@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/agentSessions/sessionDeadline.ts

@@ -0,0 +1,81 @@
+import type { SessionCloseReason } from './SessionManager.js';
+
+/** The close reasons an expiry check can yield: the two ways a live session runs out of time. */
+export type ExpiryReason = Extract<SessionCloseReason, 'Idle' | 'TimeLimit'>;
+
+/**
+ * Parses the absolute deadline (ms) from a session's `Config_` JSON, or null when absent/malformed.
+ * A malformed deadline counts as absent by design: a sweep must never throw on one bad row, so null
+ * is the documented failure result here, not a swallowed error.
+ */
+export function ParseSessionDeadlineMs(configJson: string | null | undefined): number | null {
+    if (!configJson) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(configJson) as { maxSessionDeadlineIso?: unknown };
+        if (typeof parsed.maxSessionDeadlineIso !== 'string') {
+            return null;
+        }
+        const ms = Date.parse(parsed.maxSessionDeadlineIso);
+        return Number.isNaN(ms) ? null : ms;
+    } catch {
+        // Malformed JSON: treated as "no deadline" (see doc comment).
+        return null;
+    }
+}
+
+/**
+ * Decides why a session has expired, or null when it has not.
+ *
+ * Two moments can expire a session: its idle moment (`LastActiveAt + closeThresholdMs`) and its authored
+ * hard deadline (`Config_.maxSessionDeadlineIso`). Only a moment that has already passed (`<= nowMs`)
+ * counts, and the EARLIER of the passed moments wins. A tie at the same instant yields `TimeLimit`:
+ * the authored rule beats the safety net. A row without a usable `LastActiveAt` (null, or a value that
+ * does not parse to a date) is never `Idle`, and neither is any row when `closeThresholdMs` is non-finite.
+ * `LastActiveAt` is typed `Date` but may arrive as an ISO string from a provider, so both are accepted.
+ */
+export function ExpiryCloseReason(
+    session: { LastActiveAt: Date | string | null | undefined; Config_: string | null | undefined },
+    nowMs: number,
+    closeThresholdMs: number,
+): ExpiryReason | null {
+    const lastActiveMs = session.LastActiveAt ? new Date(session.LastActiveAt).getTime() : Number.NaN;
+    const idleMs = lastActiveMs + closeThresholdMs;
+    const idleAt = Number.isFinite(idleMs) ? idleMs : null;
+    const deadlineAt = ParseSessionDeadlineMs(session.Config_);
+    const idlePassed = idleAt !== null && idleAt <= nowMs;
+    const deadlinePassed = deadlineAt !== null && deadlineAt <= nowMs;
+    if (deadlinePassed && idlePassed) {
+        return deadlineAt <= idleAt ? 'TimeLimit' : 'Idle';
+    }
+    if (deadlinePassed) {
+        return 'TimeLimit';
+    }
+    return idlePassed ? 'Idle' : null;
+}
+
+/**
+ * How far ahead of a stored deadline a browser's `TimeLimit` claim is still believed. The browser's
+ * alarm runs on its own clock: when it extends to a server ISO deadline it anchors that time against its
+ * own `Date.now()`, so a client clock running ahead of the server fires early by the difference (a throttled
+ * tab only fires late). A minute absorbs that skew without letting a client end a session meant to run for
+ * minutes more.
+ */
+export const DEADLINE_CLAIM_SKEW_MS = 60_000;
+
+/**
+ * Verifies a `TimeLimit` close claim against the session's stored deadline. The browser claims, the server
+ * verifies: the claim holds when the stored deadline has passed or falls within {@link DEADLINE_CLAIM_SKEW_MS},
+ * otherwise (no deadline, or one far in the future) the close is recorded as `Explicit`. The janitor's own
+ * `TimeLimit` trivially passes, so every caller shares one path, and this module remains the single place that
+ * answers "did the deadline pass?" for both the sweep and the client claim. Idleness never counts here.
+ */
+export function VerifyTimeLimitClaim(
+    session: { LastActiveAt: Date | string | null | undefined; Config_: string | null | undefined },
+    nowMs: number,
+): 'TimeLimit' | 'Explicit' {
+    return ExpiryCloseReason(session, nowMs + DEADLINE_CLAIM_SKEW_MS, Number.POSITIVE_INFINITY) === 'TimeLimit'
+        ? 'TimeLimit'
+        : 'Explicit';
+}

package/src/auth/APIKeyScopeAuth.ts

@@ -7,6 +7,7 @@
 import { AuthorizationError } from 'type-graphql';
 import { GetAPIKeyEngine, AuthorizationResult, AuthorizationRequest } from '@memberjunction/api-keys';
 import { UserInfo, RunView } from '@memberjunction/core';
+import { EscapeSQLString } from '@memberjunction/global';
 import { MJAPIKeyEntity, MJAPIApplicationEntity } from '@memberjunction/core-entities';
 
 /**
@@ -96,7 +97,7 @@ export async function CheckAPIKeyScope(
     const rv = new RunView();
     const keyResult = await rv.RunView<MJAPIKeyEntity>({
         EntityName: 'MJ: API Keys',
-        ExtraFilter: `ID='${apiKeyId}'`,
+        ExtraFilter: `ID='${EscapeSQLString(apiKeyId)}'`,
         ResultType: 'entity_object'
     }, contextUser);
 
@@ -117,7 +118,7 @@ export async function CheckAPIKeyScope(
     // Get the application by name
     const appResult = await rv.RunView<MJAPIApplicationEntity>({
         EntityName: 'MJ: API Applications',
-        ExtraFilter: `Name='${applicationName}'`,
+        ExtraFilter: `Name='${EscapeSQLString(applicationName)}'`,
         ResultType: 'entity_object'
     }, contextUser);
 
@@ -224,7 +225,7 @@ export async function CheckAPIKeyScopeAndLog(
     // Get the API key
     const keyResult = await rv.RunView<MJAPIKeyEntity>({
         EntityName: 'MJ: API Keys',
-        ExtraFilter: `ID='${apiKeyId}'`,
+        ExtraFilter: `ID='${EscapeSQLString(apiKeyId)}'`,
         ResultType: 'entity_object'
     }, contextUser);
 
@@ -245,7 +246,7 @@ export async function CheckAPIKeyScopeAndLog(
     // Get the application
     const appResult = await rv.RunView<MJAPIApplicationEntity>({
         EntityName: 'MJ: API Applications',
-        ExtraFilter: `Name='${applicationName}'`,
+        ExtraFilter: `Name='${EscapeSQLString(applicationName)}'`,
         ResultType: 'entity_object'
     }, contextUser);
 

package/src/auth/AuthProviderCatalogRouter.ts

@@ -13,6 +13,7 @@ import { rateLimit } from 'express-rate-limit';
 import { LogError, type PublicAuthProviderCatalog } from '@memberjunction/core';
 import { AuthProviderEngine } from './AuthProviderEngine.js';
 import { EMPTY_PUBLIC_LOGIN_SCREEN, LoginScreenEngine } from './LoginScreenEngine.js';
+import { AttachLocalDevAuthRoutes } from './localDevAuth.js';
 
 /** Mount path for the public catalog router. */
 export const AUTH_CATALOG_MOUNT_PATH = '/auth';
@@ -98,6 +99,8 @@ export function CreateAuthProviderCatalogRouter(): Router {
     }
   });
 
+  AttachLocalDevAuthRoutes(router);
+
   return router;
 }
 

package/src/auth/__tests__/loginEmailResolution.test.ts

@@ -0,0 +1,67 @@
+import { describe, it, expect } from 'vitest';
+import { DescribeUserEmailMap, EmailsMatch, ResolveUserLookupEmail } from '../loginEmailResolution.js';
+
+describe('ResolveUserLookupEmail', () => {
+  it('looks a login up by its email claim when no map is set', () => {
+    expect(ResolveUserLookupEmail({ email: 'b@two.example', preferredUsername: 'b@two.example' }, undefined)).toEqual({
+      TokenEmail: 'b@two.example',
+      LookupEmail: 'b@two.example',
+      Remapped: false,
+    });
+  });
+
+  it('applies a USER_EMAIL_MAP entry and reports the rewrite', () => {
+    const result = ResolveUserLookupEmail({ email: 'b@two.example' }, { 'b@two.example': 'a@one.example' });
+    expect(result).toEqual({ TokenEmail: 'b@two.example', LookupEmail: 'a@one.example', Remapped: true });
+  });
+
+  it('keeps the map key match exact (case-sensitive), as before', () => {
+    const result = ResolveUserLookupEmail({ email: 'B@two.example' }, { 'b@two.example': 'a@one.example' });
+    expect(result.LookupEmail).toBe('B@two.example');
+    expect(result.Remapped).toBe(false);
+  });
+
+  it('does not count an entry that only changes case as a remap', () => {
+    const result = ResolveUserLookupEmail({ email: 'b@two.example' }, { 'b@two.example': 'B@Two.example' });
+    expect(result.LookupEmail).toBe('B@Two.example');
+    expect(result.Remapped).toBe(false);
+  });
+
+  it('falls back to the preferred username and never remaps it', () => {
+    const result = ResolveUserLookupEmail({ preferredUsername: 'b@two.example' }, { 'b@two.example': 'a@one.example' });
+    expect(result).toEqual({ TokenEmail: 'b@two.example', LookupEmail: 'b@two.example', Remapped: false });
+  });
+
+  it('returns no identity when the token has neither claim', () => {
+    expect(ResolveUserLookupEmail({}, undefined)).toEqual({ TokenEmail: undefined, LookupEmail: undefined, Remapped: false });
+  });
+});
+
+describe('EmailsMatch', () => {
+  it('ignores case and surrounding whitespace, like the User lookup', () => {
+    expect(EmailsMatch(' A@One.example ', 'a@one.example')).toBe(true);
+  });
+
+  it('treats a missing side as no match', () => {
+    expect(EmailsMatch(undefined, 'a@one.example')).toBe(false);
+    expect(EmailsMatch('a@one.example', '')).toBe(false);
+  });
+});
+
+describe('DescribeUserEmailMap', () => {
+  it('returns null when no map is configured', () => {
+    expect(DescribeUserEmailMap(undefined)).toBeNull();
+    expect(DescribeUserEmailMap({})).toBeNull();
+  });
+
+  it('returns null when every entry maps an address to itself', () => {
+    expect(DescribeUserEmailMap({ 'a@one.example': 'A@one.example' })).toBeNull();
+  });
+
+  it('lists every entry that sends a login to another record', () => {
+    const warning = DescribeUserEmailMap({ 'b@two.example': 'a@one.example', 'c@three.example': 'a@one.example' });
+    expect(warning).toContain('2 login email(s)');
+    expect(warning).toContain('b@two.example -> a@one.example');
+    expect(warning).toContain('c@three.example -> a@one.example');
+  });
+});

package/src/auth/index.ts

@@ -2,7 +2,7 @@ import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import { configInfo } from '../config.js';
 import { UserCache } from '@memberjunction/generic-database-provider';
 import sql from 'mssql';
-import { DatabaseProviderBase, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
+import { DatabaseProviderBase, LogError, Metadata, RoleInfo, UserInfo } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { MJGlobal } from '@memberjunction/global';
 import { MJUserEntity, MJUserEntityType } from '@memberjunction/core-entities';
@@ -254,11 +254,63 @@ export const VerifyUserRecord = async (
 ): Promise<UserInfo | undefined> => {
   if (!email) return undefined;
 
-  // FindUser, not Users.find: a user this process has not loaded yet (created seconds ago on
-  // another server) is looked up in the database instead of being treated as nonexistent.
-  let user = await UserCache.Instance.FindUser({ Email: email });
+  // Collect ALL matches rather than taking .find()'s first hit. Two User rows can share an email
+  // case-insensitively (see the duplicate-provisioning path below), and .find() then resolved to
+  // whichever row happened to sit earlier in UserCache.Instance.Users — i.e. database row order.
+  // That order changes when the cache is rebuilt, so an MJAPI restart silently moved a user onto a
+  // different record: their conversations, artifacts, items shared with them and their profile
+  // picture (UserImageURL lives on the User row) all vanished at once, and came back if the order
+  // flipped again. Observed in production 2026-09-15. Resolution must not depend on row order.
+  const emailMatches = UserCache.Instance.Users.filter((u) => {
+    if (!u.Email || u.Email.trim() === '') {
+      // this condition should never occur. If it doesn throw a console error including the user id
+      // DB requires non-null but this is just an extra check and we could in theory have a blank string in the DB
+      console.error(`SYSTEM METADATA ISSUE: User ${u.ID} has no email address`);
+      return false;
+    } else return u.Email.toLowerCase().trim() === email.toLowerCase().trim();
+  });
+
+  if (emailMatches.length > 1) {
+    // Deterministic tie-break by ID so every process and every restart agrees, and a LOUD error
+    // because this is a data problem an operator has to resolve — silently picking a row is what
+    // made it look like data loss to the customer. Sorting by ID is arbitrary but stable; the point
+    // is that it never changes, not that it picks the "right" one.
+    emailMatches.sort((a, b) => a.ID.localeCompare(b.ID));
+    LogError(
+      `AMBIGUOUS LOGIN: ${emailMatches.length} User records share the email '${email}' ` +
+        `(case-insensitively): ${emailMatches.map((u) => `${u.ID} (${u.Email})`).join(', ')}. ` +
+        `Resolving to ${emailMatches[0].ID} by stable ID order. Until the duplicates are merged, ` +
+        `content owned by the other records is invisible to this login. Find every affected user ` +
+        `with: SELECT LOWER(Email), COUNT(*) FROM __mj.[User] GROUP BY LOWER(Email) HAVING COUNT(*) > 1`
+    );
+  }
+
+  // Nothing cached: ask FindUser, which reads the database for a user this process has not loaded
+  // yet (created seconds ago on another server) instead of treating them as nonexistent.
+  let user = emailMatches[0] ?? (await UserCache.Instance.FindUser({ Email: email }));
 
   if (!user) {
+    // REFRESH THE CACHE BEFORE PROVISIONING. This block used to sit AFTER the auto-create below,
+    // gated on `!user`, so it could only ever run when creation had already failed or was not
+    // attempted. That made it dead code in the exact case it exists to handle: a user who IS in the
+    // database but is NOT yet in this process's UserCache. Users provisioned out of band (an admin,
+    // an invite, a direct insert) are absent from the cache until it is rebuilt, so the lookup above
+    // missed and auto-create minted a SECOND record for someone who already had one — which is how
+    // the duplicate emails that Fix 1 above has to tolerate get created in the first place.
+    // Observed in production: three users created 2026-09-14 18:18, a duplicate for one of them
+    // created 2026-09-15 01:38 on that user's next sign-in.
+    //
+    // The recursive call passes attemptCacheUpdateIfNeeded=false, so the second pass skips straight
+    // to auto-create if the refreshed cache still has no match. Auto-provisioning of genuinely new
+    // users is therefore unchanged — it just no longer runs before we have looked properly.
+    if (configInfo.userHandling.updateCacheWhenNotFound && dataSource && attemptCacheUpdateIfNeeded) {
+      console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
+
+      await refreshUserCache();
+
+      return VerifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false);
+    }
+
     // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
     // this condition. It was previously required here, which meant a non-browser client sending no
     // Origin could never auto-provision while an attacker simply forged one — it gated entry without
@@ -313,14 +365,6 @@ export const VerifyUserRecord = async (
       }
     }
 
-    if (!user && configInfo.userHandling.updateCacheWhenNotFound && dataSource && attemptCacheUpdateIfNeeded) {
-      // if we get here that means in the above, if we were attempting to create a new user, it did not work, or it wasn't attempted and we have a config that asks us to auto update the cache
-      console.warn(`User ${email} not found in cache. Updating cache in attempt to find the user...`);
-
-      await refreshUserCache();
-
-      return VerifyUserRecord(email, firstName, lastName, requestDomain, dataSource, false); // try one more time but do not update cache next time if not found
-    }
   }
 
   return user;

package/src/auth/initializeProviders.ts

@@ -1,8 +1,35 @@
 import { configInfo } from '../config.js';
 import { AuthProviderConfig, LogError, LogStatus, LogStatusEx, UserInfo, type IMetadataProvider } from '@memberjunction/core';
-import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { AuthProviderFactory, LocalDevProvider } from '@memberjunction/auth-providers';
 import { AuthProviderEngine } from './AuthProviderEngine.js';
 
+/**
+ * Returns true when local development auth is enabled via `MJ_DEV_AUTH_ENABLED=true`
+ * or `configInfo.devAuth?.enabled === true`.
+ */
+export function IsLocalDevAuthEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const rawEnv = env.MJ_DEV_AUTH_ENABLED?.trim().toLowerCase();
+  if (rawEnv === 'true' || rawEnv === '1') {
+    return true;
+  }
+  if (rawEnv === 'false' || rawEnv === '0') {
+    return false;
+  }
+  return configInfo?.devAuth?.enabled === true;
+}
+
+/**
+ * Enforces the production safety invariant: throws a fatal error if local dev auth
+ * is enabled while `NODE_ENV === 'production'`.
+ */
+export function AssertLocalDevAuthAllowed(env: NodeJS.ProcessEnv = process.env): void {
+  if (IsLocalDevAuthEnabled(env) && env.NODE_ENV?.trim().toLowerCase() === 'production') {
+    throw new Error(
+      '[SECURITY] Local dev auth (MJ_DEV_AUTH_ENABLED) is strictly forbidden when NODE_ENV=production. Refusing to start.'
+    );
+  }
+}
+
 /**
  * Initialize authentication providers from configuration.
  *
@@ -15,6 +42,8 @@ import { AuthProviderEngine } from './AuthProviderEngine.js';
  * connection and a system user exist.
  */
 export function InitializeAuthProviders(): void {
+  AssertLocalDevAuthAllowed();
+
   const factory = AuthProviderFactory.Instance;
 
   // Clear any existing providers
@@ -40,6 +69,19 @@ export function InitializeAuthProviders(): void {
     }
   }
 
+  if (IsLocalDevAuthEnabled()) {
+    configInfo.authProviders = configInfo.authProviders ?? [];
+    if (!configInfo.authProviders.some((p) => p.type === 'local' || p.name === 'local')) {
+      const localConfig = LocalDevProvider.ConfigFromEnvironment({
+        ...process.env,
+        MJ_DEV_AUTH_ENABLED: 'true',
+      });
+      if (localConfig) {
+        configInfo.authProviders.push(localConfig);
+      }
+    }
+  }
+
   // Initialize providers from authProviders config
   if (configInfo.authProviders && configInfo.authProviders.length > 0) {
     for (const providerConfig of configInfo.authProviders) {