@friggframework/core 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.694.f66a64a.0

package/prisma-postgresql/schema.prisma

@@ -56,14 +56,6 @@ model User {
   integrations Integration[]
   processes    Process[]
 
-  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
-  // single-org pointer: set on a person's first link, never moved afterwards, and
-  // read as an implicit membership when no row exists for it.
-  // As an individual: the organizations this person belongs to.
-  memberships OrganizationMembership[] @relation("IndividualMemberships")
-  // As an organization: the people who belong to it.
-  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
-
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -131,14 +123,6 @@ model Entity {
   moduleName   String?
   externalId   String?
 
-  // Organization this entity was connected in (ADR-056 §3.6): the active
-  // organization for `individual`, the owner for `organization`, null for
-  // `global`. Null on an `individual` entity is also what every row written
-  // before this column existed has, and what `individualAcross: 'all'` writes.
-  // Deliberately not a relation: a deleted organization must leave its rows
-  // invisible, not turn them into "unscoped" ones (SetNull would do that).
-  organizationId Int?
-
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -152,7 +136,6 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -169,11 +152,6 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
-  // Organization this integration was created in (ADR-056 §3.6): the active
-  // organization at create time. Null for rows that predate the column. Not a
-  // relation, for the same reason as Entity.organizationId.
-  organizationId Int?
-
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -195,9 +173,9 @@ model Integration {
   syncs        Sync[]
   mappings     IntegrationMapping[]
   processes    Process[]
+  workflowRuns WorkflowRun[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([status])
 }
 
@@ -458,66 +436,55 @@ model UsageCounter {
   @@index([metric, integrationType, window])
 }
 
-// ============================================================================
-// MANAGEMENT API MODELS
-// ============================================================================
-
-/// Multi-step authorization state for Management API v2 (/api/v2/authorize,
-/// /api/v2/credentials/:id/reauthorize). Short-lived: expired rows are removed
-/// opportunistically. stepData is encrypted at rest.
-model AuthorizationSession {
-  id           Int      @id @default(autoincrement())
-  sessionId    String   @unique
-  userId       String
-  entityType   String
-  credentialId String?
-  currentStep  Int      @default(1)
-  maxSteps     Int
-  stepData     Json     @default("{}")
-  expiresAt    DateTime
-  completed    Boolean  @default(false)
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  @@index([userId, entityType])
-  @@index([expiresAt])
+// Data-defined integrations (ADR-063): one immutable row per published definition version.
+enum DefinitionStatus {
+  DRAFT
+  PUBLISHED
+  DEPRECATED
+  RETIRED
 }
 
-// ============================================================================
-// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
-// ============================================================================
-
-/// One person's membership of one organization. Unique on the pair, so adding a
-/// membership is an idempotent upsert. `orgRole` is the organization role the
-/// adopter token carried when the membership was created (MEMBER when it named none).
-model OrganizationMembership {
-  id                 Int      @id @default(autoincrement())
-  individualUserId   Int
-  organizationUserId Int
-  orgRole            String   @default("MEMBER")
-  createdAt          DateTime @default(now())
-
-  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-
-  @@unique([individualUserId, organizationUserId])
-  @@index([organizationUserId])
+model IntegrationDefinitionVersion {
+  id              Int              @id @default(autoincrement())
+  definitionId    String
+  version         String
+  schemaVersion   String
+  status          DefinitionStatus @default(DRAFT)
+  checksum        String
+  document        Json
+  changeLevel     String?
+  previousVersion String?
+  notes           String?
+  createdBy       String?
+  publishedAt     DateTime?
+  createdAt       DateTime         @default(now())
+  updatedAt       DateTime         @updatedAt
+
+  @@unique([definitionId, version])
+  @@index([definitionId, status])
 }
 
-/// One-time scheduled jobs for poll-and-dispatch scheduling pattern.
-/// Used by providers without native one-time scheduling APIs (e.g., Netlify).
-/// A cron function queries for due jobs and dispatches them to a queue.
-model ScheduledJob {
-  id              Int       @id @default(autoincrement())
-  scheduleName    String    @unique
-  scheduledAt     DateTime
-  queueResourceId String
-  payload         Json?
-  state           String    @default("PENDING")
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  @@index([state, scheduledAt])
+// One row per data-defined workflow run. trace holds step ids, statuses, timings and error messages, never request or
+// response bodies.
+model WorkflowRun {
+  id                Int         @id @default(autoincrement())
+  integrationId     Int
+  integration       Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade)
+  definitionId      String
+  definitionVersion String
+  workflowId        String
+  triggerType       String
+  eventId           String?
+  status            String
+  reason            String?
+  error             String?
+  retryable         Boolean     @default(false)
+  trace             Json        @default("[]")
+  startedAt         DateTime
+  endedAt           DateTime?
+  createdAt         DateTime    @default(now())
+
+  @@index([integrationId, startedAt])
+  @@index([integrationId, workflowId, startedAt])
+  @@index([integrationId, status])
 }

package/queues/index.js

@@ -1,29 +1,4 @@
 const { QueuerUtil } = require('./queuer-util');
-const { QueueProvider } = require('./queue-provider');
-const { QueueClientInterface } = require('./queue-client-interface');
-const {
-    createQueueProvider,
-    determineProvider,
-    QUEUE_PROVIDERS,
-} = require('./queue-provider-factory');
-const {
-    NetlifyBackgroundProvider,
-    QStashQueueProvider,
-} = require('./providers');
-
 module.exports = {
     QueuerUtil,
-    QueueProvider,
-    QueueClientInterface,
-    createQueueProvider,
-    determineProvider,
-    QUEUE_PROVIDERS,
-    NetlifyBackgroundProvider,
-    QStashQueueProvider,
-    get SqsQueueProvider() {
-        return require('./providers/sqs-queue-provider').SqsQueueProvider;
-    },
-    get SqsQueueClient() {
-        return require('./sqs-queue-client').SqsQueueClient;
-    },
 };

package/queues/queuer-util.js

@@ -88,14 +88,21 @@ const QueuerUtil = {
         return result;
     },
 
-    batchSend: async (entries = [], queueUrl) => {
+    /**
+     * Send entries in batches of 10. `options.delaySeconds(entry, index)` may return a per-message SQS
+     * DelaySeconds (0-900), e.g. to spread trigger runs across a tick.
+     */
+    batchSend: async (entries = [], queueUrl, options = {}) => {
         const buffer = [];
         const batchSize = 10;
+        const delayOf = typeof options.delaySeconds === 'function' ? options.delaySeconds : null;
 
-        for (const entry of entries) {
+        for (const [index, entry] of entries.entries()) {
+            const delay = delayOf ? Math.max(0, Math.min(900, Math.floor(delayOf(entry, index) || 0))) : 0;
             buffer.push({
                 Id: uuid(),
                 MessageBody: JSON.stringify(entry),
+                ...(delay ? { DelaySeconds: delay } : {}),
             });
             // Sends 10, then purges the buffer
             if (buffer.length === batchSize) {

package/types/index.d.ts

@@ -12,5 +12,3 @@
 /// <reference path="./eslint-config/index.d.ts" />
 /// <reference path="./associations/index.d.ts" />
 /// <reference path="./syncs/index.d.ts" />
-/// <reference path="./user/index.d.ts" />
-/// <reference path="./modules/index.d.ts" />

package/user/repositories/user-repository-documentdb.js

@@ -4,7 +4,7 @@ const {
     toObjectId,
     fromObjectId,
     findOne,
-    findManyDrained,
+    findMany,
     insertOne,
     updateOne,
     deleteOne,
@@ -72,9 +72,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
     }
 
     async findIndividualUsersByOrganizationId(organizationUserId) {
-        // Drained: findMany returns only the first cursor batch, which would
-        // drop people from a large organization.
-        const docs = await findManyDrained(this.prisma, 'User', {
+        const docs = await findMany(this.prisma, 'User', {
             organizationId: toObjectId(organizationUserId),
             type: 'INDIVIDUAL',
         });
@@ -423,29 +421,6 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         );
         return this._mapUser(decrypted);
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null or absent (see the
-     * interface): the filter carries the condition, so it is one atomic update.
-     * @param {string} individualUserId
-     * @param {string} organizationUserId
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await updateOne(
-            this.prisma,
-            'User',
-            {
-                _id: toObjectId(individualUserId),
-                type: 'INDIVIDUAL',
-                // Raw MongoDB query (not Prisma): `{ field: null }` matches both a
-                // null value and a missing field, so no `$exists` branch is needed.
-                organizationId: null,
-            },
-            { $set: { organizationId: toObjectId(organizationUserId) } }
-        );
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryDocumentDB };

package/user/repositories/user-repository-interface.js

@@ -209,24 +209,6 @@ class UserRepositoryInterface {
             'Method linkIndividualToOrganization must be implemented by subclass'
         );
     }
-
-    /**
-     * Set an individual user's legacy `organizationId` pointer only if it is
-     * not set yet (their first link), decided by the database in the same
-     * statement so two concurrent first logins cannot overwrite each other.
-     * Never changes an existing pointer (ADR-056 §3.6).
-     *
-     * @param {string|number} individualUserId - Individual user ID
-     * @param {string|number} organizationUserId - Organization user ID
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     *   (null if there is no such individual)
-     * @abstract
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        throw new Error(
-            'Method linkIndividualToOrganizationIfUnset must be implemented by subclass'
-        );
-    }
 }
 
 module.exports = { UserRepositoryInterface };

package/user/repositories/user-repository-mongo.js

@@ -318,30 +318,6 @@ class UserRepositoryMongo extends UserRepositoryInterface {
             },
         });
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null (see the interface).
-     * @param {string} individualUserId
-     * @param {string} organizationUserId
-     * @returns {Promise<Object|null>} The individual user as stored afterwards
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await this.prisma.user.updateMany({
-            where: {
-                id: individualUserId,
-                type: 'INDIVIDUAL',
-                // Prisma on MongoDB: `null` matches only an explicit null, and
-                // `isSet: false` only a missing field. An individual created
-                // without the field is the common case, so match both.
-                OR: [
-                    { organizationId: null },
-                    { organizationId: { isSet: false } },
-                ],
-            },
-            data: { organizationId: organizationUserId },
-        });
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryMongo };

package/user/repositories/user-repository-postgres.js

@@ -372,24 +372,6 @@ class UserRepositoryPostgres extends UserRepositoryInterface {
         });
         return this._convertUserIds(user);
     }
-
-    /**
-     * Set the legacy organizationId only if it is still null (see the interface).
-     * @param {string} individualUserId - Individual user ID (string from application layer)
-     * @param {string} organizationUserId - Organization user ID (string from application layer)
-     * @returns {Promise<Object|null>} The individual user as stored afterwards, with string IDs
-     */
-    async linkIndividualToOrganizationIfUnset(individualUserId, organizationUserId) {
-        await this.prisma.user.updateMany({
-            where: {
-                id: this._convertId(individualUserId),
-                type: 'INDIVIDUAL',
-                organizationId: null,
-            },
-            data: { organizationId: this._convertId(organizationUserId) },
-        });
-        return this.findIndividualUserById(individualUserId);
-    }
 }
 
 module.exports = { UserRepositoryPostgres };

package/user/use-cases/authenticate-user.js

@@ -1,6 +1,5 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
-const { AUTH_SOURCES } = require('../user');
 
 const log = getLogger('frigg.user.authentication');
 
@@ -69,13 +68,10 @@ class AuthenticateUser {
                 // Validate the API key (authentication)
                 await this.authenticateWithSharedSecret.execute(apiKey);
                 // Get user from x-frigg headers (authorization)
-                const user = await this.getUserFromXFriggHeaders.execute(
+                return await this.getUserFromXFriggHeaders.execute(
                     appUserId,
                     appOrgId
                 );
-                // The app's own backend: trusted to manage organization things.
-                user.setAuthSource(AUTH_SOURCES.SHARED_SECRET);
-                return user;
             }
             log.debug('No x-frigg-api-key header, skipping shared secret', {
                 eventName: `${log.name}.shared_secret_skipped`,
@@ -94,7 +90,6 @@ class AuthenticateUser {
             // Detect JWT format (3 parts separated by dots)
             if (token && token.split('.').length === 3) {
                 const user = await this.getUserFromAdopterJwt.execute(token);
-                user.setAuthSource(AUTH_SOURCES.ADOPTER_JWT);
                 // Validate x-frigg headers match JWT claims if present
                 if (appUserId || appOrgId) {
                     this.validateUserMatch(user, appUserId, appOrgId);
@@ -111,7 +106,6 @@ class AuthenticateUser {
             const user = await this.getUserFromBearerToken.execute(
                 req.headers.authorization
             );
-            user.setAuthSource(AUTH_SOURCES.BEARER_TOKEN);
             // Validate x-frigg headers match token user if present
             if (appUserId || appOrgId) {
                 this.validateUserMatch(user, appUserId, appOrgId);

package/user/use-cases/get-user-from-adopter-jwt.js

@@ -1,120 +1,149 @@
-const { getLogger } = require('../../logs');
-const { fail } = require('../adopter-jwt-errors');
-const {
-    findAppUsers,
-    createMissingAppUsers,
-    buildUser,
-} = require('../app-user-helpers');
-
-const log = getLogger('frigg.user.adopter_jwt');
-
-const idFromClaim = (value) => {
-    if (typeof value === 'string' && value.trim() !== '') return value;
-    if (typeof value === 'number' && Number.isFinite(value))
-        return String(value);
-    return null;
-};
+const Boom = require('@hapi/boom');
 
 /**
- * Authenticates a request by a token issued by the adopter's own identity
- * system (ADR-056 §2): verifies it, then finds or creates the individual and
- * organization users it names.
+ * STUB: Use case for retrieving a user from adopter-provided JWT token.
+ *
+ * This is a stub implementation for future JWT authentication support.
+ * When implemented, this will allow adopters to use their own JWT tokens
+ * for authentication instead of Frigg's native token system.
+ *
+ * FUTURE IMPLEMENTATION REQUIREMENTS:
+ * - Validate JWT signature using jwtConfig.secret from app definition
+ * - Support configurable signing algorithms (HS256, HS384, HS512, RS256, RS384, RS512)
+ * - Extract user identifiers from JWT claims based on jwtConfig.userIdClaim and jwtConfig.orgIdClaim
+ * - Find or create user based on extracted claim values
+ * - Handle token expiration and validation errors
+ * - Support refresh tokens (optional)
+ * - Validate user ID conflicts if both individual and org IDs present in JWT
  *
- * The organization the token names is the request's active organization
- * (ADR-056 §3.6). A person who is not yet a member of it becomes one; a person
- * can belong to several, and `IndividualUser.organizationId` is never moved
- * (see EnsureOrganizationMembership). Two first logins racing for the same new
- * person or organization both succeed: a create that loses to a unique
- * constraint finds the winner's row.
+ * RECOMMENDED IMPLEMENTATION:
+ * - Use 'jsonwebtoken' package for JWT parsing and validation
+ * - Cache JWT public keys for RS* algorithms
+ * - Add comprehensive error handling for invalid tokens
+ * - Log authentication attempts for security auditing
+ *
+ * @todo Implement JWT validation with jsonwebtoken package
+ * @todo Add unit tests for JWT parsing and claim extraction
+ * @todo Document adopter JWT integration guide in Frigg docs
+ * @todo Add support for JWT refresh tokens
+ * @todo Implement JWT public key caching for RS* algorithms
  *
  * @class GetUserFromAdopterJwt
  */
 class GetUserFromAdopterJwt {
     /**
-     * @param {Object} params
-     * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository
+     * Creates a new GetUserFromAdopterJwt instance.
+     * @param {Object} params - Configuration parameters.
+     * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
      * @param {Object} params.userConfig - The user config in the app definition.
-     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
-     * @param {{verify: Function, claimNames: Object}} params.tokenVerifier -
-     *   from `createAdopterTokenVerifier`.
      */
-    constructor({
-        userRepository,
-        ensureOrganizationMembership,
-        userConfig,
-        tokenVerifier,
-    }) {
+    constructor({ userRepository, userConfig }) {
         this.userRepository = userRepository;
-        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
-        this.tokenVerifier = tokenVerifier;
     }
 
     /**
+     * Executes the use case.
      * @async
-     * @param {string} token - The JWT from the Authorization header.
-     * @returns {Promise<import('../user').User>}
-     * @throws {Boom} 401 with `data.reason` for a token the verifier refuses
-     *   (including `token_missing_user_claim`).
-     * @throws {Boom} 503 `jwks_unavailable`, 500 `jwt_config_invalid` (from the verifier).
+     * @param {string} jwtToken - The JWT token from the Authorization header.
+     * @returns {Promise<import('../user').User>} The authenticated user object.
+     * @throws {Boom} 501 Not Implemented - This feature is not yet available.
      */
-    async execute(token) {
-        const claims = await this.tokenVerifier.verify(token);
-        const { userIdClaim, orgIdClaim, roleClaim } =
-            this.tokenVerifier.claimNames;
-
-        const appUserId = idFromClaim(claims[userIdClaim]);
-        if (!appUserId) throw fail('token_missing_user_claim');
-
-        const rawOrgId = claims[orgIdClaim];
-        const appOrgId = idFromClaim(rawOrgId);
-        if (rawOrgId !== undefined && rawOrgId !== null && !appOrgId) {
-            throw fail('token_malformed');
-        }
-        const role = claims[roleClaim];
-
-        const orgRole = typeof role === 'string' && role !== '' ? role : null;
-        const { user, membership } = await this._findOrCreateUser(
-            appUserId,
-            appOrgId,
-            orgRole
+    async execute(jwtToken) {
+        throw Boom.notImplemented(
+            'Adopter JWT authentication is not yet implemented. ' +
+                'This feature is planned for a future Frigg release. ' +
+                'Please use one of the supported authentication modes instead: ' +
+                'friggToken (native bearer token) or xFriggHeaders (backend-to-backend with x-frigg-appUserId/appOrgId headers).'
         );
-        user.setOrgRole(orgRole);
-        // What the membership row says: the role when the token carries none.
-        user.setMembershipRole(membership?.orgRole ?? null);
-
-        log.debug('Adopter token accepted', {
-            eventName: `${log.name}.accepted`,
-            hasOrganization: Boolean(user.getOrganizationUser()),
-        });
-        return user;
-    }
 
-    async _findOrCreateUser(appUserId, appOrgId, orgRole) {
-        const cfg = this.userConfig;
-        const found = await findAppUsers(this.userRepository, cfg, {
-            appUserId,
-            appOrgId,
-        });
-        const created = await createMissingAppUsers(this.userRepository, cfg, {
-            appUserId,
-            appOrgId,
-            ...found,
-        });
+        /* FUTURE IMPLEMENTATION PSEUDOCODE:
 
-        // The token's organization is the active one whether or not this is
-        // the person's first time in it.
-        const { individual, membership } =
-            await this.ensureOrganizationMembership.execute({
-                individual: created.individual,
-                organization: created.organization,
-                orgRole,
+        const jwt = require('jsonwebtoken');
+        
+        // Validate JWT configuration exists
+        if (!this.userConfig.jwtConfig || !this.userConfig.jwtConfig.secret) {
+            throw Boom.badImplementation('JWT configuration is required when adopterJwt auth mode is enabled');
+        }
+        
+        try {
+            // Verify and decode JWT
+            const decoded = jwt.verify(jwtToken, this.userConfig.jwtConfig.secret, {
+                algorithms: [this.userConfig.jwtConfig.algorithm || 'HS256']
             });
-        return {
-            user: buildUser(cfg, individual, created.organization),
-            membership,
-        };
+            
+            // Extract user identifiers from claims
+            const appUserId = decoded[this.userConfig.jwtConfig.userIdClaim || 'sub'];
+            const appOrgId = decoded[this.userConfig.jwtConfig.orgIdClaim || 'org_id'];
+            
+            // At least one identifier required
+            if (!appUserId && !appOrgId) {
+                throw Boom.badRequest('JWT must contain user or organization identifier claims');
+            }
+            
+            // Find existing users
+            let individualUserData = null;
+            let organizationUserData = null;
+            
+            if (appUserId) {
+                individualUserData = await this.userRepository.findIndividualUserByAppUserId(appUserId);
+            }
+            
+            if (appOrgId) {
+                organizationUserData = await this.userRepository.findOrganizationUserByAppOrgId(appOrgId);
+            }
+            
+            // Validate no conflicts if both IDs present
+            if (appUserId && appOrgId && individualUserData && organizationUserData) {
+                const individualOrgId = individualUserData.organizationUser?.toString();
+                const expectedOrgId = organizationUserData.id?.toString();
+                
+                if (individualOrgId !== expectedOrgId) {
+                    throw Boom.badRequest(
+                        'User ID mismatch: JWT claims refer to different users. ' +
+                        'Individual and organization IDs must belong to the same user.'
+                    );
+                }
+            }
+            
+            // Auto-create if not found
+            if (!individualUserData && !organizationUserData) {
+                if (appUserId) {
+                    individualUserData = await this.userRepository.createIndividualUser({
+                        appUserId,
+                        username: `jwt-user-${appUserId}`,
+                        email: decoded.email || `${appUserId}@jwt.local`,
+                    });
+                } else {
+                    organizationUserData = await this.userRepository.createOrganizationUser({
+                        appOrgId,
+                    });
+                }
+            }
+            
+            return new User(
+                individualUserData,
+                organizationUserData,
+                this.userConfig.usePassword,
+                this.userConfig.primary,
+                this.userConfig.individualUserRequired,
+                this.userConfig.organizationUserRequired
+            );
+            
+        } catch (error) {
+            if (error.name === 'TokenExpiredError') {
+                throw Boom.unauthorized('JWT token has expired');
+            } else if (error.name === 'JsonWebTokenError') {
+                throw Boom.unauthorized('Invalid JWT token');
+            } else if (error.isBoom) {
+                throw error;
+            }
+            throw Boom.unauthorized('JWT authentication failed');
+        }
+        */
     }
 }
 
 module.exports = { GetUserFromAdopterJwt };
+
+