@friggframework/core 2.0.0--canary.684.0da024b.0 → 2.0.0--canary.679.a2bcc2f.0

package/modules/use-cases/create-entity-from-credential.js

@@ -1,113 +0,0 @@
-const Boom = require('@hapi/boom');
-const { Module } = require('../module');
-
-const sameId = (a, b) =>
-    a !== undefined && a !== null && b !== undefined && b !== null &&
-    String(a) === String(b);
-
-/**
- * Creates (or finds) the entity for a credential the caller already holds:
- * the v1 `POST /api/entity`. The owner and organization follow the scope of
- * `entityType`, exactly as an authorization does (ADR-056 §3.2, §3.6), so the
- * owner is decided by `AuthorizeEntityForUser.resolveOwnership` and never by
- * `user.getId()`. Whatever that resolution refuses (a missing identity, and
- * an organization-level connection by a non-admin) is refused here too.
- *
- * The credential must belong to that owner: an organization entity is built
- * on the organization's credential, an individual one on the person's own.
- */
-class CreateEntityFromCredential {
-    /**
-     * @param {Object} params
-     * @param {import('./authorize-entity-for-user').AuthorizeEntityForUser} params.authorizeEntityForUser
-     * @param {import('./process-authorization-callback').ProcessAuthorizationCallback} params.processAuthorizationCallback
-     * @param {Object} params.credentialRepository
-     * @param {Array<Object>} params.moduleDefinitions
-     * @param {Function} [params.createModule] - builds a Module; injectable for tests
-     */
-    constructor({
-        authorizeEntityForUser,
-        processAuthorizationCallback,
-        credentialRepository,
-        moduleDefinitions,
-        createModule,
-    }) {
-        this.authorizeEntityForUser = authorizeEntityForUser;
-        this.processAuthorizationCallback = processAuthorizationCallback;
-        this.credentialRepository = credentialRepository;
-        this.moduleDefinitions = moduleDefinitions || [];
-        this.createModule = createModule || ((params) => new Module(params));
-    }
-
-    /**
-     * @param {Object} params
-     * @param {Object} params.user - authenticated User
-     * @param {string} params.entityType
-     * @param {string} params.credentialId
-     * @returns {Promise<Object>} the persisted entity
-     */
-    async execute({ user, entityType, credentialId }) {
-        const definition = this.moduleDefinitions.find(
-            (def) =>
-                def.moduleName === entityType ||
-                (typeof def.getName === 'function' && def.getName() === entityType)
-        );
-        if (!definition) {
-            throw Boom.badRequest(`Unknown entity type ${entityType}`, {
-                code: 'ENTITY_TYPE_NOT_FOUND',
-            });
-        }
-
-        const ownership = this.authorizeEntityForUser.resolveOwnership({
-            user,
-            entityType,
-        });
-
-        const credential =
-            await this.credentialRepository.findCredentialById(credentialId);
-        // A missing credential and someone else's are the same answer, so ids
-        // cannot be probed.
-        if (!credential || !sameId(credential.userId, ownership.ownerId)) {
-            throw Boom.badRequest('Invalid credential ID', {
-                code: 'INVALID_CREDENTIAL',
-            });
-        }
-
-        // Built for the owner, with the credential loaded (the repository
-        // returns its tokens flat; a Module reads them from `data`), so the
-        // API can call the provider and a token refresh during
-        // getEntityDetails updates the owner's credential.
-        const { id, userId, externalId, authIsValid, ...data } = credential;
-        const module = this.createModule({
-            userId: ownership.ownerId,
-            definition,
-            entity: {
-                credential: { id, userId, externalId, authIsValid, data },
-            },
-        });
-        const entityDetails =
-            await definition.requiredAuthMethods.getEntityDetails(
-                module.api,
-                null,
-                null,
-                ownership.ownerId
-            );
-        Object.assign(
-            entityDetails.details,
-            module.apiParamsFromEntity(module.api)
-        );
-
-        return this.processAuthorizationCallback.findOrCreateEntity(
-            entityDetails,
-            definition.moduleName,
-            credential.id,
-            {
-                scope: ownership.scope,
-                organizationId: ownership.organizationId,
-                legacyOrgId: ownership.legacyOrgId,
-            }
-        );
-    }
-}
-
-module.exports = { CreateEntityFromCredential };

package/modules/use-cases/manage-access.js

@@ -1,21 +0,0 @@
-const Boom = require('@hapi/boom');
-const { ACCESS } = require('../scope-resolution');
-
-/**
- * The one check behind every "may this caller change or delete it" gate
- * (ADR-056 §3 permissions): the caller may use it but not manage it, so 403
- * `ORG_ADMIN_REQUIRED`. `access` comes from describeRecord (entities,
- * integrations) or scopePolicy.accessToOwnedBy (credentials).
- *
- * @param {string|null} access - ACCESS value
- * @param {string} subject - e.g. `entity 5`, for the message
- */
-function assertCanManage(access, subject) {
-    if (access !== ACCESS.MANAGE) {
-        throw Boom.forbidden(`You may use ${subject} but not change or delete it`, {
-            code: 'ORG_ADMIN_REQUIRED',
-        });
-    }
-}
-
-module.exports = { assertCanManage };

package/prisma-postgresql/migrations/20261015000000_add_organization_membership/migration.sql

@@ -1,26 +0,0 @@
--- CreateTable
--- Organization memberships (ADR-056 §3.6). One row per person per organization.
--- "User"."organizationId" stays as the legacy single-org pointer. It is NOT
--- backfilled into this table: the domain (user/membership.js) reads it as an
--- implicit membership when no row exists (see docs/guides/organization-memberships.md).
-CREATE TABLE "OrganizationMembership" (
-    "id" SERIAL NOT NULL,
-    "individualUserId" INTEGER NOT NULL,
-    "organizationUserId" INTEGER NOT NULL,
-    "orgRole" TEXT NOT NULL DEFAULT 'MEMBER',
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    CONSTRAINT "OrganizationMembership_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE INDEX "OrganizationMembership_organizationUserId_idx" ON "OrganizationMembership"("organizationUserId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "OrganizationMembership_individualUserId_organizationUserId_key" ON "OrganizationMembership"("individualUserId", "organizationUserId");
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_individualUserId_fkey" FOREIGN KEY ("individualUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_organizationUserId_fkey" FOREIGN KEY ("organizationUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;

package/prisma-postgresql/migrations/20261016000000_add_entity_integration_organization/migration.sql

@@ -1,25 +0,0 @@
--- Entity and Integration carry the organization they were created in (ADR-056 §3.6).
--- Nullable, no default and no backfill: a row written before this migration keeps
--- NULL, and the domain (modules/entity-scope.js) reads NULL as "predates scoping"
--- (docs/guides/entity-scopes.md). No scope column: the owner's user type says it.
--- Deliberately no foreign key: a deleted organization must leave its rows
--- invisible, and ON DELETE SET NULL would turn them into unscoped ones.
---
--- Release note: the two CREATE INDEX statements below are plain (not
--- CONCURRENTLY, which Prisma migrations cannot run inside a transaction). Each
--- takes a SHARE lock on its table while it builds, so writes to "Entity" and
--- "Integration" wait for it. Both tables are small in a typical Frigg
--- deployment; on a very large one, create the indexes by hand first with
--- CREATE INDEX CONCURRENTLY IF NOT EXISTS under the same names, then deploy.
-
--- AlterTable
-ALTER TABLE "Entity" ADD COLUMN     "organizationId" INTEGER;
-
--- AlterTable
-ALTER TABLE "Integration" ADD COLUMN     "organizationId" INTEGER;
-
--- CreateIndex
-CREATE INDEX "Entity_userId_organizationId_idx" ON "Entity"("userId", "organizationId");
-
--- CreateIndex
-CREATE INDEX "Integration_userId_organizationId_idx" ON "Integration"("userId", "organizationId");

package/types/user/index.d.ts

@@ -1,134 +0,0 @@
-declare module "@friggframework/core/user" {
-  export type AdopterJwtAlgorithm =
-    | "ES256"
-    | "ES384"
-    | "RS256"
-    | "RS384"
-    | "RS512"
-    | "HS256"
-    | "HS384"
-    | "HS512";
-
-  /**
-   * Verification of tokens issued by the adopter's identity system
-   * (`authModes.adopterJwt`, ADR-056 §2). Set exactly one of `jwksUri` or `secret`.
-   */
-  export interface AdopterJwtConfig {
-    /** https URL of the issuer's JWKS (http only for localhost, 127.0.0.0/8, ::1). */
-    jwksUri?: string;
-    /** Shared HMAC secret for HS* tokens. */
-    secret?: string;
-    /** Required `iss`. With `jwksUri`, a startup warning is logged when unset. */
-    issuer?: string;
-    /** Accepted `aud`. Required with `jwksUri`. */
-    audience?: string | string[];
-    /** Allow-list. Default ES256 and RS256 with `jwksUri`, HS256 with `secret`. */
-    algorithms?: AdopterJwtAlgorithm[];
-    /** @deprecated Use `algorithms`. Setting both is an error. */
-    algorithm?: AdopterJwtAlgorithm;
-    /** Skew allowed on `exp` and `nbf`. Default 30. */
-    clockToleranceSec?: number;
-    /** Default `sub`. */
-    userIdClaim?: string;
-    /** Default `org_id`. */
-    orgIdClaim?: string;
-    /** Default `org_role`. Exposed as `User#getOrgRole()`; stored on a new membership. */
-    roleClaim?: string;
-  }
-
-  export interface UserAuthModes {
-    friggToken?: boolean;
-    sharedSecret?: boolean;
-    adopterJwt?: boolean;
-  }
-
-  /** The `user` block of the app definition. */
-  export interface UserConfig {
-    usePassword?: boolean;
-    primary?: "individual" | "organization";
-    individualUserRequired?: boolean;
-    organizationUserRequired?: boolean;
-    /**
-     * With `x-frigg` headers, refuse (400) to make a person a member of an
-     * organization that already existed: anyone not already a member, a
-     * brand-new `appUserId` included, is rejected. Naming an organization the
-     * request itself creates is still allowed. Default false (a non-member is
-     * added).
-     */
-    strictMembership?: boolean;
-    /**
-     * @deprecated Alias of `strictMembership`, with the same new meaning (it
-     * used to reject a mismatched individual/organization pair). Logs a warning
-     * at startup. `strictMembership` wins when both are set.
-     */
-    strictUserValidation?: boolean;
-    /**
-     * Roles that may manage organization-level things (ADR-056 §3). Default
-     * `['ADMIN']`. The role is the adopter token's role claim, else the stored
-     * membership `orgRole`, else `MEMBER` (never admin). A shared-secret
-     * (`x-frigg` header) caller needs no role, nor does a Frigg bearer token
-     * unless `orgAdminGateBearerTokens`. Compared case-insensitively.
-     * Validated at load.
-     */
-    orgAdminRoles?: string[];
-    /**
-     * Judge Frigg bearer-token callers by role like adopter-token callers.
-     * Default false: they keep their behaviour from before organization roles.
-     */
-    orgAdminGateBearerTokens?: boolean;
-    authModes?: UserAuthModes;
-    jwtConfig?: AdopterJwtConfig;
-  }
-
-  /**
-   * One person's membership of one organization (ADR-056 §3.6). `implicit` is
-   * true when it is only the legacy `IndividualUser.organizationId` pointer.
-   */
-  export interface OrganizationMembership {
-    id: string | null;
-    individualUserId: string;
-    organizationUserId: string;
-    /** Defaults to `MEMBER`. */
-    orgRole: string;
-    createdAt?: Date;
-    implicit: boolean;
-  }
-
-  export interface OrganizationMembershipRepository {
-    /** The stored row or null: the legacy `organizationId` pointer is not read here. */
-    findMembership(
-      individualUserId: string,
-      organizationUserId: string
-    ): Promise<OrganizationMembership | null>;
-    /** Idempotent: adds when absent, never changes an existing membership. */
-    addMembership(
-      individualUserId: string,
-      organizationUserId: string,
-      options?: { orgRole?: string | null }
-    ): Promise<OrganizationMembership>;
-    /** Stored rows only, oldest first; legacy-pointer people are not here. */
-    listMembershipsForOrganization(
-      organizationUserId: string
-    ): Promise<OrganizationMembership[]>;
-  }
-
-  export function createOrganizationMembershipRepository(): OrganizationMembershipRepository;
-
-  export class User {
-    /** The primary user's id; under `primary: 'organization'` the ACTIVE organization. */
-    getId(): string | undefined;
-    /** The organization this request acts in (token or `x-frigg-apporgid`), or null. */
-    getActiveOrganizationId(): string | null;
-    getAppUserId(): string | null;
-    getAppOrgId(): string | null;
-    getIndividualUser(): any;
-    getOrganizationUser(): any;
-    getPrimaryUser(): any;
-    /** The organization role from the adopter token for this request, or null. */
-    getOrgRole(): string | null;
-    setOrgRole(orgRole: string | null): void;
-    /** The stored `orgRole` of the membership of the active organization, or null. Used when the token carries no role. */
-    getMembershipRole(): string | null;
-    setMembershipRole(membershipRole: string | null): void;
-  }
-}

package/user/adopter-jwt-config.js

@@ -1,177 +0,0 @@
-const { getLogger } = require('../logs');
-
-const log = getLogger('frigg.user.adopter_jwt');
-
-/**
- * Normalises and validates `user.jwtConfig` from the app definition (ADR-056 §2).
- * Called once at startup by the app definition loader and once per verifier,
- * never per request.
- */
-
-const ASYMMETRIC_ALGORITHMS = ['ES256', 'ES384', 'RS256', 'RS384', 'RS512'];
-const HMAC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
-const SUPPORTED_ALGORITHMS = [...ASYMMETRIC_ALGORITHMS, ...HMAC_ALGORITHMS];
-
-const DEFAULTS = Object.freeze({
-    jwksAlgorithms: Object.freeze(['ES256', 'RS256']),
-    secretAlgorithms: Object.freeze(['HS256']),
-    clockToleranceSec: 30,
-    userIdClaim: 'sub',
-    orgIdClaim: 'org_id',
-    roleClaim: 'org_role',
-});
-
-const isNonEmptyString = (value) =>
-    typeof value === 'string' && value.trim() !== '';
-
-const hasAudience = (audience) =>
-    isNonEmptyString(audience) ||
-    (Array.isArray(audience) &&
-        audience.length > 0 &&
-        audience.every(isNonEmptyString));
-
-const LOOPBACK_IPV4 = /^127(\.\d{1,3}){3}$/;
-
-function isLoopbackHost(hostname) {
-    return (
-        hostname === 'localhost' ||
-        hostname === '[::1]' ||
-        LOOPBACK_IPV4.test(hostname)
-    );
-}
-
-/**
- * The JWKS is the trust root: fetched over https, or over http only to the
- * machine itself (a local identity provider in development).
- */
-function assertJwksUri(jwksUri) {
-    let url;
-    try {
-        url = new URL(jwksUri);
-    } catch {
-        throw new Error('user.jwtConfig.jwksUri is not a valid URL');
-    }
-    if (url.protocol === 'https:') return;
-    if (url.protocol === 'http:' && isLoopbackHost(url.hostname)) return;
-    throw new Error(
-        'user.jwtConfig.jwksUri must use https (http is allowed only for localhost, 127.0.0.0/8 and ::1)'
-    );
-}
-
-/**
- * @param {Object} [jwtConfig] `userConfig.jwtConfig`
- * @returns {{jwksUri?: string, secret?: string, issuer?: string,
- *   audience?: string|string[], algorithms: string[], clockToleranceSec: number,
- *   userIdClaim: string, orgIdClaim: string, roleClaim: string}}
- * @throws {Error} When the config cannot verify any token safely.
- */
-function resolveAdopterJwtConfig(jwtConfig) {
-    const config = jwtConfig && typeof jwtConfig === 'object' ? jwtConfig : {};
-    const hasJwks = isNonEmptyString(config.jwksUri);
-    const hasSecret = isNonEmptyString(config.secret);
-
-    if (!hasJwks && !hasSecret) {
-        throw new Error(
-            'user.authModes.adopterJwt is enabled but user.jwtConfig has neither jwksUri nor secret'
-        );
-    }
-    if (hasJwks && hasSecret) {
-        throw new Error(
-            'user.jwtConfig sets both jwksUri and secret; set one, so a token cannot choose which key family verifies it'
-        );
-    }
-    if (hasJwks) {
-        assertJwksUri(config.jwksUri);
-        // Without an audience, a token minted by the same issuer for another
-        // service verifies here. HMAC mode shares its secret with one issuer,
-        // so it stays lenient.
-        if (!hasAudience(config.audience)) {
-            throw new Error(
-                'user.jwtConfig.audience is required when jwksUri is used'
-            );
-        }
-    }
-    if (config.algorithm !== undefined && config.algorithms !== undefined) {
-        throw new Error(
-            'user.jwtConfig sets both algorithm and algorithms; use algorithms (algorithm is a deprecated alias)'
-        );
-    }
-
-    const configured =
-        config.algorithms ??
-        (config.algorithm ? [config.algorithm] : undefined);
-    const algorithms =
-        configured ??
-        (hasSecret ? DEFAULTS.secretAlgorithms : DEFAULTS.jwksAlgorithms);
-
-    if (
-        !Array.isArray(algorithms) ||
-        algorithms.length === 0 ||
-        algorithms.some((alg) => !SUPPORTED_ALGORITHMS.includes(alg))
-    ) {
-        throw new Error(
-            `user.jwtConfig.algorithms must be a non-empty list drawn from ${SUPPORTED_ALGORITHMS.join(
-                ', '
-            )}`
-        );
-    }
-    // A key family only verifies its own algorithms; mixing them is how
-    // algorithm-confusion attacks are built.
-    if (hasSecret && algorithms.some((alg) => !HMAC_ALGORITHMS.includes(alg))) {
-        throw new Error(
-            'user.jwtConfig.algorithms may only list HS* algorithms when secret is used'
-        );
-    }
-    if (hasJwks && algorithms.some((alg) => HMAC_ALGORITHMS.includes(alg))) {
-        throw new Error(
-            'user.jwtConfig.algorithms may not list HS* algorithms when jwksUri is used'
-        );
-    }
-
-    const clockToleranceSec =
-        config.clockToleranceSec ?? DEFAULTS.clockToleranceSec;
-    if (!Number.isInteger(clockToleranceSec) || clockToleranceSec < 0) {
-        throw new Error(
-            'user.jwtConfig.clockToleranceSec must be an integer >= 0'
-        );
-    }
-
-    return {
-        jwksUri: hasJwks ? config.jwksUri : undefined,
-        secret: hasSecret ? config.secret : undefined,
-        issuer: config.issuer || undefined,
-        audience: config.audience || undefined,
-        algorithms,
-        clockToleranceSec,
-        userIdClaim: config.userIdClaim || DEFAULTS.userIdClaim,
-        orgIdClaim: config.orgIdClaim || DEFAULTS.orgIdClaim,
-        roleClaim: config.roleClaim || DEFAULTS.roleClaim,
-    };
-}
-
-/**
- * Startup check: throws when `authModes.adopterJwt` is on and `jwtConfig`
- * is unusable, and warns when a jwksUri has no issuer. A no-op when the mode
- * is off, so apps that never enabled it are not affected by a stray `jwtConfig`.
- *
- * @param {Object|null} [userConfig] `appDefinition.user`
- * @throws {Error}
- */
-function assertAdopterJwtConfig(userConfig) {
-    if (userConfig?.authModes?.adopterJwt !== true) return;
-    const config = resolveAdopterJwtConfig(userConfig.jwtConfig);
-    if (config.jwksUri && !config.issuer) {
-        log.warn(
-            'Adopter JWT issuer is not set; any issuer on this JWKS is accepted',
-            {
-                eventName: `${log.name}.issuer_unset`,
-            }
-        );
-    }
-}
-
-module.exports = {
-    resolveAdopterJwtConfig,
-    assertAdopterJwtConfig,
-    SUPPORTED_ALGORITHMS,
-};

package/user/adopter-jwt-errors.js

@@ -1,59 +0,0 @@
-/* eslint-disable camelcase -- the reason codes are snake_case by spec */
-const Boom = require('@hapi/boom');
-
-/**
- * Every failure adopter-token authentication can produce, keyed by the stable
- * reason code clients see in `error.data.reason`. Messages are fixed text:
- * the token and its claims never reach a message, `data` or a log record.
- */
-const ADOPTER_JWT_ERRORS = Object.freeze({
-    token_expired: Object.freeze({ status: 401, message: 'Token has expired' }),
-    token_not_yet_valid: Object.freeze({
-        status: 401,
-        message: 'Token is not yet valid',
-    }),
-    token_invalid_signature: Object.freeze({
-        status: 401,
-        message: 'Token signature could not be verified',
-    }),
-    token_wrong_issuer: Object.freeze({
-        status: 401,
-        message: 'Token issuer is not accepted',
-    }),
-    token_wrong_audience: Object.freeze({
-        status: 401,
-        message: 'Token audience is not accepted',
-    }),
-    token_missing_user_claim: Object.freeze({
-        status: 401,
-        message: 'Token does not identify a user',
-    }),
-    token_malformed: Object.freeze({
-        status: 401,
-        message: 'Token is malformed',
-    }),
-    // Our dependency failing, not the caller's token: not a 401, so a client
-    // does not discard a good session during a JWKS outage.
-    jwks_unavailable: Object.freeze({
-        status: 503,
-        message: 'Token verification keys are unavailable',
-    }),
-    jwt_config_invalid: Object.freeze({
-        status: 500,
-        message: 'Adopter JWT authentication is misconfigured',
-    }),
-});
-
-/**
- * @param {keyof typeof ADOPTER_JWT_ERRORS} code
- * @returns {Boom.Boom} with `data.reason` set to `code`
- */
-function fail(code) {
-    const { status, message } = ADOPTER_JWT_ERRORS[code];
-    return new Boom.Boom(message, {
-        statusCode: status,
-        data: { reason: code },
-    });
-}
-
-module.exports = { ADOPTER_JWT_ERRORS, fail };

package/user/adopter-token-verifier.js

@@ -1,122 +0,0 @@
-const jose = require('jose');
-const { getLogger } = require('../logs');
-const { resolveAdopterJwtConfig } = require('./adopter-jwt-config');
-const { fail } = require('./adopter-jwt-errors');
-
-const log = getLogger('frigg.user.adopter_jwt');
-
-/**
- * The only failures that are the caller's token. Anything else thrown while
- * verifying (a refused connection, a DNS failure, a non-200 from the JWKS, a
- * generic JOSE error) is our key source failing, not a bad token.
- */
-function tokenFailureCode(error) {
-    const { errors } = jose;
-    if (error instanceof errors.JWTExpired) return 'token_expired';
-    if (error instanceof errors.JWTClaimValidationFailed) {
-        if (error.claim === 'iss') return 'token_wrong_issuer';
-        if (error.claim === 'aud') return 'token_wrong_audience';
-        if (error.claim === 'nbf') return 'token_not_yet_valid';
-        return 'token_malformed';
-    }
-    if (
-        error instanceof errors.JWSSignatureVerificationFailed ||
-        error instanceof errors.JOSEAlgNotAllowed ||
-        error instanceof errors.JWKSNoMatchingKey ||
-        error instanceof errors.JWKSMultipleMatchingKeys
-    ) {
-        return 'token_invalid_signature';
-    }
-    if (
-        error instanceof errors.JWSInvalid ||
-        error instanceof errors.JWTInvalid
-    ) {
-        return 'token_malformed';
-    }
-    return null;
-}
-
-/**
- * Verifies adopter-issued tokens (ADR-056 §2). Owns config resolution, the key
- * source and the mapping from jose failures to typed Boom errors.
- *
- * Build one per app definition: the config is resolved once here, and the
- * remote JWKS is an instance field, so jose's key cache lives as long as the
- * verifier does. A bad config does not throw here (apps with adopterJwt off
- * build a verifier too); `verify` answers 500 and logs the real reason.
- *
- * @param {Object} params
- * @param {Object} [params.jwtConfig] `userConfig.jwtConfig`
- * @param {Function|Object|Uint8Array} [params.keySource] Replaces the key
- *   derived from the config: a jose key or a getKey function such as
- *   `jose.createLocalJWKSet(jwks)`. Tests and custom key stores use it.
- * @returns {{verify: (token: string) => Promise<Object>,
- *   claimNames: {userIdClaim: string, orgIdClaim: string, roleClaim: string}}}
- */
-function createAdopterTokenVerifier({ jwtConfig, keySource } = {}) {
-    let config = null;
-    let configError = null;
-    try {
-        config = resolveAdopterJwtConfig(jwtConfig);
-    } catch (error) {
-        configError = error;
-    }
-
-    let key = null;
-    if (config) {
-        key =
-            keySource ??
-            (config.jwksUri
-                ? jose.createRemoteJWKSet(new URL(config.jwksUri))
-                : new TextEncoder().encode(config.secret));
-    }
-
-    const requireConfig = () => {
-        if (config) return config;
-        log.error('Adopter JWT config is invalid', {
-            eventName: `${log.name}.config_invalid`,
-            validationMessage: configError.message,
-        });
-        throw fail('jwt_config_invalid');
-    };
-
-    return {
-        get claimNames() {
-            const { userIdClaim, orgIdClaim, roleClaim } = requireConfig();
-            return { userIdClaim, orgIdClaim, roleClaim };
-        },
-
-        /**
-         * @param {string} token
-         * @returns {Promise<Object>} the verified claims
-         * @throws {Boom} 401 with `data.reason` for a token the verifier refuses
-         * @throws {Boom} 503 `jwks_unavailable` for any other verification failure
-         * @throws {Boom} 500 `jwt_config_invalid` when the config is unusable
-         */
-        async verify(token) {
-            const resolved = requireConfig();
-            try {
-                const { payload } = await jose.jwtVerify(token, key, {
-                    algorithms: resolved.algorithms,
-                    issuer: resolved.issuer,
-                    audience: resolved.audience,
-                    clockTolerance: resolved.clockToleranceSec,
-                    // A token that never expires is not browser-safe.
-                    requiredClaims: ['exp'],
-                });
-                return payload;
-            } catch (error) {
-                const code = tokenFailureCode(error) ?? 'jwks_unavailable';
-                if (code !== 'jwks_unavailable') {
-                    log.debug('Adopter token rejected', {
-                        eventName: `${log.name}.rejected`,
-                        reason: code,
-                    });
-                }
-                throw fail(code);
-            }
-        },
-    };
-}
-
-module.exports = { createAdopterTokenVerifier };