@friggframework/core 2.0.0--canary.669.5f3833b.0 → 2.0.0--canary.671.dc3e89f.0

package/credential/repositories/credential-repository-documentdb.js

@@ -186,6 +186,40 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        const userObjectId = toObjectId(userId);
+        if (!userObjectId) return [];
+        const docs = await findManyDrained(
+            this.prisma,
+            'Credential',
+            { userId: userObjectId },
+            { sort: { createdAt: -1 } }
+        );
+        const credentials = [];
+        for (const doc of docs) {
+            const decrypted = await this.encryptionService.decryptFields(
+                'Credential',
+                doc
+            );
+            credentials.push({
+                ...this._mapCredential(decrypted),
+                id: fromObjectId(doc._id),
+                userId: fromObjectId(doc.userId) ?? doc.userId,
+                externalId: doc.externalId ?? null,
+                authIsValid: doc.authIsValid ?? null,
+                createdAt: doc.createdAt ?? null,
+                updatedAt: doc.updatedAt ?? null,
+            });
+        }
+        return credentials;
+    }
+
     async updateCredential(credentialId, updates) {
         const objectId = toObjectId(credentialId);
         if (!objectId) return null;

package/credential/repositories/credential-repository-interface.js

@@ -80,6 +80,21 @@ class CredentialRepositoryInterface {
         );
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string|number} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs, `createdAt`
+     *   and `updatedAt`, and the (decrypted) data fields spread in, as
+     *   findCredentialById returns them. Empty when the user has none.
+     * @abstract
+     */
+    async findCredentialsByUserId(userId) {
+        throw new Error(
+            'Method findCredentialsByUserId must be implemented by subclass'
+        );
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/repositories/credential-repository-mongo.js

@@ -188,6 +188,29 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        if (!userId) return [];
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: String(userId) },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id,
+            userId: credential.userId,
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })

package/credential/repositories/credential-repository-postgres.js

@@ -205,6 +205,34 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        let intUserId;
+        try {
+            intUserId = this._convertId(userId);
+        } catch {
+            return [];
+        }
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: intUserId },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id.toString(),
+            userId: credential.userId?.toString(),
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/use-cases/credential-operations-for-user.js

@@ -0,0 +1,117 @@
+const Boom = require('@hapi/boom');
+const { userOwns } = require('../../modules/use-cases/get-entity-module-for-user');
+
+/**
+ * Management API v2 credential operations. A credential has no module name
+ * of its own; its `type` and the entities that use it come from the
+ * caller's entities. A missing or foreign credential is a 404.
+ */
+
+const credentialIdOf = (entity) => {
+    const ref = entity.credential ?? entity.credentialId;
+    if (ref === undefined || ref === null) return null;
+    if (typeof ref === 'object') {
+        const id = ref.id ?? ref._id;
+        return id === undefined || id === null ? null : String(id);
+    }
+    return String(ref);
+};
+
+/** Adds `type` and `entityIds` from the user's entities to each credential. */
+function withEntityUsage(credentials, entities) {
+    const usage = new Map();
+    for (const entity of entities || []) {
+        const credentialId = credentialIdOf(entity);
+        if (!credentialId) continue;
+        const entry = usage.get(credentialId) || { type: null, entityIds: [] };
+        entry.type = entry.type || entity.moduleName || null;
+        entry.entityIds.push(String(entity.id));
+        usage.set(credentialId, entry);
+    }
+    return credentials.map((credential) => {
+        const entry = usage.get(String(credential.id)) || {
+            type: null,
+            entityIds: [],
+        };
+        return { ...credential, type: entry.type, entityIds: entry.entityIds };
+    });
+}
+
+/** The caller's credentials with their type and entity usage. */
+class ListCredentialsForUser {
+    constructor({ credentialRepository, moduleRepository }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+    }
+
+    async execute(user) {
+        const userId = user.getId();
+        const [credentials, entities] = await Promise.all([
+            this.credentialRepository.findCredentialsByUserId(userId),
+            this.moduleRepository.findEntitiesByUserId(userId),
+        ]);
+        return withEntityUsage(credentials || [], entities);
+    }
+}
+
+/** One credential the caller owns, with its type and entity usage. */
+class GetCredentialForUserV2 {
+    constructor({ credentialRepository, moduleRepository }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+    }
+
+    async execute(credentialId, user) {
+        let credential = null;
+        try {
+            credential = await this.credentialRepository.findCredentialById(
+                credentialId
+            );
+        } catch (error) {
+            if (!/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
+                throw error;
+            }
+        }
+        if (!credential || !userOwns(user, credential.userId)) {
+            throw Boom.notFound(`Credential ${credentialId} not found`, {
+                code: 'CREDENTIAL_NOT_FOUND',
+            });
+        }
+        const entities = await this.moduleRepository.findEntitiesByUserId(
+            credential.userId
+        );
+        return withEntityUsage([credential], entities)[0];
+    }
+}
+
+/**
+ * Deletes a credential the caller owns. The entities that used it stay, with
+ * their credential unset, so they show as needing re-authorization rather
+ * than disappearing from integrations.
+ */
+class DeleteCredentialForUser {
+    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+        this.getCredentialForUser = getCredentialForUser;
+    }
+
+    async execute(credentialId, user) {
+        const credential = await this.getCredentialForUser.execute(
+            credentialId,
+            user
+        );
+        for (const entityId of credential.entityIds) {
+            await this.moduleRepository.unsetCredential(entityId);
+        }
+        await this.credentialRepository.deleteCredentialById(credential.id);
+        return { id: String(credential.id), entityIds: credential.entityIds };
+    }
+}
+
+module.exports = {
+    ListCredentialsForUser,
+    GetCredentialForUserV2,
+    DeleteCredentialForUser,
+    withEntityUsage,
+};

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -0,0 +1,66 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Re-authorization of a credential the caller owns (Management API v2). It
+ * runs the same flow as /api/v2/authorize for the credential's entity type,
+ * with the session bound to the credential so it cannot be reused for
+ * anything else.
+ */
+async function credentialEntityType(getCredentialForUser, credentialId, user) {
+    const credential = await getCredentialForUser.execute(credentialId, user);
+    if (!credential.type) {
+        throw Boom.conflict(
+            `Credential ${credentialId} is not used by any entity, so its type is unknown; authorize a new connection instead`,
+            { code: 'CREDENTIAL_TYPE_UNKNOWN' }
+        );
+    }
+    return { entityType: credential.type, credentialId: String(credential.id) };
+}
+
+/** GET /api/v2/credentials/:credentialId/reauthorize */
+class GetCredentialReauthorization {
+    constructor({ getCredentialForUser, getAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.getAuthorizationStep = getAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
+        const binding = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
+        return this.getAuthorizationStep.execute({
+            user,
+            ...binding,
+            step,
+            sessionId,
+            state,
+        });
+    }
+}
+
+/** POST /api/v2/credentials/:credentialId/reauthorize */
+class ReauthorizeCredentialForUser {
+    constructor({ getCredentialForUser, submitAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.submitAuthorizationStep = submitAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
+        const binding = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
+        return this.submitAuthorizationStep.execute({
+            user,
+            ...binding,
+            data,
+            step,
+            sessionId,
+        });
+    }
+}
+
+module.exports = { GetCredentialReauthorization, ReauthorizeCredentialForUser };

package/database/encryption/encryption-schema-registry.js

@@ -39,6 +39,12 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
+
+    // Multi-step authorization (Management API v2): earlier steps can collect
+    // emails, usernames or one-time codes.
+    AuthorizationSession: {
+        fields: ['stepData'],
+    },
 };
 
 let customSchema = {};