Member Junction
    Preparing search index...

    Interface MagicLinkJWTClaims

    Claims carried by a MJ-issued magic-link session JWT. Identity claims (email/given_name/family_name) follow standard OIDC so the existing provider extraction works; the mj_* claims describe the scope.

    interface MagicLinkJWTClaims {
        aud: string;
        email: string;
        exp: number;
        family_name?: string;
        given_name?: string;
        iat: number;
        iss: string;
        mj_anon?: boolean;
        mj_app_id: string;
        mj_host_email?: string;
        mj_invited_by?: string;
        mj_last_conversation_id?: string;
        mj_linked_entity_id?: string;
        mj_linked_record_id?: string;
        mj_magic_link: true;
        mj_role: string;
        mj_scopes?: MagicLinkScopeEntry[];
        mj_sid?: string;
        mj_visitor_key?: string;
        mj_widget_id?: string;
        name?: string;
        sub: string;
    }
    Index

    Properties

    aud email exp family_name? given_name? iat iss mj_anon? mj_app_id mj_host_email? mj_invited_by? mj_last_conversation_id? mj_linked_entity_id? mj_linked_record_id? mj_magic_link mj_role mj_scopes? mj_sid? mj_visitor_key? mj_widget_id? name? sub

    Properties

    aud: string

    Audience — the configured magic-link audience (default mj-magic-link).

    email: string
    exp: number

    Expiry (epoch seconds).

    family_name?: string
    given_name?: string
    iat: number

    Issued-at (epoch seconds).

    iss: string

    Issuer — MJ's public URL; resolves to the registered magic-link auth provider.

    mj_anon?: boolean

    True when this session resolves to the shared Anonymous principal (claims-based enforcement).

    mj_app_id: string

    The single Application this session is scoped to.

    mj_host_email?: string

    Host-asserted visitor email for a widget host-identity session (additive). The authoritative email/sub still resolve the constrained shared Anonymous principal; this carries WHO the host says the visitor is, for the agent to look up their account — without granting that account's permissions. Absent on anonymous/ordinary sessions.

    mj_invited_by?: string

    UserID of the internal user who issued the invite (attribution/audit). Absent on links whose inviter could not be resolved.

    mj_last_conversation_id?: string

    The prior conversation this visit chains from (RV2), for the voice path to stamp Conversation.LastConversationID.

    mj_linked_entity_id?: string

    Resolved polymorphic identity entity id (RV4), for the voice path to stamp the existing Conversation.LinkedEntityID / AIAgentSession.LinkedEntityID.

    mj_linked_record_id?: string

    Resolved polymorphic identity record id (RV4), for the voice path to stamp the existing Conversation.LinkedRecordID / AIAgentSession.LinkedRecordID.

    mj_magic_link: true

    Marks the session as magic-link so the Explorer can confine the UI.

    mj_role: string

    The restricted role name assigned to this user (informational; enforcement is server-side via the role's entity permissions).

    mj_scopes?: MagicLinkScopeEntry[]

    Per-session scope UNION (Phase 4+). Each entry is one redeemed link's grant. The server enforces anonymous sessions against THIS set (not the user's role set), which is why two anon visitors sharing the Anonymous principal can hold different scopes without accretion. For email sessions the singular mj_app_id/ mj_role remain authoritative; this carries the union when links are stacked.

    mj_sid?: string

    Opaque per-session id — correlates one anonymous session's activity across audit rows without a real user.

    mj_visitor_key?: string

    Returning-visitor anchor for a widget guest session (additive, RV1). Carried so the VOICE path — whose conversation is created server-side — can stamp the same Conversation.VisitorKey the text path stamps client-side. Present only when the widget remembers returning visitors.

    mj_widget_id?: string

    Public web widget instance id (additive — set only for widget guest sessions minted by WidgetSessionService). Binds the synthesized guest principal to one widget instance so its pinned agent / guest role can be locked down. Absent on ordinary magic-link sessions.

    name?: string
    sub: string

    Subject — magic-link|<inviteId>.

    Settings

    Member Visibility

    On This Page

    Properties