@friggframework/core 2.0.0--canary.684.e113124.0 → 2.0.0--canary.684.bfb48ef.0

package/integrations/integration-router.js

@@ -534,10 +534,14 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/authorize').get(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.query, ['entityType']);
+            // The owner POST stores under, so GET and POST describe one connection.
+            const { ownerId } = authorizeEntityForUser.resolveOwnership({
+                user,
+                entityType: params.entityType,
+            });
             const module = await getModuleInstanceFromType.execute(
-                userId,
+                ownerId,
                 params.entityType,
                 { state: req.query.state }
             );

package/modules/repositories/module-repository-documentdb.js

@@ -373,14 +373,15 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     _mapEntity(doc, credential) {
         const dynamicData = doc?.data || {};
         return {
+            // First, so no stored provider field can replace a column below
+            // (identity, owner or organization decide who sees the entity).
+            ...dynamicData,
             id: fromObjectId(doc?._id),
             credential,
             userId: fromObjectId(doc?.userId),
             name: doc?.name ?? null,
             externalId: doc?.externalId ?? null,
             moduleName: doc?.moduleName ?? null,
-            ...dynamicData,
-            // After the spread: a provider field of the same name must not decide visibility.
             organizationId: fromObjectId(doc?.organizationId) ?? null,
         };
     }

package/modules/repositories/module-repository-mongo.js

@@ -79,19 +79,20 @@ class ModuleRepositoryMongo extends ModuleRepositoryInterface {
 
     /**
      * The one place a stored entity row becomes the entity the application sees.
-     * `organizationId` comes after the entity data: a provider field of the same
-     * name must not decide who sees the entity.
+     * The provider's `data` is spread FIRST and every column is pinned after it:
+     * a stored `id`, `userId` or `organizationId` in `data` must not decide who
+     * owns the entity or who sees it.
      * @private
      */
     _mapEntity(row, credential) {
         return {
+            ...(row.data || {}),
             id: row.id,
             credential,
             userId: row.userId,
             name: row.name,
             externalId: row.externalId,
             moduleName: row.moduleName,
-            ...(row.data || {}),
             organizationId: row.organizationId ?? null,
         };
     }

package/modules/repositories/module-repository-postgres.js

@@ -110,19 +110,20 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
 
     /**
      * The one place a stored entity row becomes the entity the application sees.
-     * `organizationId` comes after the entity data: a provider field of the same
-     * name must not decide who sees the entity.
+     * The provider's `data` is spread FIRST and every column is pinned after it:
+     * a stored `id`, `userId` or `organizationId` in `data` must not decide who
+     * owns the entity or who sees it.
      * @private
      */
     _mapEntity(row, credential) {
         return {
+            ...(row.data || {}),
             id: row.id.toString(),
             credential,
             userId: row.userId?.toString(),
             name: row.name,
             externalId: row.externalId,
             moduleName: row.moduleName,
-            ...(row.data || {}),
             organizationId: row.organizationId?.toString() ?? null,
         };
     }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.684.e113124.0",
+    "version": "2.0.0--canary.684.bfb48ef.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.684.e113124.0",
-        "@friggframework/prettier-config": "2.0.0--canary.684.e113124.0",
-        "@friggframework/test": "2.0.0--canary.684.e113124.0",
+        "@friggframework/eslint-config": "2.0.0--canary.684.bfb48ef.0",
+        "@friggframework/prettier-config": "2.0.0--canary.684.bfb48ef.0",
+        "@friggframework/test": "2.0.0--canary.684.bfb48ef.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "e1131240a890bf30cfee08ba3786458c9e2d1135"
+    "gitHead": "bfb48ef7325e5052da0628e130ee6a77807d544e"
 }