@friggframework/core 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.694.f66a64a.0

package/user/use-cases/get-user-from-x-frigg-headers.js

@@ -1,38 +1,10 @@
 const Boom = require('@hapi/boom');
-const {
-    findAppUsers,
-    createMissingAppUsers,
-    buildUser,
-    wantsIndividual,
-} = require('../app-user-helpers');
-const { getLogger } = require('../../logs');
-
-const log = getLogger('frigg.user.x_frigg_headers');
-
-const NOT_A_MEMBER_MESSAGE =
-    'Not a member: the user identified by x-frigg-appUserId is not a member of the ' +
-    'organization identified by x-frigg-appOrgId, and strict membership does not ' +
-    'allow these headers to add them.';
+const { User } = require('../user');
 
 /**
  * Use case for retrieving or creating a user from x-frigg header identifiers.
  * Supports backend-to-backend API communication using application user IDs.
  *
- * `x-frigg-appOrgId` names the request's active organization (ADR-056 §3.6).
- * A person the organization does not know yet is added to it as a member; the
- * person is never moved out of another organization, and
- * `IndividualUser.organizationId` is set only on a first link.
- *
- * With `user.strictMembership: true` the headers cannot make anyone a member of
- * an organization that already existed: a person who is not already a member
- * (a brand-new `appUserId` included) is refused with 400. The one thing strict
- * mode still allows is naming an organization this request creates, so a first
- * login can bootstrap its own organization. Apps that run strict add people to
- * existing organizations themselves, through the membership repository.
- *
- * `strictUserValidation` is a deprecated alias for `strictMembership`; its
- * meaning changed (it used to reject a mismatched individual/organization pair).
- *
  * @class GetUserFromXFriggHeaders
  */
 class GetUserFromXFriggHeaders {
@@ -40,22 +12,11 @@ class GetUserFromXFriggHeaders {
      * Creates a new GetUserFromXFriggHeaders instance.
      * @param {Object} params - Configuration parameters.
      * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
-     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
      * @param {Object} params.userConfig - The user config in the app definition.
      */
-    constructor({ userRepository, ensureOrganizationMembership, userConfig }) {
+    constructor({ userRepository, userConfig }) {
         this.userRepository = userRepository;
-        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
-
-        const { strictMembership, strictUserValidation } = userConfig ?? {};
-        if (strictUserValidation !== undefined && strictMembership === undefined) {
-            log.warn(
-                'user.strictUserValidation is deprecated and now means strictMembership; rename it',
-                { eventName: `${log.name}.strict_user_validation_deprecated` }
-            );
-        }
-        this.strict = Boolean(strictMembership ?? strictUserValidation);
     }
 
     /**
@@ -64,7 +25,7 @@ class GetUserFromXFriggHeaders {
      * @param {string} [appUserId] - The app user ID from x-frigg-appUserId header.
      * @param {string} [appOrgId] - The app organization ID from x-frigg-appOrgId header.
      * @returns {Promise<import('../user').User>} The authenticated user object.
-     * @throws {Boom} 400 Bad Request if neither ID is provided or, in strict mode, if the person is not already a member of the existing organization named.
+     * @throws {Boom} 400 Bad Request if neither ID is provided or if both IDs are provided but belong to different users.
      */
     async execute(appUserId, appOrgId) {
         // At least one header must be provided
@@ -75,60 +36,96 @@ class GetUserFromXFriggHeaders {
         }
 
         // Find users by both IDs if both are provided
-        let { individual: individualUserData, organization: organizationUserData } =
-            await findAppUsers(this.userRepository, this.userConfig, {
-                appUserId,
-                appOrgId,
-            });
+        let individualUserData = null;
+        let organizationUserData = null;
+
+        if (appUserId && this.userConfig.individualUserRequired !== false) {
+            individualUserData =
+                await this.userRepository.findIndividualUserByAppUserId(
+                    appUserId
+                );
+        }
 
-        // Strict mode refuses to make anyone a member of an organization that
-        // existed before this request. Only an organization created below is
-        // exempt, since it has no members to disagree with.
-        const refuseNewMembers = this.strict && Boolean(organizationUserData);
+        if (appOrgId && this.userConfig.organizationUserRequired) {
+            organizationUserData =
+                await this.userRepository.findOrganizationUserByAppOrgId(
+                    appOrgId
+                );
+        }
 
-        // A person who does not exist yet cannot already be a member, so refuse
-        // now, before anything is persisted: refusing after creating them would
-        // leave an orphan individual behind on every refused request.
+        // VALIDATION/AUTO-LINKING: If both IDs provided and both users exist, handle mismatch
         if (
-            refuseNewMembers &&
             appUserId &&
-            wantsIndividual(this.userConfig) &&
-            !individualUserData
+            appOrgId &&
+            individualUserData &&
+            organizationUserData
         ) {
-            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
+            // Check if individual user is linked to the org user
+            const individualOrgId =
+                individualUserData.organizationUser?.toString();
+            const expectedOrgId = organizationUserData.id?.toString();
+
+            if (individualOrgId !== expectedOrgId) {
+                // Default behavior: Auto-link disconnected users
+                // Opt-in strict mode: Throw error on mismatch
+                if (this.userConfig.strictUserValidation) {
+                    throw Boom.badRequest(
+                        'User ID mismatch: x-frigg-appUserId and x-frigg-appOrgId refer to different users. ' +
+                            'Provide only one identifier or ensure they belong to the same user.'
+                    );
+                }
+
+                // Auto-link the users
+                individualUserData = await this.userRepository.linkIndividualToOrganization(
+                    individualUserData.id,
+                    organizationUserData.id
+                );
+            }
         }
 
         // Auto-create users independently if they don't exist and are required
-        const created = await createMissingAppUsers(
-            this.userRepository,
-            this.userConfig,
-            {
-                appUserId,
-                appOrgId,
-                individual: individualUserData,
-                organization: organizationUserData,
-            }
-        );
-        individualUserData = created.individual;
-        organizationUserData = created.organization;
+        if (
+            !individualUserData &&
+            appUserId &&
+            this.userConfig.individualUserRequired !== false
+        ) {
+            individualUserData =
+                await this.userRepository.createIndividualUser({
+                    appUserId,
+                    username: `app-user-${appUserId}`,
+                    email: `${appUserId}@app.local`,
+                });
+        }
 
-        // The organization named by the header is the active one: join it
-        // rather than re-linking the person's single organizationId.
-        const ensured = await this.ensureOrganizationMembership.execute({
-            individual: individualUserData,
-            organization: organizationUserData,
-            requireExisting: refuseNewMembers,
-        });
-        if (refuseNewMembers && individualUserData && !ensured.membership) {
-            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
+        if (
+            !organizationUserData &&
+            appOrgId &&
+            this.userConfig.organizationUserRequired
+        ) {
+            organizationUserData =
+                await this.userRepository.createOrganizationUser({
+                    appOrgId,
+                });
+
+            // Link individual user to newly created org user if individual exists
+            if (individualUserData && organizationUserData) {
+                individualUserData = await this.userRepository.linkIndividualToOrganization(
+                    individualUserData.id,
+                    organizationUserData.id
+                );
+            }
         }
-        individualUserData = ensured.individual;
 
-        return buildUser(
-            this.userConfig,
+        const user = new User(
             individualUserData,
-            organizationUserData
+            organizationUserData,
+            this.userConfig.usePassword,
+            this.userConfig.primary,
+            this.userConfig.individualUserRequired,
+            this.userConfig.organizationUserRequired
         );
+
+        return user;
     }
 }
 

package/user/user.js

@@ -1,20 +1,5 @@
 const bcrypt = require('bcryptjs');
 
-/**
- * How the request that produced a `User` proved who it is. Set by
- * AuthenticateUser, never inferred from a missing value. Organization roles
- * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
- * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
- * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
- * adopter token has the role it carries, else the stored membership role,
- * else `MEMBER`.
- */
-const AUTH_SOURCES = Object.freeze({
-    SHARED_SECRET: 'shared-secret',
-    ADOPTER_JWT: 'adopter-jwt',
-    BEARER_TOKEN: 'bearer-token',
-});
-
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -33,14 +18,6 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
-        // Organization role from an adopter token claim (ADR-056 §2), per
-        // request. When present it wins over the stored membership role.
-        this.orgRole = null;
-        // The role stored on the person's membership of the active organization
-        // (OrganizationMembership.orgRole); used when the token carries none.
-        this.membershipRole = null;
-        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
-        this.authSource = null;
 
         this.config = {
             primary,
@@ -49,17 +26,6 @@ class User {
         };
     }
 
-    /**
-     * The organization this request acts in (ADR-056 §3.6): the one the token or
-     * `x-frigg-appOrgId` named, not the person's legacy `organizationId`
-     * pointer. Null when the request has no organization.
-     * @returns {string|null}
-     */
-    getActiveOrganizationId() {
-        const id = this.organizationUser?.id;
-        return id === undefined || id === null || id === '' ? null : String(id);
-    }
-
     getPrimaryUser() {
         if (this.config.primary === 'organization') {
             return this.organizationUser;
@@ -67,11 +33,6 @@ class User {
         return this.individualUser;
     }
 
-    /**
-     * The id of the primary user. With `primary: 'organization'` this is the
-     * active organization (the one the request named), never the organization
-     * the person was first linked to.
-     */
     getId() {
         return this.getPrimaryUser()?.id;
     }
@@ -104,30 +65,6 @@ class User {
         return this.config.individualUserRequired;
     }
 
-    getAuthSource() {
-        return this.authSource;
-    }
-
-    setAuthSource(authSource) {
-        this.authSource = authSource ?? null;
-    }
-
-    getOrgRole() {
-        return this.orgRole;
-    }
-
-    setOrgRole(orgRole) {
-        this.orgRole = orgRole ?? null;
-    }
-
-    getMembershipRole() {
-        return this.membershipRole;
-    }
-
-    setMembershipRole(membershipRole) {
-        this.membershipRole = membershipRole ?? null;
-    }
-
     getIndividualUser() {
         return this.individualUser;
     }
@@ -185,4 +122,4 @@ class User {
     }
 }
 
-module.exports = { User, AUTH_SOURCES }; 
+module.exports = { User }; 

package/credential/use-cases/credential-operations-for-user.js

@@ -1,202 +0,0 @@
-const Boom = require('@hapi/boom');
-const {
-    createScopePolicy,
-    describeRecord,
-    visibilityClauses,
-    matchesListFilters,
-    SCOPES,
-} = require('../../modules/entity-scope');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
-
-/**
- * Management API v2 credential operations (ADR-056 §3.4, §3.6). A credential
- * has no module name and no organization of its own:
- *
- * - its `type` and `entityIds` come from the entities that use it that the
- *   caller may see, so the same person's account connected in two
- *   organizations (one credential, two entities) lists in each organization
- *   with that organization's entity only;
- * - who it belongs to is its OWNER (`credential.userId`), never the entities:
- *   a credential an individual entity and an organization entity both point at
- *   (possible only through legacy data) is described by whoever owns the
- *   credential, so the answer cannot change with the order the entities load;
- * - a credential whose entities are all out of sight (another organization's)
- *   is a 404, and one with no entities at all (its entity was deleted) is
- *   visible to its owner only, as it was before scoping.
- */
-
-const credentialIdOf = (entity) => {
-    const ref = entity.credential ?? entity.credentialId;
-    if (ref === undefined || ref === null) return null;
-    if (typeof ref === 'object') {
-        const id = ref.id ?? ref._id;
-        return id === undefined || id === null ? null : String(id);
-    }
-    return String(ref);
-};
-
-/** Adds `type` and `entityIds` from the user's entities to each credential. */
-function withEntityUsage(credentials, entities) {
-    const usage = new Map();
-    for (const entity of entities || []) {
-        const credentialId = credentialIdOf(entity);
-        if (!credentialId) continue;
-        const entry = usage.get(credentialId) || { type: null, entityIds: [] };
-        entry.type = entry.type || entity.moduleName || null;
-        entry.entityIds.push(String(entity.id));
-        usage.set(credentialId, entry);
-    }
-    return credentials.map((credential) => {
-        const entry = usage.get(String(credential.id)) || {
-            type: null,
-            entityIds: [],
-        };
-        return { ...credential, type: entry.type, entityIds: entry.entityIds };
-    });
-}
-
-/**
- * `{scope, owner, organizationId, access}` of a credential for this caller, or
- * null when its owner is neither the caller nor the active organization. Built
- * by `describeRecord` over the row a connection by this owner has: the
- * organization of a visible entity, else the one a new entity would get.
- */
-function credentialTenancy(credential, visibleEntities, ctx) {
-    const entityOrg = visibleEntities.find(
-        (entity) => entity.organizationId !== undefined && entity.organizationId !== null
-    )?.organizationId;
-    const organizationId =
-        entityOrg ?? (ctx.individualAcross === 'all' ? null : ctx.activeOrgId);
-    return describeRecord({ userId: credential.userId, organizationId }, ctx, 'entity');
-}
-
-/** The entities of `entities` the caller may see, each with its `tenancy`. */
-function visibleOf(entities, ctx) {
-    const visible = [];
-    for (const entity of entities || []) {
-        const tenancy = describeRecord(entity, ctx, 'entity');
-        if (tenancy) visible.push({ ...entity, tenancy });
-    }
-    return visible;
-}
-
-/**
- * The caller's credentials with their type, the entities of them they may see
- * and `tenancy`. Credentials with no entity at all are listed too, for the
- * person and the active organization that own them.
- */
-class ListCredentialsForUser {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
-    }
-
-    /** @param {{scope?: string, owner?: string}} [filters] */
-    async execute(user, filters = {}) {
-        const ctx = this.scopePolicy.accessContext(user);
-        const owners = [...new Set([ctx.callerId, ctx.activeOrgId].filter(Boolean))];
-        const [found, perOwner, owned] = await Promise.all([
-            this.moduleRepository.findEntitiesByOwnership(visibilityClauses(ctx, 'entity')),
-            Promise.all(owners.map((id) => this.credentialRepository.findCredentialsByUserId(id))),
-            // Every entity of those owners, in any organization: only to tell a credential
-            // with no entity at all from one used elsewhere.
-            Promise.all(owners.map((id) => this.moduleRepository.findEntitiesByUserId(id))),
-        ]);
-        const visible = visibleOf(found, ctx);
-        const usedAnywhere = new Set(owned.flat().map(credentialIdOf).filter(Boolean));
-        const listed = [];
-        for (const credential of perOwner.flat().filter(Boolean)) {
-            const id = String(credential.id);
-            const referencing = visible.filter((entity) => credentialIdOf(entity) === id);
-            if (referencing.length === 0 && usedAnywhere.has(id)) continue;
-            const tenancy = credentialTenancy(credential, referencing, ctx);
-            if (!tenancy || !matchesListFilters(tenancy, filters)) continue;
-            listed.push({ ...withEntityUsage([credential], referencing)[0], tenancy });
-        }
-        return listed;
-    }
-}
-
-/** One credential the caller may see: see the header. 404 otherwise. */
-class GetCredentialForUserV2 {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
-    }
-
-    async execute(credentialId, user) {
-        const notFound = () =>
-            Boom.notFound(`Credential ${credentialId} not found`, {
-                code: 'CREDENTIAL_NOT_FOUND',
-            });
-        let credential = null;
-        try {
-            credential = await this.credentialRepository.findCredentialById(
-                credentialId
-            );
-        } catch (error) {
-            if (!/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
-                throw error;
-            }
-        }
-        if (!credential) throw notFound();
-        const ctx = this.scopePolicy.accessContext(user);
-
-        const referencing =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        const visible = visibleOf(referencing, ctx);
-        if (referencing.length > 0 && visible.length === 0) throw notFound();
-        const tenancy = credentialTenancy(credential, visible, ctx);
-        if (!tenancy) throw notFound();
-        return { ...withEntityUsage([credential], visible)[0], tenancy };
-    }
-}
-
-/**
- * Deletes a credential the caller may manage. The entities that used it stay,
- * with their credential unset, so they show as needing re-authorization rather
- * than disappearing from integrations.
- *
- * Refuses with 409 `CREDENTIAL_SHARED` while an entity the caller cannot see
- * still uses it: one credential row serves the same provider account in every
- * organization, and deleting it from one would break the other. The message
- * says nothing about the other connections (not even how many): remove the
- * entities that use it, and it goes with the last one.
- */
-class DeleteCredentialForUser {
-    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.getCredentialForUser = getCredentialForUser;
-    }
-
-    async execute(credentialId, user) {
-        const credential = await this.getCredentialForUser.execute(
-            credentialId,
-            user
-        );
-        assertCanManage(credential.tenancy.access, `credential ${credential.id}`);
-        const usedBy =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        if (usedBy.length > credential.entityIds.length) {
-            throw Boom.conflict(
-                `Credential ${credential.id} is still in use by other connections and cannot be deleted from here`,
-                { code: 'CREDENTIAL_SHARED' }
-            );
-        }
-        for (const entityId of credential.entityIds) {
-            await this.moduleRepository.unsetCredential(entityId);
-        }
-        await this.credentialRepository.deleteCredentialById(credential.id);
-        return { id: String(credential.id), entityIds: credential.entityIds };
-    }
-}
-
-module.exports = {
-    ListCredentialsForUser,
-    GetCredentialForUserV2,
-    DeleteCredentialForUser,
-    withEntityUsage,
-};

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -1,73 +0,0 @@
-const Boom = require('@hapi/boom');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
-
-/**
- * Re-authorization of a credential the caller owns (Management API v2). It
- * runs the same flow as /api/v2/authorize for the credential's entity type,
- * with the session bound to the credential so it cannot be reused for
- * anything else.
- */
-async function credentialEntityType(getCredentialForUser, credentialId, user) {
-    const credential = await getCredentialForUser.execute(credentialId, user);
-    if (!credential.type) {
-        throw Boom.conflict(
-            `Credential ${credentialId} is not used by any entity, so its type is unknown; authorize a new connection instead`,
-            { code: 'CREDENTIAL_TYPE_UNKNOWN' }
-        );
-    }
-    return {
-        entityType: credential.type,
-        credentialId: String(credential.id),
-        // A re-authorization keeps the scope the connection already has.
-        fixedScope: credential.tenancy?.scope,
-        access: credential.tenancy?.access,
-    };
-}
-
-/** GET /api/v2/credentials/:credentialId/reauthorize */
-class GetCredentialReauthorization {
-    constructor({ getCredentialForUser, getAuthorizationStep }) {
-        this.getCredentialForUser = getCredentialForUser;
-        this.getAuthorizationStep = getAuthorizationStep;
-    }
-
-    async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
-        const { entityType, credentialId: boundCredentialId } =
-            await credentialEntityType(this.getCredentialForUser, credentialId, user);
-        return this.getAuthorizationStep.execute({
-            user,
-            entityType,
-            credentialId: boundCredentialId,
-            step,
-            sessionId,
-            state,
-        });
-    }
-}
-
-/** POST /api/v2/credentials/:credentialId/reauthorize */
-class ReauthorizeCredentialForUser {
-    constructor({ getCredentialForUser, submitAuthorizationStep }) {
-        this.getCredentialForUser = getCredentialForUser;
-        this.submitAuthorizationStep = submitAuthorizationStep;
-    }
-
-    async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
-        const { access, ...binding } = await credentialEntityType(
-            this.getCredentialForUser,
-            credentialId,
-            user
-        );
-        // A credential an organization owns: the organization's admins only.
-        assertCanManage(access, `credential ${credentialId}`);
-        return this.submitAuthorizationStep.execute({
-            user,
-            ...binding,
-            data,
-            step,
-            sessionId,
-        });
-    }
-}
-
-module.exports = { GetCredentialReauthorization, ReauthorizeCredentialForUser };

package/database/organization-where.js

@@ -1,18 +0,0 @@
-/**
- * The Prisma `where` fragment for an `organizationId` on MongoDB (ADR-056
- * §3.6), shared by the entity and integration adapters.
- *
- * Prisma on MongoDB: `null` matches only an explicit null and `isSet: false`
- * only a missing field. A row written before the column existed is the common
- * "no organization" case, so `null` here means both.
- */
-function organizationWhere(organizationId) {
-    if (organizationId === null) {
-        return {
-            OR: [{ organizationId: null }, { organizationId: { isSet: false } }],
-        };
-    }
-    return { organizationId };
-}
-
-module.exports = { organizationWhere };

package/database/unique-violation.js

@@ -1,25 +0,0 @@
-/** Mongo/DocumentDB duplicate-key error code. */
-const DUPLICATE_KEY_CODE = 11000;
-/** Prisma's unique-constraint error code (PostgreSQL and MongoDB). */
-const PRISMA_UNIQUE_CODE = 'P2002';
-
-/**
- * Whether `error` is a unique-constraint violation, however the database
- * layer raised it: a Prisma `P2002`, or a duplicate-key `11000`
- * (`documentdb-utils` `insertOne` sets `code` on the error it throws).
- * Matches on the code only, never on message text.
- *
- * @param {unknown} error
- * @returns {boolean}
- */
-function isUniqueViolation(error) {
-    return (
-        error?.code === PRISMA_UNIQUE_CODE || error?.code === DUPLICATE_KEY_CODE
-    );
-}
-
-module.exports = {
-    isUniqueViolation,
-    DUPLICATE_KEY_CODE,
-    PRISMA_UNIQUE_CODE,
-};

package/extensions/bootstrap-runner.js

@@ -1,43 +0,0 @@
-/**
- * Bootstrap Runner
- *
- * Runs extension bootstrap functions in sequence.
- * Bootstrap hooks execute AFTER database connection but BEFORE integration
- * router creation. This is the right place for extensions to:
- *
- * - Load credentials from database into integration definitions
- * - Register additional middleware or services
- * - Perform one-time initialization
- *
- * @example
- * await runExtensionBootstraps(extensions, { prisma, appDefinition });
- */
-
-/**
- * Runs all extension bootstrap functions in sequence.
- *
- * @param {Array<Object>} extensions - Normalized extensions (from extension-loader)
- * @param {Object} context
- * @param {Object} context.prisma - Prisma client instance
- * @param {Object} context.appDefinition - Full app definition
- * @throws {Error} If any bootstrap function fails (fails fast)
- */
-async function runExtensionBootstraps(extensions, context = {}) {
-    if (!extensions || extensions.length === 0) return;
-
-    const { prisma, appDefinition } = context;
-
-    for (const ext of extensions) {
-        if (!ext.bootstrap) continue;
-
-        try {
-            await ext.bootstrap(prisma, appDefinition);
-        } catch (error) {
-            throw new Error(
-                `Extension "${ext.name}" bootstrap failed: ${error.message}`
-            );
-        }
-    }
-}
-
-module.exports = { runExtensionBootstraps };