@friggframework/core 2.0.0--canary.682.3c8b68a.0 → 2.0.0--canary.685.022c3c3.0

package/modules/repositories/module-repository-documentdb.js

@@ -9,6 +9,7 @@ const {
     deleteOne,
 } = require('../../database/documentdb-utils');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
+const { entityNotFoundError } = require('./entity-not-found');
 const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
 
 /**
@@ -33,11 +34,11 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     async findEntityById(entityId) {
         const objectId = toObjectId(entityId);
         if (!objectId) {
-            throw new Error(`Entity ${entityId} not found`);
+            throw entityNotFoundError(entityId);
         }
         const doc = await findOne(this.prisma, 'Entity', { _id: objectId });
         if (!doc) {
-            throw new Error(`Entity ${entityId} not found`);
+            throw entityNotFoundError(entityId);
         }
         const credential = await this._fetchCredential(doc.credentialId);
         return this._mapEntity(doc, credential);

package/modules/repositories/module-repository-mongo.js

@@ -1,6 +1,7 @@
 const { prisma } = require('../../database/prisma');
 const { organizationWhere } = require('../../database/organization-where');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
+const { entityNotFoundError } = require('./entity-not-found');
 
 /**
  * MongoDB Module Repository Adapter
@@ -111,7 +112,7 @@ class ModuleRepositoryMongo extends ModuleRepositoryInterface {
         });
 
         if (!entity) {
-            throw new Error(`Entity ${entityId} not found`);
+            throw entityNotFoundError(entityId);
         }
 
         const credential = await this._fetchCredential(entity.credentialId);

package/modules/repositories/module-repository-postgres.js

@@ -1,5 +1,6 @@
 const { prisma } = require('../../database/prisma');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
+const { entityNotFoundError } = require('./entity-not-found');
 
 /**
  * PostgreSQL Module Repository Adapter
@@ -144,7 +145,7 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         });
 
         if (!entity) {
-            throw new Error(`Entity ${entityId} not found`);
+            throw entityNotFoundError(entityId);
         }
 
         const credential = await this._fetchCredential(entity.credentialId);

package/modules/repositories/module-repository.js

@@ -1,5 +1,6 @@
 const { prisma } = require('../../database/prisma');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
+const { entityNotFoundError } = require('./entity-not-found');
 
 /**
  * Prisma-based Module Repository
@@ -37,7 +38,7 @@ class ModuleRepository extends ModuleRepositoryInterface {
         });
 
         if (!entity) {
-            throw new Error(`Entity ${entityId} not found`);
+            throw entityNotFoundError(entityId);
         }
 
         return {

package/modules/scope-config.js

@@ -8,6 +8,7 @@ const {
     SCOPES,
     INDIVIDUAL_ACROSS_VALUES,
     OWNER_RULES,
+    DEFAULT_ORG_ADMIN_ROLES,
     configError,
     isPlainObject,
     parseScopeSetting,
@@ -75,6 +76,26 @@ function readIntegrationOwnership(integrationClass) {
     return { scope: parseScopeSetting(raw.scope, `${where}.scope`), owner };
 }
 
+/**
+ * `user.orgAdminRoles`: the token roles that may manage organization-level
+ * things. Default `['ADMIN']`. A shared-secret caller needs no role.
+ */
+function readOrgAdminRoles(appDefinition) {
+    const raw = appDefinition?.user?.orgAdminRoles;
+    if (raw === undefined || raw === null) return [...DEFAULT_ORG_ADMIN_ROLES];
+    if (
+        !Array.isArray(raw) ||
+        raw.length === 0 ||
+        raw.some((role) => typeof role !== 'string' || role.trim() === '')
+    ) {
+        throw configError(
+            'appDefinition.user.orgAdminRoles',
+            'must be a non-empty array of role names'
+        );
+    }
+    return [...raw];
+}
+
 /**
  * Every binding of every integration with its resolved scope and where it came
  * from, parsing each integration's settings once. Throws OwnershipConfigError
@@ -118,7 +139,7 @@ function listBindingScopes(appDefinition, entityTypeRegistry, primary) {
  * Validates every ownership setting in one pass and returns the app-level
  * config the runtime needs.
  *
- * @returns {{scope: ({default: string, allow: string[]}|null), individualAcross: string}}
+ * @returns {{scope: ({default: string, allow: string[]}|null), individualAcross: string, orgAdminRoles: string[]}}
  * @throws {OwnershipConfigError}
  */
 function resolveOwnershipConfig(appDefinition, entityTypeRegistry) {
@@ -143,6 +164,7 @@ function resolveOwnershipConfig(appDefinition, entityTypeRegistry) {
     return Object.freeze({
         scope: app.scope,
         individualAcross: app.individualAcross,
+        orgAdminRoles: Object.freeze(readOrgAdminRoles(appDefinition)),
     });
 }
 

package/modules/scope-policy.js

@@ -6,16 +6,21 @@
 
 const {
     INDIVIDUAL_ACROSS_VALUES,
+    DEFAULT_ORG_ADMIN_ROLES,
     configError,
     parseScopeSetting,
     resolveScope,
     resolveOwnerForScope,
 } = require('./scope-resolution');
-const { accessContext, describeRecord } = require('./scope-visibility');
+const {
+    accessContext,
+    accessToOwner,
+    describeRecord,
+} = require('./scope-visibility');
 
 /**
  * @param {Object} [params]
- * @param {{scope: *, individualAcross: string}} [params.ownership] - the raw
+ * @param {{scope: *, individualAcross: string, orgAdminRoles?: string[]}} [params.ownership] - the raw
  *   `appDefinition.ownership` or what resolveOwnershipConfig returned (a parsed
  *   `{ default, allow }` parses to itself)
  * @param {Map} [params.entityTypeRegistry]
@@ -33,7 +38,10 @@ function createScopePolicy({ ownership, entityTypeRegistry } = {}) {
         );
     }
 
-    const contextFor = (user) => accessContext(user, { individualAcross });
+    const orgAdminRoles = ownership?.orgAdminRoles ?? DEFAULT_ORG_ADMIN_ROLES;
+
+    const contextFor = (user) =>
+        accessContext(user, { individualAcross, orgAdminRoles });
 
     /** The scope a new connection of `entityType` gets (levels 1, 4, 5, 6). */
     const resolveEntityScope = ({ entityType, requestScope, binding, integration, user }) =>
@@ -61,15 +69,38 @@ function createScopePolicy({ ownership, entityTypeRegistry } = {}) {
         };
     };
 
+    /**
+     * The owner and organization for a scope that is already decided: a
+     * re-authorization keeps the scope its connection has, whatever the config
+     * says now. The admin gate applies as it does on create.
+     */
+    const ownershipForScope = ({ scope, user }) => {
+        const ctx = contextFor(user);
+        return {
+            ...resolveOwnerForScope(scope, ctx),
+            legacyOrgId: ctx.legacyOrgId,
+            source: 'fixed',
+        };
+    };
+
     /** Whether `user` may load this stored entity for use (same clauses as the list). */
     const canUseEntity = (user, entity) =>
         describeRecord(entity, contextFor(user), 'entity') !== null;
 
+    /**
+     * What `user` may do with a record owned by `ownerId` that has no
+     * organization of its own (a credential): manage, or null when not theirs.
+     */
+    const accessToOwnedBy = (user, ownerId) => accessToOwner(ownerId, contextFor(user));
+
     return Object.freeze({
         individualAcross,
+        orgAdminRoles,
+        accessToOwnedBy,
         accessContext: contextFor,
         resolveScope: resolveEntityScope,
         resolveOwnership,
+        ownershipForScope,
         canUseEntity,
     });
 }

package/modules/scope-resolution.js

@@ -25,6 +25,9 @@ const INDIVIDUAL_ACROSS_VALUES = Object.freeze(['organization', 'all']);
 const OWNER_RULES = Object.freeze(['derive', 'individual', 'organization']);
 const ACCESS = Object.freeze({ MANAGE: 'manage', USE: 'use', VIEW: 'view' });
 
+/** The organization roles that may manage organization-level things unless `user.orgAdminRoles` says. */
+const DEFAULT_ORG_ADMIN_ROLES = Object.freeze(['ADMIN']);
+
 /** Raised at app-definition load for an invalid ownership setting. */
 class OwnershipConfigError extends BaseError {
     constructor(message, options) {
@@ -180,6 +183,11 @@ const MISSING_ORGANIZATION =
 const missing = (message, field) =>
     Boom.badRequest(message, { code: 'IDENTITY_REQUIRED', details: { field } });
 
+const adminRequired = (what) =>
+    Boom.forbidden(`only an organization admin can ${what}`, {
+        code: 'ORG_ADMIN_REQUIRED',
+    });
+
 /**
  * The owner and organization for a new entity of `scope` (§3.2):
  *
@@ -200,6 +208,7 @@ function resolveOwnerForScope(scope, ctx) {
     }
     if (scope === SCOPES.ORGANIZATION) {
         if (!ctx.activeOrgId) throw missing(MISSING_ORGANIZATION, 'x-frigg-apporgid');
+        if (!ctx.canManageOrg) throw adminRequired('connect an organization-level account');
         return { scope, ownerId: ctx.activeOrgId, organizationId: ctx.activeOrgId };
     }
     throw Boom.forbidden(
@@ -229,6 +238,7 @@ function integrationOwnerKind(entityScopes, rule = 'derive') {
 function resolveIntegrationOwner(kind, ctx) {
     if (kind === SCOPES.ORGANIZATION) {
         if (!ctx.activeOrgId) throw missing(MISSING_ORGANIZATION, 'x-frigg-apporgid');
+        if (!ctx.canManageOrg) throw adminRequired('create an organization-level integration');
         return { ownerId: ctx.activeOrgId, organizationId: ctx.activeOrgId };
     }
     if (!ctx.callerId) throw missing(MISSING_INDIVIDUAL, 'x-frigg-appuserid');
@@ -263,6 +273,7 @@ module.exports = {
     INDIVIDUAL_ACROSS_VALUES,
     OWNER_RULES,
     ACCESS,
+    DEFAULT_ORG_ADMIN_ROLES,
     OwnershipConfigError,
     configError,
     isPlainObject,

package/modules/scope-visibility.js

@@ -8,7 +8,8 @@
  */
 
 const { isPresent, idString, sameId } = require('../user/membership');
-const { SCOPES, ACCESS } = require('./scope-resolution');
+const { AUTH_SOURCES } = require('../user/user');
+const { SCOPES, ACCESS, DEFAULT_ORG_ADMIN_ROLES } = require('./scope-resolution');
 
 /**
  * One owner/organization pair a repository ORs into a single query.
@@ -66,15 +67,35 @@ function buildClauses(base, kind) {
     return clauses;
 }
 
+/**
+ * Whether the caller may manage organization-level things (create, change,
+ * delete). A shared-secret caller is the app's own backend and may. A person
+ * with a token has the role the token carries, and `MEMBER` when it carries
+ * none: a missing role never means admin. An unknown source (a `User` built
+ * outside AuthenticateUser) is treated like a token.
+ *
+ * @param {{authSource: (string|null), orgRole: (string|null)}} who
+ * @param {string[]} adminRoles - `user.orgAdminRoles`, compared case-insensitively
+ */
+function canManageOrganization({ authSource, orgRole }, adminRoles = DEFAULT_ORG_ADMIN_ROLES) {
+    if (authSource === AUTH_SOURCES.SHARED_SECRET) return true;
+    const role = String(isPresent(orgRole) ? orgRole : 'MEMBER').toUpperCase();
+    return adminRoles.some((admin) => String(admin).toUpperCase() === role);
+}
+
 /**
  * Who the caller is, for ownership and visibility: their individual user, the
- * organization this request acts in, the legacy `organizationId` pointer, and
- * the clauses that follow from them (computed once).
+ * organization this request acts in, the legacy `organizationId` pointer,
+ * whether they may manage organization-level things, and the clauses that
+ * follow from them (computed once).
  *
  * @param {Object} user - the authenticated `User` (or a `{ getId }` double)
- * @param {{individualAcross?: string}} [options]
+ * @param {{individualAcross?: string, orgAdminRoles?: string[]}} [options]
  */
-function accessContext(user, { individualAcross = 'organization' } = {}) {
+function accessContext(
+    user,
+    { individualAcross = 'organization', orgAdminRoles = DEFAULT_ORG_ADMIN_ROLES } = {}
+) {
     const hasUserModel = typeof user?.getIndividualUser === 'function';
     const individual = hasUserModel ? user.getIndividualUser() : null;
     const base = {
@@ -86,8 +107,14 @@ function accessContext(user, { individualAcross = 'organization' } = {}) {
         legacyOrgId: idString(individual?.organizationId),
         individualAcross,
     };
+    const who = {
+        authSource:
+            typeof user?.getAuthSource === 'function' ? user.getAuthSource() : null,
+        orgRole: typeof user?.getOrgRole === 'function' ? user.getOrgRole() : null,
+    };
     return {
         ...base,
+        canManageOrg: canManageOrganization(who, orgAdminRoles),
         clauses: {
             entity: buildClauses(base, 'entity'),
             integration: buildClauses(base, 'integration'),
@@ -112,8 +139,33 @@ function scopeOf(record, ctx) {
     return null;
 }
 
-const accessFor = (scope) =>
-    scope === SCOPES.GLOBAL ? ACCESS.USE : ACCESS.MANAGE;
+/** manage for the person's own; for the organization's, only an admin; use otherwise. */
+const accessFor = (scope, ctx) => {
+    if (scope === SCOPES.INDIVIDUAL) return ACCESS.MANAGE;
+    if (scope === SCOPES.ORGANIZATION) {
+        return ctx.canManageOrg ? ACCESS.MANAGE : ACCESS.USE;
+    }
+    return ACCESS.USE;
+};
+
+/**
+ * Whether an access level lets the caller use a record: bind it, proxy through
+ * it (§3.4). `manage` includes `use`; `view` (metadata only) does not, and
+ * neither does anything unrecognised.
+ */
+const grantsUse = (access) => access === ACCESS.USE || access === ACCESS.MANAGE;
+
+/**
+ * What the caller may do with a record owned by `ownerId` that carries no
+ * organization of its own (a credential): manage the person's own, manage the
+ * active organization's only as an admin, nothing otherwise. Null when the
+ * record is not theirs.
+ */
+function accessToOwner(ownerId, ctx) {
+    const scope = scopeOf({ userId: ownerId }, ctx);
+    if (scope !== SCOPES.INDIVIDUAL && scope !== SCOPES.ORGANIZATION) return null;
+    return accessFor(scope, ctx);
+}
 
 /**
  * What a row is to this caller, or null when they may not see it.
@@ -134,7 +186,7 @@ function describeRecord(record, ctx, kind) {
             scope === SCOPES.ORGANIZATION
                 ? idString(record.userId)
                 : idString(record.organizationId),
-        access: accessFor(scope),
+        access: accessFor(scope, ctx),
     };
 }
 
@@ -154,12 +206,15 @@ function matchesListFilters(description, { scope, owner } = {}) {
 }
 
 module.exports = {
+    canManageOrganization,
+    accessToOwner,
     accessContext,
     unscopedRowsBelongHere,
     visibilityClauses,
     matchesClause,
     scopeOf,
     describeRecord,
+    grantsUse,
     LIST_OWNERS,
     matchesListFilters,
 };

package/modules/use-cases/authorize-entity-for-user.js

@@ -19,9 +19,11 @@ class AuthorizeEntityForUser {
      * The scope, owner and organization a new entity of `entityType` gets for
      * this caller. Throws a 400/403 when the request cannot have one.
      *
-     * @param {{user: Object, entityType: string, scope?: string}} params
+     * @param {{user: Object, entityType: string, scope?: string, fixedScope?: string}} params
+     *   `fixedScope`: a re-authorization keeps the scope its connection has
      */
-    resolveOwnership({ user, entityType, scope }) {
+    resolveOwnership({ user, entityType, scope, fixedScope }) {
+        if (fixedScope) return this.scopePolicy.ownershipForScope({ scope: fixedScope, user });
         return this.scopePolicy.resolveOwnership({
             entityType,
             requestScope: scope,

package/modules/use-cases/entity-operations-for-user.js

@@ -5,6 +5,7 @@ const {
     matchesListFilters,
 } = require('../scope-visibility');
 const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
+const { assertCanManage } = require('./manage-access');
 
 /**
  * Management API v2 entity operations. Each one starts from
@@ -111,10 +112,10 @@ class RefreshEntityOptionsForUser {
 }
 
 /**
- * Deletes an entity the caller may use. Refuses with 409 while integrations
- * still use it, so an integration never points at a missing entity. The
- * credential is left alone (others may share it); delete it through
- * /api/v2/credentials.
+ * Deletes an entity the caller may manage (the owner; for an organization
+ * entity, an organization admin). Refuses with 409 while integrations still
+ * use it, so an integration never points at a missing entity. The credential
+ * is left alone (others may share it); delete it through /api/v2/credentials.
  */
 class DeleteEntityForUser {
     constructor({ getEntityModuleForUser, moduleRepository, integrationRepository }) {
@@ -128,6 +129,10 @@ class DeleteEntityForUser {
             entityId,
             user
         );
+        assertCanManage(
+            this.getEntityModuleForUser.describe(entity, user)?.access,
+            `entity ${entity.id}`
+        );
         const integrations =
             (await this.integrationRepository.findIntegrationsByEntityId(
                 entity.id

package/modules/use-cases/execute-entity-proxy-request.js

@@ -2,6 +2,8 @@ const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
 const { getTelemetry } = require('../../telemetry/telemetry-runtime');
 const { ProxyRequestError } = require('../proxy/proxy-errors');
+const { SCOPES } = require('../scope-resolution');
+const { grantsUse } = require('../scope-visibility');
 const { normalizeProxyPath, matchAllowRule } = require('../proxy/proxy-path');
 const {
     validateProxyRequest,
@@ -55,9 +57,11 @@ const authHeaderNamesOf = (api) =>
  * through its module with the stored credential, inside the limits the app
  * and the module set.
  *
- * Order of checks: request shape and size, path rules, entity ownership
- * (404), the module's allow-list (403, deny by default), credential
- * readiness (401), then the call through Requester._proxyRequest. Every call,
+ * Order of checks: request shape and size, path rules, entity visibility in
+ * the active organization (404), `use` access (403), the entity's scope
+ * against `managementApi.proxy.scopes` (403), the module's allow-list (403,
+ * deny by default), credential readiness (401), then the call through
+ * Requester._proxyRequest. Every call,
  * allowed or denied, writes one audit record and one usage count. Bodies,
  * headers, query values and the raw path are never logged.
  */
@@ -98,24 +102,14 @@ class ExecuteEntityProxyRequest {
             audit.requestBytes = validated.requestBytes;
             const path = normalizeProxyPath(validated.path);
 
-            // Access is `use` in the active organization (ADR-056 §3.5, §3.6): the
-            // owner's entity there, or the organization's. A `global` entity is
-            // never the tenant's.
+            // Visible in the active organization, or 404 (ADR-056 §3.6): the
+            // same clauses the v2 lists use, so a missing entity, another
+            // person's and one paired with another organization look alike.
             const { entity, definition, module } =
                 await this.getEntityModuleForUser.execute(entityId, user);
             audit.module = definition.moduleName;
-            // Narrowest by default (§3.5): proxying through a shared credential
-            // lets any member act on the organization's account, so only an
-            // individual entity may be proxied until `managementApi.proxy.scopes`
-            // lets an app opt in to `organization`.
-            // TODO(F6): read proxy.scopes here instead of refusing outright.
-            if (this.getEntityModuleForUser.describe(entity, user)?.scope !== 'individual') {
-                throw new ProxyRequestError(
-                    'PROXY_NOT_ALLOWED',
-                    'The entity proxy only accepts individual entities; organization-level entities are not proxied',
-                    { module: definition.moduleName, reason: 'scope' }
-                );
-            }
+            this.assertProxyable(entityId, entity, definition, user);
+
             const credentialRef = entity.credential;
             const credentialId =
                 credentialRef && typeof credentialRef === 'object'
@@ -217,6 +211,44 @@ class ExecuteEntityProxyRequest {
         }
     }
 
+    /**
+     * ADR-056 §3.5: the caller needs `use` access to the entity in the active
+     * organization, and the entity's scope must be one the app lets the proxy
+     * accept. `access` and `scope` come from the description the v2 lists
+     * return (GetEntityModuleForUser.describe), never from a second rule.
+     *
+     * Both refusals are 403 PROXY_NOT_ALLOWED: the caller can already see the
+     * entity, so saying it exists leaks nothing. `details.reason` tells them
+     * apart ('access' or 'scope').
+     */
+    assertProxyable(entityId, entity, definition, user) {
+        const tenancy = this.getEntityModuleForUser.describe(entity, user);
+        if (!tenancy) {
+            // Not visible after all: the same 404 as a missing entity.
+            throw Boom.notFound(`Entity ${entityId} not found`, {
+                code: 'ENTITY_NOT_FOUND',
+            });
+        }
+        if (!grantsUse(tenancy.access)) {
+            throw new ProxyRequestError(
+                'PROXY_NOT_ALLOWED',
+                'Proxying through an entity needs use access to it; you can only view this one',
+                { module: definition.moduleName, reason: 'access' }
+            );
+        }
+        // Narrowest by default (§3.5): with no setting only individual
+        // entities are proxied, because proxying through a shared credential
+        // lets any member act on the organization's account.
+        const acceptedScopes = this.proxyConfig.scopes ?? [SCOPES.INDIVIDUAL];
+        if (!acceptedScopes.includes(tenancy.scope)) {
+            throw new ProxyRequestError(
+                'PROXY_NOT_ALLOWED',
+                `The entity proxy does not accept ${tenancy.scope} entities in this app`,
+                { module: definition.moduleName, reason: 'scope', scope: tenancy.scope }
+            );
+        }
+    }
+
     /** A module may pin its proxy base URL (string, or a function of the api). */
     resolveBaseUrl(definition, api) {
         const declared = definition.proxy?.baseUrl;

package/modules/use-cases/get-entity-module-for-user.js

@@ -1,6 +1,7 @@
 const Boom = require('@hapi/boom');
 const { describeRecord } = require('../scope-visibility');
 const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
+const { isEntityNotFound } = require('../repositories/entity-not-found');
 
 /**
  * True when `user` may act on records owned by `ownerId`. Uses the User
@@ -79,8 +80,14 @@ class GetEntityModuleForUser {
         try {
             entity = await this.moduleRepository.findEntityById(entityId);
         } catch (error) {
-            // A malformed id (e.g. not an integer on Postgres) is "not found".
-            if (/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
+            // Every adapter throws for a missing row, and a malformed id (e.g.
+            // not an integer on Postgres) is "not found" too. Both must be the
+            // 404 another tenant's entity gets, or the status says which ids
+            // exist. Anything else is a real failure.
+            if (
+                isEntityNotFound(error) ||
+                /Invalid ID|ObjectId|Malformed/i.test(error?.message || '')
+            ) {
                 entity = null;
             } else {
                 throw error;

package/modules/use-cases/manage-access.js

@@ -0,0 +1,21 @@
+const Boom = require('@hapi/boom');
+const { ACCESS } = require('../scope-resolution');
+
+/**
+ * The one check behind every "may this caller change or delete it" gate
+ * (ADR-056 §3 permissions): the caller may use it but not manage it, so 403
+ * `ORG_ADMIN_REQUIRED`. `access` comes from describeRecord (entities,
+ * integrations) or scopePolicy.accessToOwnedBy (credentials).
+ *
+ * @param {string|null} access - ACCESS value
+ * @param {string} subject - e.g. `entity 5`, for the message
+ */
+function assertCanManage(access, subject) {
+    if (access !== ACCESS.MANAGE) {
+        throw Boom.forbidden(`You may use ${subject} but not change or delete it`, {
+            code: 'ORG_ADMIN_REQUIRED',
+        });
+    }
+}
+
+module.exports = { assertCanManage };

package/modules/use-cases/multi-step-authorization.js

@@ -166,8 +166,10 @@ class SubmitAuthorizationStep {
      * @param {Object} params
      * @param {string} [params.scope] - the scope the caller asks for, from the
      *   deciding level's allow list (ADR-056 §3.1). Never `global`.
+     * @param {string} [params.fixedScope] - re-authorization keeps the scope the
+     *   credential already has, whatever the config says now.
      */
-    async execute({ user, entityType, data, step = 1, sessionId, credentialId = null, scope }) {
+    async execute({ user, entityType, data, step = 1, sessionId, credentialId = null, scope, fixedScope }) {
         if (!data || typeof data !== 'object' || Array.isArray(data)) {
             throw Boom.badRequest('data must be an object', {
                 code: 'VALIDATION_ERROR',
@@ -183,6 +185,7 @@ class SubmitAuthorizationStep {
             user,
             entityType,
             scope,
+            fixedScope,
         });
 
         if (!isMultiStep(definition)) {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.682.3c8b68a.0",
+    "version": "2.0.0--canary.685.022c3c3.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.682.3c8b68a.0",
-        "@friggframework/prettier-config": "2.0.0--canary.682.3c8b68a.0",
-        "@friggframework/test": "2.0.0--canary.682.3c8b68a.0",
+        "@friggframework/eslint-config": "2.0.0--canary.685.022c3c3.0",
+        "@friggframework/prettier-config": "2.0.0--canary.685.022c3c3.0",
+        "@friggframework/test": "2.0.0--canary.685.022c3c3.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "3c8b68a5062138b3b869c284daceb427f055aed7"
+    "gitHead": "022c3c3ae2d4e9d22046d94911fc00854416cb2a"
 }