@friggframework/core 2.0.0--canary.663.8de669c.0 → 2.0.0--canary.686.821f8a3.0

package/integrations/use-cases/integration-operations-for-user.js

@@ -0,0 +1,256 @@
+const Boom = require('@hapi/boom');
+const { describeRecord } = require('../../modules/scope-visibility');
+const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
+const { assertCanManage } = require('../../modules/use-cases/manage-access');
+const { isIntegrationNotFound } = require('../repositories/integration-not-found');
+
+/**
+ * Management API v2 integration operations. They put an access check
+ * (missing or unavailable integration = 404) in front of the existing
+ * integration use cases, and pass the record's owner id on. Access follows
+ * the owner and the organization the integration was created in (ADR-056
+ * §3.6), not the owner alone.
+ */
+
+const notFound = (integrationId) =>
+    Boom.notFound(`Integration ${integrationId} not found`, {
+        code: 'INTEGRATION_NOT_FOUND',
+    });
+
+/**
+ * The integration record, or 404 when it is missing or the caller may not
+ * use it: not theirs or their active organization's, or created in another
+ * organization.
+ */
+class GetOwnedIntegrationRecord {
+    constructor({ integrationRepository, scopePolicy }) {
+        this.integrationRepository = integrationRepository;
+        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
+    }
+
+    /** `{ scope, owner, organizationId, access }` of a record to this caller, or null. */
+    describe(record, user) {
+        return describeRecord(record, this.scopePolicy.accessContext(user), 'integration');
+    }
+
+    /**
+     * @param {string} integrationId
+     * @param {Object} user - authenticated User
+     * @param {{manage?: boolean}} [options] - `manage: true` for changing or
+     *   deleting: a person may use an organization's integration but only an
+     *   admin may change it (403 ORG_ADMIN_REQUIRED)
+     */
+    async execute(integrationId, user, { manage = false } = {}) {
+        let record = null;
+        try {
+            record = await this.integrationRepository.findIntegrationById(
+                integrationId
+            );
+        } catch (error) {
+            if (
+                /Invalid ID|ObjectId|Malformed/i.test(error?.message || '') ||
+                isIntegrationNotFound(error)
+            ) {
+                throw notFound(integrationId);
+            }
+            throw error;
+        }
+        const tenancy = record && this.describe(record, user);
+        if (!tenancy) throw notFound(integrationId);
+        if (manage) assertCanManage(tenancy.access, `integration ${integrationId}`);
+        return record;
+    }
+}
+
+/**
+ * Creates (or reuses) an integration between entities the caller may use.
+ * The entities' access, the binding scopes and the integration type are
+ * checked before anything is written, and the integration is owned and
+ * paired with an organization by `resolveIntegrationOwnership` (§3, §3.6).
+ */
+class CreateIntegrationForUser {
+    constructor({ createIntegration, resolveIntegrationOwnership, integrationClasses }) {
+        this.createIntegration = createIntegration;
+        this.resolveIntegrationOwnership = resolveIntegrationOwnership;
+        this.integrationClasses = integrationClasses || [];
+    }
+
+    async execute({ entities, config }, user) {
+        if (!config || typeof config !== 'object' || typeof config.type !== 'string') {
+            throw Boom.badRequest('config.type is required', {
+                code: 'VALIDATION_ERROR',
+                details: { field: 'config.type' },
+            });
+        }
+        const known = this.integrationClasses.some(
+            (IntegrationClass) => IntegrationClass.Definition?.name === config.type
+        );
+        if (!known) {
+            throw Boom.badRequest(`Unknown integration type '${config.type}'`, {
+                code: 'UNKNOWN_INTEGRATION_TYPE',
+            });
+        }
+        if (
+            !Array.isArray(entities) ||
+            entities.some((id) => typeof id !== 'string' && typeof id !== 'number')
+        ) {
+            throw Boom.badRequest('entities must be an array of entity ids', {
+                code: 'VALIDATION_ERROR',
+                details: { field: 'entities' },
+            });
+        }
+        const { ownerId, organizationId, adoptUnscoped } =
+            await this.resolveIntegrationOwnership.execute({
+                entityIds: entities,
+                config,
+                user,
+            });
+        return this.createIntegration.execute(
+            entities.map(String),
+            ownerId,
+            config,
+            { organizationId, adoptUnscoped }
+        );
+    }
+}
+
+/** The hydrated integration instance (modules loaded) for an owned integration. */
+class GetIntegrationInstanceForUser {
+    constructor({ getOwnedIntegrationRecord, getIntegrationInstance }) {
+        this.getOwnedIntegrationRecord = getOwnedIntegrationRecord;
+        this.getIntegrationInstance = getIntegrationInstance;
+    }
+
+    async execute(integrationId, user) {
+        const record = await this.getOwnedIntegrationRecord.execute(
+            integrationId,
+            user
+        );
+        return this.getIntegrationInstance.execute(record.id, record.userId);
+    }
+}
+
+/** Replaces an owned integration's config. */
+class UpdateIntegrationForUser {
+    constructor({ getOwnedIntegrationRecord, updateIntegration }) {
+        this.getOwnedIntegrationRecord = getOwnedIntegrationRecord;
+        this.updateIntegration = updateIntegration;
+    }
+
+    async execute(integrationId, user, config) {
+        if (!config || typeof config !== 'object' || Array.isArray(config)) {
+            throw Boom.badRequest('config must be an object', {
+                code: 'VALIDATION_ERROR',
+                details: { field: 'config' },
+            });
+        }
+        const record = await this.getOwnedIntegrationRecord.execute(
+            integrationId,
+            user,
+            { manage: true }
+        );
+        return this.updateIntegration.execute(record.id, record.userId, config);
+    }
+}
+
+/** Deletes an owned integration (runs its onDelete hooks). */
+class RemoveIntegrationForUser {
+    constructor({ getOwnedIntegrationRecord, deleteIntegrationForUser }) {
+        this.getOwnedIntegrationRecord = getOwnedIntegrationRecord;
+        this.deleteIntegrationForUser = deleteIntegrationForUser;
+    }
+
+    async execute(integrationId, user) {
+        const record = await this.getOwnedIntegrationRecord.execute(
+            integrationId,
+            user,
+            { manage: true }
+        );
+        await this.deleteIntegrationForUser.execute(record.id, record.userId);
+    }
+}
+
+/**
+ * Sends one of the framework's user-facing events (GET_CONFIG_OPTIONS,
+ * GET_USER_ACTIONS, ...) to an owned integration. Handlers pass fixed event
+ * names only; caller-chosen action ids go through RunIntegrationActionForUser.
+ */
+class SendIntegrationEventForUser {
+    constructor({ getIntegrationInstanceForUser }) {
+        this.getIntegrationInstanceForUser = getIntegrationInstanceForUser;
+    }
+
+    async execute(integrationId, user, event, payload) {
+        const instance = await this.getIntegrationInstanceForUser.execute(
+            integrationId,
+            user
+        );
+        return instance.send(event, payload);
+    }
+}
+
+/**
+ * Runs a user action on an owned integration. Unlike v1, the action id must
+ * be one the integration lists as a user action (static USER_ACTION events
+ * or its dynamic user actions), so a caller cannot fire internal events such
+ * as lifecycle hooks.
+ */
+class RunIntegrationActionForUser {
+    constructor({ getIntegrationInstanceForUser }) {
+        this.getIntegrationInstanceForUser = getIntegrationInstanceForUser;
+    }
+
+    async execute(integrationId, user, actionId, payload) {
+        const instance = await this.getIntegrationInstanceForUser.execute(
+            integrationId,
+            user
+        );
+        const actions =
+            typeof instance.loadUserActions === 'function'
+                ? await instance.loadUserActions()
+                : {};
+        if (!actions || !Object.prototype.hasOwnProperty.call(actions, actionId)) {
+            throw Boom.notFound(
+                `Integration ${integrationId} has no user action '${actionId}'`,
+                { code: 'ACTION_NOT_FOUND' }
+            );
+        }
+        return instance.send(actionId, payload);
+    }
+}
+
+/**
+ * Runs the integration's auth test and reconciles its status. Returns the
+ * errors recorded during the test.
+ */
+class TestIntegrationAuthForUser {
+    constructor({ getIntegrationInstanceForUser }) {
+        this.getIntegrationInstanceForUser = getIntegrationInstanceForUser;
+    }
+
+    /** @returns {Promise<{ ok: boolean, errors: Array<Object> }>} */
+    async execute(integrationId, user) {
+        const instance = await this.getIntegrationInstanceForUser.execute(
+            integrationId,
+            user
+        );
+        const start = Date.now();
+        const authPassed = await instance.testAuth();
+        await instance.reconcileAuthStatus(authPassed);
+        const errors = (instance.record?.messages?.errors || []).filter(
+            ({ timestamp }) => timestamp >= start
+        );
+        return { ok: Boolean(authPassed) && errors.length === 0, errors };
+    }
+}
+
+module.exports = {
+    GetOwnedIntegrationRecord,
+    CreateIntegrationForUser,
+    GetIntegrationInstanceForUser,
+    UpdateIntegrationForUser,
+    RemoveIntegrationForUser,
+    SendIntegrationEventForUser,
+    RunIntegrationActionForUser,
+    TestIntegrationAuthForUser,
+};

package/integrations/use-cases/resolve-integration-ownership.js

@@ -0,0 +1,177 @@
+const Boom = require('@hapi/boom');
+const { SCOPES, resolveScope } = require('../../modules/scope-resolution');
+const {
+    integrationOwnerKind,
+    resolveIntegrationOwner,
+} = require('../../modules/scope-resolution');
+const {
+    describeRecord,
+    unscopedRowsBelongHere,
+} = require('../../modules/scope-visibility');
+const {
+    bindingScopeSetting,
+    readIntegrationOwnership,
+} = require('../../modules/scope-config');
+const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
+const { entityTypeNameOf } = require('../../modules/entity-type-registry');
+
+const notFound = (entityId) =>
+    Boom.notFound(`Entity ${entityId} not found`, { code: 'ENTITY_NOT_FOUND' });
+
+/**
+ * Who owns an integration about to be created, and in which organization
+ * (ADR-056 §3, §3.3, §3.6). Shared by the v1 and v2 create paths. Nothing is
+ * persisted before this has answered, so a refusal leaves no row behind.
+ *
+ * Every entity must be one the caller may use in the active organization. A
+ * missing one, another organization's and a `global` one are the same 404, so
+ * ids cannot be probed. When the integration declares a scope (a binding's
+ * `scope` or `Definition.entities[key].scope`, or `Definition.ownership.scope`)
+ * the entity's scope must be in it. Levels below the integration (entity type,
+ * app, default) decide where a connection is CREATED and do not restrict what
+ * an integration may bind, so an app that adds a registry scope later does not
+ * break integrations that already use older connections.
+ *
+ * The owner follows the entities (all organization: the organization;
+ * otherwise the person) unless `Definition.ownership.owner` says. Every entity
+ * must then be of the owner's own scope: an integration is loaded by its owner,
+ * who must own what it uses, so an integration that mixes an organization
+ * entity with a person's own, or that names an owner that does not match, is
+ * refused with a 400 here, before anything is written.
+ */
+class ResolveIntegrationOwnership {
+    /**
+     * @param {Object} params
+     * @param {import('../../modules/repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository
+     * @param {Array<Function>} params.integrationClasses
+     * @param {Object} [params.scopePolicy] - from createScopePolicy
+     */
+    constructor({ moduleRepository, integrationClasses, scopePolicy }) {
+        this.moduleRepository = moduleRepository;
+        this.integrationClasses = integrationClasses || [];
+        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
+    }
+
+    /**
+     * @param {Object} params
+     * @param {Array<string|number>} params.entityIds
+     * @param {Object} params.config - `{ type }`
+     * @param {Object} params.user - authenticated User
+     * @returns {Promise<{ownerId: string, organizationId: (string|null), ownerKind: string, adoptUnscoped: boolean}>}
+     */
+    async execute({ entityIds, config, user }) {
+        const ctx = this.scopePolicy.accessContext(user);
+        const integrationClass = this.integrationClasses.find(
+            (IntegrationClass) => IntegrationClass.Definition?.name === config?.type
+        );
+        const ownership = readIntegrationOwnership(integrationClass);
+
+        const entities = await this.loadEntities(entityIds);
+        const scoped = entities.map((entity) => ({
+            entity,
+            scope: this.acceptedScope({ entity, ctx, integrationClass, ownership }),
+        }));
+
+        const ownerKind = integrationOwnerKind(
+            scoped.map(({ scope }) => scope),
+            ownership.owner
+        );
+        this.assertOneScope(scoped, ownerKind, config?.type);
+        return {
+            ...resolveIntegrationOwner(ownerKind, ctx),
+            ownerKind,
+            // Whether an existing integration with no organization (written
+            // before scoping) is this caller's to reuse. An organization-owned
+            // one is unambiguous: its owner is the organization, whoever asks
+            // and whatever their own legacy pointer says. A person's is theirs
+            // only where scope-visibility says (their legacy organization).
+            adoptUnscoped:
+                ownerKind === SCOPES.ORGANIZATION ||
+                unscopedRowsBelongHere(ctx, 'integration'),
+        };
+    }
+
+    /** Every entity must be of the integration owner's own scope (see the class comment). */
+    assertOneScope(scoped, ownerKind, type) {
+        for (const { entity, scope } of scoped) {
+            if (scope === ownerKind) continue;
+            // The load-time check (resolveOwnershipConfig) only sees declared
+            // scopes; this one sees the entities actually named.
+            if (ownerKind === SCOPES.ORGANIZATION) {
+                throw Boom.badRequest(
+                    "An organization-owned integration cannot use an 'individual' entity: a shared integration must not run on one person's credential",
+                    {
+                        code: 'ORG_INTEGRATION_INDIVIDUAL_ENTITY',
+                        details: { entityId: String(entity.id) },
+                    }
+                );
+            }
+            throw Boom.badRequest(
+                `Integration '${type}' would be owned by the person but uses the organization entity ${entity.id}. An integration must use entities of one scope: all of the person's, or all of the organization's.`,
+                {
+                    code: 'MIXED_ENTITY_SCOPES',
+                    details: { entityId: String(entity.id), scope },
+                }
+            );
+        }
+    }
+
+    async loadEntities(entityIds) {
+        const ids = (entityIds || []).map(String);
+        if (ids.length === 0) return [];
+        let found;
+        try {
+            found = await this.moduleRepository.findEntitiesByIds(ids);
+        } catch (error) {
+            // A malformed id (e.g. not an integer on PostgreSQL) is "not found".
+            if (/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
+                throw notFound(ids[0]);
+            }
+            throw error;
+        }
+        const byId = new Map((found || []).filter(Boolean).map((e) => [String(e.id), e]));
+        return ids.map((id) => {
+            if (!byId.has(id)) throw notFound(id);
+            return byId.get(id);
+        });
+    }
+
+    /** The entity's scope for this caller, or a refusal. */
+    acceptedScope({ entity, ctx, integrationClass, ownership }) {
+        const described = describeRecord(entity, ctx, 'entity');
+        if (!described) throw notFound(entity.id);
+        const { scope } = described;
+
+        const declared = this.declaredScope({ entity, integrationClass, ownership });
+        if (declared && !declared.allow.includes(scope)) {
+            throw Boom.badRequest(
+                `Entity ${entity.id} is ${scope}-scoped, but this integration binds ${entity.moduleName} at ${declared.allow.join(' or ')} scope`,
+                {
+                    code: 'ENTITY_SCOPE_MISMATCH',
+                    details: { entityId: String(entity.id), scope, allowed: declared.allow },
+                }
+            );
+        }
+        return scope;
+    }
+
+    /**
+     * What the integration itself declares for this entity's binding (levels 2
+     * and 3 only), or null when it declares nothing.
+     */
+    declaredScope({ entity, integrationClass, ownership }) {
+        const Definition = integrationClass?.Definition;
+        const key = Object.keys(Definition?.modules || {}).find(
+            (candidate) =>
+                entityTypeNameOf(Definition.modules[candidate]?.definition) ===
+                entity.moduleName
+        );
+        const resolved = resolveScope({
+            binding: key === undefined ? undefined : bindingScopeSetting(Definition, key),
+            integration: ownership.scope,
+        });
+        return resolved.decidedBy === 'default' ? null : resolved;
+    }
+}
+
+module.exports = { ResolveIntegrationOwnership };

package/integrations/utils/map-integration-dto.js

@@ -19,19 +19,48 @@ function mapIntegrationClassToIntegrationDTO(integration) {
     };
 }
 
+let deprecationLogged = false;
 
-const getModulesDefinitionFromIntegrationClasses = (integrationClasses) => {
-    return [
-        ...new Set(
-            integrationClasses
-                .map((integration) =>
-                    Object.values(integration.Definition.modules).map(
-                        (module) => module.definition
-                    )
-                )
-                .flat()
-        ),
-    ];
-};
+/**
+ * @deprecated Since ADR-059. Read `entityTypeRegistry` / `moduleDefinitions`
+ * from `loadAppDefinition()`, or call `getEntityTypeRegistry(appDefinition)`
+ * and read each entry's `definition`.
+ *
+ * Kept as a wrapper over the entity type registry so callers that imported it
+ * keep working. It returns the registry's definitions, so it follows the
+ * registry's rules: one definition per entity type name (the first wins when
+ * two integrations bind different definitions under one name, as
+ * ModuleFactory already picked), and, when `entities` is passed, registry-only
+ * types are included and conflicts throw `EntityRegistryError`.
+ *
+ * @param {Array<Function>} integrationClasses - integration classes
+ * @param {Object} [entities] - `appDefinition.entities` (ADR-059)
+ * @returns {Array<Object>} API module definitions
+ */
+function getModulesDefinitionFromIntegrationClasses(
+    integrationClasses,
+    entities
+) {
+    // Required here, not at the top: modules/ must not load at require time
+    // of every integration use case that only wants the DTO mapper.
+    const {
+        getEntityTypeRegistry,
+        getEntityTypeDefinitions,
+    } = require('../../modules/entity-type-registry');
+    if (!deprecationLogged) {
+        deprecationLogged = true;
+        const { getLogger } = require('../../logs');
+        getLogger('frigg.integrations').warn(
+            'getModulesDefinitionFromIntegrationClasses is deprecated; use getEntityTypeRegistry (ADR-059)',
+            { eventName: 'frigg.integrations.deprecated_module_definitions' }
+        );
+    }
+    return getEntityTypeDefinitions(
+        getEntityTypeRegistry({ integrations: integrationClasses, entities })
+    );
+}
 
-module.exports = { mapIntegrationClassToIntegrationDTO, getModulesDefinitionFromIntegrationClasses }; 
+module.exports = {
+    mapIntegrationClassToIntegrationDTO,
+    getModulesDefinitionFromIntegrationClasses,
+};

package/management-api/create-management-api-router.js

@@ -0,0 +1,49 @@
+const express = require('express');
+const { resolveManagementApiConfig } = require('./management-api-config');
+const {
+    createV1DeprecationRouter,
+    createV1DisabledRouter,
+} = require('./v1-deprecation');
+
+/**
+ * The Management API served by the auth Lambda (ADR-053): v2 under /api/v2
+ * and the frozen, deprecated v1 at the unprefixed paths. With
+ * `managementApi.v1: false` the v1 handlers are never built and the v1 paths
+ * answer 410.
+ *
+ * @param {Object} [params]
+ * @param {Object} [params.appDefinition] - defaults to loadAppDefinition().
+ * @param {Function} [params.createV1Router] - defaults to createIntegrationRouter.
+ * @param {Function} [params.createV2Router] - defaults to createManagementApiV2Router.
+ */
+function createManagementApiRouter({
+    appDefinition,
+    createV1Router,
+    createV2Router,
+} = {}) {
+    const definition =
+        appDefinition ||
+        require('../handlers/app-definition-loader').loadAppDefinition();
+    const config = resolveManagementApiConfig(definition.managementApi);
+
+    const buildV1 =
+        createV1Router ||
+        require('../integrations/integration-router').createIntegrationRouter;
+    const buildV2 =
+        createV2Router ||
+        require('./v2/create-v2-router').createManagementApiV2Router;
+
+    const router = express.Router();
+    router.use(buildV2({ appDefinition: definition, config }));
+
+    if (config.v1) {
+        router.use(createV1DeprecationRouter());
+        router.use(buildV1());
+    } else {
+        router.use(createV1DisabledRouter());
+    }
+
+    return router;
+}
+
+module.exports = { createManagementApiRouter };

package/management-api/error-response.js

@@ -0,0 +1,116 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Error responses for the HTTP boundary (handlers/app-handler-helpers.js).
+ *
+ * - v1 and other unversioned routes keep their historical body:
+ *   `{ error: message }` for 4xx, `{ error: 'Internal Server Error' }` for 5xx.
+ * - Management API v2 and /api/meta answer `{ error: { code, message, details? } }`
+ *   and carry `Frigg-API-Version: 2` even when the error happened before any
+ *   v2 router ran (for example a body-parser failure).
+ */
+
+const API_VERSION_HEADER = 'Frigg-API-Version';
+
+const CODE_BY_STATUS = {
+    400: 'BAD_REQUEST',
+    401: 'UNAUTHORIZED',
+    403: 'FORBIDDEN',
+    404: 'NOT_FOUND',
+    405: 'METHOD_NOT_ALLOWED',
+    409: 'CONFLICT',
+    410: 'GONE',
+    413: 'PAYLOAD_TOO_LARGE',
+    415: 'UNSUPPORTED_MEDIA_TYPE',
+    422: 'UNPROCESSABLE_ENTITY',
+    429: 'RATE_LIMITED',
+    500: 'INTERNAL_ERROR',
+    501: 'NOT_IMPLEMENTED',
+    502: 'BAD_GATEWAY',
+    503: 'SERVICE_UNAVAILABLE',
+    504: 'GATEWAY_TIMEOUT',
+};
+
+// body-parser (via http-errors) tags its failures with `type`.
+const CODE_BY_BODY_PARSER_TYPE = {
+    'entity.parse.failed': 'INVALID_JSON',
+    'entity.too.large': 'PAYLOAD_TOO_LARGE',
+    'encoding.unsupported': 'UNSUPPORTED_MEDIA_TYPE',
+    'charset.unsupported': 'UNSUPPORTED_MEDIA_TYPE',
+    'request.aborted': 'BAD_REQUEST',
+};
+
+/** True for paths that use the v2 error contract. */
+function isVersionedManagementApiPath(path = '') {
+    return (
+        path === '/api/v2' ||
+        path.startsWith('/api/v2/') ||
+        path === '/api/meta' ||
+        path.startsWith('/api/meta/')
+    );
+}
+
+/**
+ * The HTTP status for an error. Boom errors carry theirs. Other errors are
+ * trusted only when they declare a client error as safe to expose, as
+ * http-errors (and so body-parser) does; anything else is a 500, so an
+ * upstream FetchError's `statusCode` is never mistaken for ours.
+ */
+function resolveStatusCode(err) {
+    if (err?.isBoom) return err.output.statusCode;
+    const status = err?.status ?? err?.statusCode;
+    if (
+        err?.expose === true &&
+        Number.isInteger(status) &&
+        status >= 400 &&
+        status < 500
+    ) {
+        return status;
+    }
+    return 500;
+}
+
+/** Normalises any thrown value into a Boom error with the right status. */
+function toBoom(err) {
+    if (err?.isBoom) return err;
+    const error = err instanceof Error ? err : new Error(String(err));
+    return Boom.boomify(error, { statusCode: resolveStatusCode(err) });
+}
+
+/** The v2 error body for a Boom error. */
+function toV2ErrorBody(boomError) {
+    const statusCode = boomError.output.statusCode;
+    const data =
+        boomError.data && typeof boomError.data === 'object'
+            ? boomError.data
+            : {};
+    const exposeServerError = statusCode >= 500 && data.expose === true;
+
+    const code =
+        (typeof data.code === 'string' && data.code) ||
+        CODE_BY_BODY_PARSER_TYPE[boomError.type] ||
+        CODE_BY_STATUS[statusCode] ||
+        (statusCode >= 500 ? 'INTERNAL_ERROR' : 'BAD_REQUEST');
+
+    const message =
+        statusCode < 500 || exposeServerError
+            ? boomError.message
+            : 'Internal Server Error';
+
+    const body = { code, message };
+    if (
+        data.details !== undefined &&
+        (statusCode < 500 || exposeServerError)
+    ) {
+        body.details = data.details;
+    }
+    return { error: body };
+}
+
+module.exports = {
+    API_VERSION_HEADER,
+    isVersionedManagementApiPath,
+    resolveStatusCode,
+    toBoom,
+    toV2ErrorBody,
+};