@friggframework/core 2.0.0--canary.690.3fe2b27.0 → 2.0.0--canary.705.9cfd819.0

package/user/user.js

@@ -1,20 +1,5 @@
 const bcrypt = require('bcryptjs');
 
-/**
- * How the request that produced a `User` proved who it is. Set by
- * AuthenticateUser, never inferred from a missing value. Organization roles
- * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
- * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
- * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
- * adopter token has the role it carries, else the stored membership role,
- * else `MEMBER`.
- */
-const AUTH_SOURCES = Object.freeze({
-    SHARED_SECRET: 'shared-secret',
-    ADOPTER_JWT: 'adopter-jwt',
-    BEARER_TOKEN: 'bearer-token',
-});
-
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -33,14 +18,6 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
-        // Organization role from an adopter token claim (ADR-056 §2), per
-        // request. When present it wins over the stored membership role.
-        this.orgRole = null;
-        // The role stored on the person's membership of the active organization
-        // (OrganizationMembership.orgRole); used when the token carries none.
-        this.membershipRole = null;
-        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
-        this.authSource = null;
 
         this.config = {
             primary,
@@ -49,17 +26,6 @@ class User {
         };
     }
 
-    /**
-     * The organization this request acts in (ADR-056 §3.6): the one the token or
-     * `x-frigg-appOrgId` named, not the person's legacy `organizationId`
-     * pointer. Null when the request has no organization.
-     * @returns {string|null}
-     */
-    getActiveOrganizationId() {
-        const id = this.organizationUser?.id;
-        return id === undefined || id === null || id === '' ? null : String(id);
-    }
-
     getPrimaryUser() {
         if (this.config.primary === 'organization') {
             return this.organizationUser;
@@ -67,11 +33,6 @@ class User {
         return this.individualUser;
     }
 
-    /**
-     * The id of the primary user. With `primary: 'organization'` this is the
-     * active organization (the one the request named), never the organization
-     * the person was first linked to.
-     */
     getId() {
         return this.getPrimaryUser()?.id;
     }
@@ -104,30 +65,6 @@ class User {
         return this.config.individualUserRequired;
     }
 
-    getAuthSource() {
-        return this.authSource;
-    }
-
-    setAuthSource(authSource) {
-        this.authSource = authSource ?? null;
-    }
-
-    getOrgRole() {
-        return this.orgRole;
-    }
-
-    setOrgRole(orgRole) {
-        this.orgRole = orgRole ?? null;
-    }
-
-    getMembershipRole() {
-        return this.membershipRole;
-    }
-
-    setMembershipRole(membershipRole) {
-        this.membershipRole = membershipRole ?? null;
-    }
-
     getIndividualUser() {
         return this.individualUser;
     }
@@ -185,4 +122,4 @@ class User {
     }
 }
 
-module.exports = { User, AUTH_SOURCES }; 
+module.exports = { User }; 

package/credential/use-cases/credential-operations-for-user.js

@@ -1,202 +0,0 @@
-const Boom = require('@hapi/boom');
-const {
-    createScopePolicy,
-    describeRecord,
-    visibilityClauses,
-    matchesListFilters,
-    SCOPES,
-} = require('../../modules/entity-scope');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
-
-/**
- * Management API v2 credential operations (ADR-056 §3.4, §3.6). A credential
- * has no module name and no organization of its own:
- *
- * - its `type` and `entityIds` come from the entities that use it that the
- *   caller may see, so the same person's account connected in two
- *   organizations (one credential, two entities) lists in each organization
- *   with that organization's entity only;
- * - who it belongs to is its OWNER (`credential.userId`), never the entities:
- *   a credential an individual entity and an organization entity both point at
- *   (possible only through legacy data) is described by whoever owns the
- *   credential, so the answer cannot change with the order the entities load;
- * - a credential whose entities are all out of sight (another organization's)
- *   is a 404, and one with no entities at all (its entity was deleted) is
- *   visible to its owner only, as it was before scoping.
- */
-
-const credentialIdOf = (entity) => {
-    const ref = entity.credential ?? entity.credentialId;
-    if (ref === undefined || ref === null) return null;
-    if (typeof ref === 'object') {
-        const id = ref.id ?? ref._id;
-        return id === undefined || id === null ? null : String(id);
-    }
-    return String(ref);
-};
-
-/** Adds `type` and `entityIds` from the user's entities to each credential. */
-function withEntityUsage(credentials, entities) {
-    const usage = new Map();
-    for (const entity of entities || []) {
-        const credentialId = credentialIdOf(entity);
-        if (!credentialId) continue;
-        const entry = usage.get(credentialId) || { type: null, entityIds: [] };
-        entry.type = entry.type || entity.moduleName || null;
-        entry.entityIds.push(String(entity.id));
-        usage.set(credentialId, entry);
-    }
-    return credentials.map((credential) => {
-        const entry = usage.get(String(credential.id)) || {
-            type: null,
-            entityIds: [],
-        };
-        return { ...credential, type: entry.type, entityIds: entry.entityIds };
-    });
-}
-
-/**
- * `{scope, owner, organizationId, access}` of a credential for this caller, or
- * null when its owner is neither the caller nor the active organization. Built
- * by `describeRecord` over the row a connection by this owner has: the
- * organization of a visible entity, else the one a new entity would get.
- */
-function credentialTenancy(credential, visibleEntities, ctx) {
-    const entityOrg = visibleEntities.find(
-        (entity) => entity.organizationId !== undefined && entity.organizationId !== null
-    )?.organizationId;
-    const organizationId =
-        entityOrg ?? (ctx.individualAcross === 'all' ? null : ctx.activeOrgId);
-    return describeRecord({ userId: credential.userId, organizationId }, ctx, 'entity');
-}
-
-/** The entities of `entities` the caller may see, each with its `tenancy`. */
-function visibleOf(entities, ctx) {
-    const visible = [];
-    for (const entity of entities || []) {
-        const tenancy = describeRecord(entity, ctx, 'entity');
-        if (tenancy) visible.push({ ...entity, tenancy });
-    }
-    return visible;
-}
-
-/**
- * The caller's credentials with their type, the entities of them they may see
- * and `tenancy`. Credentials with no entity at all are listed too, for the
- * person and the active organization that own them.
- */
-class ListCredentialsForUser {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
-    }
-
-    /** @param {{scope?: string, owner?: string}} [filters] */
-    async execute(user, filters = {}) {
-        const ctx = this.scopePolicy.accessContext(user);
-        const owners = [...new Set([ctx.callerId, ctx.activeOrgId].filter(Boolean))];
-        const [found, perOwner, owned] = await Promise.all([
-            this.moduleRepository.findEntitiesByOwnership(visibilityClauses(ctx, 'entity')),
-            Promise.all(owners.map((id) => this.credentialRepository.findCredentialsByUserId(id))),
-            // Every entity of those owners, in any organization: only to tell a credential
-            // with no entity at all from one used elsewhere.
-            Promise.all(owners.map((id) => this.moduleRepository.findEntitiesByUserId(id))),
-        ]);
-        const visible = visibleOf(found, ctx);
-        const usedAnywhere = new Set(owned.flat().map(credentialIdOf).filter(Boolean));
-        const listed = [];
-        for (const credential of perOwner.flat().filter(Boolean)) {
-            const id = String(credential.id);
-            const referencing = visible.filter((entity) => credentialIdOf(entity) === id);
-            if (referencing.length === 0 && usedAnywhere.has(id)) continue;
-            const tenancy = credentialTenancy(credential, referencing, ctx);
-            if (!tenancy || !matchesListFilters(tenancy, filters)) continue;
-            listed.push({ ...withEntityUsage([credential], referencing)[0], tenancy });
-        }
-        return listed;
-    }
-}
-
-/** One credential the caller may see: see the header. 404 otherwise. */
-class GetCredentialForUserV2 {
-    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || createScopePolicy();
-    }
-
-    async execute(credentialId, user) {
-        const notFound = () =>
-            Boom.notFound(`Credential ${credentialId} not found`, {
-                code: 'CREDENTIAL_NOT_FOUND',
-            });
-        let credential = null;
-        try {
-            credential = await this.credentialRepository.findCredentialById(
-                credentialId
-            );
-        } catch (error) {
-            if (!/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
-                throw error;
-            }
-        }
-        if (!credential) throw notFound();
-        const ctx = this.scopePolicy.accessContext(user);
-
-        const referencing =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        const visible = visibleOf(referencing, ctx);
-        if (referencing.length > 0 && visible.length === 0) throw notFound();
-        const tenancy = credentialTenancy(credential, visible, ctx);
-        if (!tenancy) throw notFound();
-        return { ...withEntityUsage([credential], visible)[0], tenancy };
-    }
-}
-
-/**
- * Deletes a credential the caller may manage. The entities that used it stay,
- * with their credential unset, so they show as needing re-authorization rather
- * than disappearing from integrations.
- *
- * Refuses with 409 `CREDENTIAL_SHARED` while an entity the caller cannot see
- * still uses it: one credential row serves the same provider account in every
- * organization, and deleting it from one would break the other. The message
- * says nothing about the other connections (not even how many): remove the
- * entities that use it, and it goes with the last one.
- */
-class DeleteCredentialForUser {
-    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
-        this.credentialRepository = credentialRepository;
-        this.moduleRepository = moduleRepository;
-        this.getCredentialForUser = getCredentialForUser;
-    }
-
-    async execute(credentialId, user) {
-        const credential = await this.getCredentialForUser.execute(
-            credentialId,
-            user
-        );
-        assertCanManage(credential.tenancy.access, `credential ${credential.id}`);
-        const usedBy =
-            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
-        if (usedBy.length > credential.entityIds.length) {
-            throw Boom.conflict(
-                `Credential ${credential.id} is still in use by other connections and cannot be deleted from here`,
-                { code: 'CREDENTIAL_SHARED' }
-            );
-        }
-        for (const entityId of credential.entityIds) {
-            await this.moduleRepository.unsetCredential(entityId);
-        }
-        await this.credentialRepository.deleteCredentialById(credential.id);
-        return { id: String(credential.id), entityIds: credential.entityIds };
-    }
-}
-
-module.exports = {
-    ListCredentialsForUser,
-    GetCredentialForUserV2,
-    DeleteCredentialForUser,
-    withEntityUsage,
-};

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -1,73 +0,0 @@
-const Boom = require('@hapi/boom');
-const { assertCanManage } = require('../../modules/use-cases/manage-access');
-
-/**
- * Re-authorization of a credential the caller owns (Management API v2). It
- * runs the same flow as /api/v2/authorize for the credential's entity type,
- * with the session bound to the credential so it cannot be reused for
- * anything else.
- */
-async function credentialEntityType(getCredentialForUser, credentialId, user) {
-    const credential = await getCredentialForUser.execute(credentialId, user);
-    if (!credential.type) {
-        throw Boom.conflict(
-            `Credential ${credentialId} is not used by any entity, so its type is unknown; authorize a new connection instead`,
-            { code: 'CREDENTIAL_TYPE_UNKNOWN' }
-        );
-    }
-    return {
-        entityType: credential.type,
-        credentialId: String(credential.id),
-        // A re-authorization keeps the scope the connection already has.
-        fixedScope: credential.tenancy?.scope,
-        access: credential.tenancy?.access,
-    };
-}
-
-/** GET /api/v2/credentials/:credentialId/reauthorize */
-class GetCredentialReauthorization {
-    constructor({ getCredentialForUser, getAuthorizationStep }) {
-        this.getCredentialForUser = getCredentialForUser;
-        this.getAuthorizationStep = getAuthorizationStep;
-    }
-
-    async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
-        const { entityType, credentialId: boundCredentialId } =
-            await credentialEntityType(this.getCredentialForUser, credentialId, user);
-        return this.getAuthorizationStep.execute({
-            user,
-            entityType,
-            credentialId: boundCredentialId,
-            step,
-            sessionId,
-            state,
-        });
-    }
-}
-
-/** POST /api/v2/credentials/:credentialId/reauthorize */
-class ReauthorizeCredentialForUser {
-    constructor({ getCredentialForUser, submitAuthorizationStep }) {
-        this.getCredentialForUser = getCredentialForUser;
-        this.submitAuthorizationStep = submitAuthorizationStep;
-    }
-
-    async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
-        const { access, ...binding } = await credentialEntityType(
-            this.getCredentialForUser,
-            credentialId,
-            user
-        );
-        // A credential an organization owns: the organization's admins only.
-        assertCanManage(access, `credential ${credentialId}`);
-        return this.submitAuthorizationStep.execute({
-            user,
-            ...binding,
-            data,
-            step,
-            sessionId,
-        });
-    }
-}
-
-module.exports = { GetCredentialReauthorization, ReauthorizeCredentialForUser };

package/database/encryption/encryption-config.js

@@ -1,219 +0,0 @@
-/**
- * Field-level encryption configuration: decides whether sensitive fields are
- * encrypted, and with which key, from the process environment.
- *
- * The rule fails closed:
- *
- * - **Deployed** (running in AWS Lambda, and not under
- *   serverless-offline, `serverless invoke local` or Jest): the stage name is
- *   ignored. A configured key (KMS_KEY_ARN, or AES_KEY_ID with AES_KEY) turns
- *   encryption on. With no key, the configuration is an error and the Prisma
- *   client refuses to start, unless FRIGG_ENCRYPTION_DISABLED=true opts out
- *   explicitly.
- * - **Local** (`frigg start`, tests, scripts on a laptop): the stages dev,
- *   test and local skip encryption. Any other stage encrypts when a key is
- *   configured and stays plaintext, with a warning, when none is.
- *
- * Every module that encrypts or reports on encryption reads this one rule.
- */
-
-const { logger } = require('./logger');
-const {
-    isDeployedRuntime: isDeployedProviderRuntime,
-} = require('../../providers/runtime-detection');
-
-const LOCAL_BYPASS_STAGES = ['dev', 'test', 'local'];
-const OPT_OUT_VAR = 'FRIGG_ENCRYPTION_DISABLED';
-
-class EncryptionConfigurationError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'EncryptionConfigurationError';
-    }
-}
-
-function isSet(value) {
-    return typeof value === 'string' && value.trim() !== '';
-}
-
-function isTrue(value) {
-    if (typeof value !== 'string') return false;
-    const normalized = value.trim().toLowerCase();
-    return normalized === 'true' || normalized === '1';
-}
-
-/**
- * True when the process runs as a deployed function, on AWS Lambda or on the
- * active provider's platform (provider-netlify: FRIGG_PROVIDER=netlify, set by
- * its generated entry points), and not under a local emulator or test runner.
- * One rule for encryption and queue authentication: core/providers/
- * runtime-detection asks the provider's detect(), and fails closed when a
- * named non-AWS provider cannot be loaded.
- *
- * @param {Object} [env=process.env]
- * @returns {boolean}
- */
-function isDeployedRuntime(env = process.env) {
-    return isDeployedProviderRuntime(env);
-}
-
-function missingKeyMessage(stage) {
-    return (
-        `[Frigg] No field-level encryption key is configured for stage "${stage}". ` +
-        'A deployed Frigg app will not write credentials and other sensitive fields in plaintext. ' +
-        "Fix: set encryption: { fieldLevelEncryptionMethod: 'kms' } in the app definition and redeploy " +
-        '(Frigg creates or discovers a KMS key and sets KMS_KEY_ARN), ' +
-        'or provide AES_KEY_ID and AES_KEY (32 characters) in the Lambda environment. ' +
-        `To run this stage without encryption on purpose, set ${OPT_OUT_VAR}=true ` +
-        "(or encryption: { fieldLevelEncryptionMethod: 'none' } in the app definition)."
-    );
-}
-
-function incompleteAesMessage(stage) {
-    return (
-        `[Frigg] AES_KEY_ID is set but AES_KEY is not (stage "${stage}"). ` +
-        'Provide AES_KEY (32 characters) alongside AES_KEY_ID, ' +
-        "or use KMS with encryption: { fieldLevelEncryptionMethod: 'kms' }."
-    );
-}
-
-/**
- * Resolves the encryption configuration without side effects.
- *
- * @param {Object} [env=process.env]
- * @returns {{
- *   enabled: boolean,
- *   method: 'kms'|'aes'|undefined,
- *   mode: 'kms'|'aes'|'none',
- *   runtime: 'deployed'|'local',
- *   stage: string,
- *   bypassed: boolean,
- *   optedOut: boolean,
- *   optOutIgnored: boolean,
- *   hasKMS: boolean,
- *   hasAES: boolean,
- *   error: string|null,
- * }} `error` is set when a deployed runtime has no usable key.
- */
-function resolveEncryptionConfig(env = process.env) {
-    const stage = env.STAGE || env.NODE_ENV || 'development';
-    const runtime = isDeployedRuntime(env) ? 'deployed' : 'local';
-    const hasKMS = isSet(env.KMS_KEY_ARN);
-    const hasAES = isSet(env.AES_KEY_ID);
-    const optOutRequested = isTrue(env[OPT_OUT_VAR]);
-
-    const base = {
-        enabled: false,
-        method: undefined,
-        mode: 'none',
-        runtime,
-        stage,
-        bypassed: false,
-        optedOut: false,
-        optOutIgnored: false,
-        hasKMS,
-        hasAES,
-        error: null,
-    };
-
-    if (runtime === 'local') {
-        if (LOCAL_BYPASS_STAGES.includes(String(stage).toLowerCase())) {
-            return { ...base, bypassed: true };
-        }
-        if (hasKMS || hasAES) {
-            const method = hasKMS ? 'kms' : 'aes';
-            return { ...base, enabled: true, method, mode: method };
-        }
-        return base;
-    }
-
-    const hasCompleteAES = hasAES && isSet(env.AES_KEY);
-    if (hasKMS || hasCompleteAES) {
-        const method = hasKMS ? 'kms' : 'aes';
-        return {
-            ...base,
-            enabled: true,
-            method,
-            mode: method,
-            optOutIgnored: optOutRequested,
-        };
-    }
-
-    if (optOutRequested) {
-        return { ...base, optedOut: true };
-    }
-
-    return {
-        ...base,
-        error: hasAES ? incompleteAesMessage(stage) : missingKeyMessage(stage),
-    };
-}
-
-const warned = new Set();
-
-function warnOnce(key, message) {
-    if (warned.has(key)) return;
-    warned.add(key);
-    logger.warn(message);
-}
-
-/**
- * Resolves the encryption configuration for use: throws when a deployed
- * runtime has no usable key, and warns once per process (once per Lambda
- * cold start) when encryption is explicitly disabled.
- *
- * @param {Object} [env=process.env]
- * @returns {ReturnType<typeof resolveEncryptionConfig>}
- * @throws {EncryptionConfigurationError}
- */
-function getEncryptionConfig(env = process.env) {
-    const config = resolveEncryptionConfig(env);
-
-    if (config.error) {
-        throw new EncryptionConfigurationError(config.error);
-    }
-
-    if (config.optedOut) {
-        warnOnce(
-            'opted-out',
-            `[Frigg] ${OPT_OUT_VAR}=true: field-level encryption is OFF for stage "${config.stage}". ` +
-                'Credentials and other sensitive fields are stored in PLAINTEXT. ' +
-                `Remove ${OPT_OUT_VAR} and configure a key (fieldLevelEncryptionMethod: 'kms') to encrypt them.`
-        );
-    }
-
-    if (config.optOutIgnored) {
-        warnOnce(
-            'opt-out-ignored',
-            `[Frigg] ${OPT_OUT_VAR}=true is ignored because an encryption key is configured; ` +
-                `fields are encrypted with ${config.method.toUpperCase()}. ` +
-                'Turning encryption off while a key is present would leave encrypted data unreadable.'
-        );
-    }
-
-    if (config.runtime === 'local' && !config.enabled && !config.bypassed) {
-        warnOnce(
-            'local-no-keys',
-            `No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID) for local stage "${config.stage}". ` +
-                'Field-level encryption disabled for this local run. ' +
-                'A deployed stage without a key refuses to start.'
-        );
-    }
-
-    return config;
-}
-
-/** Test helper: let the once-per-process warnings fire again. */
-function resetEncryptionConfigWarnings() {
-    warned.clear();
-}
-
-module.exports = {
-    EncryptionConfigurationError,
-    LOCAL_BYPASS_STAGES,
-    OPT_OUT_VAR,
-    getEncryptionConfig,
-    isDeployedRuntime,
-    resetEncryptionConfigWarnings,
-    resolveEncryptionConfig,
-};

package/database/encryption/test-support/fake-ciphertext.js

@@ -1,15 +0,0 @@
-/**
- * Test double for Cryptor output. Same shape as the real thing
- * (`keyId:iv:ciphertext:encryptedKey`: base64, 16-byte hex, hex, base64) so
- * FieldEncryptionService._isEncrypted accepts it, with the plaintext
- * recoverable for the fake decrypt.
- */
-const fakeCiphertext = (plain) =>
-    `a2V5SWQ=:${'0'.repeat(32)}:${Buffer.from(String(plain)).toString(
-        'hex'
-    )}:ZW5jS2V5`;
-
-const fakePlaintext = (ciphertext) =>
-    Buffer.from(String(ciphertext).split(':')[2], 'hex').toString();
-
-module.exports = { fakeCiphertext, fakePlaintext };

package/database/organization-where.js

@@ -1,18 +0,0 @@
-/**
- * The Prisma `where` fragment for an `organizationId` on MongoDB (ADR-056
- * §3.6), shared by the entity and integration adapters.
- *
- * Prisma on MongoDB: `null` matches only an explicit null and `isSet: false`
- * only a missing field. A row written before the column existed is the common
- * "no organization" case, so `null` here means both.
- */
-function organizationWhere(organizationId) {
-    if (organizationId === null) {
-        return {
-            OR: [{ organizationId: null }, { organizationId: { isSet: false } }],
-        };
-    }
-    return { organizationId };
-}
-
-module.exports = { organizationWhere };

package/database/unique-violation.js

@@ -1,25 +0,0 @@
-/** Mongo/DocumentDB duplicate-key error code. */
-const DUPLICATE_KEY_CODE = 11000;
-/** Prisma's unique-constraint error code (PostgreSQL and MongoDB). */
-const PRISMA_UNIQUE_CODE = 'P2002';
-
-/**
- * Whether `error` is a unique-constraint violation, however the database
- * layer raised it: a Prisma `P2002`, or a duplicate-key `11000`
- * (`documentdb-utils` `insertOne` sets `code` on the error it throws).
- * Matches on the code only, never on message text.
- *
- * @param {unknown} error
- * @returns {boolean}
- */
-function isUniqueViolation(error) {
-    return (
-        error?.code === PRISMA_UNIQUE_CODE || error?.code === DUPLICATE_KEY_CODE
-    );
-}
-
-module.exports = {
-    isUniqueViolation,
-    DUPLICATE_KEY_CODE,
-    PRISMA_UNIQUE_CODE,
-};