@friggframework/core 2.0.0--canary.663.8de669c.0 → 2.0.0--canary.686.821f8a3.0

package/user/use-cases/get-user-from-x-frigg-headers.js

@@ -1,10 +1,38 @@
 const Boom = require('@hapi/boom');
-const { User } = require('../user');
+const {
+    findAppUsers,
+    createMissingAppUsers,
+    buildUser,
+    wantsIndividual,
+} = require('../app-user-helpers');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.user.x_frigg_headers');
+
+const NOT_A_MEMBER_MESSAGE =
+    'Not a member: the user identified by x-frigg-appUserId is not a member of the ' +
+    'organization identified by x-frigg-appOrgId, and strict membership does not ' +
+    'allow these headers to add them.';
 
 /**
  * Use case for retrieving or creating a user from x-frigg header identifiers.
  * Supports backend-to-backend API communication using application user IDs.
  *
+ * `x-frigg-appOrgId` names the request's active organization (ADR-056 §3.6).
+ * A person the organization does not know yet is added to it as a member; the
+ * person is never moved out of another organization, and
+ * `IndividualUser.organizationId` is set only on a first link.
+ *
+ * With `user.strictMembership: true` the headers cannot make anyone a member of
+ * an organization that already existed: a person who is not already a member
+ * (a brand-new `appUserId` included) is refused with 400. The one thing strict
+ * mode still allows is naming an organization this request creates, so a first
+ * login can bootstrap its own organization. Apps that run strict add people to
+ * existing organizations themselves, through the membership repository.
+ *
+ * `strictUserValidation` is a deprecated alias for `strictMembership`; its
+ * meaning changed (it used to reject a mismatched individual/organization pair).
+ *
  * @class GetUserFromXFriggHeaders
  */
 class GetUserFromXFriggHeaders {
@@ -12,11 +40,22 @@ class GetUserFromXFriggHeaders {
      * Creates a new GetUserFromXFriggHeaders instance.
      * @param {Object} params - Configuration parameters.
      * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
+     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
      * @param {Object} params.userConfig - The user config in the app definition.
      */
-    constructor({ userRepository, userConfig }) {
+    constructor({ userRepository, ensureOrganizationMembership, userConfig }) {
         this.userRepository = userRepository;
+        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
+
+        const { strictMembership, strictUserValidation } = userConfig ?? {};
+        if (strictUserValidation !== undefined && strictMembership === undefined) {
+            log.warn(
+                'user.strictUserValidation is deprecated and now means strictMembership; rename it',
+                { eventName: `${log.name}.strict_user_validation_deprecated` }
+            );
+        }
+        this.strict = Boolean(strictMembership ?? strictUserValidation);
     }
 
     /**
@@ -25,7 +64,7 @@ class GetUserFromXFriggHeaders {
      * @param {string} [appUserId] - The app user ID from x-frigg-appUserId header.
      * @param {string} [appOrgId] - The app organization ID from x-frigg-appOrgId header.
      * @returns {Promise<import('../user').User>} The authenticated user object.
-     * @throws {Boom} 400 Bad Request if neither ID is provided or if both IDs are provided but belong to different users.
+     * @throws {Boom} 400 Bad Request if neither ID is provided or, in strict mode, if the person is not already a member of the existing organization named.
      */
     async execute(appUserId, appOrgId) {
         // At least one header must be provided
@@ -36,96 +75,60 @@ class GetUserFromXFriggHeaders {
         }
 
         // Find users by both IDs if both are provided
-        let individualUserData = null;
-        let organizationUserData = null;
-
-        if (appUserId && this.userConfig.individualUserRequired !== false) {
-            individualUserData =
-                await this.userRepository.findIndividualUserByAppUserId(
-                    appUserId
-                );
-        }
+        let { individual: individualUserData, organization: organizationUserData } =
+            await findAppUsers(this.userRepository, this.userConfig, {
+                appUserId,
+                appOrgId,
+            });
 
-        if (appOrgId && this.userConfig.organizationUserRequired) {
-            organizationUserData =
-                await this.userRepository.findOrganizationUserByAppOrgId(
-                    appOrgId
-                );
-        }
+        // Strict mode refuses to make anyone a member of an organization that
+        // existed before this request. Only an organization created below is
+        // exempt, since it has no members to disagree with.
+        const refuseNewMembers = this.strict && Boolean(organizationUserData);
 
-        // VALIDATION/AUTO-LINKING: If both IDs provided and both users exist, handle mismatch
+        // A person who does not exist yet cannot already be a member, so refuse
+        // now, before anything is persisted: refusing after creating them would
+        // leave an orphan individual behind on every refused request.
         if (
+            refuseNewMembers &&
             appUserId &&
-            appOrgId &&
-            individualUserData &&
-            organizationUserData
+            wantsIndividual(this.userConfig) &&
+            !individualUserData
         ) {
-            // Check if individual user is linked to the org user
-            const individualOrgId =
-                individualUserData.organizationUser?.toString();
-            const expectedOrgId = organizationUserData.id?.toString();
-
-            if (individualOrgId !== expectedOrgId) {
-                // Default behavior: Auto-link disconnected users
-                // Opt-in strict mode: Throw error on mismatch
-                if (this.userConfig.strictUserValidation) {
-                    throw Boom.badRequest(
-                        'User ID mismatch: x-frigg-appUserId and x-frigg-appOrgId refer to different users. ' +
-                            'Provide only one identifier or ensure they belong to the same user.'
-                    );
-                }
-
-                // Auto-link the users
-                individualUserData = await this.userRepository.linkIndividualToOrganization(
-                    individualUserData.id,
-                    organizationUserData.id
-                );
-            }
+            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
         }
 
         // Auto-create users independently if they don't exist and are required
-        if (
-            !individualUserData &&
-            appUserId &&
-            this.userConfig.individualUserRequired !== false
-        ) {
-            individualUserData =
-                await this.userRepository.createIndividualUser({
-                    appUserId,
-                    username: `app-user-${appUserId}`,
-                    email: `${appUserId}@app.local`,
-                });
-        }
-
-        if (
-            !organizationUserData &&
-            appOrgId &&
-            this.userConfig.organizationUserRequired
-        ) {
-            organizationUserData =
-                await this.userRepository.createOrganizationUser({
-                    appOrgId,
-                });
-
-            // Link individual user to newly created org user if individual exists
-            if (individualUserData && organizationUserData) {
-                individualUserData = await this.userRepository.linkIndividualToOrganization(
-                    individualUserData.id,
-                    organizationUserData.id
-                );
+        const created = await createMissingAppUsers(
+            this.userRepository,
+            this.userConfig,
+            {
+                appUserId,
+                appOrgId,
+                individual: individualUserData,
+                organization: organizationUserData,
             }
+        );
+        individualUserData = created.individual;
+        organizationUserData = created.organization;
+
+        // The organization named by the header is the active one: join it
+        // rather than re-linking the person's single organizationId.
+        const ensured = await this.ensureOrganizationMembership.execute({
+            individual: individualUserData,
+            organization: organizationUserData,
+            requireExisting: refuseNewMembers,
+        });
+        if (refuseNewMembers && individualUserData && !ensured.membership) {
+            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
         }
+        individualUserData = ensured.individual;
 
-        const user = new User(
+        return buildUser(
+            this.userConfig,
             individualUserData,
-            organizationUserData,
-            this.userConfig.usePassword,
-            this.userConfig.primary,
-            this.userConfig.individualUserRequired,
-            this.userConfig.organizationUserRequired
+            organizationUserData
         );
-
-        return user;
     }
 }
 

package/user/user.js

@@ -1,5 +1,20 @@
 const bcrypt = require('bcryptjs');
 
+/**
+ * How the request that produced a `User` proved who it is. Set by
+ * AuthenticateUser, never inferred from a missing value. Organization roles
+ * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
+ * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
+ * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
+ * adopter token has the role it carries, else the stored membership role,
+ * else `MEMBER`.
+ */
+const AUTH_SOURCES = Object.freeze({
+    SHARED_SECRET: 'shared-secret',
+    ADOPTER_JWT: 'adopter-jwt',
+    BEARER_TOKEN: 'bearer-token',
+});
+
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -18,6 +33,14 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
+        // Organization role from an adopter token claim (ADR-056 §2), per
+        // request. When present it wins over the stored membership role.
+        this.orgRole = null;
+        // The role stored on the person's membership of the active organization
+        // (OrganizationMembership.orgRole); used when the token carries none.
+        this.membershipRole = null;
+        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
+        this.authSource = null;
 
         this.config = {
             primary,
@@ -26,6 +49,17 @@ class User {
         };
     }
 
+    /**
+     * The organization this request acts in (ADR-056 §3.6): the one the token or
+     * `x-frigg-appOrgId` named, not the person's legacy `organizationId`
+     * pointer. Null when the request has no organization.
+     * @returns {string|null}
+     */
+    getActiveOrganizationId() {
+        const id = this.organizationUser?.id;
+        return id === undefined || id === null || id === '' ? null : String(id);
+    }
+
     getPrimaryUser() {
         if (this.config.primary === 'organization') {
             return this.organizationUser;
@@ -33,6 +67,11 @@ class User {
         return this.individualUser;
     }
 
+    /**
+     * The id of the primary user. With `primary: 'organization'` this is the
+     * active organization (the one the request named), never the organization
+     * the person was first linked to.
+     */
     getId() {
         return this.getPrimaryUser()?.id;
     }
@@ -65,6 +104,30 @@ class User {
         return this.config.individualUserRequired;
     }
 
+    getAuthSource() {
+        return this.authSource;
+    }
+
+    setAuthSource(authSource) {
+        this.authSource = authSource ?? null;
+    }
+
+    getOrgRole() {
+        return this.orgRole;
+    }
+
+    setOrgRole(orgRole) {
+        this.orgRole = orgRole ?? null;
+    }
+
+    getMembershipRole() {
+        return this.membershipRole;
+    }
+
+    setMembershipRole(membershipRole) {
+        this.membershipRole = membershipRole ?? null;
+    }
+
     getIndividualUser() {
         return this.individualUser;
     }
@@ -122,4 +185,4 @@ class User {
     }
 }
 
-module.exports = { User }; 
+module.exports = { User, AUTH_SOURCES };