@friggframework/core 2.0.0--canary.681.2df9ef0.0 → 2.0.0--canary.682.cbca9e2.0

package/README.md

@@ -421,6 +421,42 @@ Rules worth knowing:
 - Two first logins for the same new person or organization, even in different organizations, both
   succeed: a create that loses to a unique constraint finds the winner's row.
 
+#### Entity scopes and ownership (ADR-056 §3)
+
+Who owns an entity (a connected account) or an integration follows its **scope**, not `user.primary`:
+
+| Scope | Owned by | Created with |
+|---|---|---|
+| `individual` | the person (`individualUser`) | the active organization (`organizationId`), or none under `individualAcross: 'all'` |
+| `organization` | the active organization's user | that organization |
+| `global` | nobody (the app owner) | none; refused by the tenant API (admin routes only) |
+
+The scope of a new connection is the first of: the request (`scope` on `POST /api/v2/authorize`, only from
+the deciding level's `allow` list), the integration binding (`Definition.modules[key].scope` or
+`Definition.entities[key].scope`), `Definition.ownership.scope`, the entity type
+(`appDefinition.entities[name].scope`), `appDefinition.ownership.scope`, then `organization` for an
+organization-primary app and `individual` otherwise. A setting is `'organization'` or
+`{ default: 'individual', allow: ['individual', 'organization'] }`.
+
+```javascript
+const appDefinition = {
+    user: { primary: 'individual', authModes: { adopterJwt: true } },
+    ownership: { scope: 'individual', individualAcross: 'organization' }, // the defaults
+    entities: {
+        google: { definition: google, scope: 'individual' },
+        xero: { definition: xero, scope: { default: 'organization', allow: ['organization', 'individual'] } },
+    },
+    integrations: [Sync], // Sync.Definition.ownership = { owner: 'derive' }
+};
+```
+
+`GET /api/v2/entities` and `/integrations` return, for the active organization, its own
+rows and the caller's, each with `scope`, `owner`, `organizationId` and `access`, and take `?scope=` and
+`?owner=me|org`. An individual entity is only visible and usable in the organization it was connected in
+(or in all of them, with `individualAcross: 'all'`). Rows written before this existed keep working: see
+[Entity scopes](../../docs/guides/entity-scopes.md), which also covers the schema (`organizationId` on
+`Entity` and `Integration`, no `scope` column) and what is deferred.
+
 ### 8. Lambda Utilities (`/lambda`)
 
 AWS Lambda-specific utilities and helpers.

package/application/commands/integration-commands.js

@@ -18,7 +18,7 @@ const {
     ListIntegrationsByEntityExternalIdUseCase,
 } = require('../../integrations/use-cases/list-integrations-by-entity-external-id');
 const {
-    GetIntegrationsForUser,
+    GetIntegrationsByUserId,
 } = require('../../integrations/use-cases/get-integrations-for-user');
 const {
     CreateIntegration,
@@ -30,8 +30,9 @@ const {
     PatchIntegrationConfig,
 } = require('../../integrations/use-cases/patch-integration-config');
 const {
-    getModulesDefinitionFromIntegrationClasses,
-} = require('../../integrations/utils/map-integration-dto');
+    getEntityTypeRegistry,
+    getEntityTypeDefinitions,
+} = require('../../modules/entity-type-registry');
 
 const ERROR_CODE_MAP = {
     ENTITY_NOT_FOUND: 401,
@@ -51,7 +52,16 @@ function mapErrorToResponse(error) {
     };
 }
 
-function createIntegrationCommands({ integrationClass } = {}) {
+/**
+ * @param {Object} [params]
+ * @param {Function} [params.integrationClass]
+ * @param {Array<object>} [params.moduleDefinitions] - the app's offered module
+ *   definitions (`loadAppDefinition().moduleDefinitions`). Integration code
+ *   calls this from a constructor with no app definition in hand, so when it
+ *   is omitted the commands hydrate with this integration's own modules only
+ *   (a registry built from `{ integrations: [integrationClass] }`).
+ */
+function createIntegrationCommands({ integrationClass, moduleDefinitions } = {}) {
     // Always use Frigg's default repositories and use cases
     const integrationRepository = createIntegrationRepository();
 
@@ -108,13 +118,13 @@ function createIntegrationCommands({ integrationClass } = {}) {
 
     const moduleRepository = createModuleRepository();
 
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses([
-        integrationClass,
-    ]);
-
     const moduleFactory = new ModuleFactory({
         moduleRepository,
-        moduleDefinitions,
+        moduleDefinitions:
+            moduleDefinitions ??
+            getEntityTypeDefinitions(
+                getEntityTypeRegistry({ integrations: [integrationClass] })
+            ),
     });
 
     const loadIntegrationContextUseCase = new LoadIntegrationContextUseCase({
@@ -142,7 +152,7 @@ function createIntegrationCommands({ integrationClass } = {}) {
             moduleRepository,
         });
 
-    const getIntegrationsForUserUseCase = new GetIntegrationsForUser({
+    const getIntegrationsForUserUseCase = new GetIntegrationsByUserId({
         integrationRepository,
         integrationClasses: [integrationClass],
         moduleFactory,

package/application/index.js

@@ -17,6 +17,7 @@ const { createUsageCommands } = require('./commands/usage-commands');
  *
  * @param {Object} params
  * @param {Object} params.integrationClass - Integration class (required)
+ * @param {Array<object>} [params.moduleDefinitions] - the app's offered module definitions; defaults to the integration's own modules
  * @returns {Object} Unified commands object with all CRUD operations
  *
  * @example
@@ -24,9 +25,12 @@ const { createUsageCommands } = require('./commands/usage-commands');
  * const user = await commands.createUser({ username: 'user@example.com' });
  * const credential = await commands.createCredential({ userId: user.id, ... });
  */
-function createFriggCommands({ integrationClass }) {
+function createFriggCommands({ integrationClass, moduleDefinitions }) {
     // All commands use Frigg's default repositories and use cases
-    const integrationCommands = createIntegrationCommands({ integrationClass });
+    const integrationCommands = createIntegrationCommands({
+        integrationClass,
+        moduleDefinitions,
+    });
 
     const userCommands = createUserCommands();
 

package/database/encryption/encryption-schema-registry.js

@@ -180,6 +180,13 @@ function loadModuleEncryptionSchemas(integrations) {
         return;
     }
 
+    // NOTE: this path does not exist ('../integrations' resolves to
+    // database/integrations), so today this function throws MODULE_NOT_FOUND,
+    // loadCustomEncryptionSchema swallows it, and module credentialFields are
+    // effectively NOT registered. Fixing it changes which fields are encrypted
+    // and needs a decrypt that tolerates plaintext, so it ships separately:
+    // branch claude/internal-mcp-03b-module-credential-encryption. Left as is
+    // here on purpose (ADR-059 must not change what gets encrypted).
     const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
 
     const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);

package/database/organization-where.js

@@ -0,0 +1,18 @@
+/**
+ * The Prisma `where` fragment for an `organizationId` on MongoDB (ADR-056
+ * §3.6), shared by the entity and integration adapters.
+ *
+ * Prisma on MongoDB: `null` matches only an explicit null and `isSet: false`
+ * only a missing field. A row written before the column existed is the common
+ * "no organization" case, so `null` here means both.
+ */
+function organizationWhere(organizationId) {
+    if (organizationId === null) {
+        return {
+            OR: [{ organizationId: null }, { organizationId: { isSet: false } }],
+        };
+    }
+    return { organizationId };
+}
+
+module.exports = { organizationWhere };