@friggframework/core 2.0.0--canary.683.8a84ab1.0 → 2.0.0--canary.682.d8626c4.0

package/README.md

@@ -393,7 +393,7 @@ value that is not a three-part JWT is not offered to the verifier at all; it fal
 | `clockToleranceSec` | `30` | Skew allowed on `exp` and `nbf`. |
 | `userIdClaim` | `sub` | App user id (required in the token). |
 | `orgIdClaim` | `org_id` | App organization id (optional). |
-| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). For permissions the token's role wins; a token with none uses the role stored on the person's membership of the active organization, and is a member when there is none: it cannot create or change organization-level entities or integrations. `user.orgAdminRoles` (default `['ADMIN']`) names the roles that can. Frigg bearer tokens are not gated unless `user.orgAdminGateBearerTokens: true`. |
+| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). |
 
 Rules worth knowing:
 

package/credential/use-cases/credential-operations-for-user.js

@@ -1,7 +1,5 @@
 const Boom = require('@hapi/boom');
 const { userOwns } = require('../../modules/use-cases/get-entity-module-for-user');
-const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
 
 /**
  * Management API v2 credential operations. A credential has no module name
@@ -92,8 +90,7 @@ class GetCredentialForUserV2 {
  * than disappearing from integrations.
  */
 class DeleteCredentialForUser {
-    constructor({ credentialRepository, moduleRepository, getCredentialForUser, scopePolicy }) {
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
+    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
         this.credentialRepository = credentialRepository;
         this.moduleRepository = moduleRepository;
         this.getCredentialForUser = getCredentialForUser;
@@ -104,11 +101,6 @@ class DeleteCredentialForUser {
             credentialId,
             user
         );
-        // A credential an organization owns: the organization's admins only.
-        // (null: not the person's or the active organization's, which the
-        // owner check above already decided.)
-        const access = this.scopePolicy.accessToOwnedBy(user, credential.userId);
-        if (access !== null) assertCanManage(access, `credential ${credential.id}`);
         for (const entityId of credential.entityIds) {
             await this.moduleRepository.unsetCredential(entityId);
         }

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -1,6 +1,4 @@
 const Boom = require('@hapi/boom');
-const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
 
 /**
  * Re-authorization of a credential the caller owns (Management API v2). It
@@ -16,11 +14,7 @@ async function credentialEntityType(getCredentialForUser, credentialId, user) {
             { code: 'CREDENTIAL_TYPE_UNKNOWN' }
         );
     }
-    return {
-        entityType: credential.type,
-        credentialId: String(credential.id),
-        ownerId: credential.userId,
-    };
+    return { entityType: credential.type, credentialId: String(credential.id) };
 }
 
 /** GET /api/v2/credentials/:credentialId/reauthorize */
@@ -31,7 +25,7 @@ class GetCredentialReauthorization {
     }
 
     async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
-        const { ownerId, ...binding } = await credentialEntityType(
+        const binding = await credentialEntityType(
             this.getCredentialForUser,
             credentialId,
             user
@@ -48,21 +42,17 @@ class GetCredentialReauthorization {
 
 /** POST /api/v2/credentials/:credentialId/reauthorize */
 class ReauthorizeCredentialForUser {
-    constructor({ getCredentialForUser, submitAuthorizationStep, scopePolicy }) {
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
+    constructor({ getCredentialForUser, submitAuthorizationStep }) {
         this.getCredentialForUser = getCredentialForUser;
         this.submitAuthorizationStep = submitAuthorizationStep;
     }
 
     async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
-        const { ownerId, ...binding } = await credentialEntityType(
+        const binding = await credentialEntityType(
             this.getCredentialForUser,
             credentialId,
             user
         );
-        // A credential an organization owns: the organization's admins only.
-        const access = this.scopePolicy.accessToOwnedBy(user, ownerId);
-        if (access !== null) assertCanManage(access, `credential ${credentialId}`);
         return this.submitAuthorizationStep.execute({
             user,
             ...binding,

package/integrations/integration-router.js

@@ -291,11 +291,9 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
     } = useCases;
 
     // The owner of an integration the caller may reach (404 otherwise), which is
-    // what the id-and-owner use cases below expect. `manage: true` is for
-    // changing or deleting: an organization's integration needs an admin (403).
-    const ownerOf = async (integrationId, user, options) =>
-        (await getOwnedIntegrationRecord.execute(integrationId, user, options))
-            .userId;
+    // what the id-and-owner use cases below expect.
+    const ownerOf = async (integrationId, user) =>
+        (await getOwnedIntegrationRecord.execute(integrationId, user)).userId;
 
     router.route('/api/integrations').get(
         catchAsyncError(async (req, res) => {
@@ -347,7 +345,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
 
             const integration = await updateIntegration.execute(
                 req.params.integrationId,
-                await ownerOf(req.params.integrationId, user, { manage: true }),
+                await ownerOf(req.params.integrationId, user),
                 params.config
             );
             res.json(integration);
@@ -360,7 +358,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             await deleteIntegrationForUser.execute(
                 params.integrationId,
-                await ownerOf(params.integrationId, user, { manage: true })
+                await ownerOf(params.integrationId, user)
             );
             res.status(204).json({});
         })

package/integrations/use-cases/integration-operations-for-user.js

@@ -1,7 +1,6 @@
 const Boom = require('@hapi/boom');
 const { describeRecord } = require('../../modules/scope-visibility');
 const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
 const { isIntegrationNotFound } = require('../repositories/integration-not-found');
 
 /**
@@ -33,14 +32,7 @@ class GetOwnedIntegrationRecord {
         return describeRecord(record, this.scopePolicy.accessContext(user), 'integration');
     }
 
-    /**
-     * @param {string} integrationId
-     * @param {Object} user - authenticated User
-     * @param {{manage?: boolean}} [options] - `manage: true` for changing or
-     *   deleting: a person may use an organization's integration but only an
-     *   admin may change it (403 ORG_ADMIN_REQUIRED)
-     */
-    async execute(integrationId, user, { manage = false } = {}) {
+    async execute(integrationId, user) {
         let record = null;
         try {
             record = await this.integrationRepository.findIntegrationById(
@@ -55,9 +47,9 @@ class GetOwnedIntegrationRecord {
             }
             throw error;
         }
-        const tenancy = record && this.describe(record, user);
-        if (!tenancy) throw notFound(integrationId);
-        if (manage) assertCanManage(tenancy.access, `integration ${integrationId}`);
+        if (!record || !this.describe(record, user)) {
+            throw notFound(integrationId);
+        }
         return record;
     }
 }
@@ -146,8 +138,7 @@ class UpdateIntegrationForUser {
         }
         const record = await this.getOwnedIntegrationRecord.execute(
             integrationId,
-            user,
-            { manage: true }
+            user
         );
         return this.updateIntegration.execute(record.id, record.userId, config);
     }
@@ -163,8 +154,7 @@ class RemoveIntegrationForUser {
     async execute(integrationId, user) {
         const record = await this.getOwnedIntegrationRecord.execute(
             integrationId,
-            user,
-            { manage: true }
+            user
         );
         await this.deleteIntegrationForUser.execute(record.id, record.userId);
     }

package/management-api/v2/dependencies.js

@@ -252,7 +252,6 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
             credentialRepository,
             moduleRepository,
             getCredentialForUser,
-            scopePolicy,
         }),
         getCredentialReauthorization: new GetCredentialReauthorization({
             getCredentialForUser,
@@ -261,7 +260,6 @@ function buildV2Dependencies({ appDefinition, config, entityTypeRegistry }) {
         reauthorizeCredentialForUser: new ReauthorizeCredentialForUser({
             getCredentialForUser,
             submitAuthorizationStep,
-            scopePolicy,
         }),
 
         // Authorization (multi-step)

package/modules/scope-config.js

@@ -8,7 +8,6 @@ const {
     SCOPES,
     INDIVIDUAL_ACROSS_VALUES,
     OWNER_RULES,
-    DEFAULT_ORG_ADMIN_ROLES,
     configError,
     isPlainObject,
     parseScopeSetting,
@@ -76,40 +75,6 @@ function readIntegrationOwnership(integrationClass) {
     return { scope: parseScopeSetting(raw.scope, `${where}.scope`), owner };
 }
 
-/**
- * `user.orgAdminRoles`: the token roles that may manage organization-level
- * things. Default `['ADMIN']`. A shared-secret caller needs no role.
- */
-function readOrgAdminRoles(appDefinition) {
-    const raw = appDefinition?.user?.orgAdminRoles;
-    if (raw === undefined || raw === null) return [...DEFAULT_ORG_ADMIN_ROLES];
-    if (
-        !Array.isArray(raw) ||
-        raw.length === 0 ||
-        raw.some((role) => typeof role !== 'string' || role.trim() === '')
-    ) {
-        throw configError(
-            'appDefinition.user.orgAdminRoles',
-            'must be a non-empty array of role names'
-        );
-    }
-    return [...raw];
-}
-
-/**
- * `user.orgAdminGateBearerTokens`: judge Frigg bearer-token callers by role
- * like adopter-token callers. Default false: they keep their pre-roles
- * behaviour and may manage the organization they act in.
- */
-function readGateBearerTokens(appDefinition) {
-    const raw = appDefinition?.user?.orgAdminGateBearerTokens;
-    if (raw === undefined || raw === null) return false;
-    if (typeof raw !== 'boolean') {
-        throw configError('appDefinition.user.orgAdminGateBearerTokens', 'must be a boolean');
-    }
-    return raw;
-}
-
 /**
  * Every binding of every integration with its resolved scope and where it came
  * from, parsing each integration's settings once. Throws OwnershipConfigError
@@ -153,7 +118,7 @@ function listBindingScopes(appDefinition, entityTypeRegistry, primary) {
  * Validates every ownership setting in one pass and returns the app-level
  * config the runtime needs.
  *
- * @returns {{scope: ({default: string, allow: string[]}|null), individualAcross: string, orgAdminRoles: string[], gateBearerTokens: boolean}}
+ * @returns {{scope: ({default: string, allow: string[]}|null), individualAcross: string}}
  * @throws {OwnershipConfigError}
  */
 function resolveOwnershipConfig(appDefinition, entityTypeRegistry) {
@@ -178,8 +143,6 @@ function resolveOwnershipConfig(appDefinition, entityTypeRegistry) {
     return Object.freeze({
         scope: app.scope,
         individualAcross: app.individualAcross,
-        orgAdminRoles: Object.freeze(readOrgAdminRoles(appDefinition)),
-        gateBearerTokens: readGateBearerTokens(appDefinition),
     });
 }
 

package/modules/scope-policy.js

@@ -6,21 +6,16 @@
 
 const {
     INDIVIDUAL_ACROSS_VALUES,
-    DEFAULT_ORG_ADMIN_ROLES,
     configError,
     parseScopeSetting,
     resolveScope,
     resolveOwnerForScope,
 } = require('./scope-resolution');
-const {
-    accessContext,
-    accessToOwner,
-    describeRecord,
-} = require('./scope-visibility');
+const { accessContext, describeRecord } = require('./scope-visibility');
 
 /**
  * @param {Object} [params]
- * @param {{scope: *, individualAcross: string, orgAdminRoles?: string[], gateBearerTokens?: boolean}} [params.ownership] - the raw
+ * @param {{scope: *, individualAcross: string}} [params.ownership] - the raw
  *   `appDefinition.ownership` or what resolveOwnershipConfig returned (a parsed
  *   `{ default, allow }` parses to itself)
  * @param {Map} [params.entityTypeRegistry]
@@ -38,11 +33,7 @@ function createScopePolicy({ ownership, entityTypeRegistry } = {}) {
         );
     }
 
-    const orgAdminRoles = ownership?.orgAdminRoles ?? DEFAULT_ORG_ADMIN_ROLES;
-    const gateBearerTokens = ownership?.gateBearerTokens === true;
-
-    const contextFor = (user) =>
-        accessContext(user, { individualAcross, orgAdminRoles, gateBearerTokens });
+    const contextFor = (user) => accessContext(user, { individualAcross });
 
     /** The scope a new connection of `entityType` gets (levels 1, 4, 5, 6). */
     const resolveEntityScope = ({ entityType, requestScope, binding, integration, user }) =>
@@ -74,16 +65,8 @@ function createScopePolicy({ ownership, entityTypeRegistry } = {}) {
     const canUseEntity = (user, entity) =>
         describeRecord(entity, contextFor(user), 'entity') !== null;
 
-    /**
-     * What `user` may do with a record owned by `ownerId` that has no
-     * organization of its own (a credential): manage, or null when not theirs.
-     */
-    const accessToOwnedBy = (user, ownerId) => accessToOwner(ownerId, contextFor(user));
-
     return Object.freeze({
         individualAcross,
-        orgAdminRoles,
-        accessToOwnedBy,
         accessContext: contextFor,
         resolveScope: resolveEntityScope,
         resolveOwnership,

package/modules/scope-resolution.js

@@ -25,9 +25,6 @@ const INDIVIDUAL_ACROSS_VALUES = Object.freeze(['organization', 'all']);
 const OWNER_RULES = Object.freeze(['derive', 'individual', 'organization']);
 const ACCESS = Object.freeze({ MANAGE: 'manage', USE: 'use', VIEW: 'view' });
 
-/** The organization roles that may manage organization-level things unless `user.orgAdminRoles` says. */
-const DEFAULT_ORG_ADMIN_ROLES = Object.freeze(['ADMIN']);
-
 /** Raised at app-definition load for an invalid ownership setting. */
 class OwnershipConfigError extends BaseError {
     constructor(message, options) {
@@ -183,11 +180,6 @@ const MISSING_ORGANIZATION =
 const missing = (message, field) =>
     Boom.badRequest(message, { code: 'IDENTITY_REQUIRED', details: { field } });
 
-const adminRequired = (what) =>
-    Boom.forbidden(`only an organization admin can ${what}`, {
-        code: 'ORG_ADMIN_REQUIRED',
-    });
-
 /**
  * The owner and organization for a new entity of `scope` (§3.2):
  *
@@ -208,7 +200,6 @@ function resolveOwnerForScope(scope, ctx) {
     }
     if (scope === SCOPES.ORGANIZATION) {
         if (!ctx.activeOrgId) throw missing(MISSING_ORGANIZATION, 'x-frigg-apporgid');
-        if (!ctx.canManageOrg) throw adminRequired('connect an organization-level account');
         return { scope, ownerId: ctx.activeOrgId, organizationId: ctx.activeOrgId };
     }
     throw Boom.forbidden(
@@ -238,7 +229,6 @@ function integrationOwnerKind(entityScopes, rule = 'derive') {
 function resolveIntegrationOwner(kind, ctx) {
     if (kind === SCOPES.ORGANIZATION) {
         if (!ctx.activeOrgId) throw missing(MISSING_ORGANIZATION, 'x-frigg-apporgid');
-        if (!ctx.canManageOrg) throw adminRequired('create an organization-level integration');
         return { ownerId: ctx.activeOrgId, organizationId: ctx.activeOrgId };
     }
     if (!ctx.callerId) throw missing(MISSING_INDIVIDUAL, 'x-frigg-appuserid');
@@ -273,7 +263,6 @@ module.exports = {
     INDIVIDUAL_ACROSS_VALUES,
     OWNER_RULES,
     ACCESS,
-    DEFAULT_ORG_ADMIN_ROLES,
     OwnershipConfigError,
     configError,
     isPlainObject,

package/modules/scope-visibility.js

@@ -8,8 +8,7 @@
  */
 
 const { isPresent, idString, sameId } = require('../user/membership');
-const { AUTH_SOURCES } = require('../user/user');
-const { SCOPES, ACCESS, DEFAULT_ORG_ADMIN_ROLES } = require('./scope-resolution');
+const { SCOPES, ACCESS } = require('./scope-resolution');
 
 /**
  * One owner/organization pair a repository ORs into a single query.
@@ -67,56 +66,15 @@ function buildClauses(base, kind) {
     return clauses;
 }
 
-/**
- * Whether the caller may manage organization-level things (create, change,
- * delete), ADR-056 §3.6:
- *
- * - A shared-secret caller is the app's own backend and may.
- * - A Frigg bearer token (`/user/login`) predates organization roles and
- *   carries none. It keeps its pre-roles behaviour and may, unless the app
- *   sets `user.orgAdminGateBearerTokens: true`; then it is judged like any
- *   other caller below.
- * - Otherwise the role is the one the token carries; when it carries none,
- *   the role stored on the caller's membership of the active organization;
- *   when there is none, `MEMBER`. A missing role never means admin. An
- *   unknown source (a `User` built outside AuthenticateUser) is judged this
- *   way too.
- *
- * @param {{authSource: (string|null), orgRole: (string|null), membershipRole: (string|null)}} who
- * @param {string[]} adminRoles - `user.orgAdminRoles`, compared case-insensitively
- * @param {{gateBearerTokens?: boolean}} [options]
- */
-function canManageOrganization(
-    { authSource, orgRole, membershipRole },
-    adminRoles = DEFAULT_ORG_ADMIN_ROLES,
-    { gateBearerTokens = false } = {}
-) {
-    if (authSource === AUTH_SOURCES.SHARED_SECRET) return true;
-    if (authSource === AUTH_SOURCES.BEARER_TOKEN && !gateBearerTokens) return true;
-    let role = 'MEMBER';
-    if (isPresent(orgRole)) role = orgRole;
-    else if (isPresent(membershipRole)) role = membershipRole;
-    role = String(role).toUpperCase();
-    return adminRoles.some((admin) => String(admin).toUpperCase() === role);
-}
-
 /**
  * Who the caller is, for ownership and visibility: their individual user, the
- * organization this request acts in, the legacy `organizationId` pointer,
- * whether they may manage organization-level things, and the clauses that
- * follow from them (computed once).
+ * organization this request acts in, the legacy `organizationId` pointer, and
+ * the clauses that follow from them (computed once).
  *
  * @param {Object} user - the authenticated `User` (or a `{ getId }` double)
- * @param {{individualAcross?: string, orgAdminRoles?: string[], gateBearerTokens?: boolean}} [options]
+ * @param {{individualAcross?: string}} [options]
  */
-function accessContext(
-    user,
-    {
-        individualAcross = 'organization',
-        orgAdminRoles = DEFAULT_ORG_ADMIN_ROLES,
-        gateBearerTokens = false,
-    } = {}
-) {
+function accessContext(user, { individualAcross = 'organization' } = {}) {
     const hasUserModel = typeof user?.getIndividualUser === 'function';
     const individual = hasUserModel ? user.getIndividualUser() : null;
     const base = {
@@ -128,20 +86,8 @@ function accessContext(
         legacyOrgId: idString(individual?.organizationId),
         individualAcross,
     };
-    const who = {
-        authSource:
-            typeof user?.getAuthSource === 'function' ? user.getAuthSource() : null,
-        orgRole: typeof user?.getOrgRole === 'function' ? user.getOrgRole() : null,
-        membershipRole:
-            typeof user?.getMembershipRole === 'function'
-                ? user.getMembershipRole()
-                : null,
-    };
     return {
         ...base,
-        canManageOrg: canManageOrganization(who, orgAdminRoles, {
-            gateBearerTokens,
-        }),
         clauses: {
             entity: buildClauses(base, 'entity'),
             integration: buildClauses(base, 'integration'),
@@ -166,26 +112,8 @@ function scopeOf(record, ctx) {
     return null;
 }
 
-/** manage for the person's own; for the organization's, only an admin; use otherwise. */
-const accessFor = (scope, ctx) => {
-    if (scope === SCOPES.INDIVIDUAL) return ACCESS.MANAGE;
-    if (scope === SCOPES.ORGANIZATION) {
-        return ctx.canManageOrg ? ACCESS.MANAGE : ACCESS.USE;
-    }
-    return ACCESS.USE;
-};
-
-/**
- * What the caller may do with a record owned by `ownerId` that carries no
- * organization of its own (a credential): manage the person's own, manage the
- * active organization's only as an admin, nothing otherwise. Null when the
- * record is not theirs.
- */
-function accessToOwner(ownerId, ctx) {
-    const scope = scopeOf({ userId: ownerId }, ctx);
-    if (scope !== SCOPES.INDIVIDUAL && scope !== SCOPES.ORGANIZATION) return null;
-    return accessFor(scope, ctx);
-}
+const accessFor = (scope) =>
+    scope === SCOPES.GLOBAL ? ACCESS.USE : ACCESS.MANAGE;
 
 /**
  * What a row is to this caller, or null when they may not see it.
@@ -206,7 +134,7 @@ function describeRecord(record, ctx, kind) {
             scope === SCOPES.ORGANIZATION
                 ? idString(record.userId)
                 : idString(record.organizationId),
-        access: accessFor(scope, ctx),
+        access: accessFor(scope),
     };
 }
 
@@ -226,8 +154,6 @@ function matchesListFilters(description, { scope, owner } = {}) {
 }
 
 module.exports = {
-    canManageOrganization,
-    accessToOwner,
     accessContext,
     unscopedRowsBelongHere,
     visibilityClauses,

package/modules/use-cases/entity-operations-for-user.js

@@ -5,7 +5,6 @@ const {
     matchesListFilters,
 } = require('../scope-visibility');
 const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
-const { assertCanManage } = require('./manage-access');
 
 /**
  * Management API v2 entity operations. Each one starts from
@@ -112,10 +111,10 @@ class RefreshEntityOptionsForUser {
 }
 
 /**
- * Deletes an entity the caller may manage (the owner; for an organization
- * entity, an organization admin). Refuses with 409 while integrations still
- * use it, so an integration never points at a missing entity. The credential
- * is left alone (others may share it); delete it through /api/v2/credentials.
+ * Deletes an entity the caller may use. Refuses with 409 while integrations
+ * still use it, so an integration never points at a missing entity. The
+ * credential is left alone (others may share it); delete it through
+ * /api/v2/credentials.
  */
 class DeleteEntityForUser {
     constructor({ getEntityModuleForUser, moduleRepository, integrationRepository }) {
@@ -129,10 +128,6 @@ class DeleteEntityForUser {
             entityId,
             user
         );
-        assertCanManage(
-            this.getEntityModuleForUser.describe(entity, user)?.access,
-            `entity ${entity.id}`
-        );
         const integrations =
             (await this.integrationRepository.findIntegrationsByEntityId(
                 entity.id

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.683.8a84ab1.0",
+    "version": "2.0.0--canary.682.d8626c4.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.683.8a84ab1.0",
-        "@friggframework/prettier-config": "2.0.0--canary.683.8a84ab1.0",
-        "@friggframework/test": "2.0.0--canary.683.8a84ab1.0",
+        "@friggframework/eslint-config": "2.0.0--canary.682.d8626c4.0",
+        "@friggframework/prettier-config": "2.0.0--canary.682.d8626c4.0",
+        "@friggframework/test": "2.0.0--canary.682.d8626c4.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "8a84ab14e5e56c7e7939b1b6a0b656ed9301dcfd"
+    "gitHead": "d8626c44a041edbf421a843c24d6a050cbf8657b"
 }

package/types/user/index.d.ts

@@ -62,20 +62,6 @@ declare module "@friggframework/core/user" {
      * at startup. `strictMembership` wins when both are set.
      */
     strictUserValidation?: boolean;
-    /**
-     * Roles that may manage organization-level things (ADR-056 §3). Default
-     * `['ADMIN']`. The role is the adopter token's role claim, else the stored
-     * membership `orgRole`, else `MEMBER` (never admin). A shared-secret
-     * (`x-frigg` header) caller needs no role, nor does a Frigg bearer token
-     * unless `orgAdminGateBearerTokens`. Compared case-insensitively.
-     * Validated at load.
-     */
-    orgAdminRoles?: string[];
-    /**
-     * Judge Frigg bearer-token callers by role like adopter-token callers.
-     * Default false: they keep their behaviour from before organization roles.
-     */
-    orgAdminGateBearerTokens?: boolean;
     authModes?: UserAuthModes;
     jwtConfig?: AdopterJwtConfig;
   }
@@ -127,8 +113,5 @@ declare module "@friggframework/core/user" {
     /** The organization role from the adopter token for this request, or null. */
     getOrgRole(): string | null;
     setOrgRole(orgRole: string | null): void;
-    /** The stored `orgRole` of the membership of the active organization, or null. Used when the token carries no role. */
-    getMembershipRole(): string | null;
-    setMembershipRole(membershipRole: string | null): void;
   }
 }

package/user/use-cases/authenticate-user.js

@@ -1,6 +1,5 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
-const { AUTH_SOURCES } = require('../user');
 
 const log = getLogger('frigg.user.authentication');
 
@@ -69,13 +68,10 @@ class AuthenticateUser {
                 // Validate the API key (authentication)
                 await this.authenticateWithSharedSecret.execute(apiKey);
                 // Get user from x-frigg headers (authorization)
-                const user = await this.getUserFromXFriggHeaders.execute(
+                return await this.getUserFromXFriggHeaders.execute(
                     appUserId,
                     appOrgId
                 );
-                // The app's own backend: trusted to manage organization things.
-                user.setAuthSource(AUTH_SOURCES.SHARED_SECRET);
-                return user;
             }
             log.debug('No x-frigg-api-key header, skipping shared secret', {
                 eventName: `${log.name}.shared_secret_skipped`,
@@ -94,7 +90,6 @@ class AuthenticateUser {
             // Detect JWT format (3 parts separated by dots)
             if (token && token.split('.').length === 3) {
                 const user = await this.getUserFromAdopterJwt.execute(token);
-                user.setAuthSource(AUTH_SOURCES.ADOPTER_JWT);
                 // Validate x-frigg headers match JWT claims if present
                 if (appUserId || appOrgId) {
                     this.validateUserMatch(user, appUserId, appOrgId);
@@ -111,7 +106,6 @@ class AuthenticateUser {
             const user = await this.getUserFromBearerToken.execute(
                 req.headers.authorization
             );
-            user.setAuthSource(AUTH_SOURCES.BEARER_TOKEN);
             // Validate x-frigg headers match token user if present
             if (appUserId || appOrgId) {
                 this.validateUserMatch(user, appUserId, appOrgId);

package/user/use-cases/get-user-from-adopter-jwt.js

@@ -74,14 +74,8 @@ class GetUserFromAdopterJwt {
         const role = claims[roleClaim];
 
         const orgRole = typeof role === 'string' && role !== '' ? role : null;
-        const { user, membership } = await this._findOrCreateUser(
-            appUserId,
-            appOrgId,
-            orgRole
-        );
+        const user = await this._findOrCreateUser(appUserId, appOrgId, orgRole);
         user.setOrgRole(orgRole);
-        // What the membership row says: the role when the token carries none.
-        user.setMembershipRole(membership?.orgRole ?? null);
 
         log.debug('Adopter token accepted', {
             eventName: `${log.name}.accepted`,
@@ -104,16 +98,12 @@ class GetUserFromAdopterJwt {
 
         // The token's organization is the active one whether or not this is
         // the person's first time in it.
-        const { individual, membership } =
-            await this.ensureOrganizationMembership.execute({
-                individual: created.individual,
-                organization: created.organization,
-                orgRole,
-            });
-        return {
-            user: buildUser(cfg, individual, created.organization),
-            membership,
-        };
+        const { individual } = await this.ensureOrganizationMembership.execute({
+            individual: created.individual,
+            organization: created.organization,
+            orgRole,
+        });
+        return buildUser(cfg, individual, created.organization);
     }
 }
 

package/user/user.js

@@ -1,20 +1,5 @@
 const bcrypt = require('bcryptjs');
 
-/**
- * How the request that produced a `User` proved who it is. Set by
- * AuthenticateUser, never inferred from a missing value. Organization roles
- * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
- * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
- * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
- * adopter token has the role it carries, else the stored membership role,
- * else `MEMBER`.
- */
-const AUTH_SOURCES = Object.freeze({
-    SHARED_SECRET: 'shared-secret',
-    ADOPTER_JWT: 'adopter-jwt',
-    BEARER_TOKEN: 'bearer-token',
-});
-
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -33,14 +18,9 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
-        // Organization role from an adopter token claim (ADR-056 §2), per
-        // request. When present it wins over the stored membership role.
+        // Organization role from an adopter token claim (ADR-056 §2). Per request:
+        // the role stored on a membership is only what the first token carried.
         this.orgRole = null;
-        // The role stored on the person's membership of the active organization
-        // (OrganizationMembership.orgRole); used when the token carries none.
-        this.membershipRole = null;
-        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
-        this.authSource = null;
 
         this.config = {
             primary,
@@ -104,14 +84,6 @@ class User {
         return this.config.individualUserRequired;
     }
 
-    getAuthSource() {
-        return this.authSource;
-    }
-
-    setAuthSource(authSource) {
-        this.authSource = authSource ?? null;
-    }
-
     getOrgRole() {
         return this.orgRole;
     }
@@ -120,14 +92,6 @@ class User {
         this.orgRole = orgRole ?? null;
     }
 
-    getMembershipRole() {
-        return this.membershipRole;
-    }
-
-    setMembershipRole(membershipRole) {
-        this.membershipRole = membershipRole ?? null;
-    }
-
     getIndividualUser() {
         return this.individualUser;
     }
@@ -185,4 +149,4 @@ class User {
     }
 }
 
-module.exports = { User, AUTH_SOURCES }; 
+module.exports = { User }; 

package/modules/use-cases/manage-access.js

@@ -1,21 +0,0 @@
-const Boom = require('@hapi/boom');
-const { ACCESS } = require('../scope-resolution');
-
-/**
- * The one check behind every "may this caller change or delete it" gate
- * (ADR-056 §3 permissions): the caller may use it but not manage it, so 403
- * `ORG_ADMIN_REQUIRED`. `access` comes from describeRecord (entities,
- * integrations) or scopePolicy.accessToOwnedBy (credentials).
- *
- * @param {string|null} access - ACCESS value
- * @param {string} subject - e.g. `entity 5`, for the message
- */
-function assertCanManage(access, subject) {
-    if (access !== ACCESS.MANAGE) {
-        throw Boom.forbidden(`You may use ${subject} but not change or delete it`, {
-            code: 'ORG_ADMIN_REQUIRED',
-        });
-    }
-}
-
-module.exports = { assertCanManage };