocked" from "bad key/origin".
@@ -193,6 +208,9 @@ async function handleMint(service: WidgetSessionService, req: Request, res: Resp
     origin,
     hostAssertion: typeof body.hostAssertion === 'string' ? body.hostAssertion : undefined,
     visitorKey: typeof body.visitorKey === 'string' ? body.visitorKey : undefined,
+    BearerToken: refresh ? extractBearerToken(req.get('authorization')) : undefined,
+    Proof: refresh ? req.get('dpop') : undefined,
+    ProofKey: refresh ? undefined : proofKey,
     audit: { ipAddress: req.ip, userAgent: req.get('user-agent') ?? undefined, origin },
   };
   const result = refresh ? await service.RefreshGuestSession(input) : await service.MintGuestSession(input);

package/src/realtimeWidget/WidgetSessionService.ts

@@ -9,20 +9,22 @@
  * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
  * carried in the token, plus best-effort structured audit logging. The minted
  * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
- * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ * JWKS) and synthesized into a constrained guest principal by `BuildMagicLinkSessionUser`.
  *
  * @module @memberjunction/server/widget
  */
 
+import { createPublicKey } from 'node:crypto';
+import jwt from 'jsonwebtoken';
 import { Metadata, RunView, UserInfo, LogError, LogStatus } from '@memberjunction/core';
-import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
+import { ComputeJwkThumbprint, MJLruCache, ToProofPublicJwk, UUIDsEqual, VerifyProofOfPossessionJwt, type ProofPublicJwk } from '@memberjunction/global';
 import type { MJConversationWidgetInstanceEntity, MJConversationEntity } from '@memberjunction/core-entities';
 import { ResolveConfiguredPrincipal } from '../auth/principals.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { GenerateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
 import { configInfo, type WidgetConfig } from '../config.js';
-import { BuildWidgetGuestClaims, EvaluateWidgetMint, ParseEnabledChannels, type WidgetMintErrorCode } from './widgetCore.js';
+import { BuildWidgetGuestClaims, EvaluateWidgetMint, IsIsolatedGuestRole, ParseEnabledChannels, type GuestRolePolicy, type WidgetMintErrorCode } from './widgetCore.js';
 import { VerifyHostAssertion, type HostAssertedIdentity } from './host-identity.js';
 import { WriteReturningVisitorRecap } from '../agentSessions/ReturningVisitorRecap.js';
 import { ResolveIdentityByEmail, MergeVisitorIdentity, ForgetVisitor, type ResolvedVisitorIdentity } from './visitorIdentity.js';
@@ -33,6 +35,43 @@ const CONVERSATIONS_ENTITY = 'MJ: Conversations';
 /** Shape of the durable visitor anchor key (opaque base64url, same alphabet as generateSessionId). */
 const VISITOR_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 
+/**
+ * Maximum clock-skew / late-timer grace window (seconds) after `exp` during which
+ * `RefreshGuestSession` still accepts a widget guest Bearer token and preserves its `mj_sid`.
+ */
+export const REFRESH_GRACE_SECONDS = 300;
+
+/**
+ * Hard end of a widget guest session (seconds after its first mint, `mj_sid_iat`). Refresh keeps the
+ * visitor's `mj_sid`, so without an end a token captured once could be renewed forever and keep reading
+ * that visitor's conversations; past this point refresh is refused and no token outlives it.
+ */
+export const MAX_GUEST_SESSION_SECONDS = 12 * 3600;
+
+/**
+ * The least lifetime a refreshed token may have. Refresh is refused once less than this remains before the hard end,
+ * so the last refresh gets the 403 that makes the widget start a new session. It must exceed the widget's refresh
+ * lead (60 s before `exp`): a token issued with less would be due for refresh at once, every time, until the rate
+ * limiter answered 429 instead. It also keeps a re-minted token's `exp` after its `iat`.
+ */
+export const MIN_REFRESHED_TOKEN_SECONDS = 120;
+
+/** The refresh route's path under the widget mount; the refresh proof must name it (`htu`). */
+export const WIDGET_REFRESH_PATH = '/session/refresh';
+
+/** How far a refresh proof's signing time (`iat`) may be from the server clock, either way. */
+export const REFRESH_PROOF_MAX_SKEW_SECONDS = 60;
+
+/** The session a valid refresh token belongs to, carried into the re-minted token unchanged. */
+interface RefreshableGuestSession {
+  /** `mj_sid`. */
+  SessionId: string;
+  /** `mj_sid_iat`: when the session was first minted, epoch seconds. */
+  StartedAtSeconds: number;
+  /** `cnf.jkt`: the thumbprint of the key the session is bound to. */
+  KeyThumbprint: string;
+}
+
 /** Resolved returning-visitor anchor for a mint: the durable key + the prior conversation to chain from. */
 interface ReturningVisitorResolution {
   /** The durable VisitorKey to persist as a cookie (validated-presented or freshly minted). */
@@ -67,6 +106,19 @@ export interface MintGuestSessionInput {
    * server mints a fresh one. Ignored entirely when remembering is off.
    */
   visitorKey?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  /**
+   * The caller's current guest session JWT (`Authorization: Bearer <token>`), required by
+   * `RefreshGuestSession` so a refresh proves possession of the session being renewed and
+   * preserves its `mj_sid` (`sessionId`).
+   */
+  BearerToken?: string;
+  /**
+   * The widget's proof key (public P-256 JWK, from the mint body's `proofKey`). Its thumbprint is signed into
+   * the token as `cnf.jkt`; a token minted without one cannot be refreshed.
+   */
+  ProofKey?: ProofPublicJwk;
+  /** The refresh proof (`DPoP` header), signed by the key registered at mint. Required by `RefreshGuestSession`. */
+  Proof?: string;
   audit?: WidgetMintAuditContext;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
@@ -210,6 +262,8 @@ export class WidgetSessionService {
   constructor(
     private readonly publicUrl: string,
     private readonly config: WidgetConfig,
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    private readonly guestRolePolicy: GuestRolePolicy = { GrantableRoleNames: [] },
   ) {}
 
   /**
@@ -237,11 +291,11 @@ export class WidgetSessionService {
         return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
       }
 
-      const guestRoleName = this.resolveGuestRoleName(widget.GuestRoleID);
-      if (!guestRoleName) {
-        LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
-        return this.audited({ success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' }, input, widget);
+      const guestRole = this.resolveIsolatedGuestRole(widget);
+      if (guestRole.ok === false) {
+        return this.audited(guestRole.refusal, input, widget);
       }
+      const guestRoleName = guestRole.name;
 
       // D1 host-identity strategy: a HostIdentity widget MUST present a valid host assertion.
       let hostIdentity: HostAssertedIdentity | undefined;
@@ -267,7 +321,21 @@ export class WidgetSessionService {
       // anonymous trail to that record and surface the pair so the client stamps the new conversation.
       const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
 
-      return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity), input, widget);
+      let proofKeyThumbprint: string | undefined;
+      if (input.ProofKey !== undefined) {
+        const proofKey = ToProofPublicJwk(input.ProofKey);
+        if (!proofKey) {
+          LogError(`[Widget] Mint for widget ${widget.ID} refused: the proof key is not a public P-256 JWK.`);
+          return this.audited({ success: false, errorCode: 'not_found', error: 'Widget mint rejected.' }, input, widget);
+        }
+        proofKeyThumbprint = await ComputeJwkThumbprint(proofKey);
+      }
+
+      return this.audited(
+        this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, undefined, proofKeyThumbprint),
+        input,
+        widget,
+      );
     } catch (e) {
       LogError(e);
       return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
@@ -275,12 +343,147 @@ export class WidgetSessionService {
   }
 
   /**
-   * Refreshes a live guest session. The widget always holds its public key, so a
-   * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
-   * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+   * Refreshes a live guest session while preserving its per-visitor `sessionId` (`mj_sid`).
+   * Requires the caller's current widget guest JWT (`input.BearerToken`), verified against the
+   * magic-link signing key with a {@link REFRESH_GRACE_SECONDS} post-expiry grace window, and
+   * bound to the resolved widget instance (`mj_widget_id === widget.ID`, `mj_anon === true`,
+   * `mj_magic_link === true`). Any failure returns the same uniform 403 shape as an unknown widget key.
    */
   public async RefreshGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult> {
-    return this.MintGuestSession(input);
+    try {
+      const contextUser = this.resolveLookupUser();
+      if (!contextUser) {
+        LogError('[Widget] No lookup context user available; server not configured.');
+        return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+      }
+
+      const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+      if (!widget) {
+        return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, undefined);
+      }
+
+      const eligibility = EvaluateWidgetMint(
+        { Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality },
+        input.origin,
+      );
+      if (!eligibility.ok) {
+        return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
+      }
+
+      const guestRole = this.resolveIsolatedGuestRole(widget);
+      if (guestRole.ok === false) {
+        return this.audited(guestRole.refusal, input, widget);
+      }
+      const guestRoleName = guestRole.name;
+
+      let hostIdentity: HostAssertedIdentity | undefined;
+      if (widget.AuthStrategy === 'HostIdentity') {
+        const verified = this.verifyHost(widget, input.hostAssertion);
+        if (!verified) {
+          return this.audited({ success: false, errorCode: 'host_assertion_invalid', error: 'Host identity assertion invalid.' }, input, widget);
+        }
+        hostIdentity = verified;
+      }
+
+      const existingSession = await this.verifyRefreshRequest(input.BearerToken, input.Proof, widget.ID);
+      if (!existingSession) {
+        return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, widget);
+      }
+
+      const returningVisitor = await this.resolveReturningVisitor(widget, input.visitorKey, contextUser);
+      const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
+
+      return this.audited(
+        this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, existingSession.KeyThumbprint),
+        input,
+        widget,
+      );
+    } catch (e) {
+      LogError(e);
+      return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+    }
+  }
+
+  /**
+   * Verifies a `RefreshGuestSession` request: the caller's current widget guest JWT and the proof that the
+   * caller holds the key the token is bound to. Returns the session to carry forward, or `null` when the token
+   * is missing, tampered, expired past {@link REFRESH_GRACE_SECONDS}, past the session's hard end
+   * ({@link MAX_GUEST_SESSION_SECONDS}) or without a session start, non-anonymous, minted for a different
+   * widget, issued by another deployment, or not bound to a key; or when the proof is missing or not made by
+   * that key for this request and token.
+   */
+  private async verifyRefreshRequest(bearerToken: string | undefined, proof: string | undefined, widgetId: string): Promise<RefreshableGuestSession | null> {
+    const session = this.verifyRefreshBearerToken(bearerToken, widgetId);
+    if (!session) {
+      return null;
+    }
+    const verification = await VerifyProofOfPossessionJwt(proof ?? '', {
+      Method: 'POST',
+      PathSuffix: WIDGET_REFRESH_PATH,
+      AccessToken: (bearerToken ?? '').trim(),
+      NowSeconds: Math.floor(Date.now() / 1000),
+      MaxSkewSeconds: REFRESH_PROOF_MAX_SKEW_SECONDS,
+    });
+    if (verification.Valid === false) {
+      LogError(`[Widget] Refresh proof refused for widget ${widgetId} (${verification.Reason}).`);
+      return null;
+    }
+    if (verification.Thumbprint !== session.KeyThumbprint) {
+      LogError(`[Widget] Refresh proof refused for widget ${widgetId}: signed by a key the token is not bound to.`);
+      return null;
+    }
+    return session;
+  }
+
+  /** The token half of {@link verifyRefreshRequest}: everything except the proof. */
+  private verifyRefreshBearerToken(bearerToken: string | undefined, widgetId: string): RefreshableGuestSession | null {
+    const token = (bearerToken ?? '').trim();
+    if (!token) {
+      return null;
+    }
+    try {
+      const jwk = MagicLinkKeyManager.Instance.GetJWKS().keys[0];
+      if (!jwk) {
+        return null;
+      }
+      const publicKey = createPublicKey({ key: { ...jwk }, format: 'jwk' });
+      const verified = jwt.verify(token, publicKey, {
+        algorithms: ['RS256'],
+        audience: this.config.audience,
+        issuer: this.publicUrl,
+        ignoreExpiration: true,
+      });
+      if (typeof verified !== 'object' || verified === null) {
+        return null;
+      }
+      const payload = verified as jwt.JwtPayload;
+      const nowSeconds = Math.floor(Date.now() / 1000);
+      if (typeof payload.exp !== 'number' || nowSeconds > payload.exp + REFRESH_GRACE_SECONDS) {
+        return null;
+      }
+      if (payload.mj_magic_link !== true || payload.mj_anon !== true) {
+        return null;
+      }
+      if (typeof payload.mj_widget_id !== 'string' || !UUIDsEqual(payload.mj_widget_id, widgetId)) {
+        return null;
+      }
+      const sid = typeof payload.mj_sid === 'string' ? payload.mj_sid.trim() : '';
+      if (sid.length === 0) {
+        return null;
+      }
+      const startedAt = payload.mj_sid_iat;
+      if (typeof startedAt !== 'number' || !Number.isFinite(startedAt) || startedAt + MAX_GUEST_SESSION_SECONDS - nowSeconds < MIN_REFRESHED_TOKEN_SECONDS) {
+        return null;
+      }
+      const keyThumbprint = typeof payload.cnf?.jkt === 'string' ? payload.cnf.jkt : '';
+      if (keyThumbprint.length === 0) {
+        return null;
+      }
+      return { SessionId: sid, StartedAtSeconds: startedAt, KeyThumbprint: keyThumbprint };
+    } catch (e) {
+      LogError(`[Widget] Refresh token verification failed for widget ${widgetId}: ${e instanceof Error ? e.message : String(e)}`);
+      return null;
+    }
   }
 
   /**
@@ -343,7 +546,7 @@ export class WidgetSessionService {
    * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
    * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
    *
-   * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+   * This converges on the SAME `AuthProviderFactory` + `BuildMagicLinkSessionUser` path as the guest
    * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
    * throws for business failures — returns a structured result.
    */
@@ -412,12 +615,18 @@ export class WidgetSessionService {
     hostIdentity?: HostAssertedIdentity,
     returningVisitor?: ReturningVisitorResolution,
     resolvedIdentity?: ResolvedVisitorIdentity,
+    existingSession?: RefreshableGuestSession,
+    proofKeyThumbprint?: string,
   ): MintGuestSessionResult {
     const nowSeconds = Math.floor(Date.now() / 1000);
     const ttlMinutes = widget.SessionTTLMinutes || this.config.defaultSessionTtlMinutes;
-    // Generated once and returned to the client: the widget stamps Conversation.ExternalID with
-    // this id so the Widget Guest RLS filters ({{ScopeResourceID}}) isolate this guest's rows.
-    const sessionId = GenerateSessionId();
+    // Generated once on initial mint and preserved across refreshes: the widget (and server-side
+    // voice session creation) stamps Conversation.ExternalID with this id so the Widget Guest RLS
+    // filters ({{ScopeResourceID}}) and AuthorizeSessionAccess isolate this guest's rows.
+    const sessionId = existingSession?.SessionId ?? GenerateSessionId();
+    const startedAtSeconds = existingSession?.StartedAtSeconds ?? nowSeconds;
+    // No token outlives the session's hard end, so the cap holds for API calls as well as for refresh.
+    const ttlSeconds = Math.min(ttlMinutes * 60, startedAtSeconds + MAX_GUEST_SESSION_SECONDS - nowSeconds);
     const claims = BuildWidgetGuestClaims({
       issuer: this.publicUrl,
       audience: this.config.audience,
@@ -427,7 +636,9 @@ export class WidgetSessionService {
       applicationId: widget.ApplicationID,
       guestRoleName,
       nowSeconds,
-      ttlSeconds: ttlMinutes * 60,
+      ttlSeconds,
+      sessionStartedAtSeconds: startedAtSeconds,
+      proofKeyThumbprint,
       hostIdentity,
       // RV1/RV2/RV4: carry the returning-visitor anchor + resolved identity as claims so the voice path
       // (server-created conversation) stamps the same fields the text path stamps client-side.
@@ -650,6 +861,7 @@ export class WidgetSessionService {
         ExtraFilter: `VisitorKey = '${visitorKey}' AND ApplicationID = '${applicationId.replace(/'/g, "''")}'`,
         OrderBy: '__mj_CreatedAt DESC',
         MaxRows: 1,
+        SkipTotalRowCount: true,
         Fields: ['ID'],
         ResultType: 'simple',
       },
@@ -674,6 +886,7 @@ export class WidgetSessionService {
         EntityName: WIDGET_ENTITY,
         ExtraFilter: `PublicKey = '${key.replace(/'/g, "''")}'`,
         MaxRows: 1,
+        SkipTotalRowCount: true,
         ResultType: 'entity_object',
       },
       contextUser,
@@ -692,6 +905,30 @@ export class WidgetSessionService {
     return role?.Name ?? null;
   }
 
+  /**
+   * The ONE decision, for mint and refresh alike, of which role a guest token carries: the widget's `GuestRoleID`
+   * must resolve, and it must be a role the deployment may hand to an anonymous visitor
+   * ({@link IsIsolatedGuestRole}). Both refusals are the admin's to fix, so both are logged with the widget id;
+   * the visitor gets a uniform rejection.
+   */
+  private resolveIsolatedGuestRole(
+    widget: MJConversationWidgetInstanceEntity,
+  ): { ok: true; name: string } | { ok: false; refusal: MintGuestSessionResult } {
+    const name = this.resolveGuestRoleName(widget.GuestRoleID);
+    if (!name) {
+      LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
+      return { ok: false, refusal: { success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' } };
+    }
+    if (!IsIsolatedGuestRole(name, this.guestRolePolicy)) {
+      LogError(
+        `[Widget] Widget ${widget.ID} grants guest role '${name}', whose row filters do not isolate anonymous visitors ` +
+          `from each other. Use the Widget Guest role, or list '${name}' in magicLink.grantableRoleNames to allow it (MJ#6043).`,
+      );
+      return { ok: false, refusal: { success: false, errorCode: 'guest_role_not_isolated', error: 'Widget mint rejected.' } };
+    }
+    return { ok: true, name };
+  }
+
   /** Resolves the server-side context user used to READ widget config (not the guest principal). */
   private resolveLookupUser(): UserInfo | null {
     return ResolveConfiguredPrincipal(this.config.contextUserForLookup, 'Widget');

package/src/realtimeWidget/host-identity.ts

@@ -5,7 +5,7 @@
  * `POST /widget/session`, which verifies it against the host's registered public key
  * and folds the host-provided identity into the minted guest claims. The minted token
  * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
- * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * `BuildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
  * session-validation provider (it converges on the one pathway, per D1).
  *
  * Pure + unit-testable: verification takes the PEM as an argument.

package/src/realtimeWidget/visitorIdentity.ts

@@ -79,6 +79,7 @@ export async function ResolveIdentityByEmail(
         ExtraFilter: `${emailField} = '${trimmed.replace(/'/g, "''")}'`,
         Fields: pkNames,
         MaxRows: 1,
+        SkipTotalRowCount: true,
         ResultType: 'simple',
       },
       contextUser,

package/src/realtimeWidget/widgetCore.ts

@@ -12,8 +12,9 @@
  * @module @memberjunction/server/widget
  */
 
-import { BuildSessionClaims } from '../auth/magicLink/magicLinkCore.js';
+import { BuildSessionClaims, IsRoleGrantable } from '../auth/magicLink/magicLinkCore.js';
 import type { MagicLinkJWTClaims } from '../auth/magicLink/types.js';
+import { NormalizeOrigin } from '../requestOrigin.js';
 
 /**
  * The magic-link resource-scope `resourceType` used for a widget guest session. Pairs with the
@@ -31,8 +32,29 @@ export type WidgetMintErrorCode =
     | 'host_assertion_invalid'
     | 'upgrade_not_enabled'
     | 'invalid_email'
+    | 'guest_role_not_isolated'
     | 'server_error';
 
+/**
+ * The one stock role whose row filters key on the per-visitor scope id (`{{ScopeResourceID}}`) rather than on
+ * `UserID`. Every anonymous widget guest authenticates as the ONE shared Anonymous user, so a role whose filters
+ * compare `UserID` (the stock `UI` role, for instance) lets every guest read and update every other guest's rows
+ * through the generic API (MJ#6043). A widget may therefore grant only this role, or a role the deployment has
+ * explicitly listed as safe for anonymous visitors — the same opt-in list magic-link invites use.
+ */
+export const WIDGET_GUEST_ROLE_NAME = 'Widget Guest';
+
+/** Which roles, beyond {@link WIDGET_GUEST_ROLE_NAME}, a deployment allows a widget to hand to an anonymous guest. */
+export interface GuestRolePolicy {
+  /** Role names (case-insensitive) the deployment has opted in, normally `magicLink.grantableRoleNames`. */
+  GrantableRoleNames: readonly string[];
+}
+
+/** Pure check: may a widget grant `roleName` to an anonymous guest under `policy`? See {@link WIDGET_GUEST_ROLE_NAME}. */
+export function IsIsolatedGuestRole(roleName: string | null | undefined, policy: GuestRolePolicy): boolean {
+  return IsRoleGrantable(roleName, WIDGET_GUEST_ROLE_NAME, policy.GrantableRoleNames);
+}
+
 /** The minimal widget-instance shape the pure validators need (a subset of the entity). */
 export interface WidgetInstanceEligibilityInput {
   Status: string;
@@ -56,12 +78,12 @@ export function ParseAllowedOrigins(allowedOrigins: string | null | undefined):
     list = JSON.parse(raw);
   } catch {
     // Not JSON — tolerate a CSV form.
-    return raw.split(',').map((s) => normalizeOrigin(s)).filter((s): s is string => !!s);
+    return raw.split(',').map((s) => NormalizeOrigin(s)).filter((s): s is string => !!s);
   }
   if (!Array.isArray(list)) {
     return [];
   }
-  return list.filter((s): s is string => typeof s === 'string').map(normalizeOrigin).filter((s): s is string => !!s);
+  return list.filter((s): s is string => typeof s === 'string').map(NormalizeOrigin).filter((s): s is string => !!s);
 }
 
 /** @deprecated Use {@link ParseAllowedOrigins}. */
@@ -69,11 +91,6 @@ export function parseAllowedOrigins(allowedOrigins: string | null | undefined):
   return ParseAllowedOrigins(allowedOrigins);
 }
 
-/** Lowercases + trims an origin and strips a trailing slash for stable comparison. */
-function normalizeOrigin(origin: string): string {
-  return origin.trim().toLowerCase().replace(/\/+$/, '');
-}
-
 /**
  * Parses the widget's `EnabledChannels` column into a clean list of channel names (Phase 2). Accepts a
  * JSON array (preferred, e.g. `["Whiteboard"]`) or a comma-separated string (tolerated). Returns an
@@ -108,7 +125,7 @@ export function IsOriginAllowed(requestOrigin: string | null | undefined, allowe
   if (!requestOrigin || allowedOrigins.length === 0) {
     return false;
   }
-  const candidate = normalizeOrigin(requestOrigin);
+  const candidate = NormalizeOrigin(requestOrigin);
   return allowedOrigins.some((o) => o === candidate);
 }
 
@@ -206,6 +223,10 @@ export function BuildWidgetGuestClaims(args: {
   guestRoleName: string;
   nowSeconds: number;
   ttlSeconds: number;
+  /** When `sessionId` was first minted (`mj_sid_iat`); a refresh passes the original. Defaults to `nowSeconds`. */
+  sessionStartedAtSeconds?: number;
+  /** Thumbprint of the widget's proof key (`cnf.jkt`). Without it the token cannot be refreshed. */
+  proofKeyThumbprint?: string;
   /**
    * Host-asserted identity for a `host-identity` session. Its email/name are carried as
    * INFORMATIONAL claims only — the principal-resolving `email`/`sub` remain the shared
@@ -248,6 +269,10 @@ export function BuildWidgetGuestClaims(args: {
   });
   // Additive widget claim — lets the synthesized principal be bound to one widget.
   claims.mj_widget_id = args.widgetId;
+  claims.mj_sid_iat = args.sessionStartedAtSeconds ?? args.nowSeconds;
+  if (args.proofKeyThumbprint) {
+    claims.cnf = { jkt: args.proofKeyThumbprint };
+  }
   if (args.hostIdentity) {
     claims.given_name = args.hostIdentity.firstName ?? claims.given_name;
     claims.family_name = args.hostIdentity.lastName ?? claims.family_name;

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -41,7 +41,7 @@ export interface WidgetGuestRunContext {
  * Returns elevation context when the request is a public web-widget guest, else `null` (the common
  * case — every non-widget request). A widget guest is identified by the synthesized principal's
  * `IsMagicLinkAnonymous` flag plus a `WidgetGuestContext.WidgetID` (sourced from the signed
- * `mj_widget_id` claim by `buildMagicLinkSessionUser`). The widget instance is loaded under the
+ * `mj_widget_id` claim by `BuildMagicLinkSessionUser`). The widget instance is loaded under the
  * SYSTEM principal so resolving the pinned agent does not depend on the guest's narrow grants.
  *
  * Never throws: a resolution failure (no system user, widget not found, read error) returns `null`,
@@ -169,6 +169,7 @@ export function ElevateUserPayload(userPayload: UserPayload, elevatedUser: UserI
     email: elevatedUser.Email,
     userRecord: elevatedUser,
     isSystemUser: true,
+    ElevatedFrom: userPayload.userRecord,
   };
 }
 
@@ -189,6 +190,7 @@ async function loadWidgetById(
       EntityName: WIDGET_ENTITY,
       ExtraFilter: `ID = '${widgetId.replace(/'/g, "''")}'`,
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'entity_object',
     },
     elevatedUser,