@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -8,6 +8,8 @@ import {
   ReadIsRowFiltered,
   ShapeCacheInvalidationEvent,
 } from '../generic/CacheInvalidationResolver.js';
+import { EntityInfo } from '@memberjunction/core';
+import { EmployeeEntity } from './fieldSecurityFixtures.js';
 
 /**
  * The cache-invalidation subscription is delivered to every connected client with no per-user
@@ -62,6 +64,49 @@ describe('MayBroadcastRecordData', () => {
   });
 });
 
+/**
+ * An entity under field-level security never broadcasts its row, whatever the allowlist says.
+ *
+ * The event reaches every signed-in session that may read the entity, with no per-user
+ * projection, so a row of an entity whose fields are restricted per role would hand every
+ * session the columns it may not read. The check is the IS-A-aware one: a child whose parent has
+ * field security carries the parent's restricted fields as its own.
+ */
+describe('MayBroadcastRecordData: entities under field-level security', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it("REGRESSION: refuses an FLS entity even under an explicit '*'", () => {
+    ConfigureRecordDataBroadcast(['*']);
+    expect(MayBroadcastRecordData('Employees', EmployeeEntity(true))).toBe(false);
+  });
+
+  it('REGRESSION: refuses an FLS entity that is named in the allowlist', () => {
+    ConfigureRecordDataBroadcast(['Employees']);
+    expect(MayBroadcastRecordData('Employees', EmployeeEntity(true))).toBe(false);
+  });
+
+  it('still allows the same entity with field security off', () => {
+    ConfigureRecordDataBroadcast(['Employees']);
+    expect(MayBroadcastRecordData('Employees', EmployeeEntity(false))).toBe(true);
+  });
+
+  it("REGRESSION: refuses MJ: Record Changes under '*', with or without its metadata", () => {
+    // A Record Change row carries other entities' values in ChangesJSON / FullRecordJSON, and its
+    // own FieldLevelSecurityApplies is false; the per-row projection never runs on this push.
+    ConfigureRecordDataBroadcast(['*']);
+    const recordChanges = new EntityInfo({ ID: 'rc', Name: 'MJ: Record Changes', SchemaName: '__mj', BaseTable: 'RecordChange', BaseView: 'vwRecordChanges', Fields: [] });
+    expect(recordChanges.FieldLevelSecurityApplies).toBe(false);
+    expect(MayBroadcastRecordData('MJ: Record Changes', recordChanges)).toBe(false);
+    expect(MayBroadcastRecordData('MJ: Record Changes')).toBe(false);
+    expect(MayBroadcastRecordData(' mj: record changes ')).toBe(false);
+  });
+
+  it('REGRESSION: refuses MJ: Record Changes even when named in the allowlist', () => {
+    ConfigureRecordDataBroadcast(['MJ: Record Changes']);
+    expect(MayBroadcastRecordData('MJ: Record Changes')).toBe(false);
+  });
+});
+
 /**
  * Importing this module must not drag server config loading in with it.
  *

package/src/__tests__/contextRequestOrigin.test.ts

@@ -0,0 +1,105 @@
+/**
+ * Tests that ContextFunction surfaces the request's normalized Origin header on AppContext as
+ * `RequestOrigin`. Database-facing dependencies are mocked; no connection is opened.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { BehaviorSubject } from 'rxjs';
+
+const { mockProviderConfig } = vi.hoisted(() => ({
+  mockProviderConfig: vi.fn(),
+}));
+
+vi.mock('../util.js', () => ({
+  GetReadOnlyDataSource: vi.fn(() => undefined),
+  GetReadWriteDataSource: vi.fn(() => undefined),
+}));
+
+vi.mock('../config.js', () => ({
+  configInfo: { databaseSettings: { metadataCacheRefreshInterval: 0 } },
+  userEmailMap: {},
+  apiKey: 'test-api-key',
+  mj_core_schema: '__mj',
+}));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  SQLServerDataProvider: class {
+    Config = mockProviderConfig;
+  },
+  SQLServerProviderConfigData: class {},
+}));
+
+vi.mock('@memberjunction/postgresql-dataprovider', () => ({
+  PostgreSQLDataProvider: class {
+    Config = mockProviderConfig;
+  },
+  PostgreSQLProviderConfigData: class {},
+}));
+
+vi.mock('@memberjunction/generic-database-provider', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@memberjunction/generic-database-provider')>();
+  return {
+    ...actual,
+    resolveDbPlatformFromEnv: () => 'sqlserver' as const,
+    UserCache: { Instance: {} } as typeof actual.UserCache,
+  };
+});
+
+vi.mock('@memberjunction/api-keys', () => ({
+  GetAPIKeyEngine: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@memberjunction/core')>();
+  return { ...actual, Metadata: { Provider: { Entities: [{}] } } };
+});
+
+import { ContextFunction } from '../context.js';
+import type { IncomingMessage } from 'http';
+import type { ConnectionPool } from 'mssql';
+import type { UserPayload } from '../types.js';
+
+const MOCK_POOL = {} as ConnectionPool;
+const MOCK_PAYLOAD = { email: 'user@example.com' } as UserPayload;
+
+function makeReq(headers: IncomingMessage['headers']): IncomingMessage {
+  return { headers, body: {}, ip: '127.0.0.1', userPayload: MOCK_PAYLOAD } as unknown as IncomingMessage;
+}
+
+async function contextFor(headers: IncomingMessage['headers']) {
+  const build = ContextFunction({ setupComplete$: new BehaviorSubject<unknown>(true), dataSource: MOCK_POOL, dataSources: [] });
+  return build({ req: makeReq(headers) });
+}
+
+describe('ContextFunction RequestOrigin', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockProviderConfig.mockResolvedValue(true);
+  });
+
+  it('carries the normalized Origin header', async () => {
+    const ctx = await contextFor({ origin: 'https://Embed.Example.com/' });
+    expect(ctx.RequestOrigin).toBe('https://embed.example.com');
+  });
+
+  it('keeps an explicit port', async () => {
+    const ctx = await contextFor({ origin: 'http://localhost:4200' });
+    expect(ctx.RequestOrigin).toBe('http://localhost:4200');
+  });
+
+  it('is undefined when the request sent no Origin header', async () => {
+    const ctx = await contextFor({});
+    expect(ctx.RequestOrigin).toBeUndefined();
+  });
+
+  it('is undefined for a malformed or opaque Origin header', async () => {
+    expect((await contextFor({ origin: 'null' })).RequestOrigin).toBeUndefined();
+    expect((await contextFor({ origin: 'https://a.com/path' })).RequestOrigin).toBeUndefined();
+  });
+
+  it('leaves the existing context fields in place', async () => {
+    const ctx = await contextFor({ origin: 'https://a.com' });
+    expect(ctx.userPayload).toBe(MOCK_PAYLOAD);
+    expect(ctx.ClientIp).toBe('127.0.0.1');
+    expect(ctx.providers).toHaveLength(1);
+  });
+});

package/src/__tests__/conversationBrowsers.test.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+const endSession = vi.fn(async (_id: string) => true);
+vi.mock('@memberjunction/remote-browser-server', () => ({
+  RemoteBrowserEngine: { Instance: { EndSessionForAgentSession: (id: string) => endSession(id) } },
+}));
+
+import { GetGlobalObjectStore, ShutdownRegistry } from '@memberjunction/global';
+import { ConversationBrowserLedger, RemoteBrowserRefusedError } from '../agentSessions/conversationBrowsers.js';
+
+const USER = { Key: 'user:a1a1a1a1-0000-4000-8000-000000000001', Anonymous: false };
+const LIMITS = { maxPerUser: 2, maxAnonymousTotal: 4, idleMinutes: 15 };
+const guest = (scope: string) => ({ Key: `scope:${scope}`, Anonymous: true });
+const ledger = ConversationBrowserLedger.Instance;
+
+afterEach(() => {
+  for (const id of ['conv-idle', 'conv-used', 'conv-third', 'g1-a', 'g1-b', 'g2-a']) {
+    ledger.Release(id);
+  }
+  vi.useRealTimers();
+});
+
+describe('ConversationBrowserLedger', () => {
+  it('is one process-wide instance, held in the global object store so every copy of the module shares it', () => {
+    expect(ConversationBrowserLedger.Instance).toBe(ledger);
+    expect(GetGlobalObjectStore()?.[ledger.GlobalKey]).toBe(ledger);
+  });
+
+  it('ends a browser nobody used for its idle limit, keeps a used one, and frees the owner\'s slot', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    vi.setSystemTime(0);
+    ledger.Claim('conv-idle', USER, LIMITS);
+    ledger.Claim('conv-used', USER, LIMITS);
+    expect(() => ledger.Claim('conv-third', USER, LIMITS)).toThrow(RemoteBrowserRefusedError);
+
+    vi.setSystemTime(10 * 60_000);
+    ledger.Touch('conv-used');
+    vi.setSystemTime(16 * 60_000);
+    expect(await ledger.ReapIdle()).toBe(1);
+    expect(endSession).toHaveBeenCalledWith('conv-idle');
+    expect(endSession).not.toHaveBeenCalledWith('conv-used');
+    expect(() => ledger.Claim('conv-third', USER, LIMITS)).not.toThrow();
+  });
+
+  it('joins the graceful shutdown with its first browser, and ends every browser it holds there', async () => {
+    endSession.mockClear();
+    ledger.Claim('conv-idle', USER, LIMITS);
+    ledger.Claim('conv-used', USER, LIMITS);
+    expect(ShutdownRegistry.Instance.List()).toContain(ledger);
+
+    await ledger.Shutdown();
+    expect(endSession.mock.calls.map((c) => c[0]).sort()).toEqual(['conv-idle', 'conv-used']);
+    expect(await ledger.ReapIdle()).toBe(0);
+  });
+
+  it('counts each owner key on its own, so one anonymous guest cannot use up another\'s cap', () => {
+    const one = { ...LIMITS, maxPerUser: 1 };
+    ledger.Claim('g1-a', guest('visitor-1'), one);
+    expect(() => ledger.Claim('g1-b', guest('visitor-1'), one)).toThrow(RemoteBrowserRefusedError);
+    expect(() => ledger.Claim('g2-a', guest('visitor-2'), one)).not.toThrow();
+  });
+});

package/src/__tests__/fieldSecurityFixtures.ts

@@ -0,0 +1,91 @@
+/**
+ * Shared field-security fixtures for the transport tests: an `Employees` entity whose `Salary`
+ * and `Base Salary` only the HR role may read, plus users holding either role.
+ *
+ * Built from real `EntityInfo` / `UserInfo` objects so the denied sets come from the same
+ * aggregation production uses, not from a stub.
+ */
+import { EntityInfo, FieldSecurityClientInputMessage, UserInfo, UserRoleInfo } from '@memberjunction/core';
+
+export const HR_ROLE_ID = 'A0000000-0000-0000-0000-000000000001';
+export const INTERN_ROLE_ID = 'A0000000-0000-0000-0000-000000000003';
+export const EMPLOYEES_ENTITY_ID = 'entity-employees';
+export const EMPLOYEES_ENTITY_NAME = 'Employees';
+
+/** The salary an HR user may read and an intern may not. Distinctive so a leak is easy to spot. */
+export const SECRET_SALARY = 987654.32;
+
+function openTo(fieldId: string, roles: string[] = [HR_ROLE_ID, INTERN_ROLE_ID]): Record<string, unknown>[] {
+    return roles.map((roleId, i) => ({
+        ID: `${fieldId}-open-${i}`,
+        EntityFieldID: fieldId,
+        RoleID: roleId,
+        ReadAccess: 'Allow',
+        UpdateAccess: 'Allow',
+        CreateAccess: 'Allow',
+    }));
+}
+
+/** Init data for the `Employees` entity. `withFls: false` switches field security off entirely. */
+export function EmployeeEntityInit(withFls = true): Record<string, unknown> {
+    const field = (id: string, sequence: number, name: string, type: string, extra: Record<string, unknown> = {}) => ({
+        ID: id, EntityID: EMPLOYEES_ENTITY_ID, Sequence: sequence, Name: name, Entity: EMPLOYEES_ENTITY_NAME, Type: type, ...extra,
+    });
+    return {
+        ID: EMPLOYEES_ENTITY_ID,
+        Name: EMPLOYEES_ENTITY_NAME,
+        SchemaName: 'dbo',
+        BaseTable: 'Employee',
+        BaseView: 'vwEmployees',
+        IncludeInAPI: true,
+        AllowCreateAPI: true,
+        AllowUpdateAPI: true,
+        AllowDeleteAPI: true,
+        EnableFieldLevelSecurity: withFls,
+        Permissions: [
+            { EntityID: EMPLOYEES_ENTITY_ID, RoleID: HR_ROLE_ID, CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true },
+            { EntityID: EMPLOYEES_ENTITY_ID, RoleID: INTERN_ROLE_ID, CanCreate: true, CanRead: true, CanUpdate: true, CanDelete: true },
+        ],
+        Fields: [
+            field('f-id', 1, 'ID', 'uniqueidentifier', { IsPrimaryKey: true }),
+            field('f-name', 2, 'Name', 'nvarchar', { EntityFieldPermissions: openTo('f-name') }),
+            field('f-salary', 3, 'Salary', 'money', { EntityFieldPermissions: openTo('f-salary', [HR_ROLE_ID]) }),
+            field('f-base-salary', 4, 'Base Salary', 'money', { EntityFieldPermissions: openTo('f-base-salary', [HR_ROLE_ID]) }),
+            field('f-notes', 5, 'Notes', 'nvarchar', { EntityFieldPermissions: openTo('f-notes') }),
+        ],
+    };
+}
+
+export function EmployeeEntity(withFls = true): EntityInfo {
+    return new EntityInfo(EmployeeEntityInit(withFls));
+}
+
+export function BuildUser(roleIds: string[], id = 'user-1'): UserInfo {
+    const u = new UserInfo();
+    u.ID = id;
+    u.Name = 'Test User';
+    u.Email = `${id}@test.com`;
+    u.IsActive = true;
+    (u as unknown as Record<string, unknown>)['_UserRoles'] =
+        roleIds.map(rid => new UserRoleInfo({ UserID: id, RoleID: rid, Role: `Role-${rid}` }));
+    return u;
+}
+
+export const Intern = (): UserInfo => BuildUser([INTERN_ROLE_ID], 'intern-1');
+export const HRUser = (): UserInfo => BuildUser([HR_ROLE_ID], 'hr-1');
+
+/** A full-width employee row: what a system-identity load, or a save's re-read, returns. */
+export function FullWidthEmployeeRow(): Record<string, unknown> {
+    return { ID: 'emp-1', Name: 'Ada', Salary: SECRET_SALARY, 'Base Salary': SECRET_SALARY, Notes: 'n' };
+}
+
+/** The refusal text for a key, identical whether the key is denied or names no field. */
+export function RefusalFor(key: string): string {
+    return FieldSecurityClientInputMessage(key, EMPLOYEES_ENTITY_NAME);
+}
+
+/** A metadata source the projection accepts; Record Changes resolution is never reached for Employees. */
+export const NoRecordChangesMetadata = {
+    Entities: [] as EntityInfo[],
+    EntityByID: (): EntityInfo | undefined => undefined,
+};

package/src/__tests__/globalCors.test.ts

@@ -58,7 +58,7 @@ async function startApp(extensions: ServerExtensionConfig[]): Promise<string> {
     app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'] }, GetCorsOwningServerExtensionRoots(extensions)));
     mountBallotExtension(app);
     app.get('/core', (_req, res) => { res.json({ ok: true }); });
-    server = app.listen(0);
+    server = app.listen(0, '127.0.0.1');
     await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
     return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
 }
@@ -138,7 +138,7 @@ describe('CreateGlobalCorsMiddleware', () => {
         const app = express();
         app.use(CreateGlobalCorsMiddleware({ allowedOrigins: ['*'], allowCredentials: true }));
         app.get('/core', (_req, res) => { res.json({ ok: true }); });
-        server = app.listen(0);
+        server = app.listen(0, '127.0.0.1');
         await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
         const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
         const res = await fetch(`${base}/core`, { headers: { Origin: OTHER_ORIGIN } });
@@ -164,7 +164,7 @@ async function startAppWithGraphQLMount(withFallback: boolean): Promise<string>
         app.use(CreateExtensionOwnedPreflightFallback(ownedRoots));
     }
     app.use('/', cors(), (_req, res) => { res.json({ graphql: true }); });
-    server = app.listen(0);
+    server = app.listen(0, '127.0.0.1');
     await new Promise<void>((resolve) => server!.once('listening', () => resolve()));
     return `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
 }

package/src/__tests__/localDevAuth.test.ts

@@ -0,0 +1,196 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import type { Request } from 'express';
+import jwt from 'jsonwebtoken';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { UserInfo } from '@memberjunction/core';
+
+vi.mock('../config.js', () => ({
+  configInfo: {
+    devAuth: { enabled: false },
+    magicLink: {},
+    authProviders: [],
+  },
+}));
+
+import {
+  AssertLocalDevAuthAllowed,
+  IsLocalDevAuthEnabled,
+  IsLoopbackAddress,
+  MintLocalDevJwt,
+  RegisterLocalDevAuthProvider,
+  VerifyLocalhostRequest,
+} from '../auth/localDevAuth.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+
+function createMockRequest(overrides: {
+  remoteAddress?: string;
+  host?: string;
+  origin?: string;
+  referer?: string;
+  xff?: string;
+}): Request {
+  const headers: Record<string, string | undefined> = {
+    host: overrides.host ?? 'localhost:4000',
+    origin: overrides.origin,
+    referer: overrides.referer,
+    'x-forwarded-for': overrides.xff,
+  };
+  return {
+    headers,
+    hostname: (overrides.host ?? 'localhost:4000').split(':')[0],
+    ip: overrides.remoteAddress ?? '127.0.0.1',
+    socket: {
+      remoteAddress: overrides.remoteAddress ?? '127.0.0.1',
+    },
+  } as unknown as Request;
+}
+
+describe('localDevAuth security invariants', () => {
+  beforeEach(() => {
+    AuthProviderFactory.Instance.clear();
+  });
+
+  it('IsLocalDevAuthEnabled detects MJ_DEV_AUTH_ENABLED=true or 1', () => {
+    expect(IsLocalDevAuthEnabled({})).toBe(false);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: 'false' })).toBe(false);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: 'true' })).toBe(true);
+    expect(IsLocalDevAuthEnabled({ MJ_DEV_AUTH_ENABLED: '1' })).toBe(true);
+  });
+
+  it('AssertLocalDevAuthAllowed fails loudly when NODE_ENV=production', () => {
+    expect(() =>
+      AssertLocalDevAuthAllowed({
+        MJ_DEV_AUTH_ENABLED: 'true',
+        NODE_ENV: 'development',
+      })
+    ).not.toThrow();
+
+    expect(() =>
+      AssertLocalDevAuthAllowed({
+        MJ_DEV_AUTH_ENABLED: 'true',
+        NODE_ENV: 'production',
+      })
+    ).toThrow(/strictly forbidden when NODE_ENV=production/);
+  });
+
+  it('IsLoopbackAddress accepts loopback and conditional Docker local bridge IPs', () => {
+    expect(IsLoopbackAddress('127.0.0.1', false)).toBe(true);
+    expect(IsLoopbackAddress('::1', false)).toBe(true);
+    expect(IsLoopbackAddress('::ffff:127.0.0.1', false)).toBe(true);
+    expect(IsLoopbackAddress('192.168.65.1', false)).toBe(false);
+    expect(IsLoopbackAddress('192.168.65.1', true)).toBe(true);
+    expect(IsLoopbackAddress('172.18.0.1', true)).toBe(true);
+    expect(IsLoopbackAddress('192.168.1.42', true)).toBe(false);
+    expect(IsLoopbackAddress('203.0.113.10', true)).toBe(false);
+  });
+
+  it('VerifyLocalhostRequest allows genuine localhost requests and blocks non-localhost vectors', () => {
+    // 1. Standard localhost IPv4 and IPv6
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000', origin: 'http://localhost:4202' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(true);
+
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '::1', host: '127.0.0.1:4000', origin: 'http://127.0.0.1:4202' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(true);
+
+    // 2. Docker Desktop host-gateway when Host is localhost, inside container, and no XFF is present
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '::ffff:192.168.65.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'development', MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE: 'true' }
+      ).Allowed
+    ).toBe(true);
+
+    // 2b. Rejects Docker bridge IPs when NOT running inside a container
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '172.18.0.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'development', MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE: 'false' }
+      ).Allowed
+    ).toBe(false);
+
+    // 2c. Rejects non-gateway RFC1918 172.16.0.0/12 addresses even inside a container
+    expect(IsLoopbackAddress('172.20.10.5', true)).toBe(false);
+
+    // 3. Rejects in production even from 127.0.0.1
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000' }),
+        { NODE_ENV: 'production' }
+      ).Allowed
+    ).toBe(false);
+
+    // 4. Rejects LAN IP on socket
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '192.168.1.50', host: 'localhost:4000' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 5. Rejects non-localhost Host header
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: '192.168.1.50:4000' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 6. Rejects external X-Forwarded-For
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({ remoteAddress: '127.0.0.1', host: 'localhost:4000', xff: '203.0.113.5' }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+
+    // 7. Rejects external Origin
+    expect(
+      VerifyLocalhostRequest(
+        createMockRequest({
+          remoteAddress: '127.0.0.1',
+          host: 'localhost:4000',
+          origin: 'https://attacker.example.com',
+        }),
+        { NODE_ENV: 'development' }
+      ).Allowed
+    ).toBe(false);
+  });
+
+  it('MintLocalDevJwt mints an RS256 token verifiable by the registered LocalDevProvider', () => {
+    MagicLinkKeyManager.Instance.Initialize();
+    RegisterLocalDevAuthProvider('http://localhost:4000');
+
+    const mockUser = new UserInfo(undefined, {
+      ID: '11111111-2222-3333-4444-555555555555',
+      Name: 'Admin User',
+      Email: 'admin@memberjunction.org',
+      FirstName: 'Admin',
+      LastName: 'User',
+      IsActive: true,
+      Type: 'Owner',
+      UserRoles: [],
+    });
+
+    const { token, claims } = MintLocalDevJwt(mockUser, 'http://localhost:4000');
+    expect(claims.iss).toBe('http://localhost:4000/local-dev');
+    expect(claims.aud).toBe('mj-local-dev');
+    expect(claims.email).toBe('admin@memberjunction.org');
+    expect(claims['mj_magic_link']).toBeUndefined();
+
+    const provider = AuthProviderFactory.Instance.getByIssuer('http://localhost:4000/local-dev');
+    expect(provider).toBeDefined();
+    const decoded = jwt.decode(token) as jwt.JwtPayload;
+    const userInfo = provider!.extractUserInfo(decoded);
+    expect(userInfo.email).toBe('admin@memberjunction.org');
+    expect(userInfo.firstName).toBe('Admin');
+    expect(userInfo.lastName).toBe('User');
+  });
+});