@friggframework/core 2.0.0--canary.685.022c3c3.0 → 2.0.0--canary.683.8a84ab1.0

package/CLAUDE.md

@@ -502,29 +502,6 @@ The single source of the max receive count is
 devtools integration builder uses it for the queue's `RedrivePolicy` and sets
 it as `FRIGG_QUEUE_MAX_RECEIVE_COUNT` on the queue worker function.
 
-### Management API v2 notes (`/management-api`)
-
-- Handlers in `management-api/v2/handlers/` call use cases only; dependencies are wired in
-  `management-api/v2/dependencies.js`. Errors are `{ error: { code, message, details? } }`.
-- `appDefinition.managementApi` is resolved by `resolveManagementApiConfig`, which `loadAppDefinition`
-  also calls so a bad value stops the app at load. Numeric proxy limits fall back to their defaults;
-  `proxy.scopes` (ADR-056 §3.5, default `['individual']`) never does: an unknown scope, `'global'`, a
-  non-list, an empty list or a repeated scope throws `ManagementApiConfigError`
-  (`MANAGEMENT_API_CONFIG_INVALID`).
-- **Entity proxy** (`ExecuteEntityProxyRequest`): visibility in the active organization comes from
-  `GetEntityModuleForUser` (404), then `assertProxyable` reads the same `{ scope, access }` description
-  the v2 lists return: `grantsUse(access)` (`use` or `manage`, from `modules/scope-visibility.js`) or 403
-  `PROXY_NOT_ALLOWED` `reason: 'access'`, and the scope must be in `proxy.scopes` or 403 `reason: 'scope'`.
-  Do not add a second ownership rule for the proxy; change the description instead.
-- **Not visible is 404, and so is missing.** Module repositories throw `entityNotFoundError(id)`
-  (`modules/repositories/entity-not-found.js`) for a missing row and use cases match it with
-  `isEntityNotFound`. A 500 for a missing id next to a 404 for another tenant's id tells a caller which
-  ids exist. A test double that resolves `findEntityById` to `null` hides this: no adapter does that.
-- **Tenant isolation on real PostgreSQL**: `management-api/v2/tenant-isolation.postgres.test.js`, run with
-  `FRIGG_TEST_POSTGRES_URL=<a database it may wipe>`. It applies the migrations, truncates every table
-  before each test, and drives real adopter-JWT auth through the real router and Prisma repositories.
-  Without the variable it is skipped (and says so), not passed. See `docs/guides/entity-scopes.md`.
-
 ### 8. Error Handling (`/errors`)
 
 **Purpose**: Standardized error types with proper HTTP semantics.

package/README.md

@@ -393,7 +393,7 @@ value that is not a three-part JWT is not offered to the verifier at all; it fal
 | `clockToleranceSec` | `30` | Skew allowed on `exp` and `nbf`. |
 | `userIdClaim` | `sub` | App user id (required in the token). |
 | `orgIdClaim` | `org_id` | App organization id (optional). |
-| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). A token with no role is a member for permissions too: it cannot create or change organization-level entities or integrations; `user.orgAdminRoles` (default `['ADMIN']`) names the roles that can. |
+| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). For permissions the token's role wins; a token with none uses the role stored on the person's membership of the active organization, and is a member when there is none: it cannot create or change organization-level entities or integrations. `user.orgAdminRoles` (default `['ADMIN']`) names the roles that can. Frigg bearer tokens are not gated unless `user.orgAdminGateBearerTokens: true`. |
 
 Rules worth knowing:
 

package/credential/use-cases/credential-operations-for-user.js

@@ -1,28 +1,12 @@
 const Boom = require('@hapi/boom');
-const {
-    createScopePolicy,
-    describeRecord,
-    visibilityClauses,
-    matchesListFilters,
-    SCOPES,
-} = require('../../modules/entity-scope');
+const { userOwns } = require('../../modules/use-cases/get-entity-module-for-user');
+const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
 const { assertCanManage } = require('../../modules/use-cases/manage-access');
 
 /**
- * Management API v2 credential operations (ADR-056 §3.4, §3.6). A credential
- * has no module name and no organization of its own:
- *
- * - its `type` and `entityIds` come from the entities that use it that the
- *   caller may see, so the same person's account connected in two
- *   organizations (one credential, two entities) lists in each organization
- *   with that organization's entity only;
- * - who it belongs to is its OWNER (`credential.userId`), never the entities:
- *   a credential an individual entity and an organization entity both point at
- *   (possible only through legacy data) is described by whoever owns the
- *   credential, so the answer cannot change with the order the entities load;
- * - a credential whose entities are all out of sight (another organization's)
- *   is a 404, and one with no entities at all (its entity was deleted) is
- *   visible to its owner only, as it was before scoping.
+ * Management API v2 credential operations. A credential has no module name
+ * of its own; its `type` and the entities that use it come from the
+ * caller's entities. A missing or foreign credential is a 404.
  */
 
 const credentialIdOf = (entity) => {
@@ -55,82 +39,31 @@ function withEntityUsage(credentials, entities) {
     });
 }
 
-/**
- * `{scope, owner, organizationId, access}` of a credential for this caller, or
- * null when its owner is neither the caller nor the active organization. Built
- * by `describeRecord` over the row a connection by this owner has: the
- * organization of a visible entity, else the one a new entity would get.
- */
-function credentialTenancy(credential, visibleEntities, ctx) {
-    const entityOrg = visibleEntities.find(
-        (entity) => entity.organizationId !== undefined && entity.organizationId !== null
-    )?.organizationId;
-    const organizationId =
-        entityOrg ?? (ctx.individualAcross === 'all' ? null : ctx.activeOrgId);
-    return describeRecord({ userId: credential.userId, organizationId }, ctx, 'entity');
-}
-
-/** The entities of `entities` the caller may see, each with its `tenancy`. */
-function visibleOf(entities, ctx) {
-    const visible = [];
-    for (const entity of entities || []) {
-        const tenancy = describeRecord(entity, ctx, 'entity');
-        if (tenancy) visible.push({ ...entity, tenancy });
-    }
-    return visible;
-}
-
-/**
- * The caller's credentials with their type, the entities of them they may see
- * and `tenancy`. Credentials with no entity at all are listed too, for the
- * person and the active organization that own them.
- */
+/** The caller's credentials with their type and entity usage. */
 class ListCredentialsForUser {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
+    constructor({ credentialRepository, moduleRepository }) {
         this.credentialRepository = credentialRepository;
         this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
     }
 
-    /** @param {{scope?: string, owner?: string}} [filters] */
-    async execute(user, filters = {}) {
-        const ctx = this.scopePolicy.accessContext(user);
-        const owners = [...new Set([ctx.callerId, ctx.activeOrgId].filter(Boolean))];
-        const [found, perOwner, owned] = await Promise.all([
-            this.moduleRepository.findEntitiesByOwnership(visibilityClauses(ctx, 'entity')),
-            Promise.all(owners.map((id) => this.credentialRepository.findCredentialsByUserId(id))),
-            // Every entity of those owners, in any organization: only to tell a credential
-            // with no entity at all from one used elsewhere.
-            Promise.all(owners.map((id) => this.moduleRepository.findEntitiesByUserId(id))),
+    async execute(user) {
+        const userId = user.getId();
+        const [credentials, entities] = await Promise.all([
+            this.credentialRepository.findCredentialsByUserId(userId),
+            this.moduleRepository.findEntitiesByUserId(userId),
         ]);
-        const visible = visibleOf(found, ctx);
-        const usedAnywhere = new Set(owned.flat().map(credentialIdOf).filter(Boolean));
-        const listed = [];
-        for (const credential of perOwner.flat().filter(Boolean)) {
-            const id = String(credential.id);
-            const referencing = visible.filter((entity) => credentialIdOf(entity) === id);
-            if (referencing.length === 0 && usedAnywhere.has(id)) continue;
-            const tenancy = credentialTenancy(credential, referencing, ctx);
-            if (!tenancy || !matchesListFilters(tenancy, filters)) continue;
-            listed.push({ ...withEntityUsage([credential], referencing)[0], tenancy });
-        }
-        return listed;
+        return withEntityUsage(credentials || [], entities);
     }
 }
 
-/** One credential the caller may see: see the header. 404 otherwise. */
+/** One credential the caller owns, with its type and entity usage. */
 class GetCredentialForUserV2 {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
+    constructor({ credentialRepository, moduleRepository }) {
         this.credentialRepository = credentialRepository;
         this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
     }
 
     async execute(credentialId, user) {
-        const notFound = () =>
-            Boom.notFound(`Credential ${credentialId} not found`, {
-                code: 'CREDENTIAL_NOT_FOUND',
-            });
         let credential = null;
         try {
             credential = await this.credentialRepository.findCredentialById(
@@ -141,32 +74,26 @@ class GetCredentialForUserV2 {
                 throw error;
             }
         }
-        if (!credential) throw notFound();
-        const ctx = this.scopePolicy.accessContext(user);
-
-        const referencing =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        const visible = visibleOf(referencing, ctx);
-        if (referencing.length > 0 && visible.length === 0) throw notFound();
-        const tenancy = credentialTenancy(credential, visible, ctx);
-        if (!tenancy) throw notFound();
-        return { ...withEntityUsage([credential], visible)[0], tenancy };
+        if (!credential || !userOwns(user, credential.userId)) {
+            throw Boom.notFound(`Credential ${credentialId} not found`, {
+                code: 'CREDENTIAL_NOT_FOUND',
+            });
+        }
+        const entities = await this.moduleRepository.findEntitiesByUserId(
+            credential.userId
+        );
+        return withEntityUsage([credential], entities)[0];
     }
 }
 
 /**
- * Deletes a credential the caller may manage. The entities that used it stay,
- * with their credential unset, so they show as needing re-authorization rather
+ * Deletes a credential the caller owns. The entities that used it stay, with
+ * their credential unset, so they show as needing re-authorization rather
  * than disappearing from integrations.
- *
- * Refuses with 409 `CREDENTIAL_SHARED` while an entity the caller cannot see
- * still uses it: one credential row serves the same provider account in every
- * organization, and deleting it from one would break the other. The message
- * says nothing about the other connections (not even how many): remove the
- * entities that use it, and it goes with the last one.
  */
 class DeleteCredentialForUser {
-    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
+    constructor({ credentialRepository, moduleRepository, getCredentialForUser, scopePolicy }) {
+        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
         this.credentialRepository = credentialRepository;
         this.moduleRepository = moduleRepository;
         this.getCredentialForUser = getCredentialForUser;
@@ -177,15 +104,11 @@ class DeleteCredentialForUser {
             credentialId,
             user
         );
-        assertCanManage(credential.tenancy.access, `credential ${credential.id}`);
-        const usedBy =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        if (usedBy.length > credential.entityIds.length) {
-            throw Boom.conflict(
-                `Credential ${credential.id} is still in use by other connections and cannot be deleted from here`,
-                { code: 'CREDENTIAL_SHARED' }
-            );
-        }
+        // A credential an organization owns: the organization's admins only.
+        // (null: not the person's or the active organization's, which the
+        // owner check above already decided.)
+        const access = this.scopePolicy.accessToOwnedBy(user, credential.userId);
+        if (access !== null) assertCanManage(access, `credential ${credential.id}`);
         for (const entityId of credential.entityIds) {
             await this.moduleRepository.unsetCredential(entityId);
         }

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -1,4 +1,5 @@
 const Boom = require('@hapi/boom');
+const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
 const { assertCanManage } = require('../../modules/use-cases/manage-access');
 
 /**
@@ -18,9 +19,7 @@ async function credentialEntityType(getCredentialForUser, credentialId, user) {
     return {
         entityType: credential.type,
         credentialId: String(credential.id),
-        // A re-authorization keeps the scope the connection already has.
-        fixedScope: credential.tenancy?.scope,
-        access: credential.tenancy?.access,
+        ownerId: credential.userId,
     };
 }
 
@@ -32,12 +31,14 @@ class GetCredentialReauthorization {
     }
 
     async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
-        const { entityType, credentialId: boundCredentialId } =
-            await credentialEntityType(this.getCredentialForUser, credentialId, user);
+        const { ownerId, ...binding } = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
         return this.getAuthorizationStep.execute({
             user,
-            entityType,
-            credentialId: boundCredentialId,
+            ...binding,
             step,
             sessionId,
             state,
@@ -47,19 +48,21 @@ class GetCredentialReauthorization {
 
 /** POST /api/v2/credentials/:credentialId/reauthorize */
 class ReauthorizeCredentialForUser {
-    constructor({ getCredentialForUser, submitAuthorizationStep }) {
+    constructor({ getCredentialForUser, submitAuthorizationStep, scopePolicy }) {
+        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
         this.getCredentialForUser = getCredentialForUser;
         this.submitAuthorizationStep = submitAuthorizationStep;
     }
 
     async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
-        const { access, ...binding } = await credentialEntityType(
+        const { ownerId, ...binding } = await credentialEntityType(
             this.getCredentialForUser,
             credentialId,
             user
         );
         // A credential an organization owns: the organization's admins only.
-        assertCanManage(access, `credential ${credentialId}`);
+        const access = this.scopePolicy.accessToOwnedBy(user, ownerId);
+        if (access !== null) assertCanManage(access, `credential ${credentialId}`);
         return this.submitAuthorizationStep.execute({
             user,
             ...binding,

package/handlers/app-definition-loader.js

@@ -12,9 +12,6 @@ const {
     getEntityTypeDefinitions,
 } = require('../modules/entity-type-registry');
 const { resolveOwnershipConfig } = require('../modules/entity-scope');
-const {
-    resolveManagementApiConfig,
-} = require('../management-api/management-api-config');
 
 // Handlers without a database never load the encryption registry, so the
 // credential leaf keys are registered for redaction here too.
@@ -42,7 +39,6 @@ function registerCredentialLogKeys(appDefinition, moduleDefinitions) {
  * @throws {Error} Throws error if index.js file cannot be found in the backend directory.
  * @throws {Error} Throws error if user.authModes.adopterJwt is enabled without a usable user.jwtConfig.
  * @throws {OwnershipConfigError} Throws if an ownership or scope setting is invalid (ADR-056 §3.1).
- * @throws {ManagementApiConfigError} Throws if `managementApi.proxy.scopes` is invalid (ADR-056 §3.5).
  * @example
  * const { integrations, userConfig, telemetry } = loadAppDefinition();
  * console.log(`Found ${integrations.length} integrations`);
@@ -88,11 +84,6 @@ function loadAppDefinition() {
     // individual entity stops the app at load.
     const ownership = resolveOwnershipConfig(appDefinition, entityTypeRegistry);
 
-    // And for the Management API: `managementApi.proxy.scopes` decides whose
-    // credentials the entity proxy may act through (ADR-056 §3.5), so an
-    // unknown scope stops the app here rather than being read as a default.
-    resolveManagementApiConfig(managementApi);
-
     registerCredentialLogKeys(appDefinition, moduleDefinitions);
 
     // Degrade consistently: an invalid telemetry block must never take down a

package/index.js

@@ -71,6 +71,7 @@ const {
     Options,
     createIntegrationRouter,
     checkRequiredParams,
+    getModulesDefinitionFromIntegrationClasses,
     LoadIntegrationContextUseCase,
 } = require('./integrations/index');
 const {
@@ -112,9 +113,6 @@ const {
     listBindingScopes,
     OwnershipConfigError,
 } = require('./modules/index');
-const {
-    ManagementApiConfigError,
-} = require('./management-api/management-api-config');
 const application = require('./application');
 const utils = require('./utils');
 
@@ -169,6 +167,8 @@ module.exports = {
     Options,
     checkRequiredParams,
     createIntegrationRouter,
+    // Deprecated (ADR-059): use getEntityTypeRegistry.
+    getModulesDefinitionFromIntegrationClasses,
     LoadIntegrationContextUseCase,
     CreateProcess,
     UpdateProcessState,
@@ -229,7 +229,6 @@ module.exports = {
     resolveScope,
     listBindingScopes,
     OwnershipConfigError,
-    ManagementApiConfigError,
     // queues
     QueuerUtil,
 

package/integrations/index.js

@@ -4,6 +4,9 @@ const {
     createIntegrationRouter,
     checkRequiredParams,
 } = require('./integration-router');
+const {
+    getModulesDefinitionFromIntegrationClasses,
+} = require('./utils/map-integration-dto');
 const {
     LoadIntegrationContextUseCase,
 } = require('./use-cases/load-integration-context');
@@ -18,6 +21,8 @@ module.exports = {
     Options,
     createIntegrationRouter,
     checkRequiredParams,
+    // Deprecated (ADR-059): a wrapper over getEntityTypeRegistry.
+    getModulesDefinitionFromIntegrationClasses,
     LoadIntegrationContextUseCase,
     validateExtensionBinding,
     getExtensionRoutes,

package/integrations/integration-router.js

@@ -65,6 +65,9 @@ const { createScopePolicy } = require('../modules/scope-policy');
 const {
     AuthorizeEntityForUser,
 } = require('../modules/use-cases/authorize-entity-for-user');
+const {
+    CreateEntityFromCredential,
+} = require('../modules/use-cases/create-entity-from-credential');
 const {
     ResolveIntegrationOwnership,
 } = require('./use-cases/resolve-integration-ownership');
@@ -199,14 +202,22 @@ function createIntegrationRouter() {
     });
 
     // The owner of what an authorization creates follows its scope (ADR-056 §3.2).
+    const processAuthorizationCallback = new ProcessAuthorizationCallback({
+        moduleRepository,
+        credentialRepository,
+        integrationRepository,
+        moduleDefinitions,
+    });
     const authorizeEntityForUser = new AuthorizeEntityForUser({
         scopePolicy,
-        processAuthorizationCallback: new ProcessAuthorizationCallback({
-            moduleRepository,
-            credentialRepository,
-            integrationRepository,
-            moduleDefinitions,
-        }),
+        processAuthorizationCallback,
+    });
+    // v1 POST /api/entity: same owner resolution as /api/authorize.
+    const createEntityFromCredential = new CreateEntityFromCredential({
+        authorizeEntityForUser,
+        processAuthorizationCallback,
+        credentialRepository,
+        moduleDefinitions,
     });
 
     const router = express();
@@ -231,6 +242,7 @@ function createIntegrationRouter() {
         getEntityOptionsById,
         refreshEntityOptions,
         authorizeEntityForUser,
+        createEntityFromCredential,
     });
     return router;
 }
@@ -529,6 +541,7 @@ function setEntityRoutes(router, authenticateUser, useCases) {
         getEntityOptionsById,
         refreshEntityOptions,
         authorizeEntityForUser,
+        createEntityFromCredential,
     } = useCases;
 
     router.route('/api/authorize').get(
@@ -603,35 +616,20 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entity').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.body, [
                 'entityType',
                 'data',
             ]);
             checkRequiredParams(req.body.data, ['credential_id']);
 
-            // May want to pass along the user ID as well so credential ID's can't be fished???
-            const credential = await getCredentialForUser.execute(
-                params.data.credential_id,
-                userId
-            );
-
-            if (!credential) {
-                throw Boom.badRequest('Invalid credential ID');
-            }
-
-            const module = await getModuleInstanceFromType.execute(
-                userId,
-                params.entityType
-            );
-            const entityDetails = await module.getEntityDetails(
-                module.api,
-                null,
-                null,
-                userId
+            // The owner follows the entity type's scope, as /api/authorize.
+            res.json(
+                await createEntityFromCredential.execute({
+                    user,
+                    entityType: params.entityType,
+                    credentialId: params.data.credential_id,
+                })
             );
-
-            res.json(await module.findOrCreateEntity(entityDetails));
         })
     );
 

package/integrations/repositories/integration-repository-documentdb.js

@@ -40,7 +40,8 @@ class IntegrationRepositoryDocumentDB extends IntegrationRepositoryInterface {
      */
     async findIntegrationsByOwnership(clauses) {
         if (!Array.isArray(clauses) || clauses.length === 0) return [];
-        const records = await findMany(this.prisma, 'Integration', {
+        // Drained: a list can hold more than the first cursor batch (~101).
+        const records = await findManyDrained(this.prisma, 'Integration', {
             $or: clauses.map(({ userId, organizationId }) => ({
                 userId: toObjectId(userId),
                 organizationId:

package/integrations/utils/map-integration-dto.js

@@ -19,5 +19,48 @@ function mapIntegrationClassToIntegrationDTO(integration) {
     };
 }
 
+let deprecationLogged = false;
 
-module.exports = { mapIntegrationClassToIntegrationDTO };
+/**
+ * @deprecated Since ADR-059. Read `entityTypeRegistry` / `moduleDefinitions`
+ * from `loadAppDefinition()`, or call `getEntityTypeRegistry(appDefinition)`
+ * and read each entry's `definition`.
+ *
+ * Kept as a wrapper over the entity type registry so callers that imported it
+ * keep working. It returns the registry's definitions, so it follows the
+ * registry's rules: one definition per entity type name (the first wins when
+ * two integrations bind different definitions under one name, as
+ * ModuleFactory already picked), and, when `entities` is passed, registry-only
+ * types are included and conflicts throw `EntityRegistryError`.
+ *
+ * @param {Array<Function>} integrationClasses - integration classes
+ * @param {Object} [entities] - `appDefinition.entities` (ADR-059)
+ * @returns {Array<Object>} API module definitions
+ */
+function getModulesDefinitionFromIntegrationClasses(
+    integrationClasses,
+    entities
+) {
+    // Required here, not at the top: modules/ must not load at require time
+    // of every integration use case that only wants the DTO mapper.
+    const {
+        getEntityTypeRegistry,
+        getEntityTypeDefinitions,
+    } = require('../../modules/entity-type-registry');
+    if (!deprecationLogged) {
+        deprecationLogged = true;
+        const { getLogger } = require('../../logs');
+        getLogger('frigg.integrations').warn(
+            'getModulesDefinitionFromIntegrationClasses is deprecated; use getEntityTypeRegistry (ADR-059)',
+            { eventName: 'frigg.integrations.deprecated_module_definitions' }
+        );
+    }
+    return getEntityTypeDefinitions(
+        getEntityTypeRegistry({ integrations: integrationClasses, entities })
+    );
+}
+
+module.exports = {
+    mapIntegrationClassToIntegrationDTO,
+    getModulesDefinitionFromIntegrationClasses,
+};

package/management-api/management-api-config.js

@@ -9,7 +9,6 @@
  *         timeoutMs: 25000,   // whole upstream call, lower only
  *         maxRequestBytes: 1048576,
  *         maxResponseBytes: 5242880, // lower only
- *         scopes: ['individual'], // entity scopes the proxy accepts (ADR-056 §3.5)
  *         modules: {          // per-module allow-list override
  *             hubspot: { allow: 'module' },
  *             erp: { allow: [{ method: 'GET', path: '/v1/customers/**' }] },
@@ -18,36 +17,10 @@
  * }
  * ```
  *
- * Limits that are out of range fall back to their defaults. `proxy.scopes` is a
- * security setting, so it does not fall back: a value that is not a list of
- * known tenant scopes throws ManagementApiConfigError, and loadAppDefinition
- * calls this so the app stops at load.
+ * TODO(F6): `proxy.scopes` (ADR-056 §3.5) is not read yet; see
+ * ExecuteEntityProxyRequest.
  */
 
-const { BaseError } = require('../errors/base-error');
-const { SCOPES } = require('../modules/scope-resolution');
-
-/** Raised for an invalid `appDefinition.managementApi` setting. */
-class ManagementApiConfigError extends BaseError {
-    constructor(message, options) {
-        super(message, options);
-        this.code = 'MANAGEMENT_API_CONFIG_INVALID';
-    }
-}
-
-/**
- * The scopes `managementApi.proxy.scopes` may list. `global` is not one of
- * them: a global entity is the app owner's and is never a tenant's to proxy.
- */
-const PROXY_SCOPE_VALUES = Object.freeze([SCOPES.INDIVIDUAL, SCOPES.ORGANIZATION]);
-
-/**
- * Narrowest by default (ADR-056 §3.5): proxying through a shared credential
- * lets any member act on the organization's account, so an app opts in to
- * `organization` explicitly.
- */
-const DEFAULT_PROXY_SCOPES = Object.freeze([SCOPES.INDIVIDUAL]);
-
 // ADR-052 §7. API Gateway HTTP APIs time out at 30s and Lambda responses cap
 // at 6MB, so the timeout and response defaults are also ceilings: an app may
 // lower them, not raise them.
@@ -74,41 +47,9 @@ function positiveOr(value, fallback, ceiling) {
     return isPositiveNumber(value) ? Math.min(value, ceiling) : fallback;
 }
 
-const proxyScopesError = (message) =>
-    new ManagementApiConfigError(`managementApi.proxy.scopes: ${message}`);
-
-/**
- * `managementApi.proxy.scopes`: absent means the default; anything else must be
- * a non-empty list of PROXY_SCOPE_VALUES, each once.
- * @returns {ReadonlyArray<string>}
- * @throws {ManagementApiConfigError}
- */
-function resolveProxyScopes(scopes) {
-    if (scopes === undefined) return DEFAULT_PROXY_SCOPES;
-    const allowed = PROXY_SCOPE_VALUES.join(', ');
-    if (!Array.isArray(scopes) || scopes.length === 0) {
-        throw proxyScopesError(`must be a non-empty list drawn from ${allowed}`);
-    }
-    for (const scope of scopes) {
-        if (scope === SCOPES.GLOBAL) {
-            throw proxyScopesError(
-                "'global' is not allowed: global entities belong to the app owner and are never proxied for a tenant"
-            );
-        }
-        if (!PROXY_SCOPE_VALUES.includes(scope)) {
-            throw proxyScopesError(`unknown scope ${JSON.stringify(scope)}; use ${allowed}`);
-        }
-    }
-    if (new Set(scopes).size !== scopes.length) {
-        throw proxyScopesError('lists a scope more than once');
-    }
-    return Object.freeze([...scopes]);
-}
-
 /**
  * @param {Object} [managementApi] - `appDefinition.managementApi`
- * @returns {{ v1: boolean, proxy: { enable: boolean, timeoutMs: number, maxRequestBytes: number, maxResponseBytes: number, scopes: ReadonlyArray<string>, modules: Object } }}
- * @throws {ManagementApiConfigError} for an invalid `proxy.scopes`
+ * @returns {{ v1: boolean, proxy: { enable: boolean, timeoutMs: number, maxRequestBytes: number, maxResponseBytes: number, modules: Object } }}
  */
 function resolveManagementApiConfig(managementApi) {
     const config =
@@ -133,7 +74,6 @@ function resolveManagementApiConfig(managementApi) {
                 proxy.maxResponseBytes,
                 DEFAULT_PROXY_LIMITS.maxResponseBytes
             ),
-            scopes: resolveProxyScopes(proxy.scopes),
             modules:
                 proxy.modules && typeof proxy.modules === 'object'
                     ? proxy.modules
@@ -142,10 +82,4 @@ function resolveManagementApiConfig(managementApi) {
     };
 }
 
-module.exports = {
-    resolveManagementApiConfig,
-    DEFAULT_PROXY_LIMITS,
-    DEFAULT_PROXY_SCOPES,
-    PROXY_SCOPE_VALUES,
-    ManagementApiConfigError,
-};
+module.exports = { resolveManagementApiConfig, DEFAULT_PROXY_LIMITS };

package/management-api/openapi/components.js

@@ -206,7 +206,6 @@ const SCHEMAS = {
             authIsValid: nullable({ type: 'boolean' }),
             entityIds: { type: 'array', items: { type: 'string' } },
             entityCount: { type: 'integer', minimum: 0 },
-            ...tenancyProperties,
             createdAt: nullable({ type: 'string', format: 'date-time' }),
             updatedAt: nullable({ type: 'string', format: 'date-time' }),
             data: {