@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/auth/loginEmailResolution.js

@@ -0,0 +1,47 @@
+/**
+ * Which email a verified login is matched to a User record by, and whether that differs from the
+ * identity the token carries.
+ *
+ * The server links a login to a User row by email alone. `USER_EMAIL_MAP` can rewrite that email
+ * before the lookup, which makes a login run as a different person's record. That is a legitimate
+ * development aid, but it is silent, so a misconfigured map on a shared machine looks exactly like
+ * an authentication bug. These helpers keep the token's identity next to the one actually used, so
+ * the session audit and the server log can say when the two differ.
+ */
+/**
+ * Resolves the lookup email for a verified token. The map applies only to the email claim, with an
+ * exact (case-sensitive) key match, as it always has; a preferred username is never remapped.
+ *
+ * Named without "login"/"auth"/"verify": CodeQL treats calls with those words as authentication
+ * actions and reports the `if (!token)` guard above this call in GetUserPayload as a user-controlled
+ * bypass. This is a plain lookup, not an authentication step.
+ */
+export function ResolveUserLookupEmail(claims, emailMap) {
+    if (!claims.email) {
+        return { TokenEmail: claims.preferredUsername, LookupEmail: claims.preferredUsername, Remapped: false };
+    }
+    const mapped = emailMap?.[claims.email];
+    const lookupEmail = mapped ?? claims.email;
+    return { TokenEmail: claims.email, LookupEmail: lookupEmail, Remapped: mapped !== undefined && !EmailsMatch(mapped, claims.email) };
+}
+/** Case-insensitive, whitespace-trimmed comparison, matching how the User lookup compares emails. */
+export function EmailsMatch(a, b) {
+    if (!a || !b) {
+        return false;
+    }
+    return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+/**
+ * The startup warning for a configured `USER_EMAIL_MAP`, or null when the map is absent or rewrites
+ * nothing. Lists every entry so whoever starts the server can see whose record each login will use.
+ */
+export function DescribeUserEmailMap(emailMap) {
+    const entries = Object.entries(emailMap ?? {}).filter(([from, to]) => !EmailsMatch(from, to));
+    if (entries.length === 0) {
+        return null;
+    }
+    const lines = entries.map(([from, to]) => `  ${from} -> ${to}`).join('\n');
+    return (`[Auth] USER_EMAIL_MAP is set: ${entries.length} login email(s) will be matched to a different user's record. ` +
+        `A login with the first address runs as the user with the second. Remove the setting unless this is intended.\n${lines}`);
+}
+//# sourceMappingURL=loginEmailResolution.js.map

package/dist/auth/loginEmailResolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginEmailResolution.js","sourceRoot":"","sources":["../../src/auth/loginEmailResolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA2B,EAAE,QAA4C;IAC9G,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtI,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,CAAqB,EAAE,CAAqB;IACtE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4C;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,CACL,iCAAiC,OAAO,CAAC,MAAM,gEAAgE;QAC/G,iHAAiH,KAAK,EAAE,CACzH,CAAC;AACJ,CAAC"}

package/dist/auth/magicLink/MagicLinkKeys.d.ts

@@ -10,6 +10,13 @@
  */
 import { BaseSingleton } from '@memberjunction/global';
 import type { MagicLinkJWTClaims } from './types.js';
+/**
+ * True when the process is NOT running with `NODE_ENV=production`. This is the same
+ * production/local-dev line MJServer already uses to forbid local dev auth in production.
+ */
+export declare function IsMagicLinkLocalDevEnvironment(env?: NodeJS.ProcessEnv): boolean;
+/** Warning logged when a non-local-dev server falls back to an ephemeral keypair. */
+export declare const EPHEMERAL_MAGIC_LINK_KEY_WARNING: string;
 /** A single JSON Web Key plus the metadata jwks-rsa needs to match it. */
 interface PublishedJWK extends JsonWebKey {
     kid: string;
@@ -28,26 +35,67 @@ export declare class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManag
     private publicKey?;
     private _kid;
     private _initialized;
+    private _isEphemeral;
     constructor();
     static get Instance(): MagicLinkKeyManager;
     get IsInitialized(): boolean;
+    /**
+     * True when no private key was configured and the keypair was generated for this process
+     * only. Tokens signed with an ephemeral key do not survive a restart and do not validate on
+     * other instances. Downstream code should ask this rather than reading the raw config value.
+     */
+    get IsEphemeral(): boolean;
     get Kid(): string;
     /**
      * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
      * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     *
+     * @param env - process environment used to decide whether the ephemeral fallback is a local-dev
+     *   default (verbose-only notice) or a production misconfiguration (warning). Defaults to `process.env`.
      */
-    Initialize(privateKeyPem?: string): void;
+    Initialize(privateKeyPem?: string, env?: NodeJS.ProcessEnv): void;
     /**
-     * Signs a set of magic-link claims and returns the compact JWT.
+     * Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
      * `iat`/`exp` are expected to already be set on the claims.
      */
-    Sign(claims: MagicLinkJWTClaims): string;
+    Sign<T extends object>(claims: T): string;
+    /**
+     * Verifies a magic-link session JWT signed by this key manager (`RS256`, `mj_magic_link === true`).
+     * Returns `null` if invalid, expired, or forged.
+     */
+    VerifySessionToken(token: string, options?: {
+        issuer?: string;
+        audience?: string;
+    }): MagicLinkJWTClaims | null;
+    /**
+     * Signs a redirect binding JWT (`mj_purpose = 'magic-link-redirect'`) that cryptographically
+     * binds a validated `redirectUrl` to a specific invite's `tokenHash`.
+     *
+     * Note: Expiration is intentionally omitted from the redirect binding JWT because the database
+     * invite row's `ExpiresAt` (enforced atomically during `RedeemInvite`) is the authoritative,
+     * mutable expiration — allowing `UpdateInviteExpiry()` to extend an invite without invalidating
+     * an already-delivered `&rt=` parameter.
+     */
+    SignRedirectBinding(tokenHash: string, redirectUrl: string, _expiresAtEpochSeconds?: number): string;
+    /**
+     * Verifies a redirect binding JWT produced by {@link SignRedirectBinding} and ensures it matches
+     * `expectedTokenHash` (preventing cross-invite substitution) and carries a valid `http(s)` URL.
+     * Ignores JWT `exp` so bindings minted before an `UpdateInviteExpiry()` extension remain valid
+     * while the underlying invite row is valid. Returns the bound URL or `null`.
+     */
+    VerifyRedirectBinding(bindingToken: string, expectedTokenHash: string): string | null;
     /**
      * Returns the JWKS document (public key set) for the JWKS endpoint.
      */
     GetJWKS(): {
         keys: PublishedJWK[];
     };
+    /**
+     * Local dev (NODE_ENV not 'production'): the ephemeral fallback is the designed behavior and
+     * fires on every boot, so the notice stays verbose-only. Otherwise it is a data-loss-on-restart
+     * misconfiguration, so it is a warning in the default output.
+     */
+    private reportEphemeralKey;
     private ensureInitialized;
     /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
     private normalizePem;

package/dist/auth/magicLink/MagicLinkKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IA+B/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAK/C;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}
+{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE5F;AAED,qFAAqF;AACrF,eAAO,MAAM,gCAAgC,QAMJ,CAAC;AAE1C,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED;;;;OAIG;IACH,IAAW,WAAW,IAAI,OAAO,CAEhC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;;;;OAMG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI;IAsBrF;;;OAGG;IACI,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;IAKhD;;;OAGG;IACI,kBAAkB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,kBAAkB,GAAG,IAAI;IAyB5B;;;;;;;;OAQG;IACI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM;IAe3G;;;;;OAKG;IACI,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IA8B5F;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}

package/dist/auth/magicLink/MagicLinkKeys.js

@@ -9,9 +9,23 @@
  * @module @memberjunction/server/auth/magicLink
  */
 import { BaseSingleton } from '@memberjunction/global';
-import { LogStatusEx } from '@memberjunction/core';
+import { LogStatusEx, LogWarning } from '@memberjunction/core';
 import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash } from 'node:crypto';
 import jwt from 'jsonwebtoken';
+/**
+ * True when the process is NOT running with `NODE_ENV=production`. This is the same
+ * production/local-dev line MJServer already uses to forbid local dev auth in production.
+ */
+export function IsMagicLinkLocalDevEnvironment(env = process.env) {
+    return env.NODE_ENV?.trim().toLowerCase() !== 'production';
+}
+/** Warning logged when a non-local-dev server falls back to an ephemeral keypair. */
+export const EPHEMERAL_MAGIC_LINK_KEY_WARNING = '[MagicLink] No rsaPrivateKey configured and NODE_ENV=production — generated an EPHEMERAL RS256 keypair. ' +
+    'Magic-link session tokens signed with it will stop validating when this process restarts, and they will not ' +
+    'validate on any other MJAPI instance behind the same load balancer, because each process generates its own key. ' +
+    'To fix, generate one RSA private key (e.g. `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`) and set it ' +
+    'as magicLink.rsaPrivateKey in mj.config.cjs or as MJ_MAGIC_LINK_PRIVATE_KEY (raw or base64-encoded PEM), ' +
+    'using the same key on every instance.';
 /**
  * Manages the RS256 keypair used to sign and publish magic-link session tokens.
  * Singleton so the keypair (and therefore the `kid`) is stable for the process
@@ -27,6 +41,7 @@ export class MagicLinkKeyManager extends BaseSingleton {
         this.privateKeyPem = '';
         this._kid = '';
         this._initialized = false;
+        this._isEphemeral = false;
     }
     static get Instance() {
         return MagicLinkKeyManager.getInstance();
@@ -34,14 +49,25 @@ export class MagicLinkKeyManager extends BaseSingleton {
     get IsInitialized() {
         return this._initialized;
     }
+    /**
+     * True when no private key was configured and the keypair was generated for this process
+     * only. Tokens signed with an ephemeral key do not survive a restart and do not validate on
+     * other instances. Downstream code should ask this rather than reading the raw config value.
+     */
+    get IsEphemeral() {
+        return this._isEphemeral;
+    }
     get Kid() {
         return this._kid;
     }
     /**
      * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
      * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     *
+     * @param env - process environment used to decide whether the ephemeral fallback is a local-dev
+     *   default (verbose-only notice) or a production misconfiguration (warning). Defaults to `process.env`.
      */
-    Initialize(privateKeyPem) {
+    Initialize(privateKeyPem, env = process.env) {
         if (this._initialized) {
             return;
         }
@@ -53,16 +79,8 @@ export class MagicLinkKeyManager extends BaseSingleton {
         else {
             const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
             priv = privateKey;
-            // Verbose-only: on dev boxes with no configured key this fires on EVERY boot, and the
-            // ephemeral fallback is the designed behavior there — not a condition worth a log line in
-            // the default startup output. Deployments that care set the key; operators diagnosing
-            // magic-link session loss can re-run with verbose logging.
-            LogStatusEx({
-                message: '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
-                    'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
-                    '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
-                verboseOnly: true
-            });
+            this._isEphemeral = true;
+            this.reportEphemeralKey(env);
         }
         this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' });
         this.publicKey = createPublicKey(priv);
@@ -70,13 +88,95 @@ export class MagicLinkKeyManager extends BaseSingleton {
         this._initialized = true;
     }
     /**
-     * Signs a set of magic-link claims and returns the compact JWT.
+     * Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
      * `iat`/`exp` are expected to already be set on the claims.
      */
     Sign(claims) {
         this.ensureInitialized();
         return jwt.sign(claims, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
     }
+    /**
+     * Verifies a magic-link session JWT signed by this key manager (`RS256`, `mj_magic_link === true`).
+     * Returns `null` if invalid, expired, or forged.
+     */
+    VerifySessionToken(token, options) {
+        this.ensureInitialized();
+        try {
+            const publicPem = this.publicKey.export({ type: 'spki', format: 'pem' });
+            const verifyOptions = { algorithms: ['RS256'] };
+            if (options?.issuer) {
+                verifyOptions.issuer = options.issuer;
+            }
+            if (options?.audience) {
+                verifyOptions.audience = options.audience;
+            }
+            const decoded = jwt.verify(token, publicPem, verifyOptions);
+            if (!decoded || typeof decoded !== 'object') {
+                return null;
+            }
+            const claims = decoded;
+            if (claims.mj_magic_link !== true || typeof claims.sub !== 'string') {
+                return null;
+            }
+            return claims;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Signs a redirect binding JWT (`mj_purpose = 'magic-link-redirect'`) that cryptographically
+     * binds a validated `redirectUrl` to a specific invite's `tokenHash`.
+     *
+     * Note: Expiration is intentionally omitted from the redirect binding JWT because the database
+     * invite row's `ExpiresAt` (enforced atomically during `RedeemInvite`) is the authoritative,
+     * mutable expiration — allowing `UpdateInviteExpiry()` to extend an invite without invalidating
+     * an already-delivered `&rt=` parameter.
+     */
+    SignRedirectBinding(tokenHash, redirectUrl, _expiresAtEpochSeconds) {
+        this.ensureInitialized();
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        return jwt.sign({
+            mj_purpose: 'magic-link-redirect',
+            mj_th: tokenHash,
+            mj_redirect: redirectUrl,
+            iat: nowSeconds,
+        }, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
+    }
+    /**
+     * Verifies a redirect binding JWT produced by {@link SignRedirectBinding} and ensures it matches
+     * `expectedTokenHash` (preventing cross-invite substitution) and carries a valid `http(s)` URL.
+     * Ignores JWT `exp` so bindings minted before an `UpdateInviteExpiry()` extension remain valid
+     * while the underlying invite row is valid. Returns the bound URL or `null`.
+     */
+    VerifyRedirectBinding(bindingToken, expectedTokenHash) {
+        this.ensureInitialized();
+        try {
+            const publicPem = this.publicKey.export({ type: 'spki', format: 'pem' });
+            const decoded = jwt.verify(bindingToken, publicPem, {
+                algorithms: ['RS256'],
+                ignoreExpiration: true,
+            });
+            if (!decoded || typeof decoded !== 'object') {
+                return null;
+            }
+            const record = decoded;
+            if (record.mj_purpose !== 'magic-link-redirect' ||
+                record.mj_th !== expectedTokenHash ||
+                typeof record.mj_redirect !== 'string' ||
+                !record.mj_redirect) {
+                return null;
+            }
+            const parsed = new URL(record.mj_redirect);
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                return null;
+            }
+            return record.mj_redirect;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Returns the JWKS document (public key set) for the JWKS endpoint.
      */
@@ -85,6 +185,23 @@ export class MagicLinkKeyManager extends BaseSingleton {
         const jwk = this.publicKey.export({ format: 'jwk' });
         return { keys: [{ ...jwk, kid: this._kid, use: 'sig', alg: 'RS256' }] };
     }
+    /**
+     * Local dev (NODE_ENV not 'production'): the ephemeral fallback is the designed behavior and
+     * fires on every boot, so the notice stays verbose-only. Otherwise it is a data-loss-on-restart
+     * misconfiguration, so it is a warning in the default output.
+     */
+    reportEphemeralKey(env) {
+        if (!IsMagicLinkLocalDevEnvironment(env)) {
+            LogWarning(EPHEMERAL_MAGIC_LINK_KEY_WARNING);
+            return;
+        }
+        LogStatusEx({
+            message: '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+                'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+                '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
+            verboseOnly: true
+        });
+    }
     ensureInitialized() {
         if (!this._initialized) {
             throw new Error('MagicLinkKeyManager not initialized — call Initialize() during server startup.');

package/dist/auth/magicLink/MagicLinkKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,sFAAsF;YACtF,0FAA0F;YAC1F,sFAAsF;YACtF,2DAA2D;YAC3D,WAAW,CAAC;gBACV,OAAO,EACL,kFAAkF;oBAClF,8FAA8F;oBAC9F,4DAA4D;gBAC9D,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAA0B;QACpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjF,OAAO,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AAC7D,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,0GAA0G;IAC1G,8GAA8G;IAC9G,kHAAkH;IAClH,wHAAwH;IACxH,2GAA2G;IAC3G,uCAAuC,CAAC;AAS1C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAOzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QATF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;QACrB,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,UAAU,CAAC,aAAsB,EAAE,MAAyB,OAAO,CAAC,GAAG;QAC5E,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAmB,MAAS;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,KAAa,EACb,OAAgD;QAEhD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACpF,MAAM,aAAa,GAAsB,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,aAAa,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,mBAAmB,CAAC,SAAiB,EAAE,WAAmB,EAAE,sBAA+B;QAChG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,IAAI,CACb;YACE,UAAU,EAAE,qBAAqB;YACjC,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,WAAW;YACxB,GAAG,EAAE,UAAU;SAChB,EACD,IAAI,CAAC,aAAa,EAClB,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,YAAoB,EAAE,iBAAyB;QAC1E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACpF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE;gBAClD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAAwE,CAAC;YACxF,IACE,MAAM,CAAC,UAAU,KAAK,qBAAqB;gBAC3C,MAAM,CAAC,KAAK,KAAK,iBAAiB;gBAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,CAAC,MAAM,CAAC,WAAW,EACnB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAsB;QAC/C,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,UAAU,CAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,WAAW,CAAC;YACV,OAAO,EACL,kFAAkF;gBAClF,8FAA8F;gBAC9F,4DAA4D;YAC9D,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/magicLink/MagicLinkRouter.d.ts

@@ -9,6 +9,7 @@
  */
 import { Router } from 'express';
 import { type MagicLinkConfig } from '../../config.js';
+import { MagicLinkService } from './MagicLinkService.js';
 /** The mount path for both routers (`/magic-link`). */
 export declare const MAGIC_LINK_MOUNT_PATH = "/magic-link";
 /** Path of the JWKS endpoint relative to the public URL. */
@@ -20,11 +21,13 @@ export declare const MAGIC_LINK_JWKS_PATH = "/magic-link/jwks.json";
 export declare function CreateMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
     publicRouter: Router;
     authenticatedRouter: Router;
+    service: MagicLinkService;
 };
 /** @deprecated Use {@link CreateMagicLinkHandler}. */
 export declare function createMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
     publicRouter: Router;
     authenticatedRouter: Router;
+    service: MagicLinkService;
 };
 /**
  * A minimal PUBLIC router that serves ONLY the JWKS endpoint (the magic-link

package/dist/auth/magicLink/MagicLinkRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAEA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAE9F"}
+{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKzD,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAyKA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAEA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAE9F"}

package/dist/auth/magicLink/MagicLinkRouter.js

@@ -51,10 +51,22 @@ export function CreateMagicLinkHandler(publicUrl, config) {
     publicRouter.get('/jwks.json', (_req, res) => {
         res.status(200).json(MagicLinkKeyManager.Instance.GetJWKS());
     });
-    // Sends a completed redemption result: browser flow → 302 into Explorer with
+    // Sends a completed redemption result: browser flow → 302 into a verified per-invite
+    // RedirectUrl (when cryptographically bound + origin-allowed) or Explorer with
     // the session token in the URL fragment (never sent to a server, so it stays
     // out of access/proxy logs); API flow → JSON with an appropriate status.
-    const sendRedeemResult = (res, result, wantsJson) => {
+    const sendRedeemResult = (res, result, wantsJson, verifiedRedirectUrl) => {
+        if (verifiedRedirectUrl && !wantsJson) {
+            const baseWithoutHash = verifiedRedirectUrl.split('#')[0];
+            if (result.success && result.token) {
+                res.redirect(302, `${baseWithoutHash}#token=${encodeURIComponent(result.token)}`);
+            }
+            else {
+                const sep = baseWithoutHash.includes('?') ? '&' : '?';
+                res.redirect(302, `${baseWithoutHash}${sep}mlError=${encodeURIComponent(result.errorCode ?? 'invalid')}`);
+            }
+            return;
+        }
         const explorerUrl = config.explorerUrl?.replace(/\/$/, '');
         if (explorerUrl && !wantsJson) {
             if (result.success && result.token) {
@@ -89,6 +101,7 @@ export function CreateMagicLinkHandler(publicUrl, config) {
     // the actual redemption happens only on POST (below), gated by a user click.
     publicRouter.get('/redeem', redeemLimiter, (req, res) => {
         const token = typeof req.query.token === 'string' ? req.query.token : '';
+        const rt = typeof req.query.rt === 'string' ? req.query.rt : undefined;
         if (!token) {
             res.status(400).json({ success: false, error: 'Missing token.' });
             return;
@@ -101,7 +114,7 @@ export function CreateMagicLinkHandler(publicUrl, config) {
         res
             .status(200)
             .type('html')
-            .send(BuildRedeemLandingHtml(token, ApiRoute(`${MAGIC_LINK_MOUNT_PATH}/redeem`)));
+            .send(BuildRedeemLandingHtml(token, ApiRoute(`${MAGIC_LINK_MOUNT_PATH}/redeem`), rt));
     });
     // POST /redeem performs the actual (side-effectful) redemption. Token arrives
     // from the interstitial form body, an API client's JSON body, or the query.
@@ -109,11 +122,14 @@ export function CreateMagicLinkHandler(publicUrl, config) {
         const body = (req.body ?? {});
         const token = (typeof body.token === 'string' && body.token) ||
             (typeof req.query.token === 'string' ? req.query.token : '');
+        const rt = (typeof body.rt === 'string' && body.rt) ||
+            (typeof req.query.rt === 'string' ? req.query.rt : undefined);
         const wantsJson = req.query.format === 'json' || req.is('application/json') === 'application/json';
         if (!token) {
             res.status(400).json({ success: false, error: 'Missing token.' });
             return;
         }
+        const verifiedRedirectUrl = service.ResolveVerifiedRedirectUrl(token, rt);
         // Forensic context for the redemption audit trail. `req.ip` honors the app's
         // trust-proxy setting; headers are best-effort and may be absent for API clients.
         const result = await service.RedeemInvite(token, {
@@ -121,7 +137,7 @@ export function CreateMagicLinkHandler(publicUrl, config) {
             userAgent: req.get('user-agent') ?? undefined,
             origin: req.get('origin') ?? undefined,
         });
-        sendRedeemResult(res, result, wantsJson);
+        sendRedeemResult(res, result, wantsJson, verifiedRedirectUrl);
     });
     // ── Authenticated (invite creation) ───────────────────────────────────────
     const authenticatedRouter = Router();
@@ -144,13 +160,15 @@ export function CreateMagicLinkHandler(publicUrl, config) {
             MaxUses: body.MaxUses,
             firstName: body.firstName,
             lastName: body.lastName,
+            RedirectUrl: body.RedirectUrl,
+            SendEmail: body.SendEmail,
         }, creatingUser);
         // forbidden → 403 (caller not allowed to issue invites); invalid_role and
         // other validation failures → 400.
         const status = result.success ? 200 : result.errorCode === 'forbidden' ? 403 : 400;
         res.status(status).json(result);
     });
-    return { publicRouter, authenticatedRouter };
+    return { publicRouter, authenticatedRouter, service };
 }
 /** @deprecated Use {@link CreateMagicLinkHandler}. */
 export function createMagicLinkHandler(publicUrl, config) {

package/dist/auth/magicLink/MagicLinkRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAa,WAAW,EAA2B,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,MAA6B,EAAE,SAAkB,EAAQ,EAAE;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,qBAAqB,SAAS,CAAC,EAAE,CAAC,CAAC;YAChJ,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,OAAO,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,EAAE,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,OAAO,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAa,WAAW,EAA2B,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAK/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CACvB,GAAa,EACb,MAA6B,EAC7B,SAAkB,EAClB,mBAA4B,EACtB,EAAE;QACR,IAAI,mBAAmB,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,eAAe,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,GAAG,WAAW,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,qBAAqB,SAAS,CAAC,EAAE,CAAC,CAAC;YAChJ,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,qBAAqB,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAoC,CAAC;QACjE,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,GACN,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC;YACxC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,0BAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAE1E,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAK/E,OAAO,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,EAAE,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,OAAO,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/magicLink/MagicLinkService.d.ts

@@ -8,24 +8,53 @@
  */
 import { UserInfo, type IMetadataProvider } from '@memberjunction/core';
 import { type MagicLinkConfig } from '../../config.js';
-import type { CreateMagicLinkInviteParams, CreateMagicLinkInviteResult, RedeemMagicLinkResult, RedeemAuditContext } from './types.js';
+import type { IServerExtensionMagicLinkService } from '@memberjunction/server-extensions-core';
+import type { CreateMagicLinkInviteParams, CreateMagicLinkInviteResult, ManageMagicLinkInviteResult, MagicLinkJWTClaims, RedeemMagicLinkResult, RedeemAuditContext } from './types.js';
+/**
+ * Validates that a candidate `redirectUrl` is a well-formed `http:` or `https:` URL whose
+ * origin matches at least one concrete normalized entry in `allowedOrigins`.
+ * Wildcard `'*'` entries are explicitly ignored/rejected so session tokens can never be
+ * redirected to unvalidated origins.
+ */
+export declare function IsMagicLinkRedirectUrlAllowed(redirectUrl: string, allowedOrigins: readonly string[]): boolean;
 /**
  * Magic-link service. One instance per server, constructed with the resolved
- * public URL and the validated config.
+ * public URL and the validated config. Implements {@link IServerExtensionMagicLinkService}
+ * so `BaseServerExtension` implementations can mint, revoke, extend, and verify invites
+ * via `context.services.GetMagicLinkService?.()`.
  */
-export declare class MagicLinkService {
+export declare class MagicLinkService implements IServerExtensionMagicLinkService {
     private readonly publicUrl;
     private readonly config;
     constructor(publicUrl: string, config: MagicLinkConfig);
     /**
      * Creates a single-use, app-scoped invite, persists its hashed token, and
-     * (when a communication provider is configured) emails the link.
+     * (when a communication provider is configured and `params.SendEmail !== false`) emails the link.
      *
      * @param params  invite parameters
      * @param creatingUser  the authenticated internal user issuing the invite
      * @param provider  the request's metadata provider; falls back to the global default
      */
     CreateInvite(params: CreateMagicLinkInviteParams, creatingUser: UserInfo, provider?: IMetadataProvider): Promise<CreateMagicLinkInviteResult>;
+    /**
+     * Revokes an existing invite so subsequent redemptions fail with `'revoked'`.
+     * Requires the acting user to hold invite-issuance authority (`CanIssueInvites`).
+     */
+    RevokeInvite(inviteId: string, actingUser: UserInfo, provider?: IMetadataProvider): Promise<ManageMagicLinkInviteResult>;
+    /**
+     * Updates the expiration timestamp of an existing non-revoked, non-consumed invite.
+     * Requires the acting user to hold invite-issuance authority (`CanIssueInvites`).
+     */
+    UpdateInviteExpiry(inviteId: string, expiresAt: Date, actingUser: UserInfo, provider?: IMetadataProvider): Promise<ManageMagicLinkInviteResult>;
+    /**
+     * Verifies a magic-link session JWT against this service's configured issuer and audience.
+     */
+    VerifySessionToken(token: string): MagicLinkJWTClaims | null;
+    /**
+     * Verifies a signed redirect binding (`rt`) against the raw invite token's hash AND the host's
+     * allowed frontend origins. Returns the verified redirect URL, or `undefined` if absent/invalid.
+     */
+    ResolveVerifiedRedirectUrl(rawToken: string, redirectBindingToken: string | undefined): string | undefined;
     /**
      * Redeems a raw token: validates the invite, atomically consumes one use,
      * provisions/links the user with the restricted role + app, and mints a
@@ -62,8 +91,13 @@ export declare class MagicLinkService {
     private writeInviteScopeChildRows;
     /** Resolves the configured restricted role's ID, if present. */
     private resolveRestrictedRoleId;
-    /** Builds the shareable redemption URL. */
+    /** Builds the shareable redemption URL (including `&rt=...` when a per-invite RedirectUrl was signed). */
     private buildRedemptionUrl;
+    /**
+     * Collects concrete frontend origins a caller-supplied per-invite `RedirectUrl` is permitted
+     * to target (`explorerUrl`, `magicLink.allowedRedirectOrigins`, and non-wildcard `cors.allowedOrigins`).
+     */
+    private allowedRedirectOrigins;
     /**
      * Provisions the redeeming user: finds them by email or creates them, then
      * ensures the restricted role and the single app assignment exist.

package/dist/auth/magicLink/MagicLinkService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAInE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAiCpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IAiE9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;;;OAiBG;YACW,aAAa;IAmB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}
+{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAInE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAiCpB;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAgC7G;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,gCAAgC;IAErE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IA4GvC;;;OAGG;IACU,YAAY,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,QAAQ,EACpB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IA+CvC;;;OAGG;IACU,kBAAkB,CAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,IAAI,EACf,UAAU,EAAE,QAAQ,EACpB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAwDvC;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAUnE;;;OAGG;IACI,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IAejH;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,0GAA0G;IAC1G,OAAO,CAAC,kBAAkB;IAM1B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAgB9B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IAiE9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;;;OAiBG;YACW,aAAa;IAmB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}