@friggframework/core 2.0.0--canary.682.451c957.0 → 2.0.0--canary.702.d5e6de1.0

package/CLAUDE.md

@@ -332,14 +332,12 @@ class MyIntegration extends IntegrationBase {
 - Password-based (bcrypt hashed)
 - Token-based (Bearer tokens)
 - App-based (external app user IDs)
-- Adopter JWT (`authModes.adopterJwt`, `jwtConfig`; `jose`, JWKS or HMAC; see `README.md`)
 
 **Use Cases**:
 - `login-user.js` - User authentication
 - `create-individual-user.js` - Create personal account
 - `create-organization-user.js` - Create business account
 - `get-user-from-bearer-token.js` - Token authentication
-- `get-user-from-adopter-jwt.js` - Adopter JWT verification, find-or-create (ADR-056 §2); `adopter-jwt-config.js` validates `jwtConfig` at load
 
 **Repositories**:
 - `user-repository-factory.js` - Creates database-specific repositories

package/README.md

@@ -305,7 +305,6 @@ Comprehensive user authentication and authorization system supporting both indiv
 - **Password-based**: Traditional username/password authentication
 - **Token-based**: Bearer token authentication with session management
 - **App-based**: External app user ID authentication (passwordless)
-- **Adopter token (JWT)**: A token issued by your own identity system, verified by Frigg and safe to send from a browser (see below)
 
 **Usage:**
 ```javascript
@@ -353,110 +352,6 @@ console.log('Individual user:', user.getIndividualUser());
 console.log('Organization user:', user.getOrganizationUser());
 ```
 
-#### Adopter token (JWT) authentication
-
-For a multi-tenant product (ADR-056 §2), let the browser send the token your identity system
-already issues. Frigg verifies the signature and claims, then finds or creates the individual
-user and the organization user the token names. Unlike `sharedSecret` (`x-frigg-*` headers), a
-token cannot name a user other than the one it was issued for, so it is safe in a browser.
-
-```javascript
-// backend/index.js
-const appDefinition = {
-    user: {
-        primary: 'organization',
-        individualUserRequired: true,
-        organizationUserRequired: true,
-        authModes: { adopterJwt: true, friggToken: false, sharedSecret: false },
-        jwtConfig: {
-            jwksUri: 'https://login.example.com/.well-known/jwks.json',
-            issuer: 'https://login.example.com/',
-            audience: 'my-frigg-api', // required with jwksUri
-        },
-    },
-};
-```
-
-The client sends `Authorization: Bearer <token>`. `x-frigg-appuserid` / `x-frigg-apporgid`, if
-also sent, must match the token or the request is refused with 403. That match rule lives in
-`user/use-cases/authenticate-user.js` (`validateUserMatch`), not in the token verifier. A bearer
-value that is not a three-part JWT is not offered to the verifier at all; it falls through to
-`friggToken` (or is a 401 when that mode is off).
-
-| `jwtConfig` field | Default | Meaning |
-|---|---|---|
-| `jwksUri` | | Remote JWKS (rotating keys, one per verifier, cached by jose). Must be `https`; `http` only for `localhost`, `127.0.0.0/8` or `::1`. Set exactly one of this and `secret`. |
-| `secret` | | Shared HMAC secret. Read it from an environment variable. |
-| `issuer` | not checked | Required `iss`. With `jwksUri`, a startup warning is logged when it is unset. |
-| `audience` | not checked with `secret`; **required with `jwksUri`** | Accepted `aud` (a string or a list). |
-| `algorithms` | `['ES256','RS256']` with `jwksUri`, `['HS256']` with `secret` | Allow-list. HS* is only accepted with `secret`, never with `jwksUri`. The older single `algorithm` is a deprecated alias; setting both is an error. |
-| `clockToleranceSec` | `30` | Skew allowed on `exp` and `nbf`. |
-| `userIdClaim` | `sub` | App user id (required in the token). |
-| `orgIdClaim` | `org_id` | App organization id (optional). |
-| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). |
-
-Rules worth knowing:
-
-- Tokens must carry `exp`. `alg: none` and any algorithm outside the allow-list are refused.
-- Startup fails (`loadAppDefinition` throws) when `adopterJwt` is on and the config is unusable:
-  neither or both of `jwksUri` and `secret`, a `jwksUri` that is not https (or loopback http),
-  no `audience` with `jwksUri`, or an algorithm list that does not fit the key type.
-- Failures are `401` with a stable `data.reason`: `token_expired`, `token_not_yet_valid`,
-  `token_invalid_signature`, `token_wrong_issuer`, `token_wrong_audience`,
-  `token_missing_user_claim`, `token_malformed`. The message never contains the token or its claims.
-  Any other verification failure, such as an unreachable or unresolvable JWKS, is `503`
-  `jwks_unavailable`, not a 401, so clients do not drop good sessions.
-- **The token's organization is the request's active organization**, and a person can belong to
-  several (ADR-056 §3.6). The first time a person presents a token for an organization they are
-  not a member of, Frigg adds an `OrganizationMembership` and the request runs as that
-  organization (`user.getActiveOrganizationId()`; `user.getId()` under `primary: 'organization'`).
-  Nothing is moved: `IndividualUser.organizationId` is a legacy pointer, set only on a person's
-  first link and read as an implicit membership. The same applies to `x-frigg-apporgid` with
-  `sharedSecret`. With `user.strictMembership: true` those headers cannot add anyone to an organization
-  that already existed (400 for a non-member, a brand-new `appUserId` included); only an organization
-  the request itself creates is allowed. `strictUserValidation` is a deprecated alias with that same
-  meaning. See
-  [Organization memberships](../../docs/guides/organization-memberships.md). A token naming a second
-  organization is no longer a `403` (`multi_org_unsupported` is gone).
-- Two first logins for the same new person or organization, even in different organizations, both
-  succeed: a create that loses to a unique constraint finds the winner's row.
-
-#### Entity scopes and ownership (ADR-056 §3)
-
-Who owns an entity (a connected account) or an integration follows its **scope**, not `user.primary`:
-
-| Scope | Owned by | Created with |
-|---|---|---|
-| `individual` | the person (`individualUser`) | the active organization (`organizationId`), or none under `individualAcross: 'all'` |
-| `organization` | the active organization's user | that organization |
-| `global` | nobody (the app owner) | none; refused by the tenant API (admin routes only) |
-
-The scope of a new connection is the first of: the request (`scope` on `POST /api/v2/authorize`, only from
-the deciding level's `allow` list), the integration binding (`Definition.modules[key].scope` or
-`Definition.entities[key].scope`), `Definition.ownership.scope`, the entity type
-(`appDefinition.entities[name].scope`), `appDefinition.ownership.scope`, then `organization` for an
-organization-primary app and `individual` otherwise. A setting is `'organization'` or
-`{ default: 'individual', allow: ['individual', 'organization'] }`.
-
-```javascript
-const appDefinition = {
-    user: { primary: 'individual', authModes: { adopterJwt: true } },
-    ownership: { scope: 'individual', individualAcross: 'organization' }, // the defaults
-    entities: {
-        google: { definition: google, scope: 'individual' },
-        xero: { definition: xero, scope: { default: 'organization', allow: ['organization', 'individual'] } },
-    },
-    integrations: [Sync], // Sync.Definition.ownership = { owner: 'derive' }
-};
-```
-
-`GET /api/v2/entities` and `/integrations` return, for the active organization, its own
-rows and the caller's, each with `scope`, `owner`, `organizationId` and `access`, and take `?scope=` and
-`?owner=me|org`. An individual entity is only visible and usable in the organization it was connected in
-(or in all of them, with `individualAcross: 'all'`). Rows written before this existed keep working: see
-[Entity scopes](../../docs/guides/entity-scopes.md), which also covers the schema (`organizationId` on
-`Entity` and `Integration`, no `scope` column) and what is deferred.
-
 ### 8. Lambda Utilities (`/lambda`)
 
 AWS Lambda-specific utilities and helpers.

package/application/commands/integration-commands.js

@@ -18,7 +18,7 @@ const {
     ListIntegrationsByEntityExternalIdUseCase,
 } = require('../../integrations/use-cases/list-integrations-by-entity-external-id');
 const {
-    GetIntegrationsByUserId,
+    GetIntegrationsForUser,
 } = require('../../integrations/use-cases/get-integrations-for-user');
 const {
     CreateIntegration,
@@ -30,9 +30,8 @@ const {
     PatchIntegrationConfig,
 } = require('../../integrations/use-cases/patch-integration-config');
 const {
-    getEntityTypeRegistry,
-    getEntityTypeDefinitions,
-} = require('../../modules/entity-type-registry');
+    getModulesDefinitionFromIntegrationClasses,
+} = require('../../integrations/utils/map-integration-dto');
 
 const ERROR_CODE_MAP = {
     ENTITY_NOT_FOUND: 401,
@@ -52,16 +51,7 @@ function mapErrorToResponse(error) {
     };
 }
 
-/**
- * @param {Object} [params]
- * @param {Function} [params.integrationClass]
- * @param {Array<object>} [params.moduleDefinitions] - the app's offered module
- *   definitions (`loadAppDefinition().moduleDefinitions`). Integration code
- *   calls this from a constructor with no app definition in hand, so when it
- *   is omitted the commands hydrate with this integration's own modules only
- *   (a registry built from `{ integrations: [integrationClass] }`).
- */
-function createIntegrationCommands({ integrationClass, moduleDefinitions } = {}) {
+function createIntegrationCommands({ integrationClass } = {}) {
     // Always use Frigg's default repositories and use cases
     const integrationRepository = createIntegrationRepository();
 
@@ -118,13 +108,13 @@ function createIntegrationCommands({ integrationClass, moduleDefinitions } = {})
 
     const moduleRepository = createModuleRepository();
 
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses([
+        integrationClass,
+    ]);
+
     const moduleFactory = new ModuleFactory({
         moduleRepository,
-        moduleDefinitions:
-            moduleDefinitions ??
-            getEntityTypeDefinitions(
-                getEntityTypeRegistry({ integrations: [integrationClass] })
-            ),
+        moduleDefinitions,
     });
 
     const loadIntegrationContextUseCase = new LoadIntegrationContextUseCase({
@@ -152,7 +142,7 @@ function createIntegrationCommands({ integrationClass, moduleDefinitions } = {})
             moduleRepository,
         });
 
-    const getIntegrationsForUserUseCase = new GetIntegrationsByUserId({
+    const getIntegrationsForUserUseCase = new GetIntegrationsForUser({
         integrationRepository,
         integrationClasses: [integrationClass],
         moduleFactory,

package/application/commands/user-commands.js

@@ -1,12 +1,6 @@
 const {
     createUserRepository,
 } = require('../../user/repositories/user-repository-factory');
-const {
-    createOrganizationMembershipRepository,
-} = require('../../user/repositories/organization-membership-repository-factory');
-const {
-    FindIndividualUsersByOrganization,
-} = require('../../user/use-cases/find-individual-users-by-organization');
 
 const ERROR_CODE_MAP = {
     USER_NOT_FOUND: 404,
@@ -32,12 +26,6 @@ function mapErrorToResponse(error) {
  */
 function createUserCommands() {
     const userRepository = createUserRepository();
-    const findIndividualUsersByOrganization =
-        new FindIndividualUsersByOrganization({
-            userRepository,
-            organizationMembershipRepository:
-                createOrganizationMembershipRepository(),
-        });
 
     return {
         /**
@@ -182,8 +170,7 @@ function createUserCommands() {
         },
 
         /**
-         * Find all individual users who belong to an organization user: those with
-         * a membership and those the legacy organizationId pointer places there.
+         * Find all individual users linked to an organization user
          * @param {string} organizationUserId - Organization user ID to search for
          * @returns {Promise<Object[]>} Array of individual user objects (empty if none)
          */
@@ -195,9 +182,10 @@ function createUserCommands() {
                     throw error;
                 }
 
-                const users = await findIndividualUsersByOrganization.execute(
-                    organizationUserId
-                );
+                const users =
+                    await userRepository.findIndividualUsersByOrganizationId(
+                        organizationUserId
+                    );
 
                 return (users || []).map((user) => ({
                     id: user._id?.toString() || user.id,

package/application/index.js

@@ -17,7 +17,6 @@ const { createUsageCommands } = require('./commands/usage-commands');
  *
  * @param {Object} params
  * @param {Object} params.integrationClass - Integration class (required)
- * @param {Array<object>} [params.moduleDefinitions] - the app's offered module definitions; defaults to the integration's own modules
  * @returns {Object} Unified commands object with all CRUD operations
  *
  * @example
@@ -25,12 +24,9 @@ const { createUsageCommands } = require('./commands/usage-commands');
  * const user = await commands.createUser({ username: 'user@example.com' });
  * const credential = await commands.createCredential({ userId: user.id, ... });
  */
-function createFriggCommands({ integrationClass, moduleDefinitions }) {
+function createFriggCommands({ integrationClass }) {
     // All commands use Frigg's default repositories and use cases
-    const integrationCommands = createIntegrationCommands({
-        integrationClass,
-        moduleDefinitions,
-    });
+    const integrationCommands = createIntegrationCommands({ integrationClass });
 
     const userCommands = createUserCommands();
 

package/credential/repositories/credential-repository-documentdb.js

@@ -186,40 +186,6 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        const userObjectId = toObjectId(userId);
-        if (!userObjectId) return [];
-        const docs = await findManyDrained(
-            this.prisma,
-            'Credential',
-            { userId: userObjectId },
-            { sort: { createdAt: -1 } }
-        );
-        const credentials = [];
-        for (const doc of docs) {
-            const decrypted = await this.encryptionService.decryptFields(
-                'Credential',
-                doc
-            );
-            credentials.push({
-                ...this._mapCredential(decrypted),
-                id: fromObjectId(doc._id),
-                userId: fromObjectId(doc.userId) ?? doc.userId,
-                externalId: doc.externalId ?? null,
-                authIsValid: doc.authIsValid ?? null,
-                createdAt: doc.createdAt ?? null,
-                updatedAt: doc.updatedAt ?? null,
-            });
-        }
-        return credentials;
-    }
-
     async updateCredential(credentialId, updates) {
         const objectId = toObjectId(credentialId);
         if (!objectId) return null;

package/credential/repositories/credential-repository-interface.js

@@ -80,21 +80,6 @@ class CredentialRepositoryInterface {
         );
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string|number} userId - User ID (string from application layer)
-     * @returns {Promise<Array<Object>>} Credentials with string IDs, `createdAt`
-     *   and `updatedAt`, and the (decrypted) data fields spread in, as
-     *   findCredentialById returns them. Empty when the user has none.
-     * @abstract
-     */
-    async findCredentialsByUserId(userId) {
-        throw new Error(
-            'Method findCredentialsByUserId must be implemented by subclass'
-        );
-    }
-
     /**
      * Update a credential by ID
      *

package/credential/repositories/credential-repository-mongo.js

@@ -188,29 +188,6 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        if (!userId) return [];
-        const credentials = await this.prisma.credential.findMany({
-            where: { userId: String(userId) },
-            orderBy: { createdAt: 'desc' },
-        });
-        return credentials.map((credential) => ({
-            ...(credential.data || {}),
-            id: credential.id,
-            userId: credential.userId,
-            externalId: credential.externalId,
-            authIsValid: credential.authIsValid,
-            createdAt: credential.createdAt,
-            updatedAt: credential.updatedAt,
-        }));
-    }
-
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })

package/credential/repositories/credential-repository-postgres.js

@@ -205,34 +205,6 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
         };
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID (string from application layer)
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        let intUserId;
-        try {
-            intUserId = this._convertId(userId);
-        } catch {
-            return [];
-        }
-        const credentials = await this.prisma.credential.findMany({
-            where: { userId: intUserId },
-            orderBy: { createdAt: 'desc' },
-        });
-        return credentials.map((credential) => ({
-            ...(credential.data || {}),
-            id: credential.id.toString(),
-            userId: credential.userId?.toString(),
-            externalId: credential.externalId,
-            authIsValid: credential.authIsValid,
-            createdAt: credential.createdAt,
-            updatedAt: credential.updatedAt,
-        }));
-    }
-
     /**
      * Update a credential by ID
      *

package/database/documentdb-utils.js

@@ -58,8 +58,6 @@ async function insertOne(client, collection, document) {
 
         // Provide helpful context for common errors
         if (error.code === 11000) {
-            // `code` lets callers recognise a lost race without parsing text
-            // (see database/unique-violation.js).
             throw Object.assign(
                 new Error(`${errorMsg} - Duplicate key violation`),
                 { code: 11000 }

package/database/encryption/encryption-schema-registry.js

@@ -39,12 +39,6 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
-
-    // Multi-step authorization (Management API v2): earlier steps can collect
-    // emails, usernames or one-time codes.
-    AuthorizationSession: {
-        fields: ['stepData'],
-    },
 };
 
 let customSchema = {};
@@ -180,13 +174,6 @@ function loadModuleEncryptionSchemas(integrations) {
         return;
     }
 
-    // NOTE: this path does not exist ('../integrations' resolves to
-    // database/integrations), so today this function throws MODULE_NOT_FOUND,
-    // loadCustomEncryptionSchema swallows it, and module credentialFields are
-    // effectively NOT registered. Fixing it changes which fields are encrypted
-    // and needs a decrypt that tolerates plaintext, so it ships separately:
-    // branch claude/internal-mcp-03b-module-credential-encryption. Left as is
-    // here on purpose (ADR-059 must not change what gets encrypted).
     const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
 
     const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);

package/errors/index.js

@@ -6,6 +6,9 @@ const {
     ParameterTypeError,
 } = require('./validation-errors');
 const { ClientSafeError } = require('./client-safe-error');
+const {
+    MappingAlreadyExistsError,
+} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -14,4 +17,5 @@ module.exports = {
     RequiredPropertyError,
     ParameterTypeError,
     ClientSafeError,
+    MappingAlreadyExistsError,
 };

package/errors/mapping-already-exists-error.js

@@ -0,0 +1,14 @@
+const { BaseError } = require('./base-error');
+
+class MappingAlreadyExistsError extends BaseError {
+    constructor(integrationId, sourceId, ...errorOptions) {
+        super(
+            `Mapping already exists for integration ${integrationId} and sourceId ${sourceId}`,
+            ...errorOptions
+        );
+        this.integrationId = integrationId;
+        this.sourceId = sourceId;
+    }
+}
+
+module.exports = { MappingAlreadyExistsError };