@friggframework/core 2.0.0--canary.704.79d9a63.0 → 2.0.0--canary.686.e94de4d.0

package/modules/module.js

@@ -21,8 +21,17 @@ class Module extends Delegate {
      * @param {string} params.userId The user id
      * @param {Object} params.entity The entity record from the database
      * @param {string} [params.state] Optional OAuth state value forwarded to the API client (round-trips through the OAuth provider).
+     * @param {Object} [params.resolvedEnv] definition.env as Module.create() resolved it (may be undefined).
+     * @param {boolean} [params.envResolved=false] true when resolvedEnv carries the resolved env, even an undefined one; otherwise the static definition.env is used.
      */
-    constructor({ definition, userId = null, entity: entityObj = null, state = null }) {
+    constructor({
+        definition,
+        userId = null,
+        entity: entityObj = null,
+        state = null,
+        resolvedEnv,
+        envResolved = false,
+    }) {
         super({ definition, userId, entity: entityObj });
 
         this.validateDefinition(definition);
@@ -54,8 +63,23 @@ class Module extends Delegate {
 
         Object.assign(this, this.definition.requiredAuthMethods);
 
+        // A pre-resolved env (Module.create()) supports definition.env as an
+        // async function, e.g. OAuth app credentials loaded from the database
+        // by the db-credentials extension; otherwise the static object.
+        // "Resolved" is an explicit flag, not a non-null value: a function env
+        // may legitimately resolve to undefined (no static env, no DB row),
+        // and falling back to definition.env would then read the function.
+        const envValues = envResolved ? resolvedEnv : this.definition.env;
+        if (typeof envValues === 'function') {
+            // Spreading a function yields no keys, so the API client would
+            // silently get no client_id / client_secret.
+            throw new TypeError(
+                `Module ${this.name}: definition.env is a function; build the module with await Module.create(...)`
+            );
+        }
+
         const apiParams = {
-            ...this.definition.env,
+            ...envValues,
             delegate: this,
             logger: this.logger,
             ...(state ? { state } : {}),
@@ -67,6 +91,33 @@ class Module extends Delegate {
         this.api = new this.apiClass(apiParams);
     }
 
+    /**
+     * Resolves definition.env, supporting both a static object and a
+     * (possibly async) function.
+     *
+     * @param {Object} definition - Module definition
+     * @returns {Promise<Object|undefined>} Resolved env values
+     */
+    static async resolveEnv(definition) {
+        if (typeof definition.env === 'function') {
+            return await definition.env();
+        }
+        return definition.env;
+    }
+
+    /**
+     * Async factory that resolves definition.env first, so a module whose
+     * env is a function gets its values. Prefer it over `new Module(...)`
+     * wherever the call site can await.
+     *
+     * @param {Object} params - same as the constructor, minus resolvedEnv
+     * @returns {Promise<Module>}
+     */
+    static async create({ definition, userId = null, entity = null, state = null }) {
+        const resolvedEnv = await Module.resolveEnv(definition);
+        return new Module({ definition, userId, entity, state, resolvedEnv, envResolved: true });
+    }
+
     getName() {
         return this.name;
     }

package/modules/proxy/proxy-errors.js

@@ -0,0 +1,20 @@
+/**
+ * A proxied call was refused or failed in a way the Management API maps to a
+ * documented status (ADR-052 §10). `code` is the public error code; nothing
+ * here carries the upstream URL, headers or credential material.
+ */
+class ProxyRequestError extends Error {
+    /**
+     * @param {string} code - e.g. INVALID_PROXY_REQUEST, PROXY_NOT_ALLOWED, TIMEOUT
+     * @param {string} message - safe to show the caller
+     * @param {Object} [details] - safe structured details
+     */
+    constructor(code, message, details) {
+        super(message);
+        this.name = 'ProxyRequestError';
+        this.code = code;
+        this.details = details;
+    }
+}
+
+module.exports = { ProxyRequestError };

package/modules/proxy/proxy-path.js

@@ -0,0 +1,179 @@
+const { ProxyRequestError } = require('./proxy-errors');
+
+/**
+ * Path rules for the entity proxy (ADR-052 §4). The caller supplies a path
+ * relative to the module's base URL and nothing else: the host, scheme and
+ * port always come from the module.
+ */
+
+const invalid = (reason) =>
+    new ProxyRequestError('INVALID_PROXY_REQUEST', `Invalid proxy path: ${reason}`, {
+        field: 'path',
+    });
+
+// Control characters (C0, DEL, C1), any whitespace, and invisible format
+// characters such as zero-width spaces and byte-order marks.
+const FORBIDDEN_CHARS = /[\x00-\x20\x7f-\x9f]|\s|\p{Cf}/u;
+
+/**
+ * Validates and normalises a caller-supplied path.
+ *
+ * - must start with a single `/`; `//` (anywhere), `\`, `?`, `#`, control
+ *   and whitespace characters are rejected;
+ * - encoded separators (`%2f`, `%5c`) are rejected, then the path is
+ *   percent-decoded exactly once; a `%` left after decoding (double
+ *   encoding) is rejected, as is any decoded control or whitespace
+ *   character other than a space (`%20`);
+ * - `.` and `..` segments are rejected rather than resolved.
+ *
+ * @param {unknown} path
+ * @returns {string} the decoded path, e.g. `/crm/v3/objects/contacts`
+ * @throws {ProxyRequestError} INVALID_PROXY_REQUEST
+ */
+function normalizeProxyPath(path) {
+    if (typeof path !== 'string' || path.length === 0) {
+        throw invalid('path must be a non-empty string');
+    }
+    if (path.length > 2048) throw invalid('path is too long');
+    if (!path.startsWith('/')) throw invalid('path must start with /');
+    if (path.startsWith('//') || path.includes('//')) {
+        throw invalid('empty path segments (//) are not allowed');
+    }
+    if (path.includes('\\')) throw invalid('backslashes are not allowed');
+    if (path.includes('?') || path.includes('#')) {
+        throw invalid('send the query string in `query`, not in the path');
+    }
+    if (FORBIDDEN_CHARS.test(path)) {
+        throw invalid('control and whitespace characters are not allowed');
+    }
+    if (/%(2f|5c)/i.test(path)) {
+        throw invalid('encoded path separators are not allowed');
+    }
+
+    let decoded;
+    try {
+        decoded = decodeURIComponent(path);
+    } catch {
+        throw invalid('malformed percent-encoding');
+    }
+    if (
+        decoded.includes('%') ||
+        decoded.includes('\\') ||
+        decoded.includes('?') ||
+        decoded.includes('#') ||
+        decoded.includes('//') ||
+        // An encoded space (%20) is a legitimate path character; every other
+        // control or whitespace character stays forbidden.
+        FORBIDDEN_CHARS.test(decoded.replaceAll(' ', ''))
+    ) {
+        throw invalid('encoded characters decode to something not allowed');
+    }
+
+    const segments = decoded.split('/').slice(1);
+    if (segments.some((segment) => segment === '.' || segment === '..')) {
+        throw invalid('dot segments (. and ..) are not allowed');
+    }
+    return decoded;
+}
+
+/**
+ * Joins a module base URL and a normalised path, then proves the result
+ * cannot leave the module's API: https only, same origin as the base URL,
+ * and under the base URL's path.
+ *
+ * @param {string} baseUrl - from the module, never from the request
+ * @param {string} normalizedPath - from normalizeProxyPath()
+ * @returns {{ url: string, basePath: string, origin: string }} `url` is not
+ *   percent-encoded; the Requester encodes it once.
+ * @throws {ProxyRequestError} PROXY_NOT_CONFIGURED or INVALID_PROXY_REQUEST
+ */
+function joinProxyUrl(baseUrl, normalizedPath) {
+    let base;
+    try {
+        base = new URL(baseUrl);
+    } catch {
+        throw new ProxyRequestError(
+            'PROXY_NOT_CONFIGURED',
+            'The module has no valid base URL to proxy to'
+        );
+    }
+    if (base.protocol !== 'https:') {
+        throw new ProxyRequestError(
+            'PROXY_NOT_CONFIGURED',
+            'The module base URL must use https to be proxied'
+        );
+    }
+    if (base.username || base.password || base.search || base.hash) {
+        throw new ProxyRequestError(
+            'PROXY_NOT_CONFIGURED',
+            'The module base URL must not carry credentials, a query or a fragment'
+        );
+    }
+
+    const basePath = base.pathname.replace(/\/+$/, '');
+    const url = `${base.origin}${basePath}${normalizedPath}`;
+
+    let joined;
+    try {
+        joined = new URL(url);
+    } catch {
+        throw invalid('the joined URL is not valid');
+    }
+    const joinedPath = decodeURIComponent(joined.pathname);
+    if (
+        joined.protocol !== 'https:' ||
+        joined.origin !== base.origin ||
+        joined.username ||
+        joined.password ||
+        !(joinedPath === basePath || joinedPath.startsWith(`${basePath}/`))
+    ) {
+        throw invalid('the path leaves the module API');
+    }
+    return { url, basePath, origin: base.origin };
+}
+
+/**
+ * Finds the allow-list rule that permits `method` on `path`.
+ *
+ * Patterns use `:param` for exactly one segment and a trailing `/**` for a
+ * subtree (the prefix itself included). `method: '*'` matches any method.
+ *
+ * @param {Array<{method: string, path: string}>} rules
+ * @param {string} method - upper case
+ * @param {string} path - normalised path
+ * @returns {{method: string, path: string}|null}
+ */
+function matchAllowRule(rules, method, path) {
+    const requestSegments = path.split('/').slice(1);
+    for (const rule of rules || []) {
+        if (!rule || typeof rule.path !== 'string' || typeof rule.method !== 'string') {
+            continue;
+        }
+        const ruleMethod = rule.method.toUpperCase();
+        if (ruleMethod !== '*' && ruleMethod !== method) continue;
+        if (patternMatches(rule.path, requestSegments)) return rule;
+    }
+    return null;
+}
+
+function patternMatches(pattern, requestSegments) {
+    if (!pattern.startsWith('/')) return false;
+    let patternSegments = pattern.split('/').slice(1);
+    let subtree = false;
+    if (patternSegments[patternSegments.length - 1] === '**') {
+        subtree = true;
+        patternSegments = patternSegments.slice(0, -1);
+    }
+    if (subtree) {
+        if (requestSegments.length < patternSegments.length) return false;
+    } else if (requestSegments.length !== patternSegments.length) {
+        return false;
+    }
+    return patternSegments.every((segment, index) => {
+        const actual = requestSegments[index];
+        if (segment.startsWith(':')) return actual !== undefined && actual !== '';
+        return segment === actual;
+    });
+}
+
+module.exports = { normalizeProxyPath, joinProxyUrl, matchAllowRule };

package/modules/proxy/proxy-policy.js

@@ -0,0 +1,248 @@
+const { ProxyRequestError } = require('./proxy-errors');
+
+/**
+ * What the entity proxy accepts and returns (ADR-052 §5-§7). Pure functions:
+ * no I/O, so every rule is unit-tested on its own.
+ */
+
+const PROXY_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+const METHODS_WITH_BODY = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/** Request headers a caller may always send (lower case). */
+const ALLOWED_REQUEST_HEADERS = [
+    'accept',
+    'content-type',
+    'accept-language',
+    'if-match',
+    'if-none-match',
+];
+
+/** Request headers that are refused outright, even if a module lists them. */
+const REJECTED_REQUEST_HEADERS = [
+    'authorization',
+    'proxy-authorization',
+    'cookie',
+    'host',
+    'forwarded',
+    'x-real-ip',
+    'x-api-key',
+];
+const REJECTED_REQUEST_HEADER_PREFIXES = ['x-forwarded-'];
+
+/** Response headers never passed back (credentials and hop-by-hop). */
+const REMOVED_RESPONSE_HEADERS = [
+    'authorization',
+    'proxy-authorization',
+    'proxy-authenticate',
+    'set-cookie',
+    'set-cookie2',
+    'www-authenticate',
+    'x-api-key',
+    'connection',
+    'keep-alive',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+    // The body is re-encoded as JSON, so these no longer describe it.
+    'content-length',
+    'content-encoding',
+];
+
+const invalid = (message, details) =>
+    new ProxyRequestError('INVALID_PROXY_REQUEST', message, details);
+
+const isPlainObject = (value) =>
+    value !== null && typeof value === 'object' && !Array.isArray(value);
+
+/**
+ * Validates the request body of POST /api/v2/entities/:id/proxy and returns
+ * it with the method upper-cased and the body serialised.
+ *
+ * @param {unknown} request
+ * @param {{ maxRequestBytes: number }} limits
+ * @returns {{ method: string, path: string, query?: Object, headers: Object, body?: string, requestBytes: number, bodyIsJson: boolean }}
+ */
+function validateProxyRequest(request, { maxRequestBytes }) {
+    if (!isPlainObject(request)) throw invalid('The proxy request must be a JSON object');
+    const method = typeof request.method === 'string' ? request.method.toUpperCase() : '';
+    if (!PROXY_METHODS.includes(method)) {
+        throw invalid(`method must be one of ${PROXY_METHODS.join(', ')}`, { field: 'method' });
+    }
+    if (typeof request.path !== 'string') {
+        throw invalid('path is required', { field: 'path' });
+    }
+
+    let query;
+    if (request.query !== undefined && request.query !== null) {
+        if (!isPlainObject(request.query)) throw invalid('query must be an object', { field: 'query' });
+        query = {};
+        for (const [key, value] of Object.entries(request.query)) {
+            const scalar = ['string', 'number', 'boolean'].includes(typeof value);
+            const list = Array.isArray(value) && value.every((v) => typeof v === 'string');
+            if (!scalar && !list) {
+                throw invalid(`query.${key} must be a string, number, boolean or array of strings`, {
+                    field: `query.${key}`,
+                });
+            }
+            // The requester sends one value per key; arrays go comma-separated.
+            query[key] = list ? value.join(',') : value;
+        }
+    }
+
+    const headers = {};
+    if (request.headers !== undefined && request.headers !== null) {
+        if (!isPlainObject(request.headers)) throw invalid('headers must be an object', { field: 'headers' });
+        for (const [name, value] of Object.entries(request.headers)) {
+            if (typeof value !== 'string') {
+                throw invalid(`header ${name} must be a string`, { field: `headers.${name}` });
+            }
+            headers[name.toLowerCase()] = value;
+        }
+    }
+
+    let body;
+    let bodyIsJson = false;
+    if (request.body !== undefined && request.body !== null) {
+        if (!METHODS_WITH_BODY.has(method)) {
+            throw invalid(`${method} requests cannot have a body`, { field: 'body' });
+        }
+        if (typeof request.body === 'string') {
+            body = request.body;
+        } else {
+            body = JSON.stringify(request.body);
+            bodyIsJson = true;
+        }
+    }
+    const requestBytes = body === undefined ? 0 : Buffer.byteLength(body);
+    if (requestBytes > maxRequestBytes) {
+        throw new ProxyRequestError(
+            'PAYLOAD_TOO_LARGE',
+            `The proxied request body is larger than ${maxRequestBytes} bytes`
+        );
+    }
+    return { method, path: request.path, query, headers, body, bodyIsJson, requestBytes };
+}
+
+const isWildcardRule = (rule) => rule?.method === '*' || rule?.path === '/**';
+
+const isValidRule = (rule) =>
+    isPlainObject(rule) &&
+    typeof rule.method === 'string' &&
+    typeof rule.path === 'string' &&
+    rule.path.startsWith('/');
+
+/**
+ * The allow-list in force for a module: the app definition's list for it when
+ * one is given (`managementApi.proxy.modules[name].allow`), otherwise the
+ * module's own `proxy.allow`. A module cannot grant itself a wildcard; only
+ * the app definition can. No list means nothing may be proxied.
+ *
+ * @returns {{ rules: Array<{method: string, path: string}>, source: 'app'|'module'|'none', ignored: number }}
+ */
+function resolveAllowRules(definition, moduleOverrides = {}) {
+    const override = moduleOverrides?.[definition.moduleName]?.allow;
+    if (Array.isArray(override)) {
+        return { rules: override.filter(isValidRule), source: 'app', ignored: 0 };
+    }
+    const declared = Array.isArray(definition.proxy?.allow) ? definition.proxy.allow : [];
+    const rules = declared.filter((rule) => isValidRule(rule) && !isWildcardRule(rule));
+    return {
+        rules,
+        source: rules.length ? 'module' : 'none',
+        ignored: declared.length - rules.length,
+    };
+}
+
+/**
+ * Keeps only the request headers the caller may set. A header from the
+ * rejected list (credentials, Host, forwarding headers, or one the module's
+ * own auth sets) fails the request instead of being dropped quietly.
+ *
+ * @param {Object} headers - lower-cased names
+ * @param {Object} options
+ * @param {string[]} [options.moduleHeaders] - from the module's `proxy.headers`
+ * @param {string[]} [options.authHeaderNames] - headers the module's auth sets
+ */
+function filterRequestHeaders(headers, { moduleHeaders = [], authHeaderNames = [] } = {}) {
+    const rejected = new Set([
+        ...REJECTED_REQUEST_HEADERS,
+        ...authHeaderNames.filter(Boolean).map((name) => String(name).toLowerCase()),
+    ]);
+    const allowed = new Set([
+        ...ALLOWED_REQUEST_HEADERS,
+        ...moduleHeaders.map((name) => String(name).toLowerCase()),
+    ]);
+    const kept = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (
+            rejected.has(name) ||
+            REJECTED_REQUEST_HEADER_PREFIXES.some((prefix) => name.startsWith(prefix))
+        ) {
+            throw invalid(`The ${name} header cannot be sent through the proxy`, {
+                field: `headers.${name}`,
+            });
+        }
+        if (allowed.has(name)) kept[name] = value;
+    }
+    return kept;
+}
+
+/**
+ * Removes credential and hop-by-hop headers from an upstream response, and
+ * the Location of a redirect the proxy refused to follow.
+ */
+function filterResponseHeaders(headers, { redirectBlocked = false, authHeaderNames = [] } = {}) {
+    const removed = new Set([
+        ...REMOVED_RESPONSE_HEADERS,
+        ...authHeaderNames.filter(Boolean).map((name) => String(name).toLowerCase()),
+    ]);
+    if (redirectBlocked) removed.add('location');
+    const kept = {};
+    for (const [name, value] of Object.entries(headers || {})) {
+        if (!removed.has(name.toLowerCase())) kept[name.toLowerCase()] = value;
+    }
+    return kept;
+}
+
+const JSON_TYPE = /^application\/([a-z0-9.+-]*\+)?json\b/i;
+const TEXT_TYPE = /^(text\/|application\/(xml|x-www-form-urlencoded|javascript|graphql)\b|[a-z]+\/[a-z0-9.+-]*\+xml\b)/i;
+
+/**
+ * Turns the upstream body into the `data` of the proxy response: parsed JSON,
+ * text, or (only if the module allows binary) base64.
+ *
+ * @returns {{ data: unknown, encoding?: 'base64' }}
+ */
+function decodeResponseBody(body, contentType, { binary = false } = {}) {
+    if (!body || body.length === 0) return { data: null };
+    if (JSON_TYPE.test(contentType)) {
+        const text = body.toString('utf8');
+        try {
+            return { data: JSON.parse(text) };
+        } catch {
+            return { data: text };
+        }
+    }
+    if (!contentType || TEXT_TYPE.test(contentType)) {
+        return { data: body.toString('utf8') };
+    }
+    if (binary) return { data: body.toString('base64'), encoding: 'base64' };
+    throw new ProxyRequestError(
+        'UNSUPPORTED_MEDIA_TYPE',
+        'The upstream response is binary and this module does not allow binary proxying',
+        { contentType: contentType.split(';')[0] }
+    );
+}
+
+module.exports = {
+    PROXY_METHODS,
+    ALLOWED_REQUEST_HEADERS,
+    REJECTED_REQUEST_HEADERS,
+    REMOVED_RESPONSE_HEADERS,
+    validateProxyRequest,
+    resolveAllowRules,
+    filterRequestHeaders,
+    filterResponseHeaders,
+    decodeResponseBody,
+};

package/modules/repositories/authorization-session-repository-documentdb.js

@@ -0,0 +1,112 @@
+const { prisma } = require('../../database/prisma');
+const {
+    findOne,
+    insertOne,
+    updateOne,
+    deleteMany,
+} = require('../../database/documentdb-utils');
+const {
+    DocumentDBEncryptionService,
+} = require('../../database/documentdb-encryption-service');
+const { AuthorizationSession } = require('../domain/authorization-session');
+const {
+    AuthorizationSessionRepositoryInterface,
+} = require('./authorization-session-repository-interface');
+
+const COLLECTION = 'AuthorizationSession';
+
+/**
+ * AuthorizationSession persistence for DocumentDB through raw commands.
+ * `stepData` is encrypted with DocumentDBEncryptionService, as the Prisma
+ * extension does not run for raw commands.
+ */
+class AuthorizationSessionRepositoryDocumentDB extends AuthorizationSessionRepositoryInterface {
+    constructor() {
+        super();
+        this.prisma = prisma;
+        this.encryptionService = new DocumentDBEncryptionService();
+    }
+
+    async create(session) {
+        const now = new Date();
+        const document = await this.encryptionService.encryptFields(COLLECTION, {
+            sessionId: session.sessionId,
+            userId: session.userId,
+            entityType: session.entityType,
+            credentialId: session.credentialId,
+            currentStep: session.currentStep,
+            maxSteps: session.maxSteps,
+            stepData: session.stepData,
+            expiresAt: session.expiresAt,
+            completed: session.completed,
+            createdAt: now,
+            updatedAt: now,
+        });
+        await insertOne(this.prisma, COLLECTION, document);
+        return this._toDomain(
+            await this.encryptionService.decryptFields(COLLECTION, document)
+        );
+    }
+
+    async findBySessionId(sessionId) {
+        if (typeof sessionId !== 'string' || !sessionId) return null;
+        const document = await findOne(this.prisma, COLLECTION, {
+            sessionId,
+            expiresAt: { $gt: new Date() },
+        });
+        if (!document) return null;
+        return this._toDomain(
+            await this.encryptionService.decryptFields(COLLECTION, document)
+        );
+    }
+
+    async update(session) {
+        const encrypted = await this.encryptionService.encryptFields(COLLECTION, {
+            stepData: session.stepData,
+        });
+        await updateOne(
+            this.prisma,
+            COLLECTION,
+            { sessionId: session.sessionId },
+            {
+                $set: {
+                    currentStep: session.currentStep,
+                    stepData: encrypted.stepData,
+                    completed: session.completed,
+                    updatedAt: new Date(),
+                },
+            }
+        );
+        return session;
+    }
+
+    async deleteBySessionId(sessionId) {
+        const result = await deleteMany(this.prisma, COLLECTION, { sessionId });
+        return result?.n ?? 0;
+    }
+
+    async deleteExpired(now = new Date()) {
+        const result = await deleteMany(this.prisma, COLLECTION, {
+            expiresAt: { $lte: now },
+        });
+        return result?.n ?? 0;
+    }
+
+    _toDomain(document) {
+        return new AuthorizationSession({
+            sessionId: document.sessionId,
+            userId: document.userId,
+            entityType: document.entityType,
+            credentialId: document.credentialId ?? null,
+            currentStep: document.currentStep,
+            maxSteps: document.maxSteps,
+            stepData: document.stepData || {},
+            expiresAt: new Date(document.expiresAt),
+            completed: Boolean(document.completed),
+            createdAt: document.createdAt,
+            updatedAt: document.updatedAt,
+        });
+    }
+}
+
+module.exports = { AuthorizationSessionRepositoryDocumentDB };

package/modules/repositories/authorization-session-repository-factory.js

@@ -0,0 +1,31 @@
+const config = require('../../database/config');
+const {
+    AuthorizationSessionRepositoryPrisma,
+} = require('./authorization-session-repository-prisma');
+const {
+    AuthorizationSessionRepositoryDocumentDB,
+} = require('./authorization-session-repository-documentdb');
+
+/**
+ * AuthorizationSession repository for the configured database. PostgreSQL
+ * and MongoDB share the Prisma adapter; DocumentDB uses raw commands.
+ */
+function createAuthorizationSessionRepository() {
+    switch (config.DB_TYPE) {
+        case 'mongodb':
+        case 'postgresql':
+            return new AuthorizationSessionRepositoryPrisma();
+        case 'documentdb':
+            return new AuthorizationSessionRepositoryDocumentDB();
+        default:
+            throw new Error(
+                `Unsupported database type: ${config.DB_TYPE}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+            );
+    }
+}
+
+module.exports = {
+    createAuthorizationSessionRepository,
+    AuthorizationSessionRepositoryPrisma,
+    AuthorizationSessionRepositoryDocumentDB,
+};