@friggframework/core 2.0.0--canary.678.58db4b2.0 → 2.0.0--canary.681.d970b9e.0

package/README.md

@@ -393,7 +393,7 @@ value that is not a three-part JWT is not offered to the verifier at all; it fal
 | `clockToleranceSec` | `30` | Skew allowed on `exp` and `nbf`. |
 | `userIdClaim` | `sub` | App user id (required in the token). |
 | `orgIdClaim` | `org_id` | App organization id (optional). |
-| `roleClaim` | `org_role` | Read and exposed as `user.getOrgRole()`; not stored yet. |
+| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). |
 
 Rules worth knowing:
 
@@ -406,8 +406,20 @@ Rules worth knowing:
   `token_missing_user_claim`, `token_malformed`. The message never contains the token or its claims.
   Any other verification failure, such as an unreachable or unresolvable JWKS, is `503`
   `jwks_unavailable`, not a 401, so clients do not drop good sessions.
-- A person belongs to one organization for now: a token naming a second one gets `403`
-  `multi_org_unsupported` and nothing is moved (ADR-056 §3.6 replaces this with memberships).
+- **The token's organization is the request's active organization**, and a person can belong to
+  several (ADR-056 §3.6). The first time a person presents a token for an organization they are
+  not a member of, Frigg adds an `OrganizationMembership` and the request runs as that
+  organization (`user.getActiveOrganizationId()`; `user.getId()` under `primary: 'organization'`).
+  Nothing is moved: `IndividualUser.organizationId` is a legacy pointer, set only on a person's
+  first link and read as an implicit membership. The same applies to `x-frigg-apporgid` with
+  `sharedSecret`. With `user.strictMembership: true` those headers cannot add anyone to an organization
+  that already existed (400 for a non-member, a brand-new `appUserId` included); only an organization
+  the request itself creates is allowed. `strictUserValidation` is a deprecated alias with that same
+  meaning. See
+  [Organization memberships](../../docs/guides/organization-memberships.md). A token naming a second
+  organization is no longer a `403` (`multi_org_unsupported` is gone).
+- Two first logins for the same new person or organization, even in different organizations, both
+  succeed: a create that loses to a unique constraint finds the winner's row.
 
 ### 8. Lambda Utilities (`/lambda`)
 

package/application/commands/user-commands.js

@@ -1,6 +1,12 @@
 const {
     createUserRepository,
 } = require('../../user/repositories/user-repository-factory');
+const {
+    createOrganizationMembershipRepository,
+} = require('../../user/repositories/organization-membership-repository-factory');
+const {
+    FindIndividualUsersByOrganization,
+} = require('../../user/use-cases/find-individual-users-by-organization');
 
 const ERROR_CODE_MAP = {
     USER_NOT_FOUND: 404,
@@ -26,6 +32,12 @@ function mapErrorToResponse(error) {
  */
 function createUserCommands() {
     const userRepository = createUserRepository();
+    const findIndividualUsersByOrganization =
+        new FindIndividualUsersByOrganization({
+            userRepository,
+            organizationMembershipRepository:
+                createOrganizationMembershipRepository(),
+        });
 
     return {
         /**
@@ -170,7 +182,8 @@ function createUserCommands() {
         },
 
         /**
-         * Find all individual users linked to an organization user
+         * Find all individual users who belong to an organization user: those with
+         * a membership and those the legacy organizationId pointer places there.
          * @param {string} organizationUserId - Organization user ID to search for
          * @returns {Promise<Object[]>} Array of individual user objects (empty if none)
          */
@@ -182,10 +195,9 @@ function createUserCommands() {
                     throw error;
                 }
 
-                const users =
-                    await userRepository.findIndividualUsersByOrganizationId(
-                        organizationUserId
-                    );
+                const users = await findIndividualUsersByOrganization.execute(
+                    organizationUserId
+                );
 
                 return (users || []).map((user) => ({
                     id: user._id?.toString() || user.id,

package/database/documentdb-utils.js

@@ -58,7 +58,12 @@ async function insertOne(client, collection, document) {
 
         // Provide helpful context for common errors
         if (error.code === 11000) {
-            throw new Error(`${errorMsg} - Duplicate key violation`);
+            // `code` lets callers recognise a lost race without parsing text
+            // (see database/unique-violation.js).
+            throw Object.assign(
+                new Error(`${errorMsg} - Duplicate key violation`),
+                { code: 11000 }
+            );
         }
         throw new Error(errorMsg);
     }

package/database/unique-violation.js

@@ -0,0 +1,25 @@
+/** Mongo/DocumentDB duplicate-key error code. */
+const DUPLICATE_KEY_CODE = 11000;
+/** Prisma's unique-constraint error code (PostgreSQL and MongoDB). */
+const PRISMA_UNIQUE_CODE = 'P2002';
+
+/**
+ * Whether `error` is a unique-constraint violation, however the database
+ * layer raised it: a Prisma `P2002`, or a duplicate-key `11000`
+ * (`documentdb-utils` `insertOne` sets `code` on the error it throws).
+ * Matches on the code only, never on message text.
+ *
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+function isUniqueViolation(error) {
+    return (
+        error?.code === PRISMA_UNIQUE_CODE || error?.code === DUPLICATE_KEY_CODE
+    );
+}
+
+module.exports = {
+    isUniqueViolation,
+    DUPLICATE_KEY_CODE,
+    PRISMA_UNIQUE_CODE,
+};