@friggframework/core 2.0.0--canary.686.3e27a92.0 → 2.0.0--canary.663.8de669c.0

package/user/repositories/user-repository-postgres.js

@@ -372,24 +372,6 @@ class UserRepositoryPostgres extends UserRepositoryInterface {
         });
         return this._convertUserIds(user);
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null (see the interface).
-     * @param {string} individualUserId - Individual user ID (string from application layer)
-     * @param {string} organizationUserId - Organization user ID (string from application layer)
-     * @returns {Promise<Object|null>} The individual user as stored afterwards, with string IDs
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await this.prisma.user.updateMany({
-            where: {
-                id: this._convertId(individualUserId),
-                type: 'INDIVIDUAL',
-                organizationId: null,
-            },
-            data: { organizationId: this._convertId(organizationUserId) },
-        });
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryPostgres };

package/user/use-cases/authenticate-user.js

@@ -1,6 +1,5 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
-const { AUTH_SOURCES } = require('../user');
 
 const log = getLogger('frigg.user.authentication');
 
@@ -69,13 +68,10 @@ class AuthenticateUser {
                 // Validate the API key (authentication)
                 await this.authenticateWithSharedSecret.execute(apiKey);
                 // Get user from x-frigg headers (authorization)
-                const user = await this.getUserFromXFriggHeaders.execute(
+                return await this.getUserFromXFriggHeaders.execute(
                     appUserId,
                     appOrgId
                 );
-                // The app's own backend: trusted to manage organization things.
-                user.setAuthSource(AUTH_SOURCES.SHARED_SECRET);
-                return user;
             }
             log.debug('No x-frigg-api-key header, skipping shared secret', {
                 eventName: `${log.name}.shared_secret_skipped`,
@@ -94,7 +90,6 @@ class AuthenticateUser {
             // Detect JWT format (3 parts separated by dots)
             if (token && token.split('.').length === 3) {
                 const user = await this.getUserFromAdopterJwt.execute(token);
-                user.setAuthSource(AUTH_SOURCES.ADOPTER_JWT);
                 // Validate x-frigg headers match JWT claims if present
                 if (appUserId || appOrgId) {
                     this.validateUserMatch(user, appUserId, appOrgId);
@@ -111,7 +106,6 @@ class AuthenticateUser {
             const user = await this.getUserFromBearerToken.execute(
                 req.headers.authorization
             );
-            user.setAuthSource(AUTH_SOURCES.BEARER_TOKEN);
             // Validate x-frigg headers match token user if present
             if (appUserId || appOrgId) {
                 this.validateUserMatch(user, appUserId, appOrgId);

package/user/use-cases/get-user-from-adopter-jwt.js

@@ -1,120 +1,149 @@
-const { getLogger } = require('../../logs');
-const { fail } = require('../adopter-jwt-errors');
-const {
-    findAppUsers,
-    createMissingAppUsers,
-    buildUser,
-} = require('../app-user-helpers');
-
-const log = getLogger('frigg.user.adopter_jwt');
-
-const idFromClaim = (value) => {
-    if (typeof value === 'string' && value.trim() !== '') return value;
-    if (typeof value === 'number' && Number.isFinite(value))
-        return String(value);
-    return null;
-};
+const Boom = require('@hapi/boom');
 
 /**
- * Authenticates a request by a token issued by the adopter's own identity
- * system (ADR-056 §2): verifies it, then finds or creates the individual and
- * organization users it names.
+ * STUB: Use case for retrieving a user from adopter-provided JWT token.
+ *
+ * This is a stub implementation for future JWT authentication support.
+ * When implemented, this will allow adopters to use their own JWT tokens
+ * for authentication instead of Frigg's native token system.
+ *
+ * FUTURE IMPLEMENTATION REQUIREMENTS:
+ * - Validate JWT signature using jwtConfig.secret from app definition
+ * - Support configurable signing algorithms (HS256, HS384, HS512, RS256, RS384, RS512)
+ * - Extract user identifiers from JWT claims based on jwtConfig.userIdClaim and jwtConfig.orgIdClaim
+ * - Find or create user based on extracted claim values
+ * - Handle token expiration and validation errors
+ * - Support refresh tokens (optional)
+ * - Validate user ID conflicts if both individual and org IDs present in JWT
  *
- * The organization the token names is the request's active organization
- * (ADR-056 §3.6). A person who is not yet a member of it becomes one; a person
- * can belong to several, and `IndividualUser.organizationId` is never moved
- * (see EnsureOrganizationMembership). Two first logins racing for the same new
- * person or organization both succeed: a create that loses to a unique
- * constraint finds the winner's row.
+ * RECOMMENDED IMPLEMENTATION:
+ * - Use 'jsonwebtoken' package for JWT parsing and validation
+ * - Cache JWT public keys for RS* algorithms
+ * - Add comprehensive error handling for invalid tokens
+ * - Log authentication attempts for security auditing
+ *
+ * @todo Implement JWT validation with jsonwebtoken package
+ * @todo Add unit tests for JWT parsing and claim extraction
+ * @todo Document adopter JWT integration guide in Frigg docs
+ * @todo Add support for JWT refresh tokens
+ * @todo Implement JWT public key caching for RS* algorithms
  *
  * @class GetUserFromAdopterJwt
  */
 class GetUserFromAdopterJwt {
     /**
-     * @param {Object} params
-     * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository
+     * Creates a new GetUserFromAdopterJwt instance.
+     * @param {Object} params - Configuration parameters.
+     * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
      * @param {Object} params.userConfig - The user config in the app definition.
-     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
-     * @param {{verify: Function, claimNames: Object}} params.tokenVerifier -
-     *   from `createAdopterTokenVerifier`.
      */
-    constructor({
-        userRepository,
-        ensureOrganizationMembership,
-        userConfig,
-        tokenVerifier,
-    }) {
+    constructor({ userRepository, userConfig }) {
         this.userRepository = userRepository;
-        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
-        this.tokenVerifier = tokenVerifier;
     }
 
     /**
+     * Executes the use case.
      * @async
-     * @param {string} token - The JWT from the Authorization header.
-     * @returns {Promise<import('../user').User>}
-     * @throws {Boom} 401 with `data.reason` for a token the verifier refuses
-     *   (including `token_missing_user_claim`).
-     * @throws {Boom} 503 `jwks_unavailable`, 500 `jwt_config_invalid` (from the verifier).
+     * @param {string} jwtToken - The JWT token from the Authorization header.
+     * @returns {Promise<import('../user').User>} The authenticated user object.
+     * @throws {Boom} 501 Not Implemented - This feature is not yet available.
      */
-    async execute(token) {
-        const claims = await this.tokenVerifier.verify(token);
-        const { userIdClaim, orgIdClaim, roleClaim } =
-            this.tokenVerifier.claimNames;
-
-        const appUserId = idFromClaim(claims[userIdClaim]);
-        if (!appUserId) throw fail('token_missing_user_claim');
-
-        const rawOrgId = claims[orgIdClaim];
-        const appOrgId = idFromClaim(rawOrgId);
-        if (rawOrgId !== undefined && rawOrgId !== null && !appOrgId) {
-            throw fail('token_malformed');
-        }
-        const role = claims[roleClaim];
-
-        const orgRole = typeof role === 'string' && role !== '' ? role : null;
-        const { user, membership } = await this._findOrCreateUser(
-            appUserId,
-            appOrgId,
-            orgRole
+    async execute(jwtToken) {
+        throw Boom.notImplemented(
+            'Adopter JWT authentication is not yet implemented. ' +
+                'This feature is planned for a future Frigg release. ' +
+                'Please use one of the supported authentication modes instead: ' +
+                'friggToken (native bearer token) or xFriggHeaders (backend-to-backend with x-frigg-appUserId/appOrgId headers).'
         );
-        user.setOrgRole(orgRole);
-        // What the membership row says: the role when the token carries none.
-        user.setMembershipRole(membership?.orgRole ?? null);
-
-        log.debug('Adopter token accepted', {
-            eventName: `${log.name}.accepted`,
-            hasOrganization: Boolean(user.getOrganizationUser()),
-        });
-        return user;
-    }
 
-    async _findOrCreateUser(appUserId, appOrgId, orgRole) {
-        const cfg = this.userConfig;
-        const found = await findAppUsers(this.userRepository, cfg, {
-            appUserId,
-            appOrgId,
-        });
-        const created = await createMissingAppUsers(this.userRepository, cfg, {
-            appUserId,
-            appOrgId,
-            ...found,
-        });
+        /* FUTURE IMPLEMENTATION PSEUDOCODE:
 
-        // The token's organization is the active one whether or not this is
-        // the person's first time in it.
-        const { individual, membership } =
-            await this.ensureOrganizationMembership.execute({
-                individual: created.individual,
-                organization: created.organization,
-                orgRole,
+        const jwt = require('jsonwebtoken');
+        
+        // Validate JWT configuration exists
+        if (!this.userConfig.jwtConfig || !this.userConfig.jwtConfig.secret) {
+            throw Boom.badImplementation('JWT configuration is required when adopterJwt auth mode is enabled');
+        }
+        
+        try {
+            // Verify and decode JWT
+            const decoded = jwt.verify(jwtToken, this.userConfig.jwtConfig.secret, {
+                algorithms: [this.userConfig.jwtConfig.algorithm || 'HS256']
             });
-        return {
-            user: buildUser(cfg, individual, created.organization),
-            membership,
-        };
+            
+            // Extract user identifiers from claims
+            const appUserId = decoded[this.userConfig.jwtConfig.userIdClaim || 'sub'];
+            const appOrgId = decoded[this.userConfig.jwtConfig.orgIdClaim || 'org_id'];
+            
+            // At least one identifier required
+            if (!appUserId && !appOrgId) {
+                throw Boom.badRequest('JWT must contain user or organization identifier claims');
+            }
+            
+            // Find existing users
+            let individualUserData = null;
+            let organizationUserData = null;
+            
+            if (appUserId) {
+                individualUserData = await this.userRepository.findIndividualUserByAppUserId(appUserId);
+            }
+            
+            if (appOrgId) {
+                organizationUserData = await this.userRepository.findOrganizationUserByAppOrgId(appOrgId);
+            }
+            
+            // Validate no conflicts if both IDs present
+            if (appUserId && appOrgId && individualUserData && organizationUserData) {
+                const individualOrgId = individualUserData.organizationUser?.toString();
+                const expectedOrgId = organizationUserData.id?.toString();
+                
+                if (individualOrgId !== expectedOrgId) {
+                    throw Boom.badRequest(
+                        'User ID mismatch: JWT claims refer to different users. ' +
+                        'Individual and organization IDs must belong to the same user.'
+                    );
+                }
+            }
+            
+            // Auto-create if not found
+            if (!individualUserData && !organizationUserData) {
+                if (appUserId) {
+                    individualUserData = await this.userRepository.createIndividualUser({
+                        appUserId,
+                        username: `jwt-user-${appUserId}`,
+                        email: decoded.email || `${appUserId}@jwt.local`,
+                    });
+                } else {
+                    organizationUserData = await this.userRepository.createOrganizationUser({
+                        appOrgId,
+                    });
+                }
+            }
+            
+            return new User(
+                individualUserData,
+                organizationUserData,
+                this.userConfig.usePassword,
+                this.userConfig.primary,
+                this.userConfig.individualUserRequired,
+                this.userConfig.organizationUserRequired
+            );
+            
+        } catch (error) {
+            if (error.name === 'TokenExpiredError') {
+                throw Boom.unauthorized('JWT token has expired');
+            } else if (error.name === 'JsonWebTokenError') {
+                throw Boom.unauthorized('Invalid JWT token');
+            } else if (error.isBoom) {
+                throw error;
+            }
+            throw Boom.unauthorized('JWT authentication failed');
+        }
+        */
     }
 }
 
 module.exports = { GetUserFromAdopterJwt };
+
+

package/user/use-cases/get-user-from-x-frigg-headers.js

@@ -1,38 +1,10 @@
 const Boom = require('@hapi/boom');
-const {
-    findAppUsers,
-    createMissingAppUsers,
-    buildUser,
-    wantsIndividual,
-} = require('../app-user-helpers');
-const { getLogger } = require('../../logs');
-
-const log = getLogger('frigg.user.x_frigg_headers');
-
-const NOT_A_MEMBER_MESSAGE =
-    'Not a member: the user identified by x-frigg-appUserId is not a member of the ' +
-    'organization identified by x-frigg-appOrgId, and strict membership does not ' +
-    'allow these headers to add them.';
+const { User } = require('../user');
 
 /**
  * Use case for retrieving or creating a user from x-frigg header identifiers.
  * Supports backend-to-backend API communication using application user IDs.
  *
- * `x-frigg-appOrgId` names the request's active organization (ADR-056 §3.6).
- * A person the organization does not know yet is added to it as a member; the
- * person is never moved out of another organization, and
- * `IndividualUser.organizationId` is set only on a first link.
- *
- * With `user.strictMembership: true` the headers cannot make anyone a member of
- * an organization that already existed: a person who is not already a member
- * (a brand-new `appUserId` included) is refused with 400. The one thing strict
- * mode still allows is naming an organization this request creates, so a first
- * login can bootstrap its own organization. Apps that run strict add people to
- * existing organizations themselves, through the membership repository.
- *
- * `strictUserValidation` is a deprecated alias for `strictMembership`; its
- * meaning changed (it used to reject a mismatched individual/organization pair).
- *
  * @class GetUserFromXFriggHeaders
  */
 class GetUserFromXFriggHeaders {
@@ -40,22 +12,11 @@ class GetUserFromXFriggHeaders {
      * Creates a new GetUserFromXFriggHeaders instance.
      * @param {Object} params - Configuration parameters.
      * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
-     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
      * @param {Object} params.userConfig - The user config in the app definition.
      */
-    constructor({ userRepository, ensureOrganizationMembership, userConfig }) {
+    constructor({ userRepository, userConfig }) {
         this.userRepository = userRepository;
-        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
-
-        const { strictMembership, strictUserValidation } = userConfig ?? {};
-        if (strictUserValidation !== undefined && strictMembership === undefined) {
-            log.warn(
-                'user.strictUserValidation is deprecated and now means strictMembership; rename it',
-                { eventName: `${log.name}.strict_user_validation_deprecated` }
-            );
-        }
-        this.strict = Boolean(strictMembership ?? strictUserValidation);
     }
 
     /**
@@ -64,7 +25,7 @@ class GetUserFromXFriggHeaders {
      * @param {string} [appUserId] - The app user ID from x-frigg-appUserId header.
      * @param {string} [appOrgId] - The app organization ID from x-frigg-appOrgId header.
      * @returns {Promise<import('../user').User>} The authenticated user object.
-     * @throws {Boom} 400 Bad Request if neither ID is provided or, in strict mode, if the person is not already a member of the existing organization named.
+     * @throws {Boom} 400 Bad Request if neither ID is provided or if both IDs are provided but belong to different users.
      */
     async execute(appUserId, appOrgId) {
         // At least one header must be provided
@@ -75,60 +36,96 @@ class GetUserFromXFriggHeaders {
         }
 
         // Find users by both IDs if both are provided
-        let { individual: individualUserData, organization: organizationUserData } =
-            await findAppUsers(this.userRepository, this.userConfig, {
-                appUserId,
-                appOrgId,
-            });
+        let individualUserData = null;
+        let organizationUserData = null;
+
+        if (appUserId && this.userConfig.individualUserRequired !== false) {
+            individualUserData =
+                await this.userRepository.findIndividualUserByAppUserId(
+                    appUserId
+                );
+        }
 
-        // Strict mode refuses to make anyone a member of an organization that
-        // existed before this request. Only an organization created below is
-        // exempt, since it has no members to disagree with.
-        const refuseNewMembers = this.strict && Boolean(organizationUserData);
+        if (appOrgId && this.userConfig.organizationUserRequired) {
+            organizationUserData =
+                await this.userRepository.findOrganizationUserByAppOrgId(
+                    appOrgId
+                );
+        }
 
-        // A person who does not exist yet cannot already be a member, so refuse
-        // now, before anything is persisted: refusing after creating them would
-        // leave an orphan individual behind on every refused request.
+        // VALIDATION/AUTO-LINKING: If both IDs provided and both users exist, handle mismatch
         if (
-            refuseNewMembers &&
             appUserId &&
-            wantsIndividual(this.userConfig) &&
-            !individualUserData
+            appOrgId &&
+            individualUserData &&
+            organizationUserData
         ) {
-            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
+            // Check if individual user is linked to the org user
+            const individualOrgId =
+                individualUserData.organizationUser?.toString();
+            const expectedOrgId = organizationUserData.id?.toString();
+
+            if (individualOrgId !== expectedOrgId) {
+                // Default behavior: Auto-link disconnected users
+                // Opt-in strict mode: Throw error on mismatch
+                if (this.userConfig.strictUserValidation) {
+                    throw Boom.badRequest(
+                        'User ID mismatch: x-frigg-appUserId and x-frigg-appOrgId refer to different users. ' +
+                            'Provide only one identifier or ensure they belong to the same user.'
+                    );
+                }
+
+                // Auto-link the users
+                individualUserData = await this.userRepository.linkIndividualToOrganization(
+                    individualUserData.id,
+                    organizationUserData.id
+                );
+            }
         }
 
         // Auto-create users independently if they don't exist and are required
-        const created = await createMissingAppUsers(
-            this.userRepository,
-            this.userConfig,
-            {
-                appUserId,
-                appOrgId,
-                individual: individualUserData,
-                organization: organizationUserData,
-            }
-        );
-        individualUserData = created.individual;
-        organizationUserData = created.organization;
+        if (
+            !individualUserData &&
+            appUserId &&
+            this.userConfig.individualUserRequired !== false
+        ) {
+            individualUserData =
+                await this.userRepository.createIndividualUser({
+                    appUserId,
+                    username: `app-user-${appUserId}`,
+                    email: `${appUserId}@app.local`,
+                });
+        }
 
-        // The organization named by the header is the active one: join it
-        // rather than re-linking the person's single organizationId.
-        const ensured = await this.ensureOrganizationMembership.execute({
-            individual: individualUserData,
-            organization: organizationUserData,
-            requireExisting: refuseNewMembers,
-        });
-        if (refuseNewMembers && individualUserData && !ensured.membership) {
-            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
+        if (
+            !organizationUserData &&
+            appOrgId &&
+            this.userConfig.organizationUserRequired
+        ) {
+            organizationUserData =
+                await this.userRepository.createOrganizationUser({
+                    appOrgId,
+                });
+
+            // Link individual user to newly created org user if individual exists
+            if (individualUserData && organizationUserData) {
+                individualUserData = await this.userRepository.linkIndividualToOrganization(
+                    individualUserData.id,
+                    organizationUserData.id
+                );
+            }
         }
-        individualUserData = ensured.individual;
 
-        return buildUser(
-            this.userConfig,
+        const user = new User(
             individualUserData,
-            organizationUserData
+            organizationUserData,
+            this.userConfig.usePassword,
+            this.userConfig.primary,
+            this.userConfig.individualUserRequired,
+            this.userConfig.organizationUserRequired
         );
+
+        return user;
     }
 }
 

package/user/user.js

@@ -1,20 +1,5 @@
 const bcrypt = require('bcryptjs');
 
-/**
- * How the request that produced a `User` proved who it is. Set by
- * AuthenticateUser, never inferred from a missing value. Organization roles
- * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
- * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
- * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
- * adopter token has the role it carries, else the stored membership role,
- * else `MEMBER`.
- */
-const AUTH_SOURCES = Object.freeze({
-    SHARED_SECRET: 'shared-secret',
-    ADOPTER_JWT: 'adopter-jwt',
-    BEARER_TOKEN: 'bearer-token',
-});
-
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -33,14 +18,6 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
-        // Organization role from an adopter token claim (ADR-056 §2), per
-        // request. When present it wins over the stored membership role.
-        this.orgRole = null;
-        // The role stored on the person's membership of the active organization
-        // (OrganizationMembership.orgRole); used when the token carries none.
-        this.membershipRole = null;
-        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
-        this.authSource = null;
 
         this.config = {
             primary,
@@ -49,17 +26,6 @@ class User {
         };
     }
 
-    /**
-     * The organization this request acts in (ADR-056 §3.6): the one the token or
-     * `x-frigg-appOrgId` named, not the person's legacy `organizationId`
-     * pointer. Null when the request has no organization.
-     * @returns {string|null}
-     */
-    getActiveOrganizationId() {
-        const id = this.organizationUser?.id;
-        return id === undefined || id === null || id === '' ? null : String(id);
-    }
-
     getPrimaryUser() {
         if (this.config.primary === 'organization') {
             return this.organizationUser;
@@ -67,11 +33,6 @@ class User {
         return this.individualUser;
     }
 
-    /**
-     * The id of the primary user. With `primary: 'organization'` this is the
-     * active organization (the one the request named), never the organization
-     * the person was first linked to.
-     */
     getId() {
         return this.getPrimaryUser()?.id;
     }
@@ -104,30 +65,6 @@ class User {
         return this.config.individualUserRequired;
     }
 
-    getAuthSource() {
-        return this.authSource;
-    }
-
-    setAuthSource(authSource) {
-        this.authSource = authSource ?? null;
-    }
-
-    getOrgRole() {
-        return this.orgRole;
-    }
-
-    setOrgRole(orgRole) {
-        this.orgRole = orgRole ?? null;
-    }
-
-    getMembershipRole() {
-        return this.membershipRole;
-    }
-
-    setMembershipRole(membershipRole) {
-        this.membershipRole = membershipRole ?? null;
-    }
-
     getIndividualUser() {
         return this.individualUser;
     }
@@ -185,4 +122,4 @@ class User {
     }
 }
 
-module.exports = { User, AUTH_SOURCES }; 
+module.exports = { User };