@friggframework/core 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.693.d8859c2.0

package/modules/use-cases/manage-access.js

@@ -1,21 +0,0 @@
-const Boom = require('@hapi/boom');
-const { ACCESS } = require('../scope-resolution');
-
-/**
- * The one check behind every "may this caller change or delete it" gate
- * (ADR-056 §3 permissions): the caller may use it but not manage it, so 403
- * `ORG_ADMIN_REQUIRED`. `access` comes from describeRecord (entities,
- * integrations) or scopePolicy.accessToOwnedBy (credentials).
- *
- * @param {string|null} access - ACCESS value
- * @param {string} subject - e.g. `entity 5`, for the message
- */
-function assertCanManage(access, subject) {
-    if (access !== ACCESS.MANAGE) {
-        throw Boom.forbidden(`You may use ${subject} but not change or delete it`, {
-            code: 'ORG_ADMIN_REQUIRED',
-        });
-    }
-}
-
-module.exports = { assertCanManage };

package/modules/use-cases/multi-step-authorization.js

@@ -1,329 +0,0 @@
-const Boom = require('@hapi/boom');
-const { FetchError } = require('../../errors/fetch-error');
-const { getLogger } = require('../../logs');
-const { AuthorizationSession } = require('../domain/authorization-session');
-const { findDefinition, getAuthStepCount } = require('./entity-types');
-const { describeRecord } = require('../scope-visibility');
-const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
-
-const log = getLogger('frigg.api.authorize');
-
-const defaultCreateModule = (params) => {
-    const { Module } = require('../module');
-    return Module.create(params);
-};
-
-const isMultiStep = (definition) =>
-    getAuthStepCount(definition) > 1 ||
-    typeof definition.processAuthorizationStep === 'function';
-
-const sessionNotFound = () =>
-    Boom.notFound('Authorization session not found or expired', {
-        code: 'AUTHORIZATION_SESSION_NOT_FOUND',
-    });
-
-/**
- * Maps a failure from the module or the provider to a client-facing error.
- * Boom errors pass through. A provider HTTP failure is a 502; a failed auth
- * test or a ClientSafeError is a 400. Anything else stays a 500.
- */
-function toAuthorizationError(error, { passMessage = false } = {}) {
-    if (error?.isBoom) return error;
-    if (error instanceof FetchError) {
-        return Boom.badGateway('The provider rejected the authorization request', {
-            code: 'UPSTREAM_ERROR',
-            expose: true,
-            details: { upstreamStatus: error.statusCode ?? null },
-        });
-    }
-    if (error?.isClientSafe || passMessage) {
-        return Boom.badRequest(error?.message || 'Authorization failed', {
-            code: 'AUTHORIZATION_FAILED',
-        });
-    }
-    if (error?.message === 'Authorization failed') {
-        return Boom.badRequest(
-            'Authorization failed: the credentials did not pass the module auth test',
-            { code: 'AUTHORIZATION_FAILED' }
-        );
-    }
-    return error;
-}
-
-/**
- * Loads the session a caller continues, checking it belongs to them, to the
- * entity type and (for re-authorization) to the credential.
- */
-async function loadSession(repository, sessionId, binding) {
-    if (typeof sessionId !== 'string' || !sessionId) throw sessionNotFound();
-    const session = await repository.findBySessionId(sessionId);
-    if (!session || session.isExpired() || !session.belongsTo(binding)) {
-        throw sessionNotFound();
-    }
-    if (session.completed) {
-        throw Boom.conflict('Authorization session is already complete', {
-            code: 'AUTHORIZATION_SESSION_COMPLETED',
-        });
-    }
-    return session;
-}
-
-async function startSession(repository, binding, maxSteps) {
-    // Expired sessions are removed opportunistically; PostgreSQL has no TTL.
-    Promise.resolve()
-        .then(() => repository.deleteExpired())
-        .catch((error) =>
-        log.warn('Expired authorization sessions were not removed', {
-            eventName: `${log.name}.session_cleanup_failed`,
-            error,
-        })
-    );
-    return repository.create(AuthorizationSession.start({ ...binding, maxSteps }));
-}
-
-/**
- * GET /api/v2/authorize (and GET /api/v2/credentials/:id/reauthorize): what
- * the caller must submit next. A multi-step flow gets a session on step 1;
- * later steps need that sessionId and must be the session's current step.
- */
-class GetAuthorizationStep {
-    /**
-     * @param {Object} params
-     * @param {Array<Object>} params.moduleDefinitions
-     * @param {import('./get-authorization-requirements').GetAuthorizationRequirements} params.getAuthorizationRequirements
-     * @param {import('../repositories/authorization-session-repository-interface').AuthorizationSessionRepositoryInterface} params.authorizationSessionRepository
-     */
-    constructor({ moduleDefinitions, getAuthorizationRequirements, authorizationSessionRepository }) {
-        this.moduleDefinitions = moduleDefinitions || [];
-        this.getAuthorizationRequirements = getAuthorizationRequirements;
-        this.sessions = authorizationSessionRepository;
-    }
-
-    async execute({ user, entityType, step = 1, sessionId, credentialId = null, state }) {
-        const definition = findDefinition(this.moduleDefinitions, entityType);
-        const userId = user.getId();
-        const requirementsFor = (n) =>
-            this.getAuthorizationRequirements.execute({ entityType, step: n, userId, state });
-
-        if (!isMultiStep(definition)) return requirementsFor(step);
-
-        const binding = { userId, entityType, credentialId };
-        let session;
-        if (sessionId) {
-            session = await loadSession(this.sessions, sessionId, binding);
-            if (step !== session.currentStep) {
-                throw Boom.conflict(
-                    `This session expects step ${session.currentStep}`,
-                    { code: 'STEP_OUT_OF_ORDER', details: { expectedStep: session.currentStep } }
-                );
-            }
-        } else {
-            if (step !== 1) {
-                throw Boom.badRequest('sessionId is required after step 1', {
-                    code: 'SESSION_REQUIRED',
-                });
-            }
-            session = await startSession(this.sessions, binding, getAuthStepCount(definition));
-        }
-        return { ...(await requirementsFor(step)), sessionId: session.sessionId };
-    }
-}
-
-/**
- * POST /api/v2/authorize (and POST /api/v2/credentials/:id/reauthorize).
- *
- * Single-step modules complete at once through ProcessAuthorizationCallback
- * (the v1 authorize logic). Multi-step modules run
- * definition.processAuthorizationStep(api, step, data, stepData) per step;
- * when it reports `completed`, its `authData` goes through the same
- * callback. Returns either
- * `{ status: 'complete', entity, credential }` (domain records; the handler
- * masks them) or
- * `{ status: 'pending', step, totalSteps, sessionId, requirements, message? }`.
- */
-class SubmitAuthorizationStep {
-    constructor({
-        moduleDefinitions,
-        getAuthorizationRequirements,
-        authorizationSessionRepository,
-        authorizeEntityForUser,
-        moduleRepository,
-        credentialRepository,
-        createModule,
-        scopePolicy,
-    }) {
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
-        this.moduleDefinitions = moduleDefinitions || [];
-        this.getAuthorizationRequirements = getAuthorizationRequirements;
-        this.sessions = authorizationSessionRepository;
-        this.authorizeEntityForUser = authorizeEntityForUser;
-        this.moduleRepository = moduleRepository;
-        this.credentialRepository = credentialRepository;
-        this.createModule = createModule || defaultCreateModule;
-    }
-
-    /**
-     * @param {Object} params
-     * @param {string} [params.scope] - the scope the caller asks for, from the
-     *   deciding level's allow list (ADR-056 §3.1). Never `global`.
-     * @param {string} [params.fixedScope] - re-authorization keeps the scope the
-     *   credential already has, whatever the config says now.
-     */
-    async execute({ user, entityType, data, step = 1, sessionId, credentialId = null, scope, fixedScope }) {
-        if (!data || typeof data !== 'object' || Array.isArray(data)) {
-            throw Boom.badRequest('data must be an object', {
-                code: 'VALIDATION_ERROR',
-                details: { field: 'data' },
-            });
-        }
-        const definition = findDefinition(this.moduleDefinitions, entityType);
-        // `userId` binds a session to the caller and is what GET /authorize
-        // computes too. The owner of the entity this creates is decided by
-        // scope (§3.2), not by user.primary, and is `ownership.ownerId`.
-        const userId = user.getId();
-        const ownership = this.authorizeEntityForUser.resolveOwnership({
-            user,
-            entityType,
-            scope,
-            fixedScope,
-        });
-
-        if (!isMultiStep(definition)) {
-            if (step !== 1) {
-                throw Boom.badRequest(`${entityType} has a single authorization step`, {
-                    code: 'INVALID_STEP',
-                });
-            }
-            return this.complete({ ownership, user, entityType, params: data, credentialId });
-        }
-
-        const totalSteps = getAuthStepCount(definition);
-        const binding = { userId, entityType, credentialId };
-        let session;
-        if (sessionId) {
-            session = await loadSession(this.sessions, sessionId, binding);
-            if (step === 1 && session.currentStep !== 1) {
-                session.restart();
-            } else if (step !== session.currentStep) {
-                throw Boom.conflict(`This session expects step ${session.currentStep}`, {
-                    code: 'STEP_OUT_OF_ORDER',
-                    details: { expectedStep: session.currentStep },
-                });
-            }
-        } else {
-            if (step !== 1) {
-                throw Boom.badRequest('sessionId is required after step 1', {
-                    code: 'SESSION_REQUIRED',
-                });
-            }
-            session = await startSession(this.sessions, binding, totalSteps);
-        }
-
-        if (typeof definition.processAuthorizationStep !== 'function') {
-            throw Boom.badImplementation(
-                `Module ${entityType} declares ${totalSteps} steps but no processAuthorizationStep`
-            );
-        }
-
-        const module = await this.createModule({ userId: ownership.ownerId, definition });
-        let result;
-        try {
-            result = await definition.processAuthorizationStep(
-                module.api,
-                step,
-                data,
-                session.stepData
-            );
-        } catch (error) {
-            // processAuthorizationStep errors are written for the end user
-            // (docs/MULTI_STEP_AUTH_MIGRATION_GUIDE.md), e.g. "Invalid code".
-            throw toAuthorizationError(error, { passMessage: true });
-        }
-
-        if (result?.completed) {
-            session.markComplete();
-            await this.sessions.update(session);
-            const outcome = await this.complete({
-                ownership,
-                user,
-                entityType,
-                params: result.authData || {},
-                credentialId,
-            });
-            // The collected data is no longer needed once the credential exists.
-            await Promise.resolve()
-                .then(() => this.sessions.deleteBySessionId(session.sessionId))
-                .catch(() => {});
-            return outcome;
-        }
-
-        const nextStep = result?.nextStep ?? step + 1;
-        try {
-            session.advanceTo(nextStep, result?.stepData);
-        } catch (error) {
-            throw Boom.badImplementation(
-                `Module ${entityType} returned an invalid next step: ${error.message}`
-            );
-        }
-        await this.sessions.update(session);
-
-        const requirements = await this.getAuthorizationRequirements.execute({
-            entityType,
-            step: nextStep,
-            userId,
-        });
-        return {
-            status: 'pending',
-            step: nextStep,
-            totalSteps,
-            sessionId: session.sessionId,
-            requirements,
-            ...(result?.message && { message: String(result.message) }),
-        };
-    }
-
-    async complete({ ownership, user, entityType, params, credentialId }) {
-        let callback;
-        try {
-            ({ result: callback } = await this.authorizeEntityForUser.execute({
-                user,
-                entityType,
-                data: params,
-                ownership,
-            }));
-        } catch (error) {
-            throw toAuthorizationError(error);
-        }
-        const [entity, credential] = await Promise.all([
-            this.moduleRepository.findEntityById(callback.entity_id),
-            this.credentialRepository.findCredentialById(callback.credential_id),
-        ]);
-        // What the new entity is to this caller (§3.4), so a client need not list again.
-        const tenancy = entity
-            ? describeRecord(entity, this.scopePolicy.accessContext(user), 'entity')
-            : null;
-        const outcome = {
-            status: 'complete',
-            entity: entity && tenancy ? { ...entity, tenancy } : entity,
-            credential: credential && {
-                ...credential,
-                type: entityType,
-                entityIds: entity ? [String(entity.id)] : [],
-                ...(tenancy && { tenancy }),
-            },
-        };
-        if (credentialId && String(callback.credential_id) !== String(credentialId)) {
-            // The provider account differs from the one being re-authorized,
-            // so a separate credential was stored.
-            outcome.previousCredentialId = String(credentialId);
-        }
-        return outcome;
-    }
-}
-
-module.exports = {
-    GetAuthorizationStep,
-    SubmitAuthorizationStep,
-    toAuthorizationError,
-    isMultiStep,
-};

package/prisma-postgresql/migrations/20261003000000_add_authorization_session/migration.sql

@@ -1,28 +0,0 @@
--- CreateTable
--- Multi-step authorization state for Management API v2 (/api/v2/authorize).
--- Short-lived rows; "stepData" is encrypted at rest by the application.
-CREATE TABLE "AuthorizationSession" (
-    "id" SERIAL NOT NULL,
-    "sessionId" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
-    "entityType" TEXT NOT NULL,
-    "credentialId" TEXT,
-    "currentStep" INTEGER NOT NULL DEFAULT 1,
-    "maxSteps" INTEGER NOT NULL,
-    "stepData" JSONB NOT NULL DEFAULT '{}',
-    "expiresAt" TIMESTAMP(3) NOT NULL,
-    "completed" BOOLEAN NOT NULL DEFAULT false,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "AuthorizationSession_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "AuthorizationSession_sessionId_key" ON "AuthorizationSession"("sessionId");
-
--- CreateIndex
-CREATE INDEX "AuthorizationSession_userId_entityType_idx" ON "AuthorizationSession"("userId", "entityType");
-
--- CreateIndex
-CREATE INDEX "AuthorizationSession_expiresAt_idx" ON "AuthorizationSession"("expiresAt");

package/prisma-postgresql/migrations/20261015000000_add_organization_membership/migration.sql

@@ -1,26 +0,0 @@
--- CreateTable
--- Organization memberships (ADR-056 §3.6). One row per person per organization.
--- "User"."organizationId" stays as the legacy single-org pointer. It is NOT
--- backfilled into this table: the domain (user/membership.js) reads it as an
--- implicit membership when no row exists (see docs/guides/organization-memberships.md).
-CREATE TABLE "OrganizationMembership" (
-    "id" SERIAL NOT NULL,
-    "individualUserId" INTEGER NOT NULL,
-    "organizationUserId" INTEGER NOT NULL,
-    "orgRole" TEXT NOT NULL DEFAULT 'MEMBER',
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    CONSTRAINT "OrganizationMembership_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE INDEX "OrganizationMembership_organizationUserId_idx" ON "OrganizationMembership"("organizationUserId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "OrganizationMembership_individualUserId_organizationUserId_key" ON "OrganizationMembership"("individualUserId", "organizationUserId");
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_individualUserId_fkey" FOREIGN KEY ("individualUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_organizationUserId_fkey" FOREIGN KEY ("organizationUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;

package/prisma-postgresql/migrations/20261016000000_add_entity_integration_organization/migration.sql

@@ -1,25 +0,0 @@
--- Entity and Integration carry the organization they were created in (ADR-056 §3.6).
--- Nullable, no default and no backfill: a row written before this migration keeps
--- NULL, and the domain (modules/entity-scope.js) reads NULL as "predates scoping"
--- (docs/guides/entity-scopes.md). No scope column: the owner's user type says it.
--- Deliberately no foreign key: a deleted organization must leave its rows
--- invisible, and ON DELETE SET NULL would turn them into unscoped ones.
---
--- Release note: the two CREATE INDEX statements below are plain (not
--- CONCURRENTLY, which Prisma migrations cannot run inside a transaction). Each
--- takes a SHARE lock on its table while it builds, so writes to "Entity" and
--- "Integration" wait for it. Both tables are small in a typical Frigg
--- deployment; on a very large one, create the indexes by hand first with
--- CREATE INDEX CONCURRENTLY IF NOT EXISTS under the same names, then deploy.
-
--- AlterTable
-ALTER TABLE "Entity" ADD COLUMN     "organizationId" INTEGER;
-
--- AlterTable
-ALTER TABLE "Integration" ADD COLUMN     "organizationId" INTEGER;
-
--- CreateIndex
-CREATE INDEX "Entity_userId_organizationId_idx" ON "Entity"("userId", "organizationId");
-
--- CreateIndex
-CREATE INDEX "Integration_userId_organizationId_idx" ON "Integration"("userId", "organizationId");

package/prisma-postgresql/migrations/20261017000000_add_scheduled_job/migration.sql

@@ -1,28 +0,0 @@
--- One-time scheduled jobs for the poll-and-dispatch scheduler
--- (NetlifySchedulerAdapter, friggframework/frigg#545): a cron function reads
--- PENDING rows that are due and dispatches them to a queue.
---
--- IF NOT EXISTS on purpose: #545 shipped this model in the Prisma schema with
--- no migration, so an app that ran its canary may already have the table from
--- `prisma db push`. On such a database this migration is a no-op; on a fresh
--- one it is the SQL `prisma migrate diff` generates.
-
--- CreateTable
-CREATE TABLE IF NOT EXISTS "ScheduledJob" (
-    "id" SERIAL NOT NULL,
-    "scheduleName" TEXT NOT NULL,
-    "scheduledAt" TIMESTAMP(3) NOT NULL,
-    "queueResourceId" TEXT NOT NULL,
-    "payload" JSONB,
-    "state" TEXT NOT NULL DEFAULT 'PENDING',
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "ScheduledJob_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX IF NOT EXISTS "ScheduledJob_scheduleName_key" ON "ScheduledJob"("scheduleName");
-
--- CreateIndex
-CREATE INDEX IF NOT EXISTS "ScheduledJob_state_scheduledAt_idx" ON "ScheduledJob"("state", "scheduledAt");

package/providers/index.js

@@ -1,23 +0,0 @@
-const {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-} = require('./resolve-provider');
-const {
-    isDeployedRuntime,
-    isAwsLambdaRuntime,
-    isLocalRun,
-    resolveActiveProvider,
-} = require('./runtime-detection');
-
-module.exports = {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-    isDeployedRuntime,
-    isAwsLambdaRuntime,
-    isLocalRun,
-    resolveActiveProvider,
-};

package/providers/resolve-provider.js

@@ -1,93 +0,0 @@
-/**
- * Provider Resolver
- *
- * Resolves a provider name from the appDefinition into the corresponding
- * @friggframework/provider-{name} package. This is the bridge between
- * `appDefinition.provider` and the provider plugin interface.
- *
- * Resolution order:
- *   1. Explicit `providerName` argument
- *   2. `appDefinition.provider`
- *   3. `FRIGG_PROVIDER` environment variable
- *   4. Default: 'aws'
- *
- * Package naming convention:
- *   provider: 'netlify'  →  require('@friggframework/provider-netlify')
- *   provider: 'aws'      →  require('@friggframework/provider-aws')
- *
- * @example
- *   const provider = resolveProvider({ provider: 'netlify' });
- *   // provider.name === 'netlify'
- *   // provider.deploy(appDefinition, options)
- *   // provider.createHandler(options)
- *   // provider.QueueProvider  (class)
- *   // etc.
- */
-
-const KNOWN_PROVIDERS = ['aws', 'netlify'];
-
-/**
- * Determine the provider name from available sources.
- *
- * @param {Object} [appDefinition] - Frigg app definition
- * @param {string} [providerName] - Explicit override
- * @returns {string} Provider name (e.g. 'netlify', 'aws')
- */
-function determineProviderName(appDefinition, providerName) {
-    if (providerName) {
-        return providerName;
-    }
-    if (appDefinition?.provider) {
-        return appDefinition.provider;
-    }
-    if (process.env.FRIGG_PROVIDER) {
-        return process.env.FRIGG_PROVIDER;
-    }
-    return 'aws';
-}
-
-/**
- * Resolve a provider name to a package name.
- *
- * @param {string} name - Provider name (e.g. 'netlify')
- * @returns {string} npm package name (e.g. '@friggframework/provider-netlify')
- */
-function providerPackageName(name) {
-    return `@friggframework/provider-${name}`;
-}
-
-/**
- * Resolve and load the provider plugin for the given app definition.
- *
- * @param {Object} [appDefinition] - Frigg app definition (reads .provider)
- * @param {Object} [options]
- * @param {string} [options.provider] - Explicit provider name override
- * @returns {Object} Provider plugin (conforms to the provider plugin interface)
- * @throws {Error} If the provider package is not installed
- */
-function resolveProvider(appDefinition, options = {}) {
-    const name = determineProviderName(appDefinition, options.provider);
-    const packageName = providerPackageName(name);
-
-    try {
-        return require(packageName);
-    } catch (error) {
-        if (error.code === 'MODULE_NOT_FOUND') {
-            const hint = KNOWN_PROVIDERS.includes(name)
-                ? `Install it with: npm install ${packageName}`
-                : `Is '${name}' a valid Frigg provider? Known providers: ${KNOWN_PROVIDERS.join(', ')}`;
-
-            throw new Error(
-                `Provider '${name}' specified in appDefinition but package '${packageName}' is not installed.\n  ${hint}`
-            );
-        }
-        throw error;
-    }
-}
-
-module.exports = {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-};