@friggframework/core 2.0.0--canary.703.12b980b.0 → 2.0.0--canary.707.df80bfd.0

package/integrations/integration-router.js

@@ -31,9 +31,6 @@ const {
     GetIntegrationInstance,
 } = require('./use-cases/get-integration-instance');
 const { UpdateIntegration } = require('./use-cases/update-integration');
-const {
-    getModulesDefinitionFromIntegrationClasses,
-} = require('./utils/map-integration-dto');
 const {
     GetModuleInstanceFromType,
 } = require('../modules/use-cases/get-module-instance-from-type');
@@ -54,47 +51,51 @@ const {
 const {
     createUserRepository,
 } = require('../user/repositories/user-repository-factory');
-const {
-    GetUserFromBearerToken,
-} = require('../user/use-cases/get-user-from-bearer-token');
-const {
-    GetUserFromXFriggHeaders,
-} = require('../user/use-cases/get-user-from-x-frigg-headers');
-const {
-    GetUserFromAdopterJwt,
-} = require('../user/use-cases/get-user-from-adopter-jwt');
 const {
     AuthenticateWithSharedSecret,
 } = require('../user/use-cases/authenticate-with-shared-secret');
 const { AuthenticateUser } = require('../user/use-cases/authenticate-user');
+const {
+    buildUserAuthentication,
+} = require('../user/create-user-authentication');
 const {
     ProcessAuthorizationCallback,
 } = require('../modules/use-cases/process-authorization-callback');
+const { createScopePolicy } = require('../modules/scope-policy');
+const {
+    AuthorizeEntityForUser,
+} = require('../modules/use-cases/authorize-entity-for-user');
+const {
+    CreateEntityFromCredential,
+} = require('../modules/use-cases/create-entity-from-credential');
+const {
+    ResolveIntegrationOwnership,
+} = require('./use-cases/resolve-integration-ownership');
+const { GetOwnedIntegrationRecord } = require('./use-cases/integration-operations-for-user');
 
 const log = getLogger('frigg.integrations');
 
 function createIntegrationRouter() {
-    const { integrations: integrationClasses, userConfig } =
-        loadAppDefinition();
+    // moduleDefinitions is the app registry's definitions (ADR-059), so
+    // /api/authorize and friends accept a type no integration binds.
+    const {
+        integrations: integrationClasses,
+        userConfig,
+        moduleDefinitions,
+        ownership,
+        entityTypeRegistry,
+    } = loadAppDefinition();
+    // Ownership by scope (ADR-056 §3): one object every use case asks.
+    const scopePolicy = createScopePolicy({ ownership, entityTypeRegistry });
     const moduleRepository = createModuleRepository();
     const integrationRepository = createIntegrationRepository();
     const credentialRepository = createCredentialRepository();
     const userRepository = createUserRepository();
-
-    const getUserFromBearerToken = new GetUserFromBearerToken({
-        userRepository,
-        userConfig,
-    });
-
-    const getUserFromXFriggHeaders = new GetUserFromXFriggHeaders({
-        userRepository,
-        userConfig,
-    });
-
-    const getUserFromAdopterJwt = new GetUserFromAdopterJwt({
-        userRepository,
-        userConfig,
-    });
+    const {
+        getUserFromBearerToken,
+        getUserFromXFriggHeaders,
+        getUserFromAdopterJwt,
+    } = buildUserAuthentication({ userConfig, userRepository });
 
     const authenticateWithSharedSecret = new AuthenticateWithSharedSecret();
 
@@ -108,8 +109,7 @@ function createIntegrationRouter() {
 
     const moduleFactory = new ModuleFactory({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
     });
     const deleteIntegrationForUser = new DeleteIntegrationForUser({
         integrationRepository,
@@ -122,6 +122,19 @@ function createIntegrationRouter() {
         integrationClasses,
         moduleFactory,
         moduleRepository,
+        scopePolicy,
+    });
+
+    // Decides who owns a new integration and which entities the caller may bind
+    // (the v1 create used to check neither), and who may reach an existing one.
+    const resolveIntegrationOwnership = new ResolveIntegrationOwnership({
+        moduleRepository,
+        integrationClasses,
+        scopePolicy,
+    });
+    const getOwnedIntegrationRecord = new GetOwnedIntegrationRecord({
+        integrationRepository,
+        scopePolicy,
     });
 
     const getCredentialForUser = new GetCredentialForUser({
@@ -136,8 +149,8 @@ function createIntegrationRouter() {
 
     const getEntitiesForUser = new GetEntitiesForUser({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+        scopePolicy,
     });
 
     const getIntegrationInstance = new GetIntegrationInstance({
@@ -153,54 +166,65 @@ function createIntegrationRouter() {
     });
 
     const getModuleInstanceFromType = new GetModuleInstanceFromType({
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
     });
 
     const getEntityOptionsByType = new GetEntityOptionsByType({
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
     });
 
     const testModuleAuth = new TestModuleAuth({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+        scopePolicy,
     });
 
     const getModule = new GetModule({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+        scopePolicy,
     });
 
     const getEntityOptionsById = new GetEntityOptionsById({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+        scopePolicy,
     });
 
     const refreshEntityOptions = new RefreshEntityOptions({
         moduleRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+        scopePolicy,
     });
 
     const getPossibleIntegrations = new GetPossibleIntegrations({
         integrationClasses,
     });
 
+    // The owner of what an authorization creates follows its scope (ADR-056 §3.2).
     const processAuthorizationCallback = new ProcessAuthorizationCallback({
         moduleRepository,
         credentialRepository,
         integrationRepository,
-        moduleDefinitions:
-            getModulesDefinitionFromIntegrationClasses(integrationClasses),
+        moduleDefinitions,
+    });
+    const authorizeEntityForUser = new AuthorizeEntityForUser({
+        scopePolicy,
+        processAuthorizationCallback,
+    });
+    // v1 POST /api/entity: same owner resolution as /api/authorize.
+    const createEntityFromCredential = new CreateEntityFromCredential({
+        authorizeEntityForUser,
+        processAuthorizationCallback,
+        credentialRepository,
+        moduleDefinitions,
     });
 
     const router = express();
 
     setIntegrationRoutes(router, authenticateUser, {
+        resolveIntegrationOwnership,
+        getOwnedIntegrationRecord,
         createIntegration,
         deleteIntegrationForUser,
         getIntegrationsForUser,
@@ -209,11 +233,6 @@ function createIntegrationRouter() {
         updateIntegration,
         getPossibleIntegrations,
     });
-    // Integration versions, run history, sync progress and approvals (ADR-063): mounted when the app registers the integration runtime.
-    require('./definitions/router').setIntegrationRuntimeRoutes(router, authenticateUser, {
-        getIntegrationInstance,
-        integrationClasses,
-    });
     setEntityRoutes(router, authenticateUser, {
         getCredentialForUser,
         getModuleInstanceFromType,
@@ -222,7 +241,8 @@ function createIntegrationRouter() {
         getModule,
         getEntityOptionsById,
         refreshEntityOptions,
-        processAuthorizationCallback,
+        authorizeEntityForUser,
+        createEntityFromCredential,
     });
     return router;
 }
@@ -259,6 +279,8 @@ function checkRequiredParams(params, requiredKeys) {
  */
 function setIntegrationRoutes(router, authenticateUser, useCases) {
     const {
+        resolveIntegrationOwnership,
+        getOwnedIntegrationRecord,
         createIntegration,
         deleteIntegrationForUser,
         getIntegrationsForUser,
@@ -267,15 +289,22 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
         updateIntegration,
         getPossibleIntegrations,
     } = useCases;
+
+    // The owner of an integration the caller may reach (404 otherwise), which is
+    // what the id-and-owner use cases below expect. `manage: true` is for
+    // changing or deleting: an organization's integration needs an admin (403).
+    const ownerOf = async (integrationId, user, options) =>
+        (await getOwnedIntegrationRecord.execute(integrationId, user, options))
+            .userId;
+
     router.route('/api/integrations').get(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
-            const integrations = await getIntegrationsForUser.execute(userId);
+            const integrations = await getIntegrationsForUser.execute(user);
             const results = {
                 entities: {
-                    options: await getPossibleIntegrations.execute({ userId }),
-                    authorized: await getEntitiesForUser.execute(userId),
+                    options: await getPossibleIntegrations.execute(),
+                    authorized: await getEntitiesForUser.execute(user),
                 },
                 integrations: integrations,
             };
@@ -287,7 +316,6 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
     router.route('/api/integrations').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.body, [
                 'entities',
                 'config',
@@ -295,10 +323,17 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
 
             get(params.config, 'type');
 
+            const { ownerId, organizationId, adoptUnscoped } =
+                await resolveIntegrationOwnership.execute({
+                    entityIds: params.entities,
+                    config: params.config,
+                    user,
+                });
             const integration = await createIntegration.execute(
                 params.entities,
-                userId,
-                params.config
+                ownerId,
+                params.config,
+                { organizationId, adoptUnscoped }
             );
 
             res.status(201).json(integration);
@@ -308,12 +343,11 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
     router.route('/api/integrations/:integrationId').patch(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.body, ['config']);
 
             const integration = await updateIntegration.execute(
                 req.params.integrationId,
-                userId,
+                await ownerOf(req.params.integrationId, user, { manage: true }),
                 params.config
             );
             res.json(integration);
@@ -326,7 +360,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             await deleteIntegrationForUser.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user, { manage: true })
             );
             res.status(204).json({});
         })
@@ -338,7 +372,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             const integration = await getIntegrationInstance.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user)
             );
             res.json(await integration.send('GET_CONFIG_OPTIONS'));
         })
@@ -354,7 +388,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                 ]);
                 const integration = await getIntegrationInstance.execute(
                     params.integrationId,
-                    user.getId()
+                    await ownerOf(params.integrationId, user)
                 );
 
                 res.json(
@@ -368,7 +402,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             const integration = await getIntegrationInstance.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user)
             );
             res.json(await integration.send('GET_USER_ACTIONS', req.body));
         })
@@ -385,7 +419,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                 ]);
                 const integration = await getIntegrationInstance.execute(
                     params.integrationId,
-                    user.getId()
+                    await ownerOf(params.integrationId, user)
                 );
 
                 res.json(
@@ -410,7 +444,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                 ]);
                 const integration = await getIntegrationInstance.execute(
                     params.integrationId,
-                    user.getId()
+                    await ownerOf(params.integrationId, user)
                 );
 
                 res.json(
@@ -431,7 +465,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             ]);
             const integration = await getIntegrationInstance.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user)
             );
             res.json(await integration.send(params.actionId, req.body));
         })
@@ -448,7 +482,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             const integration = await getIntegrationInstance.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user)
             );
 
             // We could perhaps augment router with dynamic options? Haven't decided yet, but here may be the place
@@ -468,7 +502,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
             const params = checkRequiredParams(req.params, ['integrationId']);
             const instance = await getIntegrationInstance.execute(
                 params.integrationId,
-                user.getId()
+                await ownerOf(params.integrationId, user)
             );
 
             if (!instance) {
@@ -506,16 +540,21 @@ function setEntityRoutes(router, authenticateUser, useCases) {
         getModule,
         getEntityOptionsById,
         refreshEntityOptions,
-        processAuthorizationCallback,
+        authorizeEntityForUser,
+        createEntityFromCredential,
     } = useCases;
 
     router.route('/api/authorize').get(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.query, ['entityType']);
+            // The owner POST stores under, so GET and POST describe one connection.
+            const { ownerId } = authorizeEntityForUser.resolveOwnership({
+                user,
+                entityType: params.entityType,
+            });
             const module = await getModuleInstanceFromType.execute(
-                userId,
+                ownerId,
                 params.entityType,
                 { state: req.query.state }
             );
@@ -534,11 +573,15 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/authorize').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.body, [
                 'entityType',
                 'data',
             ]);
+            const ownership = authorizeEntityForUser.resolveOwnership({
+                user,
+                entityType: params.entityType,
+            });
+            const userId = ownership.ownerId;
 
             const dataKeys =
                 params.data && typeof params.data === 'object'
@@ -550,11 +593,13 @@ function setEntityRoutes(router, authenticateUser, useCases) {
                 dataKeys,
             });
 
-            const entityDetails = await processAuthorizationCallback.execute(
-                userId,
-                params.entityType,
-                params.data
-            );
+            const { result: entityDetails } =
+                await authorizeEntityForUser.execute({
+                    user,
+                    entityType: params.entityType,
+                    data: params.data,
+                    ownership,
+                });
 
             log.info('Entity authorized', {
                 eventName: 'frigg.integrations.authorized',
@@ -571,35 +616,20 @@ function setEntityRoutes(router, authenticateUser, useCases) {
     router.route('/api/entity').post(
         catchAsyncError(async (req, res) => {
             const user = await authenticateUser.execute(req);
-            const userId = user.getId();
             const params = checkRequiredParams(req.body, [
                 'entityType',
                 'data',
             ]);
             checkRequiredParams(req.body.data, ['credential_id']);
 
-            // May want to pass along the user ID as well so credential ID's can't be fished???
-            const credential = await getCredentialForUser.execute(
-                params.data.credential_id,
-                userId
-            );
-
-            if (!credential) {
-                throw Boom.badRequest('Invalid credential ID');
-            }
-
-            const module = await getModuleInstanceFromType.execute(
-                userId,
-                params.entityType
-            );
-            const entityDetails = await module.getEntityDetails(
-                module.api,
-                null,
-                null,
-                userId
+            // The owner follows the entity type's scope, as /api/authorize.
+            res.json(
+                await createEntityFromCredential.execute({
+                    user,
+                    entityType: params.entityType,
+                    credentialId: params.data.credential_id,
+                })
             );
-
-            res.json(await module.findOrCreateEntity(entityDetails));
         })
     );
 

package/integrations/repositories/integration-mapping-repository-documentdb.js

@@ -1,5 +1,4 @@
 const { prisma } = require('../../database/prisma');
-const { MappingAlreadyExistsError } = require('../../errors');
 const {
     toObjectId,
     fromObjectId,
@@ -181,55 +180,6 @@ class IntegrationMappingRepositoryDocumentDB extends IntegrationMappingRepositor
         return this._mapMapping(decryptedMapping);
     }
 
-    async createMapping(integrationId, sourceId, mapping) {
-        const now = new Date();
-        const encryptedDocument = await this.encryptionService.encryptFields(
-            'IntegrationMapping',
-            {
-                integrationId,
-                sourceId:
-                    sourceId === null || sourceId === undefined
-                        ? null
-                        : String(sourceId),
-                mapping,
-                createdAt: now,
-                updatedAt: now,
-            }
-        );
-
-        let insertedId;
-        try {
-            insertedId = await insertOne(
-                this.prisma,
-                'IntegrationMapping',
-                encryptedDocument
-            );
-        } catch (error) {
-            if (error.code === 11000) {
-                throw new MappingAlreadyExistsError(integrationId, sourceId, {
-                    cause: error,
-                });
-            }
-            throw error;
-        }
-
-        const created = await findOne(this.prisma, 'IntegrationMapping', {
-            _id: insertedId,
-        });
-        if (!created) {
-            throw new Error(
-                'Failed to create mapping: Document not found after insert. ' +
-                    'This indicates a database consistency issue.'
-            );
-        }
-        return this._mapMapping(
-            await this.encryptionService.decryptFields(
-                'IntegrationMapping',
-                created
-            )
-        );
-    }
-
     async findMappingsByIntegration(integrationId) {
         const filter = {};
         if (integrationId) filter.integrationId = integrationId;

package/integrations/repositories/integration-mapping-repository-interface.js

@@ -39,21 +39,6 @@ class IntegrationMappingRepositoryInterface {
         throw new Error('Method upsertMapping must be implemented by subclass');
     }
 
-    /**
-     * Insert a mapping, failing if one already exists for the
-     * (integrationId, sourceId) pair. Atomic: usable as a claim/lock row.
-     *
-     * @param {string|number} integrationId - The integration ID
-     * @param {string} sourceId - The source ID for lookup
-     * @param {Object} mapping - The mapping data
-     * @returns {Promise<Object>} The created mapping document
-     * @throws {MappingAlreadyExistsError} If the pair already exists
-     * @abstract
-     */
-    async createMapping(integrationId, sourceId, mapping) {
-        throw new Error('createMapping must be implemented by subclass');
-    }
-
     /**
      * Find all mappings for an integration
      *

package/integrations/repositories/integration-mapping-repository-mongo.js

@@ -1,5 +1,4 @@
 const { prisma } = require('../../database/prisma');
-const { MappingAlreadyExistsError } = require('../../errors');
 const {
     assertMappingWrittenUnencrypted,
     decryptQueriedMappings,
@@ -94,34 +93,6 @@ class IntegrationMappingRepositoryMongo extends IntegrationMappingRepositoryInte
         });
     }
 
-    /**
-     * Insert a mapping; fails if (integrationId, sourceId) already exists
-     *
-     * @param {string} integrationId - The integration ID
-     * @param {string} sourceId - The source ID
-     * @param {Object} mapping - The mapping data
-     * @returns {Promise<Object>} The created mapping document
-     * @throws {MappingAlreadyExistsError} If the pair already exists
-     */
-    async createMapping(integrationId, sourceId, mapping) {
-        try {
-            return await this.prisma.integrationMapping.create({
-                data: {
-                    integrationId,
-                    sourceId: this._toString(sourceId),
-                    mapping,
-                },
-            });
-        } catch (error) {
-            if (error.code === 'P2002') {
-                throw new MappingAlreadyExistsError(integrationId, sourceId, {
-                    cause: error,
-                });
-            }
-            throw error;
-        }
-    }
-
     /**
      * Find all mappings for an integration
      * Replaces: IntegrationMapping.find({ integration: integrationId })

package/integrations/repositories/integration-mapping-repository-postgres.js

@@ -1,5 +1,4 @@
 const { prisma } = require('../../database/prisma');
-const { MappingAlreadyExistsError } = require('../../errors');
 const {
     assertMappingWrittenUnencrypted,
     decryptQueriedMappings,
@@ -151,35 +150,6 @@ class IntegrationMappingRepositoryPostgres extends IntegrationMappingRepositoryI
         return this._convertMappingIds(result);
     }
 
-    /**
-     * Insert a mapping; fails if (integrationId, sourceId) already exists
-     *
-     * @param {string} integrationId - The integration ID
-     * @param {string} sourceId - The source ID
-     * @param {Object} mapping - The mapping data
-     * @returns {Promise<Object>} The created mapping document
-     * @throws {MappingAlreadyExistsError} If the pair already exists
-     */
-    async createMapping(integrationId, sourceId, mapping) {
-        try {
-            const created = await this.prisma.integrationMapping.create({
-                data: {
-                    integrationId: this._stringToInt(integrationId),
-                    sourceId: this._toString(sourceId),
-                    mapping,
-                },
-            });
-            return this._convertMappingIds(created);
-        } catch (error) {
-            if (error.code === 'P2002') {
-                throw new MappingAlreadyExistsError(integrationId, sourceId, {
-                    cause: error,
-                });
-            }
-            throw error;
-        }
-    }
-
     /**
      * Find all mappings for an integration
      * Replaces: IntegrationMapping.find({ integration: integrationId })