@friggframework/core 2.0.0--canary.498.056db99.0 → 2.0.0--canary.498.701403a.0

package/integrations/integration-router.js

@@ -601,11 +601,10 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entities/:entityId/test-auth').get(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.params, ['entityId']);
             const testAuthResponse = await testModuleAuth.execute(
                 params.entityId,
-                userId
+                user // Pass User object for proper validation
             );
 
             if (!testAuthResponse) {
@@ -628,9 +627,8 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entities/:entityId').get(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.params, ['entityId']);
-            const module = await getModule.execute(params.entityId, userId);
+            const module = await getModule.execute(params.entityId, user); // Pass User object
 
             res.json(module);
         })
@@ -639,12 +637,11 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entities/:entityId/options').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.params, ['entityId']);
 
             const entityOptions = await getEntityOptionsById.execute(
                 params.entityId,
-                userId
+                user // Pass User object
             );
 
             res.json(entityOptions);
@@ -654,11 +651,10 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entities/:entityId/options/refresh').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.params, ['entityId']);
             const updatedOptions = await refreshEntityOptions.execute(
                 params.entityId,
-                userId,
+                user, // Pass User object
                 req.body
             );
 

package/modules/use-cases/get-entity-options-by-id.js

@@ -12,11 +12,18 @@ class GetEntityOptionsById {
     }
 
     /**
-     * Retrieve a Module instance for a given user and entity/module type.
-     * @param {string} userId
-     * @param {string} entityId
+     * Retrieve entity options for a given entity
+     *
+     * @param {string|number} entityId - Entity ID to retrieve options for
+     * @param {string|number|import('../../user/user').User} userIdOrUser - User ID or User object for validation
+     * @returns {Promise<Object>} Entity options
      */
-    async execute(entityId, userId) {
+    async execute(entityId, userIdOrUser) {
+        // Support both userId (backward compatible) and User object (new pattern)
+        const userId = typeof userIdOrUser === 'object' && userIdOrUser?.getId
+            ? userIdOrUser.getId()
+            : userIdOrUser;
+
         const entity = await this.moduleRepository.findEntityById(
             entityId,
             userId
@@ -26,7 +33,12 @@ class GetEntityOptionsById {
             throw new Error(`Entity ${entityId} not found`);
         }
 
-        if (entity.userId !== userId) {
+        // Validate entity ownership
+        const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
+            ? userIdOrUser.ownsUserId(entity.userId)
+            : entity.userId?.toString() === userId?.toString();
+
+        if (!isOwned) {
             throw new Error(
                 `Entity ${entityId} does not belong to user ${userId}`
             );

package/modules/use-cases/get-module.js

@@ -6,7 +6,19 @@ class GetModule {
         this.moduleDefinitions = moduleDefinitions;
     }
 
-    async execute(entityId, userId) {
+    /**
+     * Get module instance for an entity
+     *
+     * @param {string|number} entityId - Entity ID to retrieve
+     * @param {string|number|import('../../user/user').User} userIdOrUser - User ID or User object for validation
+     * @returns {Promise<Object>} Module details
+     */
+    async execute(entityId, userIdOrUser) {
+        // Support both userId (backward compatible) and User object (new pattern)
+        const userId = typeof userIdOrUser === 'object' && userIdOrUser?.getId
+            ? userIdOrUser.getId()
+            : userIdOrUser;
+
         const entity = await this.moduleRepository.findEntityById(
             entityId,
             userId
@@ -16,7 +28,14 @@ class GetModule {
             throw new Error(`Entity ${entityId} not found`);
         }
 
-        if (entity.userId !== userId) {
+        // Validate entity ownership
+        // If User object provided, use ownsUserId to check linked users
+        // Otherwise fall back to simple equality check
+        const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
+            ? userIdOrUser.ownsUserId(entity.userId)
+            : entity.userId?.toString() === userId?.toString();
+
+        if (!isOwned) {
             throw new Error(
                 `Entity ${entityId} does not belong to user ${userId}`
             );

package/modules/use-cases/refresh-entity-options.js

@@ -12,11 +12,19 @@ class RefreshEntityOptions {
     }
 
     /**
-     * Retrieve a Module instance for a given user and entity/module type.
-     * @param {string} userId
-     * @param {string} entityId
+     * Refresh entity options for a given entity
+     *
+     * @param {string|number} entityId - Entity ID to refresh
+     * @param {string|number|import('../../user/user').User} userIdOrUser - User ID or User object for validation
+     * @param {Object} options - Refresh options
+     * @returns {Promise<Object>} Updated entity options
      */
-    async execute(entityId, userId, options) {
+    async execute(entityId, userIdOrUser, options) {
+        // Support both userId (backward compatible) and User object (new pattern)
+        const userId = typeof userIdOrUser === 'object' && userIdOrUser?.getId
+            ? userIdOrUser.getId()
+            : userIdOrUser;
+
         const entity = await this.moduleRepository.findEntityById(
             entityId,
             userId
@@ -26,7 +34,12 @@ class RefreshEntityOptions {
             throw new Error(`Entity ${entityId} not found`);
         }
 
-        if (entity.userId !== userId) {
+        // Validate entity ownership
+        const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
+            ? userIdOrUser.ownsUserId(entity.userId)
+            : entity.userId?.toString() === userId?.toString();
+
+        if (!isOwned) {
             throw new Error(
                 `Entity ${entityId} does not belong to user ${userId}`
             );

package/modules/use-cases/test-module-auth.js

@@ -11,7 +11,19 @@ class TestModuleAuth {
         this.moduleDefinitions = moduleDefinitions;
     }
 
-    async execute(entityId, userId) {
+    /**
+     * Test authentication for a module entity
+     *
+     * @param {string|number} entityId - Entity ID to test
+     * @param {string|number|import('../../user/user').User} userIdOrUser - User ID or User object for validation
+     * @returns {Promise<boolean>} Authentication test result
+     */
+    async execute(entityId, userIdOrUser) {
+        // Support both userId (backward compatible) and User object (new pattern)
+        const userId = typeof userIdOrUser === 'object' && userIdOrUser?.getId
+            ? userIdOrUser.getId()
+            : userIdOrUser;
+
         const entity = await this.moduleRepository.findEntityById(
             entityId,
             userId
@@ -21,7 +33,12 @@ class TestModuleAuth {
             throw new Error(`Entity ${entityId} not found`);
         }
 
-        if (entity.userId !== userId) {
+        // Validate entity ownership
+        const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
+            ? userIdOrUser.ownsUserId(entity.userId)
+            : entity.userId?.toString() === userId?.toString();
+
+        if (!isOwned) {
             throw new Error(
                 `Entity ${entityId} does not belong to user ${userId}`
             );

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.498.056db99.0",
+    "version": "2.0.0--canary.498.701403a.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -38,9 +38,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.498.056db99.0",
-        "@friggframework/prettier-config": "2.0.0--canary.498.056db99.0",
-        "@friggframework/test": "2.0.0--canary.498.056db99.0",
+        "@friggframework/eslint-config": "2.0.0--canary.498.701403a.0",
+        "@friggframework/prettier-config": "2.0.0--canary.498.701403a.0",
+        "@friggframework/test": "2.0.0--canary.498.701403a.0",
         "@prisma/client": "^6.17.0",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -80,5 +80,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "056db998fdcb35d4834bad3f8a7313045cafdf64"
+    "gitHead": "701403a6bbd42a361784baf5d584d515328e9c7c"
 }

package/user/repositories/user-repository-documentdb.js

@@ -427,6 +427,26 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         const date = new Date(value);
         return isNaN(date.getTime()) ? undefined : date;
     }
+
+    /**
+     * Link an individual user to an organization user
+     * @param {string} individualUserId - Individual user ID (MongoDB ObjectId string)
+     * @param {string} organizationUserId - Organization user ID (MongoDB ObjectId string)
+     * @returns {Promise<Object>} Updated individual user object
+     */
+    async linkIndividualToOrganization(individualUserId, organizationUserId) {
+        const doc = await updateOne(
+            this.prisma,
+            'User',
+            { _id: toObjectId(individualUserId), type: 'INDIVIDUAL' },
+            { $set: { organizationId: toObjectId(organizationUserId) } }
+        );
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
 }
 
 module.exports = { UserRepositoryDocumentDB };

package/user/repositories/user-repository-interface.js

@@ -193,6 +193,20 @@ class UserRepositoryInterface {
     async deleteUser(userId) {
         throw new Error('Method deleteUser must be implemented by subclass');
     }
+
+    /**
+     * Link an individual user to an organization user
+     *
+     * @param {string|number} individualUserId - Individual user ID
+     * @param {string|number} organizationUserId - Organization user ID
+     * @returns {Promise<Object>} Updated individual user object
+     * @abstract
+     */
+    async linkIndividualToOrganization(individualUserId, organizationUserId) {
+        throw new Error(
+            'Method linkIndividualToOrganization must be implemented by subclass'
+        );
+    }
 }
 
 module.exports = { UserRepositoryInterface };

package/user/repositories/user-repository-mongo.js

@@ -287,6 +287,24 @@ class UserRepositoryMongo extends UserRepositoryInterface {
             throw error;
         }
     }
+
+    /**
+     * Link an individual user to an organization user
+     * @param {string} individualUserId - Individual user ID (MongoDB ObjectId string)
+     * @param {string} organizationUserId - Organization user ID (MongoDB ObjectId string)
+     * @returns {Promise<Object>} Updated individual user object
+     */
+    async linkIndividualToOrganization(individualUserId, organizationUserId) {
+        return await this.prisma.user.update({
+            where: {
+                id: individualUserId,
+                type: 'INDIVIDUAL',
+            },
+            data: {
+                organizationId: organizationUserId,
+            },
+        });
+    }
 }
 
 module.exports = { UserRepositoryMongo };

package/user/user.js

@@ -88,6 +88,38 @@ class User {
     getAppOrgId() {
         return this.organizationUser?.appOrgId || null;
     }
+
+    /**
+     * Checks if a given userId belongs to this user (either primary or linked).
+     * When primary is 'organization', entities owned by the linked individual user
+     * should still be accessible to the organization.
+     *
+     * @param {string|number} userId - The userId to check
+     * @returns {boolean} True if the userId belongs to this user or their linked user
+     */
+    ownsUserId(userId) {
+        const userIdStr = userId?.toString();
+        const primaryId = this.getPrimaryUser()?.id?.toString();
+        const individualId = this.individualUser?.id?.toString();
+        const organizationId = this.organizationUser?.id?.toString();
+
+        // Check if userId matches primary user
+        if (userIdStr === primaryId) {
+            return true;
+        }
+
+        // When primary is 'organization', also check linked individual user
+        if (this.config.primary === 'organization' && userIdStr === individualId) {
+            return true;
+        }
+
+        // When primary is 'individual', also check linked organization user if required
+        if (this.config.primary === 'individual' && this.config.organizationUserRequired && userIdStr === organizationId) {
+            return true;
+        }
+
+        return false;
+    }
 }
 
 module.exports = { User };