@friggframework/core 2.0.0--canary.685.a13fdab.0 → 2.0.0--canary.679.a2bcc2f.0

package/prisma-mongodb/schema.prisma

@@ -56,14 +56,6 @@ model User {
   integrations Integration[]
   processes    Process[]
 
-  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
-  // single-org pointer: set on a person's first link, never moved afterwards, and
-  // read as an implicit membership when no row exists for it.
-  // As an individual: the organizations this person belongs to.
-  memberships OrganizationMembership[] @relation("IndividualMemberships")
-  // As an organization: the people who belong to it.
-  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
-
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -134,14 +126,6 @@ model Entity {
   moduleName   String?
   externalId   String?
 
-  // Organization this entity was connected in (ADR-056 §3.6): the active
-  // organization for `individual`, the owner for `organization`, null for
-  // `global`. Null on an `individual` entity is also what every row written
-  // before this column existed has, and what `individualAcross: 'all'` writes.
-  // Deliberately not a relation: a deleted organization must leave its rows
-  // invisible, not turn them into "unscoped" ones (SetNull would do that).
-  organizationId String? @db.ObjectId
-
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -158,7 +142,6 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -176,11 +159,6 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
-  // Organization this integration was created in (ADR-056 §3.6): the active
-  // organization at create time. Null for rows that predate the column. Not a
-  // relation, for the same reason as Entity.organizationId.
-  organizationId String? @db.ObjectId
-
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -205,7 +183,6 @@ model Integration {
   processes    Process[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([status])
   @@map("Integration")
 }
@@ -503,27 +480,3 @@ model AuthorizationSession {
   @@index([expiresAt])
   @@map("AuthorizationSession")
 }
-
-// ============================================================================
-// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
-// ============================================================================
-
-/// One person's membership of one organization. Unique on the pair, so adding a
-/// membership is an idempotent upsert. `orgRole` is the organization role the
-/// adopter token carried when the membership was created (MEMBER when it named none). NoAction on delete
-/// because MongoDB gives no referential integrity: delete a user's memberships
-/// before the user.
-model OrganizationMembership {
-  id                 String   @id @default(auto()) @map("_id") @db.ObjectId
-  individualUserId   String   @db.ObjectId
-  organizationUserId String   @db.ObjectId
-  orgRole            String   @default("MEMBER")
-  createdAt          DateTime @default(now())
-
-  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
-  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
-
-  @@unique([individualUserId, organizationUserId])
-  @@index([organizationUserId])
-  @@map("OrganizationMembership")
-}

package/prisma-postgresql/schema.prisma

@@ -56,14 +56,6 @@ model User {
   integrations Integration[]
   processes    Process[]
 
-  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
-  // single-org pointer: set on a person's first link, never moved afterwards, and
-  // read as an implicit membership when no row exists for it.
-  // As an individual: the organizations this person belongs to.
-  memberships OrganizationMembership[] @relation("IndividualMemberships")
-  // As an organization: the people who belong to it.
-  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
-
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -131,14 +123,6 @@ model Entity {
   moduleName   String?
   externalId   String?
 
-  // Organization this entity was connected in (ADR-056 §3.6): the active
-  // organization for `individual`, the owner for `organization`, null for
-  // `global`. Null on an `individual` entity is also what every row written
-  // before this column existed has, and what `individualAcross: 'all'` writes.
-  // Deliberately not a relation: a deleted organization must leave its rows
-  // invisible, not turn them into "unscoped" ones (SetNull would do that).
-  organizationId Int?
-
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -152,7 +136,6 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -169,11 +152,6 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
-  // Organization this integration was created in (ADR-056 §3.6): the active
-  // organization at create time. Null for rows that predate the column. Not a
-  // relation, for the same reason as Entity.organizationId.
-  organizationId Int?
-
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -197,7 +175,6 @@ model Integration {
   processes    Process[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([status])
 }
 
@@ -483,24 +460,3 @@ model AuthorizationSession {
   @@index([userId, entityType])
   @@index([expiresAt])
 }
-
-// ============================================================================
-// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
-// ============================================================================
-
-/// One person's membership of one organization. Unique on the pair, so adding a
-/// membership is an idempotent upsert. `orgRole` is the organization role the
-/// adopter token carried when the membership was created (MEMBER when it named none).
-model OrganizationMembership {
-  id                 Int      @id @default(autoincrement())
-  individualUserId   Int
-  organizationUserId Int
-  orgRole            String   @default("MEMBER")
-  createdAt          DateTime @default(now())
-
-  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-
-  @@unique([individualUserId, organizationUserId])
-  @@index([organizationUserId])
-}

package/types/index.d.ts

@@ -12,5 +12,4 @@
 /// <reference path="./eslint-config/index.d.ts" />
 /// <reference path="./associations/index.d.ts" />
 /// <reference path="./syncs/index.d.ts" />
-/// <reference path="./user/index.d.ts" />
 /// <reference path="./modules/index.d.ts" />

package/types/modules/index.d.ts

@@ -36,137 +36,13 @@ declare module "@friggframework/core" {
     [entityType: string]: EntityRegistration | boolean | undefined;
   }
 
-  /**
-   * One level's setting: a scope, or a default plus the scopes a request may
-   * choose from (ADR-056 §3.1). `global` is never chosen by a tenant request.
-   */
-  export type ScopeSetting =
-    | EntityScope
-    | { default?: EntityScope; allow?: EntityScope[] };
-
-  /**
-   * `appDefinition.ownership` (ADR-056 §3, §3.6). Resolution order for a new
-   * connection: request, binding, integration, entity type (`entities[name].scope`),
-   * this `scope`, then `organization` for an organization-primary app and
-   * `individual` otherwise.
-   */
-  export interface AppOwnership {
-    scope?: ScopeSetting;
-    /**
-     * `'organization'` (default): an individual entity belongs to the organization
-     * it was connected in. `'all'`: one connection per person across every
-     * organization, stored with no `organizationId`.
-     */
-    individualAcross?: "organization" | "all";
-  }
-
-  /** `Definition.ownership` on an integration (ADR-056 §3.1, §3.3). */
-  export interface IntegrationOwnership {
-    /** Scope every binding of this integration accepts unless it sets its own. */
-    scope?: ScopeSetting;
-    /** `'derive'` (default): organization when every entity it uses is organization-scoped. */
-    owner?: "derive" | "individual" | "organization";
-  }
-
-  /** One operation a module or the app lets the entity proxy forward (ADR-052). */
-  export interface ProxyAllowRule {
-    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "*";
-    /** Relative to the module's base URL. `:param` is one segment; a trailing `/**` is a subtree. */
-    path: string;
-  }
-
-  /** `appDefinition.managementApi.proxy`: the entity proxy, POST /api/v2/entities/:id/proxy (ADR-052). */
-  export interface ManagementApiProxyConfig {
-    /** Mount the route. Default false. */
-    enable?: boolean;
-    /** Upstream timeout in ms; can only be lowered from 25000. */
-    timeoutMs?: number;
-    /** Largest request body in bytes; default 1 MiB, at most 10 MiB. */
-    maxRequestBytes?: number;
-    /** Largest response body in bytes; can only be lowered from 5 MiB. */
-    maxResponseBytes?: number;
-    /**
-     * Entity scopes the proxy accepts (ADR-056 §3.5). Default `['individual']`.
-     * Add `'organization'` to let a member with use access proxy through the
-     * organization's shared credential. `global` is never accepted. An unknown,
-     * empty or repeated value throws ManagementApiConfigError at load.
-     */
-    scopes?: Array<Exclude<EntityScope, "global">>;
-    /** Per-module allow-list override; `'module'` uses the module's own list. */
-    modules?: Record<string, { allow: "module" | ProxyAllowRule[] }>;
-  }
-
-  /** `appDefinition.managementApi` (ADR-052, ADR-053). */
-  export interface ManagementApiConfig {
-    /** Serve the deprecated v1 routes. Default true. */
-    v1?: boolean;
-    proxy?: ManagementApiProxyConfig;
-  }
-
   export interface AppDefinition {
     integrations: any[];
     /** App-level entity type registry (ADR-059). */
     entities?: AppDefinitionEntities;
-    /** Who owns what a person connects (ADR-056). */
-    ownership?: AppOwnership;
-    /** Management API versions and the entity proxy (ADR-052, ADR-053, ADR-056 §3.5). */
-    managementApi?: ManagementApiConfig;
     [key: string]: unknown;
   }
 
-  /** Whose a record is and what the caller may do with it (ADR-056 §3.4). */
-  export interface RecordTenancy {
-    scope: Exclude<EntityScope, "global">;
-    owner: { type: Exclude<EntityScope, "global">; id: string };
-    /** Null for an individual entity connected outside an organization, or under `individualAcross: 'all'`. */
-    organizationId: string | null;
-    /** `manage`: create, reauthorize, delete. `use`: bind it, proxy through it. `view`: metadata only. */
-    access: "manage" | "use" | "view";
-  }
-
-  /** Which scope a connection gets, and from which level of the order (ADR-056 §3.1). */
-  export interface ResolvedScope {
-    scope: EntityScope;
-    /** Where `scope` came from. `request` when the request chose within the allowed list. */
-    source: "request" | "binding" | "integration" | "entityType" | "app" | "default";
-    /** The level that decided what a request may choose from. */
-    decidedBy: "binding" | "integration" | "entityType" | "app" | "default";
-    allow: EntityScope[];
-  }
-
-  /**
-   * First match wins, each level overriding the ones below it. A request may
-   * choose only from the deciding level's `allow`; `global` never comes from a
-   * tenant request. Throws a Boom 400/403 for a request scope that is not allowed.
-   */
-  export function resolveScope(levels: {
-    request?: EntityScope;
-    binding?: ScopeSetting;
-    integration?: ScopeSetting;
-    entityType?: ScopeSetting;
-    app?: ScopeSetting;
-    primary?: "individual" | "organization";
-  }): ResolvedScope;
-
-  /** Every binding of every integration with its resolved scope (for tooling that wants to show the chain). */
-  export function listBindingScopes(
-    appDefinition: Pick<AppDefinition, "integrations" | "ownership">,
-    entityTypeRegistry: EntityTypeRegistry,
-    primary?: "individual" | "organization"
-  ): Array<{
-    integration: string;
-    binding: string;
-    moduleName: string | null;
-    scope: EntityScope;
-    source: ResolvedScope["source"];
-    owner: "derive" | "individual" | "organization";
-  }>;
-
-  /** Invalid ownership or scope setting, thrown at app-definition load. `code` is always `OWNERSHIP_CONFIG_INVALID`. */
-  export class OwnershipConfigError extends Error {
-    code: "OWNERSHIP_CONFIG_INVALID";
-  }
-
   /**
    * Builds the registry from `entities` plus the modules integrations bind.
    * Throws EntityRegistryError on an invalid registry.
@@ -175,11 +51,6 @@ declare module "@friggframework/core" {
     appDefinition?: Pick<AppDefinition, "entities" | "integrations">
   ): EntityTypeRegistry;
 
-  /** Invalid `managementApi` setting (today: `proxy.scopes`), thrown at app-definition load. */
-  export class ManagementApiConfigError extends Error {
-    code: "MANAGEMENT_API_CONFIG_INVALID";
-  }
-
   /**
    * @deprecated ADR-059. Use `getEntityTypeRegistry(appDefinition)` and read
    * each entry's `definition`. Returns the registry's definitions for these

package/user/repositories/user-repository-documentdb.js

@@ -4,7 +4,7 @@ const {
     toObjectId,
     fromObjectId,
     findOne,
-    findManyDrained,
+    findMany,
     insertOne,
     updateOne,
     deleteOne,
@@ -72,9 +72,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
     }
 
     async findIndividualUsersByOrganizationId(organizationUserId) {
-        // Drained: findMany returns only the first cursor batch, which would
-        // drop people from a large organization.
-        const docs = await findManyDrained(this.prisma, 'User', {
+        const docs = await findMany(this.prisma, 'User', {
             organizationId: toObjectId(organizationUserId),
             type: 'INDIVIDUAL',
         });
@@ -423,29 +421,6 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         );
         return this._mapUser(decrypted);
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null or absent (see the
-     * interface): the filter carries the condition, so it is one atomic update.
-     * @param {string} individualUserId
-     * @param {string} organizationUserId
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await updateOne(
-            this.prisma,
-            'User',
-            {
-                _id: toObjectId(individualUserId),
-                type: 'INDIVIDUAL',
-                // Raw MongoDB query (not Prisma): `{ field: null }` matches both a
-                // null value and a missing field, so no `$exists` branch is needed.
-                organizationId: null,
-            },
-            { $set: { organizationId: toObjectId(organizationUserId) } }
-        );
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryDocumentDB };

package/user/repositories/user-repository-interface.js

@@ -209,24 +209,6 @@ class UserRepositoryInterface {
             'Method linkIndividualToOrganization must be implemented by subclass'
         );
     }
-
-    /**
-     * Set an individual user's legacy `organizationId` pointer only if it is
-     * not set yet (their first link), decided by the database in the same
-     * statement so two concurrent first logins cannot overwrite each other.
-     * Never changes an existing pointer (ADR-056 §3.6).
-     *
-     * @param {string|number} individualUserId - Individual user ID
-     * @param {string|number} organizationUserId - Organization user ID
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     *   (null if there is no such individual)
-     * @abstract
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        throw new Error(
-            'Method linkIndividualToOrganizationIfUnset must be implemented by subclass'
-        );
-    }
 }
 
 module.exports = { UserRepositoryInterface };

package/user/repositories/user-repository-mongo.js

@@ -318,30 +318,6 @@ class UserRepositoryMongo extends UserRepositoryInterface {
             },
         });
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null (see the interface).
-     * @param {string} individualUserId
-     * @param {string} organizationUserId
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await this.prisma.user.updateMany({
-            where: {
-                id: individualUserId,
-                type: 'INDIVIDUAL',
-                // Prisma on MongoDB: `null` matches only an explicit null, and
-                // `isSet: false` only a missing field. An individual created
-                // without the field is the common case, so match both.
-                OR: [
-                    { organizationId: null },
-                    { organizationId: { isSet: false } },
-                ],
-            },
-            data: { organizationId: organizationUserId },
-        });
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryMongo };

package/user/repositories/user-repository-postgres.js

@@ -372,24 +372,6 @@ class UserRepositoryPostgres extends UserRepositoryInterface {
         });
         return this._convertUserIds(user);
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null (see the interface).
-     * @param {string} individualUserId - Individual user ID (string from application layer)
-     * @param {string} organizationUserId - Organization user ID (string from application layer)
-     * @returns {Promise<Object|null>} The individual user as stored afterwards, with string IDs
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await this.prisma.user.updateMany({
-            where: {
-                id: this._convertId(individualUserId),
-                type: 'INDIVIDUAL',
-                organizationId: null,
-            },
-            data: { organizationId: this._convertId(organizationUserId) },
-        });
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryPostgres };

package/user/use-cases/authenticate-user.js

@@ -1,6 +1,5 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
-const { AUTH_SOURCES } = require('../user');
 
 const log = getLogger('frigg.user.authentication');
 
@@ -69,13 +68,10 @@ class AuthenticateUser {
                 // Validate the API key (authentication)
                 await this.authenticateWithSharedSecret.execute(apiKey);
                 // Get user from x-frigg headers (authorization)
-                const user = await this.getUserFromXFriggHeaders.execute(
+                return await this.getUserFromXFriggHeaders.execute(
                     appUserId,
                     appOrgId
                 );
-                // The app's own backend: trusted to manage organization things.
-                user.setAuthSource(AUTH_SOURCES.SHARED_SECRET);
-                return user;
             }
             log.debug('No x-frigg-api-key header, skipping shared secret', {
                 eventName: `${log.name}.shared_secret_skipped`,
@@ -94,7 +90,6 @@ class AuthenticateUser {
             // Detect JWT format (3 parts separated by dots)
             if (token && token.split('.').length === 3) {
                 const user = await this.getUserFromAdopterJwt.execute(token);
-                user.setAuthSource(AUTH_SOURCES.ADOPTER_JWT);
                 // Validate x-frigg headers match JWT claims if present
                 if (appUserId || appOrgId) {
                     this.validateUserMatch(user, appUserId, appOrgId);
@@ -111,7 +106,6 @@ class AuthenticateUser {
             const user = await this.getUserFromBearerToken.execute(
                 req.headers.authorization
             );
-            user.setAuthSource(AUTH_SOURCES.BEARER_TOKEN);
             // Validate x-frigg headers match token user if present
             if (appUserId || appOrgId) {
                 this.validateUserMatch(user, appUserId, appOrgId);