@friggframework/core 2.0.0--canary.685.a13fdab.0 → 2.0.0--canary.679.a2bcc2f.0

package/integrations/use-cases/get-integrations-for-user.js

@@ -2,17 +2,9 @@
 const {
     mapIntegrationClassToIntegrationDTO,
 } = require('../utils/map-integration-dto');
-const {
-    describeRecord,
-    visibilityClauses,
-    matchesListFilters,
-} = require('../../modules/scope-visibility');
-const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
 
 /**
- * Use case for retrieving the integrations a caller may see: the ones they own
- * or their active organization owns, created in that organization (ADR-056
- * §3.6), each with `tenancy` ({scope, owner, organizationId, access}).
+ * Use case for retrieving all integrations for a specific user.
  * @class GetIntegrationsForUser
  */
 class GetIntegrationsForUser {
@@ -23,16 +15,13 @@ class GetIntegrationsForUser {
      * @param {Array<import('../integration').Integration>} params.integrationClasses - Array of available integration classes.
      * @param {import('../../modules/module-factory').ModuleFactory} params.moduleFactory - Service for module instantiation and management.
      * @param {import('../../modules/repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository - Repository for module and entity data operations.
-     * @param {Object} [params.scopePolicy] - from createScopePolicy
      */
     constructor({
         integrationRepository,
         integrationClasses,
         moduleFactory,
         moduleRepository,
-        scopePolicy,
     }) {
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
         /**
          * @type {import('../repositories/integration-repository-interface').IntegrationRepositoryInterface}
          */
@@ -43,86 +32,57 @@ class GetIntegrationsForUser {
     }
 
     /**
+     * Executes the retrieval of all integrations for a user.
      * @async
-     * @param {Object} user - authenticated User
-     * @param {{scope?: string, owner?: string}} [filters] - `?scope=` and `?owner=`
-     * @returns {Promise<Object[]>} Array of integration DTOs.
+     * @param {string} userId - ID of the user whose integrations to retrieve.
+     * @returns {Promise<Object[]>} Array of integration DTOs for the specified user.
      */
-    async execute(user, filters = {}) {
-        const ctx = this.scopePolicy.accessContext(user);
-        const records = await this.integrationRepository.findIntegrationsByOwnership(
-            visibilityClauses(ctx, 'integration')
-        );
+    async execute(userId) {
+        const integrationRecords =
+            await this.integrationRepository.findIntegrationsByUserId(userId);
 
         const integrations = [];
-        for (const record of records) {
-            // The query is the filter; the same rule again means a repository
-            // that returns too much cannot widen the list.
-            const tenancy = describeRecord(record, ctx, 'integration');
-            if (!tenancy || !matchesListFilters(tenancy, filters)) continue;
-            integrations.push({ ...(await this.toDto(record)), tenancy });
-        }
-        return integrations;
-    }
 
-    /** Hydrates one stored integration record into its DTO. */
-    async toDto(integrationRecord) {
-        const entities = await this.moduleRepository.findEntitiesByIds(
-            integrationRecord.entitiesIds
-        );
-
-        const integrationClass = this.integrationClasses.find(
-            (integrationClass) =>
-                integrationClass.Definition.name ===
-                integrationRecord.config.type
-        );
+        for (const integrationRecord of integrationRecords) {
+            const entities = await this.moduleRepository.findEntitiesByIds(
+                integrationRecord.entitiesIds
+            );
 
-        const modules = [];
-        for (const entity of entities) {
-            const moduleInstance = await this.moduleFactory.getModuleInstance(
-                entity.id,
-                integrationRecord.userId
+            const integrationClass = this.integrationClasses.find(
+                (integrationClass) =>
+                    integrationClass.Definition.name ===
+                    integrationRecord.config.type
             );
-            modules.push(moduleInstance);
-        }
 
-        return mapIntegrationClassToIntegrationDTO({
-            id: integrationRecord.id,
-            userId: integrationRecord.userId,
-            entities: entities,
-            config: integrationRecord.config,
-            status: integrationRecord.status,
-            version: integrationRecord.version,
-            messages: integrationRecord.messages || { errors: [], warnings: [] },
-            modules,
-            options: integrationClass.getOptionDetails(),
-        });
-    }
-}
+            const modules = [];
+            for (const entity of entities) {
+                const moduleInstance =
+                    await this.moduleFactory.getModuleInstance(
+                        entity.id,
+                        integrationRecord.userId
+                    );
+                modules.push(moduleInstance);
+            }
 
-/**
- * Every integration one user id owns, with no organization rules: the lookup
- * behind the app-level `friggCommands.findIntegrationsByUserId`, which has a
- * user id and no request.
- */
-class GetIntegrationsByUserId {
-    /** @param {ConstructorParameters<typeof GetIntegrationsForUser>[0]} params */
-    constructor(params) {
-        this.integrationRepository = params.integrationRepository;
-        this.hydrator = new GetIntegrationsForUser(params);
-    }
+            const integrationData = {
+                id: integrationRecord.id,
+                userId: integrationRecord.userId,
+                entities: entities,
+                config: integrationRecord.config,
+                status: integrationRecord.status,
+                version: integrationRecord.version,
+                messages: integrationRecord.messages || { errors: [], warnings: [] },
+                modules,
+                options: integrationClass.getOptionDetails(),
+            };
 
-    /** @param {string} userId */
-    async execute(userId) {
-        const records = await this.integrationRepository.findIntegrationsByUserId(
-            userId
-        );
-        const integrations = [];
-        for (const record of records) {
-            integrations.push(await this.hydrator.toDto(record));
+            integrations.push(
+                mapIntegrationClassToIntegrationDTO(integrationData)
+            );
         }
+
         return integrations;
     }
 }
 
-module.exports = { GetIntegrationsForUser, GetIntegrationsByUserId };
+module.exports = { GetIntegrationsForUser };

package/integrations/use-cases/index.js

@@ -1,7 +1,4 @@
-const {
-    GetIntegrationsForUser,
-    GetIntegrationsByUserId,
-} = require('./get-integrations-for-user');
+const { GetIntegrationsForUser } = require('./get-integrations-for-user');
 const { DeleteIntegrationForUser } = require('./delete-integration-for-user');
 const { CreateIntegration } = require('./create-integration');
 const { GetIntegration } = require('./get-integration');
@@ -12,7 +9,6 @@ const { GetProcess } = require('./get-process');
 
 module.exports = {
     GetIntegrationsForUser,
-    GetIntegrationsByUserId,
     DeleteIntegrationForUser,
     CreateIntegration,
     GetIntegration,

package/integrations/use-cases/integration-operations-for-user.js

@@ -1,15 +1,11 @@
 const Boom = require('@hapi/boom');
-const { describeRecord } = require('../../modules/scope-visibility');
-const { DEFAULT_SCOPE_POLICY } = require('../../modules/scope-policy');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
-const { isIntegrationNotFound } = require('../repositories/integration-not-found');
+const { userOwns } = require('../../modules/use-cases/get-entity-module-for-user');
 
 /**
- * Management API v2 integration operations. They put an access check
- * (missing or unavailable integration = 404) in front of the existing
- * integration use cases, and pass the record's owner id on. Access follows
- * the owner and the organization the integration was created in (ADR-056
- * §3.6), not the owner alone.
+ * Management API v2 integration operations. They put an ownership check
+ * (missing or foreign integration = 404) in front of the existing
+ * integration use cases, and pass the record's owner id on, so the
+ * organisation user model works the same as for entities.
  */
 
 const notFound = (integrationId) =>
@@ -17,61 +13,40 @@ const notFound = (integrationId) =>
         code: 'INTEGRATION_NOT_FOUND',
     });
 
-/**
- * The integration record, or 404 when it is missing or the caller may not
- * use it: not theirs or their active organization's, or created in another
- * organization.
- */
+/** The integration record, or 404 when it is missing or not the caller's. */
 class GetOwnedIntegrationRecord {
-    constructor({ integrationRepository, scopePolicy }) {
+    constructor({ integrationRepository }) {
         this.integrationRepository = integrationRepository;
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
     }
 
-    /** `{ scope, owner, organizationId, access }` of a record to this caller, or null. */
-    describe(record, user) {
-        return describeRecord(record, this.scopePolicy.accessContext(user), 'integration');
-    }
-
-    /**
-     * @param {string} integrationId
-     * @param {Object} user - authenticated User
-     * @param {{manage?: boolean}} [options] - `manage: true` for changing or
-     *   deleting: a person may use an organization's integration but only an
-     *   admin may change it (403 ORG_ADMIN_REQUIRED)
-     */
-    async execute(integrationId, user, { manage = false } = {}) {
+    async execute(integrationId, user) {
         let record = null;
         try {
             record = await this.integrationRepository.findIntegrationById(
                 integrationId
             );
         } catch (error) {
-            if (
-                /Invalid ID|ObjectId|Malformed/i.test(error?.message || '') ||
-                isIntegrationNotFound(error)
-            ) {
+            if (/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
                 throw notFound(integrationId);
             }
             throw error;
         }
-        const tenancy = record && this.describe(record, user);
-        if (!tenancy) throw notFound(integrationId);
-        if (manage) assertCanManage(tenancy.access, `integration ${integrationId}`);
+        if (!record || !userOwns(user, record.userId)) {
+            throw notFound(integrationId);
+        }
         return record;
     }
 }
 
 /**
- * Creates (or reuses) an integration between entities the caller may use.
- * The entities' access, the binding scopes and the integration type are
- * checked before anything is written, and the integration is owned and
- * paired with an organization by `resolveIntegrationOwnership` (§3, §3.6).
+ * Creates (or reuses) an integration between entities the caller owns.
+ * Unlike v1, the entities' ownership and the integration type are checked
+ * before anything is written.
  */
 class CreateIntegrationForUser {
-    constructor({ createIntegration, resolveIntegrationOwnership, integrationClasses }) {
+    constructor({ createIntegration, getEntityModuleForUser, integrationClasses }) {
         this.createIntegration = createIntegration;
-        this.resolveIntegrationOwnership = resolveIntegrationOwnership;
+        this.getEntityModuleForUser = getEntityModuleForUser;
         this.integrationClasses = integrationClasses || [];
     }
 
@@ -99,17 +74,13 @@ class CreateIntegrationForUser {
                 details: { field: 'entities' },
             });
         }
-        const { ownerId, organizationId, adoptUnscoped } =
-            await this.resolveIntegrationOwnership.execute({
-                entityIds: entities,
-                config,
-                user,
-            });
+        for (const entityId of entities) {
+            await this.getEntityModuleForUser.loadOwnedEntity(String(entityId), user);
+        }
         return this.createIntegration.execute(
             entities.map(String),
-            ownerId,
-            config,
-            { organizationId, adoptUnscoped }
+            user.getId(),
+            config
         );
     }
 }
@@ -146,8 +117,7 @@ class UpdateIntegrationForUser {
         }
         const record = await this.getOwnedIntegrationRecord.execute(
             integrationId,
-            user,
-            { manage: true }
+            user
         );
         return this.updateIntegration.execute(record.id, record.userId, config);
     }
@@ -163,8 +133,7 @@ class RemoveIntegrationForUser {
     async execute(integrationId, user) {
         const record = await this.getOwnedIntegrationRecord.execute(
             integrationId,
-            user,
-            { manage: true }
+            user
         );
         await this.deleteIntegrationForUser.execute(record.id, record.userId);
     }

package/management-api/management-api-config.js

@@ -9,7 +9,6 @@
  *         timeoutMs: 25000,   // whole upstream call, lower only
  *         maxRequestBytes: 1048576,
  *         maxResponseBytes: 5242880, // lower only
- *         scopes: ['individual'], // entity scopes the proxy accepts (ADR-056 §3.5)
  *         modules: {          // per-module allow-list override
  *             hubspot: { allow: 'module' },
  *             erp: { allow: [{ method: 'GET', path: '/v1/customers/**' }] },
@@ -17,36 +16,7 @@
  *     },
  * }
  * ```
- *
- * Limits that are out of range fall back to their defaults. `proxy.scopes` is a
- * security setting, so it does not fall back: a value that is not a list of
- * known tenant scopes throws ManagementApiConfigError, and loadAppDefinition
- * calls this so the app stops at load.
- */
-
-const { BaseError } = require('../errors/base-error');
-const { SCOPES } = require('../modules/scope-resolution');
-
-/** Raised for an invalid `appDefinition.managementApi` setting. */
-class ManagementApiConfigError extends BaseError {
-    constructor(message, options) {
-        super(message, options);
-        this.code = 'MANAGEMENT_API_CONFIG_INVALID';
-    }
-}
-
-/**
- * The scopes `managementApi.proxy.scopes` may list. `global` is not one of
- * them: a global entity is the app owner's and is never a tenant's to proxy.
  */
-const PROXY_SCOPE_VALUES = Object.freeze([SCOPES.INDIVIDUAL, SCOPES.ORGANIZATION]);
-
-/**
- * Narrowest by default (ADR-056 §3.5): proxying through a shared credential
- * lets any member act on the organization's account, so an app opts in to
- * `organization` explicitly.
- */
-const DEFAULT_PROXY_SCOPES = Object.freeze([SCOPES.INDIVIDUAL]);
 
 // ADR-052 §7. API Gateway HTTP APIs time out at 30s and Lambda responses cap
 // at 6MB, so the timeout and response defaults are also ceilings: an app may
@@ -74,41 +44,9 @@ function positiveOr(value, fallback, ceiling) {
     return isPositiveNumber(value) ? Math.min(value, ceiling) : fallback;
 }
 
-const proxyScopesError = (message) =>
-    new ManagementApiConfigError(`managementApi.proxy.scopes: ${message}`);
-
-/**
- * `managementApi.proxy.scopes`: absent means the default; anything else must be
- * a non-empty list of PROXY_SCOPE_VALUES, each once.
- * @returns {ReadonlyArray<string>}
- * @throws {ManagementApiConfigError}
- */
-function resolveProxyScopes(scopes) {
-    if (scopes === undefined) return DEFAULT_PROXY_SCOPES;
-    const allowed = PROXY_SCOPE_VALUES.join(', ');
-    if (!Array.isArray(scopes) || scopes.length === 0) {
-        throw proxyScopesError(`must be a non-empty list drawn from ${allowed}`);
-    }
-    for (const scope of scopes) {
-        if (scope === SCOPES.GLOBAL) {
-            throw proxyScopesError(
-                "'global' is not allowed: global entities belong to the app owner and are never proxied for a tenant"
-            );
-        }
-        if (!PROXY_SCOPE_VALUES.includes(scope)) {
-            throw proxyScopesError(`unknown scope ${JSON.stringify(scope)}; use ${allowed}`);
-        }
-    }
-    if (new Set(scopes).size !== scopes.length) {
-        throw proxyScopesError('lists a scope more than once');
-    }
-    return Object.freeze([...scopes]);
-}
-
 /**
  * @param {Object} [managementApi] - `appDefinition.managementApi`
- * @returns {{ v1: boolean, proxy: { enable: boolean, timeoutMs: number, maxRequestBytes: number, maxResponseBytes: number, scopes: ReadonlyArray<string>, modules: Object } }}
- * @throws {ManagementApiConfigError} for an invalid `proxy.scopes`
+ * @returns {{ v1: boolean, proxy: { enable: boolean, timeoutMs: number, maxRequestBytes: number, maxResponseBytes: number, modules: Object } }}
  */
 function resolveManagementApiConfig(managementApi) {
     const config =
@@ -133,7 +71,6 @@ function resolveManagementApiConfig(managementApi) {
                 proxy.maxResponseBytes,
                 DEFAULT_PROXY_LIMITS.maxResponseBytes
             ),
-            scopes: resolveProxyScopes(proxy.scopes),
             modules:
                 proxy.modules && typeof proxy.modules === 'object'
                     ? proxy.modules
@@ -142,10 +79,4 @@ function resolveManagementApiConfig(managementApi) {
     };
 }
 
-module.exports = {
-    resolveManagementApiConfig,
-    DEFAULT_PROXY_LIMITS,
-    DEFAULT_PROXY_SCOPES,
-    PROXY_SCOPE_VALUES,
-    ManagementApiConfigError,
-};
+module.exports = { resolveManagementApiConfig, DEFAULT_PROXY_LIMITS };

package/management-api/openapi/components.js

@@ -8,27 +8,6 @@ const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
 
 const nullable = (schema) => ({ ...schema, nullable: true });
 
-// Whose a record is and what the caller may do with it (ADR-056 §3.4). Added to
-// entities, credentials and integrations by the list and get use cases.
-const tenancyProperties = {
-    scope: { type: 'string', enum: ['individual', 'organization'], description: 'Whose it is. `global` records are not shown to tenants.' },
-    owner: {
-        type: 'object',
-        properties: { type: { type: 'string', enum: ['individual', 'organization'] }, id: { type: 'string' } },
-        description: "The user that owns it: the person, or the organization's user",
-    },
-    organizationId: nullable({
-        type: 'string',
-        description:
-            'The organization it belongs to. Null for an individual entity connected outside an organization, or under ownership.individualAcross "all".',
-    }),
-    access: {
-        type: 'string',
-        enum: ['manage', 'use', 'view'],
-        description: 'manage (create, reauthorize, delete), use (bind it, proxy through it) or view (metadata only)',
-    },
-};
-
 const errorBody = {
     type: 'object',
     required: ['error'],
@@ -90,7 +69,6 @@ const SCHEMAS = {
             config: { type: 'object', additionalProperties: true },
             version: nullable({ type: 'string' }),
             messages: { type: 'object', additionalProperties: true },
-            ...tenancyProperties,
         },
     },
     ListIntegrationsResponse: {
@@ -151,7 +129,6 @@ const SCHEMAS = {
             credentialId: nullable({ type: 'string' }),
             userId: nullable({ type: 'string' }),
             authIsValid: nullable({ type: 'boolean' }),
-            ...tenancyProperties,
         },
     },
     ListEntitiesResponse: {
@@ -176,16 +153,6 @@ const SCHEMAS = {
             isMultiStep: { type: 'boolean' },
             stepCount: { type: 'integer', minimum: 1 },
             capabilities: {},
-            scope: {
-                type: 'object',
-                description:
-                    'The scope a new connection of this type gets and the scopes a request may choose (ADR-056 §3.1). `global` is never offered.',
-                properties: {
-                    default: { type: 'string', enum: ['individual', 'organization', 'global'] },
-                    allow: { type: 'array', items: { type: 'string', enum: ['individual', 'organization'] } },
-                    source: { type: 'string', enum: ['binding', 'integration', 'entityType', 'app', 'default'] },
-                },
-            },
         },
     },
     ListEntityTypesResponse: {
@@ -206,7 +173,6 @@ const SCHEMAS = {
             authIsValid: nullable({ type: 'boolean' }),
             entityIds: { type: 'array', items: { type: 'string' } },
             entityCount: { type: 'integer', minimum: 0 },
-            ...tenancyProperties,
             createdAt: nullable({ type: 'string', format: 'date-time' }),
             updatedAt: nullable({ type: 'string', format: 'date-time' }),
             data: {
@@ -231,12 +197,6 @@ const SCHEMAS = {
             data: { type: 'object', additionalProperties: true, description: 'OAuth callback params or step form data' },
             step: { type: 'integer', minimum: 1, default: 1 },
             sessionId: { type: 'string', description: 'Required for step 2 and later' },
-            scope: {
-                type: 'string',
-                enum: ['individual', 'organization'],
-                description:
-                    "The scope to connect at, from the entity type's allow list (ADR-056 §3.1). Omit to take the type's default. `global` is refused (403).",
-            },
         },
     },
     ReauthorizeRequest: {

package/management-api/openapi/v2-operations.js

@@ -34,11 +34,6 @@ const stepQuery = [
     query('step', 'Step number, 1-based (default 1)', { type: 'integer', minimum: 1 }),
     query('sessionId', 'Session from step 1; required for later steps'),
 ];
-// ADR-056 §3.4: the same two filters on every list that mixes ownership.
-const listFilters = [
-    query('scope', 'Only records of this scope', { type: 'string', enum: ['individual', 'organization'] }),
-    query('owner', 'Only the caller\'s own (`me`) or the active organization\'s (`org`)', { type: 'string', enum: ['me', 'org'] }),
-];
 const anyJson = { description: 'Defined by the integration or module' };
 
 const V2_OPERATIONS = {
@@ -46,8 +41,7 @@ const V2_OPERATIONS = {
     listIntegrations: {
         summary: "List the caller's integrations",
         description:
-            'Returns only `{ integrations }`: the caller\'s and the active organization\'s, created in that organization (ADR-056 §3.6). Each carries `scope`, `owner`, `organizationId` and `access`. Integration types are at /api/v2/integrations/options and connected accounts at /api/v2/entities.',
-        parameters: listFilters,
+            'Returns only `{ integrations }`. Integration types are at /api/v2/integrations/options and connected accounts at /api/v2/entities.',
         responses: { 200: ok('Integrations', ref('ListIntegrationsResponse')), ...errors('Unauthorized') },
     },
     listIntegrationOptions: {
@@ -114,9 +108,6 @@ const V2_OPERATIONS = {
     // Entities
     listEntities: {
         summary: "List the caller's connected entities",
-        description:
-            "The active organization's entities and the caller's individual ones (ADR-056 §3.6): an individual entity belongs to the organization it was connected in, unless `ownership.individualAcross` is `all`. Each carries `scope`, `owner`, `organizationId` and `access`.",
-        parameters: listFilters,
         responses: { 200: ok('Entities', ref('ListEntitiesResponse')), ...errors('Unauthorized') },
     },
     listEntityTypes: {
@@ -165,14 +156,14 @@ const V2_OPERATIONS = {
     proxyEntityRequest: {
         summary: "Call the entity's API through Frigg (beta)",
         description:
-            "ADR-052. Off unless the app sets managementApi.proxy.enable. Path-only input relative to the module's base URL; deny by default, only operations in the module's (or the app's) allow-list. ADR-056 §3.5: the caller needs use access to the entity in the active organization (an entity they cannot see there is 404), and the entity's scope must be in managementApi.proxy.scopes (default individual only; 403 PROXY_NOT_ALLOWED with details.reason 'scope', or 'access' for view-only access). The HTTP status follows the upstream status; upstream 5xx is 502 UPSTREAM_ERROR, 429 keeps Retry-After.",
+            "ADR-052. Off unless the app sets managementApi.proxy.enable. Path-only input relative to the module's base URL; deny by default, only operations in the module's (or the app's) allow-list. The HTTP status follows the upstream status; upstream 5xx is 502 UPSTREAM_ERROR, 429 keeps Retry-After.",
         requestBody: body(ref('ProxyRequest')),
         responses: {
             200: ok('Upstream answer (the status mirrors the upstream status)', ref('ProxyResponse')),
             400: ok('INVALID_PROXY_REQUEST', ref('ProxyError')),
             401: ok('INVALID_CREDENTIALS or unauthenticated', ref('ProxyError')),
-            403: ok("PROXY_NOT_ALLOWED: not in the allow-list, or details.reason 'scope' / 'access'", ref('ProxyError')),
-            404: ok('Entity not found, or not visible in the active organization', ref('Error')),
+            403: ok('PROXY_NOT_ALLOWED', ref('ProxyError')),
+            404: ok('Entity not found', ref('Error')),
             413: ok('PAYLOAD_TOO_LARGE', ref('ProxyError')),
             415: ok('UNSUPPORTED_MEDIA_TYPE', ref('ProxyError')),
             429: ok('RATE_LIMITED (Retry-After passed through)', ref('ProxyError')),
@@ -184,9 +175,6 @@ const V2_OPERATIONS = {
     // Credentials
     listCredentials: {
         summary: "List the caller's credentials (masked)",
-        description:
-            'A credential is listed through the entities that use it that the caller may see, so each organization lists only its own connections; one no entity uses is listed to its owner. Each carries `scope`, `owner`, `organizationId` and `access`, taken from who owns the credential.',
-        parameters: listFilters,
         responses: { 200: ok('Credentials', ref('ListCredentialsResponse')), ...errors('Unauthorized') },
     },
     getCredential: {