@friggframework/core 2.0.0--canary.680.6bacd26.0 → 2.0.0--canary.663.8de669c.0

package/management-api/v2/handlers/credentials.js

@@ -1,29 +0,0 @@
-const { maskCredential } = require('../dto');
-
-/** Management API v2 credential handlers, keyed by operationId. */
-function createCredentialHandlers(useCases) {
-    const { listCredentialsForUser, getCredentialForUser, deleteCredentialForUser } =
-        useCases;
-
-    return {
-        async listCredentials(_req, res, user) {
-            const credentials = await listCredentialsForUser.execute(user);
-            res.json({ credentials: credentials.map(maskCredential) });
-        },
-
-        async getCredential(req, res, user) {
-            res.json(
-                maskCredential(
-                    await getCredentialForUser.execute(req.params.credentialId, user)
-                )
-            );
-        },
-
-        async deleteCredential(req, res, user) {
-            await deleteCredentialForUser.execute(req.params.credentialId, user);
-            res.status(204).end();
-        },
-    };
-}
-
-module.exports = { createCredentialHandlers };

package/management-api/v2/handlers/entities.js

@@ -1,74 +0,0 @@
-const { toEntityDto } = require('../dto');
-const { objectBody, parseStep } = require('../request');
-
-/** Management API v2 entity and entity-type handlers, keyed by operationId. */
-function createEntityHandlers(useCases) {
-    const {
-        listEntitiesForUser,
-        getEntityForUser,
-        deleteEntityForUser,
-        testEntityAuthForUser,
-        getEntityOptionsForUser,
-        refreshEntityOptionsForUser,
-        listEntityTypes,
-        getEntityType,
-        getAuthorizationRequirements,
-    } = useCases;
-
-    return {
-        async listEntities(_req, res, user) {
-            const entities = await listEntitiesForUser.execute(user);
-            res.json({ entities: entities.map(toEntityDto) });
-        },
-
-        async listEntityTypes(_req, res) {
-            res.json({ types: await listEntityTypes.execute() });
-        },
-
-        async getEntityType(req, res) {
-            res.json(await getEntityType.execute(req.params.entityType));
-        },
-
-        // Describes a step's requirements without starting an authorization
-        // session; GET /api/v2/authorize starts one.
-        async getEntityTypeRequirements(req, res, user) {
-            res.json(
-                await getAuthorizationRequirements.execute({
-                    entityType: req.params.entityType,
-                    step: parseStep(req.query.step),
-                    userId: user.getId(),
-                })
-            );
-        },
-
-        async getEntity(req, res, user) {
-            res.json(toEntityDto(await getEntityForUser.execute(req.params.entityId, user)));
-        },
-
-        async deleteEntity(req, res, user) {
-            await deleteEntityForUser.execute(req.params.entityId, user);
-            res.status(204).end();
-        },
-
-        async testEntityAuth(req, res, user) {
-            const ok = await testEntityAuthForUser.execute(req.params.entityId, user);
-            res.json({ status: ok ? 'ok' : 'failed' });
-        },
-
-        async getEntityOptions(req, res, user) {
-            res.json(await getEntityOptionsForUser.execute(req.params.entityId, user));
-        },
-
-        async refreshEntityOptions(req, res, user) {
-            res.json(
-                await refreshEntityOptionsForUser.execute(
-                    req.params.entityId,
-                    user,
-                    objectBody(req)
-                )
-            );
-        },
-    };
-}
-
-module.exports = { createEntityHandlers };

package/management-api/v2/handlers/integrations.js

@@ -1,125 +0,0 @@
-const { toIntegrationDto } = require('../dto');
-const { objectBody, optionalString } = require('../request');
-
-/**
- * Management API v2 integration handlers, keyed by registry operationId.
- * Each takes (req, res, user) after authentication and only calls use cases.
- */
-function createIntegrationHandlers(useCases) {
-    const {
-        getIntegrationsForUser,
-        getPossibleIntegrations,
-        createIntegrationForUser,
-        getIntegrationInstanceForUser,
-        updateIntegrationForUser,
-        removeIntegrationForUser,
-        sendIntegrationEventForUser,
-        runIntegrationActionForUser,
-        testIntegrationAuthForUser,
-    } = useCases;
-
-    const send = (req, user, event, payload) =>
-        sendIntegrationEventForUser.execute(
-            req.params.integrationId,
-            user,
-            event,
-            payload
-        );
-
-    return {
-        async listIntegrations(_req, res, user) {
-            const integrations = await getIntegrationsForUser.execute(user.getId());
-            res.json({ integrations: integrations.map(toIntegrationDto) });
-        },
-
-        async listIntegrationOptions(_req, res) {
-            res.json({ integrations: await getPossibleIntegrations.execute() });
-        },
-
-        async createIntegration(req, res, user) {
-            const { entities, config } = objectBody(req);
-            const integration = await createIntegrationForUser.execute(
-                { entities, config },
-                user
-            );
-            res.status(201).json(toIntegrationDto(integration));
-        },
-
-        async getIntegration(req, res, user) {
-            const instance = await getIntegrationInstanceForUser.execute(
-                req.params.integrationId,
-                user
-            );
-            res.json(toIntegrationDto(instance));
-        },
-
-        async updateIntegration(req, res, user) {
-            const { config } = objectBody(req);
-            const integration = await updateIntegrationForUser.execute(
-                req.params.integrationId,
-                user,
-                config
-            );
-            res.json(toIntegrationDto(integration));
-        },
-
-        async deleteIntegration(req, res, user) {
-            await removeIntegrationForUser.execute(req.params.integrationId, user);
-            res.status(204).end();
-        },
-
-        async getIntegrationConfigOptions(req, res, user) {
-            res.json(await send(req, user, 'GET_CONFIG_OPTIONS'));
-        },
-
-        async refreshIntegrationConfigOptions(req, res, user) {
-            res.json(await send(req, user, 'REFRESH_CONFIG_OPTIONS', objectBody(req)));
-        },
-
-        async listIntegrationActions(req, res, user) {
-            const actionType = optionalString(req.query.actionType, 'actionType');
-            res.json(
-                await send(req, user, 'GET_USER_ACTIONS', actionType ? { actionType } : {})
-            );
-        },
-
-        async getIntegrationActionOptions(req, res, user) {
-            res.json(
-                await send(req, user, 'GET_USER_ACTION_OPTIONS', {
-                    actionId: req.params.actionId,
-                    data: objectBody(req),
-                })
-            );
-        },
-
-        async refreshIntegrationActionOptions(req, res, user) {
-            res.json(
-                await send(req, user, 'REFRESH_USER_ACTION_OPTIONS', {
-                    actionId: req.params.actionId,
-                    data: objectBody(req),
-                })
-            );
-        },
-
-        async runIntegrationAction(req, res, user) {
-            res.json(
-                await runIntegrationActionForUser.execute(
-                    req.params.integrationId,
-                    user,
-                    req.params.actionId,
-                    objectBody(req)
-                )
-            );
-        },
-
-        async testIntegrationAuth(req, res, user) {
-            const { ok, errors } = await testIntegrationAuthForUser.execute(
-                req.params.integrationId,
-                user
-            );
-            res.json(ok ? { status: 'ok' } : { status: 'failed', errors });
-        },
-    };
-}
-
-module.exports = { createIntegrationHandlers };

package/management-api/v2/handlers/proxy.js

@@ -1,34 +0,0 @@
-const { toV2ErrorBody } = require('../../error-response');
-
-/**
- * POST /api/v2/entities/:entityId/proxy (ADR-052). The HTTP status follows the
- * upstream status. Proxy failures answer in the api-proxy.schema.json error
- * shape, which is also the v2 error shape plus `success` and `status`.
- */
-function createProxyHandlers({ executeEntityProxyRequest }) {
-    return {
-        async proxyEntityRequest(req, res, user) {
-            try {
-                const result = await executeEntityProxyRequest.execute(
-                    req.params.entityId,
-                    user,
-                    req.body
-                );
-                res.status(result.status).json(result.body);
-            } catch (error) {
-                if (!error?.isBoom || !error.data?.proxy) throw error;
-                const status = error.output.statusCode;
-                if (error.data.retryAfter) {
-                    res.set('Retry-After', String(error.data.retryAfter));
-                }
-                res.status(status).json({
-                    success: false,
-                    status,
-                    ...toV2ErrorBody(error),
-                });
-            }
-        },
-    };
-}
-
-module.exports = { createProxyHandlers };

package/management-api/v2/request.js

@@ -1,54 +0,0 @@
-const Boom = require('@hapi/boom');
-
-/** The JSON body as an object, or a 400 VALIDATION_ERROR. */
-function objectBody(req) {
-    const body = req.body;
-    if (body === undefined || body === null || body === '') return {};
-    if (typeof body !== 'object' || Array.isArray(body)) {
-        throw Boom.badRequest('Request body must be a JSON object', {
-            code: 'VALIDATION_ERROR',
-        });
-    }
-    return body;
-}
-
-/** Fields that must be present (non-empty) in the body. */
-function requireFields(body, fields) {
-    const missing = fields.filter(
-        (field) =>
-            body[field] === undefined || body[field] === null || body[field] === ''
-    );
-    if (missing.length) {
-        throw Boom.badRequest(
-            `Missing required field${missing.length > 1 ? 's' : ''}: ${missing.join(', ')}`,
-            { code: 'VALIDATION_ERROR', details: { missing } }
-        );
-    }
-    return body;
-}
-
-/** A 1-based step number from a query or body value; 1 when absent. */
-function parseStep(value) {
-    if (value === undefined || value === null || value === '') return 1;
-    const step = Number(value);
-    if (!Number.isInteger(step) || step < 1) {
-        throw Boom.badRequest('step must be a positive integer', {
-            code: 'INVALID_STEP',
-        });
-    }
-    return step;
-}
-
-/** An optional string query/body value. */
-function optionalString(value, name) {
-    if (value === undefined || value === null || value === '') return undefined;
-    if (typeof value !== 'string') {
-        throw Boom.badRequest(`${name} must be a string`, {
-            code: 'VALIDATION_ERROR',
-            details: { field: name },
-        });
-    }
-    return value;
-}
-
-module.exports = { objectBody, requireFields, parseStep, optionalString };

package/management-api/v2/test-support/fake-dependencies.js

@@ -1,103 +0,0 @@
-const Boom = require('@hapi/boom');
-
-/**
- * In-memory doubles for every Management API v2 dependency. Each use case is
- * a jest.fn() so a test can assert on calls or override one behaviour.
- */
-function fakeV2Dependencies(overrides = {}) {
-    const user = { getId: () => 'user-1' };
-    const notFound = (code) => async () => {
-        throw Boom.notFound('not found', { code });
-    };
-    const fn = (impl) => ({ execute: jest.fn(impl) });
-
-    return {
-        user,
-        config: { v1: true, proxy: { enable: false } },
-        authenticateUser: {
-            execute: jest.fn(async (req) => {
-                if (!req.headers.authorization) {
-                    throw Boom.unauthorized('No valid authentication provided');
-                }
-                return user;
-            }),
-        },
-        getIntegrationsForUser: fn(async () => [
-            { id: 'i1', entities: ['e1'], status: 'ENABLED', config: { type: 'sync' }, userActions: {} },
-        ]),
-        getPossibleIntegrations: fn(async () => [{ type: 'sync', display: {} }]),
-        createIntegrationForUser: fn(async () => ({
-            id: 'i2', entities: ['e1'], status: 'ENABLED', config: { type: 'sync' },
-        })),
-        getIntegrationInstanceForUser: fn(async (id) => {
-            if (id !== 'i1') return notFound('INTEGRATION_NOT_FOUND')();
-            return { id: 'i1', entities: ['e1'], status: 'ENABLED', config: { type: 'sync' } };
-        }),
-        updateIntegrationForUser: fn(async (id, _user, config) => ({
-            id, entities: ['e1'], status: 'ENABLED', config,
-        })),
-        removeIntegrationForUser: fn(async () => undefined),
-        sendIntegrationEventForUser: fn(async (_id, _user, event, payload) => ({ event, payload })),
-        runIntegrationActionForUser: fn(async (_id, _user, actionId, payload) => ({ ran: actionId, payload })),
-        testIntegrationAuthForUser: fn(async () => ({ ok: true, errors: [] })),
-
-        listEntitiesForUser: fn(async () => [
-            { id: 'e1', userId: 'user-1', moduleName: 'acme', name: 'Acme', externalId: 'x1', credential: { id: 'c1', authIsValid: true, access_token: 'secret' } },
-        ]),
-        getEntityForUser: fn(async (id) => {
-            if (id !== 'e1') return notFound('ENTITY_NOT_FOUND')();
-            return { id: 'e1', userId: 'user-1', moduleName: 'acme', name: 'Acme', externalId: 'x1', credential: { id: 'c1', authIsValid: true, access_token: 'secret' } };
-        }),
-        deleteEntityForUser: fn(async () => undefined),
-        testEntityAuthForUser: fn(async () => true),
-        getEntityOptionsForUser: fn(async () => ({ jsonSchema: {} })),
-        refreshEntityOptionsForUser: fn(async (_id, _user, body) => ({ refreshed: body })),
-        listEntityTypes: fn(async () => [{ type: 'acme', name: 'Acme' }]),
-        getEntityType: fn(async (type) => {
-            if (type !== 'acme') return notFound('ENTITY_TYPE_NOT_FOUND')();
-            return { type: 'acme', name: 'Acme' };
-        }),
-        getAuthorizationRequirements: fn(async ({ step }) => ({
-            type: 'oauth2', data: { url: 'https://provider.example/authorize' }, step, totalSteps: 1, isMultiStep: false,
-        })),
-        listCredentialsForUser: fn(async () => [
-            { id: 'c1', userId: 'user-1', type: 'acme', entityIds: ['e1'], authIsValid: true, access_token: 'ya29.secret-token-value-1234' },
-        ]),
-        getCredentialForUser: fn(async (id) => {
-            if (id !== 'c1') return notFound('CREDENTIAL_NOT_FOUND')();
-            return { id: 'c1', userId: 'user-1', type: 'acme', entityIds: ['e1'], authIsValid: true, api_key: 'sk_live_abcdefghijkl9876' };
-        }),
-        deleteCredentialForUser: fn(async () => ({ id: 'c1', entityIds: ['e1'] })),
-        getAuthorizationStep: fn(async ({ entityType, step }) => {
-            if (entityType === 'nope') return notFound('ENTITY_TYPE_NOT_FOUND')();
-            return { type: 'email', data: {}, step, totalSteps: 2, isMultiStep: true, sessionId: 'sess-1' };
-        }),
-        submitAuthorizationStep: fn(async ({ step }) =>
-            step === 1
-                ? { status: 'pending', step: 2, totalSteps: 2, sessionId: 'sess-1', requirements: { type: 'otp' } }
-                : {
-                      status: 'complete',
-                      entity: { id: 'e1', userId: 'user-1', moduleName: 'acme', credential: { id: 'c1', authIsValid: true } },
-                      credential: { id: 'c1', userId: 'user-1', type: 'acme', entityIds: ['e1'], authIsValid: true, access_token: 'ya29.brand-new-token-0001' },
-                  }
-        ),
-        getCredentialReauthorization: fn(async (id, _user, { step }) => ({ type: 'oauth2', data: {}, step, totalSteps: 1 })),
-        reauthorizeCredentialForUser: fn(async () => ({
-            status: 'complete',
-            entity: { id: 'e1', userId: 'user-1', moduleName: 'acme' },
-            credential: { id: 'c2', userId: 'user-1', type: 'acme', entityIds: ['e1'], authIsValid: true },
-            previousCredentialId: 'c1',
-        })),
-        executeEntityProxyRequest: fn(async (entityId, _user, request) => {
-            if (request?.path === '/limited') {
-                throw Boom.tooManyRequests('The upstream API is rate limiting this account', {
-                    code: 'RATE_LIMITED', proxy: true, expose: true, retryAfter: '30', details: { upstreamStatus: 429 },
-                });
-            }
-            return { status: 201, body: { success: true, status: 201, headers: {}, data: { id: 'new' } } };
-        }),
-        ...overrides,
-    };
-}
-
-module.exports = { fakeV2Dependencies };

package/modules/domain/authorization-session.js

@@ -1,144 +0,0 @@
-const crypto = require('node:crypto');
-
-const DEFAULT_TTL_MINUTES = 15;
-
-function sessionTtlMs() {
-    const minutes = parseInt(process.env.AUTH_SESSION_EXPIRY_MINUTES || '', 10);
-    return (Number.isInteger(minutes) && minutes > 0 ? minutes : DEFAULT_TTL_MINUTES) * 60 * 1000;
-}
-
-/**
- * State of one multi-step authorization (Management API v2
- * `/api/v2/authorize` and `/api/v2/credentials/:id/reauthorize`).
- *
- * `stepData` holds what earlier steps collected (for example the email an OTP
- * was sent to) and is encrypted at rest (encryption-schema-registry). A
- * session is bound to the user who started it, the entity type, and, for a
- * re-authorization, the credential being renewed.
- */
-class AuthorizationSession {
-    /**
-     * @param {Object} params
-     * @param {string} params.sessionId - unguessable id (UUID v4)
-     * @param {string} params.userId
-     * @param {string} params.entityType - module name
-     * @param {string|null} [params.credentialId] - set for re-authorization
-     * @param {number} [params.currentStep=1] - the step the caller submits next
-     * @param {number} params.maxSteps
-     * @param {Object} [params.stepData={}]
-     * @param {Date} params.expiresAt
-     * @param {boolean} [params.completed=false]
-     * @param {Date} [params.createdAt]
-     * @param {Date} [params.updatedAt]
-     */
-    constructor({
-        sessionId,
-        userId,
-        entityType,
-        credentialId = null,
-        currentStep = 1,
-        maxSteps,
-        stepData = {},
-        expiresAt,
-        completed = false,
-        createdAt = new Date(),
-        updatedAt = new Date(),
-    }) {
-        this.sessionId = sessionId;
-        this.userId = userId === undefined || userId === null ? userId : String(userId);
-        this.entityType = entityType;
-        this.credentialId =
-            credentialId === undefined || credentialId === null ? null : String(credentialId);
-        this.currentStep = currentStep;
-        this.maxSteps = maxSteps;
-        this.stepData = stepData && typeof stepData === 'object' ? stepData : {};
-        this.expiresAt = expiresAt instanceof Date ? expiresAt : new Date(expiresAt);
-        this.completed = completed;
-        this.createdAt = createdAt;
-        this.updatedAt = updatedAt;
-        this.validate();
-    }
-
-    /**
-     * A new session for step 1, expiring after AUTH_SESSION_EXPIRY_MINUTES
-     * (default 15).
-     */
-    static start({ userId, entityType, maxSteps, credentialId = null, now = new Date() }) {
-        return new AuthorizationSession({
-            sessionId: crypto.randomUUID(),
-            userId,
-            entityType,
-            credentialId,
-            currentStep: 1,
-            maxSteps,
-            stepData: {},
-            expiresAt: new Date(now.getTime() + sessionTtlMs()),
-            completed: false,
-            createdAt: now,
-            updatedAt: now,
-        });
-    }
-
-    validate() {
-        if (!this.sessionId) throw new Error('sessionId is required');
-        if (!this.userId) throw new Error('userId is required');
-        if (!this.entityType) throw new Error('entityType is required');
-        if (!Number.isInteger(this.maxSteps) || this.maxSteps < 1) {
-            throw new Error('maxSteps must be a positive integer');
-        }
-        if (
-            !Number.isInteger(this.currentStep) ||
-            this.currentStep < 1 ||
-            this.currentStep > this.maxSteps
-        ) {
-            throw new Error(`currentStep must be between 1 and ${this.maxSteps}`);
-        }
-        if (Number.isNaN(this.expiresAt.getTime())) {
-            throw new Error('expiresAt must be a valid date');
-        }
-    }
-
-    isExpired(now = new Date()) {
-        return this.expiresAt.getTime() <= now.getTime();
-    }
-
-    /** True when this session may be used by `userId` for `entityType`/`credentialId`. */
-    belongsTo({ userId, entityType, credentialId = null }) {
-        return (
-            this.userId === String(userId) &&
-            this.entityType === entityType &&
-            this.credentialId === (credentialId === null || credentialId === undefined ? null : String(credentialId))
-        );
-    }
-
-    /**
-     * Records a finished step and moves to `nextStep`, merging what the step
-     * collected into stepData.
-     */
-    advanceTo(nextStep, collected = {}) {
-        if (this.completed) throw new Error('Cannot advance a completed session');
-        if (nextStep !== this.currentStep + 1 || nextStep > this.maxSteps) {
-            throw new Error(
-                `Cannot move from step ${this.currentStep} to step ${nextStep} of ${this.maxSteps}`
-            );
-        }
-        this.currentStep = nextStep;
-        this.stepData = { ...this.stepData, ...(collected || {}) };
-        this.updatedAt = new Date();
-    }
-
-    /** Starts the flow over at step 1, forgetting collected data. */
-    restart() {
-        this.currentStep = 1;
-        this.stepData = {};
-        this.completed = false;
-        this.updatedAt = new Date();
-    }
-
-    markComplete() {
-        this.completed = true;
-        this.updatedAt = new Date();
-    }
-}
-
-module.exports = { AuthorizationSession, DEFAULT_TTL_MINUTES };