@friggframework/core 2.0.0--canary.704.79d9a63.0 → 2.0.0--canary.686.e94de4d.0

package/user/use-cases/get-user-from-bearer-token.js

@@ -40,13 +40,8 @@ class GetUserFromBearerToken {
             throw Boom.unauthorized('Session Token Not Found');
         }
 
-        const tokenUserId = sessionToken.userId;
-        if (!tokenUserId) {
-            throw Boom.unauthorized('Session Token Has No User');
-        }
-
         if (this.userConfig.primary === 'organization') {
-            const organizationUserData = await this.userRepository.findOrganizationUserById(tokenUserId);
+            const organizationUserData = await this.userRepository.findOrganizationUserById(sessionToken.user);
 
             if (!organizationUserData) {
                 throw Boom.unauthorized('Organization User Not Found');
@@ -62,7 +57,7 @@ class GetUserFromBearerToken {
             );
         }
 
-        const individualUserData = await this.userRepository.findIndividualUserById(tokenUserId);
+        const individualUserData = await this.userRepository.findIndividualUserById(sessionToken.user);
 
         if (!individualUserData) {
             throw Boom.unauthorized('Individual User Not Found');

package/user/use-cases/get-user-from-x-frigg-headers.js

@@ -1,10 +1,38 @@
 const Boom = require('@hapi/boom');
-const { User } = require('../user');
+const {
+    findAppUsers,
+    createMissingAppUsers,
+    buildUser,
+    wantsIndividual,
+} = require('../app-user-helpers');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.user.x_frigg_headers');
+
+const NOT_A_MEMBER_MESSAGE =
+    'Not a member: the user identified by x-frigg-appUserId is not a member of the ' +
+    'organization identified by x-frigg-appOrgId, and strict membership does not ' +
+    'allow these headers to add them.';
 
 /**
  * Use case for retrieving or creating a user from x-frigg header identifiers.
  * Supports backend-to-backend API communication using application user IDs.
  *
+ * `x-frigg-appOrgId` names the request's active organization (ADR-056 §3.6).
+ * A person the organization does not know yet is added to it as a member; the
+ * person is never moved out of another organization, and
+ * `IndividualUser.organizationId` is set only on a first link.
+ *
+ * With `user.strictMembership: true` the headers cannot make anyone a member of
+ * an organization that already existed: a person who is not already a member
+ * (a brand-new `appUserId` included) is refused with 400. The one thing strict
+ * mode still allows is naming an organization this request creates, so a first
+ * login can bootstrap its own organization. Apps that run strict add people to
+ * existing organizations themselves, through the membership repository.
+ *
+ * `strictUserValidation` is a deprecated alias for `strictMembership`; its
+ * meaning changed (it used to reject a mismatched individual/organization pair).
+ *
  * @class GetUserFromXFriggHeaders
  */
 class GetUserFromXFriggHeaders {
@@ -12,11 +40,22 @@ class GetUserFromXFriggHeaders {
      * Creates a new GetUserFromXFriggHeaders instance.
      * @param {Object} params - Configuration parameters.
      * @param {import('../repositories/user-repository-interface').UserRepositoryInterface} params.userRepository - Repository for user data operations.
+     * @param {import('./ensure-organization-membership').EnsureOrganizationMembership} params.ensureOrganizationMembership
      * @param {Object} params.userConfig - The user config in the app definition.
      */
-    constructor({ userRepository, userConfig }) {
+    constructor({ userRepository, ensureOrganizationMembership, userConfig }) {
         this.userRepository = userRepository;
+        this.ensureOrganizationMembership = ensureOrganizationMembership;
         this.userConfig = userConfig;
+
+        const { strictMembership, strictUserValidation } = userConfig ?? {};
+        if (strictUserValidation !== undefined && strictMembership === undefined) {
+            log.warn(
+                'user.strictUserValidation is deprecated and now means strictMembership; rename it',
+                { eventName: `${log.name}.strict_user_validation_deprecated` }
+            );
+        }
+        this.strict = Boolean(strictMembership ?? strictUserValidation);
     }
 
     /**
@@ -25,7 +64,7 @@ class GetUserFromXFriggHeaders {
      * @param {string} [appUserId] - The app user ID from x-frigg-appUserId header.
      * @param {string} [appOrgId] - The app organization ID from x-frigg-appOrgId header.
      * @returns {Promise<import('../user').User>} The authenticated user object.
-     * @throws {Boom} 400 Bad Request if neither ID is provided or if both IDs are provided but belong to different users.
+     * @throws {Boom} 400 Bad Request if neither ID is provided or, in strict mode, if the person is not already a member of the existing organization named.
      */
     async execute(appUserId, appOrgId) {
         // At least one header must be provided
@@ -36,96 +75,60 @@ class GetUserFromXFriggHeaders {
         }
 
         // Find users by both IDs if both are provided
-        let individualUserData = null;
-        let organizationUserData = null;
-
-        if (appUserId && this.userConfig.individualUserRequired !== false) {
-            individualUserData =
-                await this.userRepository.findIndividualUserByAppUserId(
-                    appUserId
-                );
-        }
+        let { individual: individualUserData, organization: organizationUserData } =
+            await findAppUsers(this.userRepository, this.userConfig, {
+                appUserId,
+                appOrgId,
+            });
 
-        if (appOrgId && this.userConfig.organizationUserRequired) {
-            organizationUserData =
-                await this.userRepository.findOrganizationUserByAppOrgId(
-                    appOrgId
-                );
-        }
+        // Strict mode refuses to make anyone a member of an organization that
+        // existed before this request. Only an organization created below is
+        // exempt, since it has no members to disagree with.
+        const refuseNewMembers = this.strict && Boolean(organizationUserData);
 
-        // VALIDATION/AUTO-LINKING: If both IDs provided and both users exist, handle mismatch
+        // A person who does not exist yet cannot already be a member, so refuse
+        // now, before anything is persisted: refusing after creating them would
+        // leave an orphan individual behind on every refused request.
         if (
+            refuseNewMembers &&
             appUserId &&
-            appOrgId &&
-            individualUserData &&
-            organizationUserData
+            wantsIndividual(this.userConfig) &&
+            !individualUserData
         ) {
-            // Check if individual user is linked to the org user
-            const individualOrgId =
-                individualUserData.organizationUser?.toString();
-            const expectedOrgId = organizationUserData.id?.toString();
-
-            if (individualOrgId !== expectedOrgId) {
-                // Default behavior: Auto-link disconnected users
-                // Opt-in strict mode: Throw error on mismatch
-                if (this.userConfig.strictUserValidation) {
-                    throw Boom.badRequest(
-                        'User ID mismatch: x-frigg-appUserId and x-frigg-appOrgId refer to different users. ' +
-                            'Provide only one identifier or ensure they belong to the same user.'
-                    );
-                }
-
-                // Auto-link the users
-                individualUserData = await this.userRepository.linkIndividualToOrganization(
-                    individualUserData.id,
-                    organizationUserData.id
-                );
-            }
+            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
         }
 
         // Auto-create users independently if they don't exist and are required
-        if (
-            !individualUserData &&
-            appUserId &&
-            this.userConfig.individualUserRequired !== false
-        ) {
-            individualUserData =
-                await this.userRepository.createIndividualUser({
-                    appUserId,
-                    username: `app-user-${appUserId}`,
-                    email: `${appUserId}@app.local`,
-                });
-        }
-
-        if (
-            !organizationUserData &&
-            appOrgId &&
-            this.userConfig.organizationUserRequired
-        ) {
-            organizationUserData =
-                await this.userRepository.createOrganizationUser({
-                    appOrgId,
-                });
-
-            // Link individual user to newly created org user if individual exists
-            if (individualUserData && organizationUserData) {
-                individualUserData = await this.userRepository.linkIndividualToOrganization(
-                    individualUserData.id,
-                    organizationUserData.id
-                );
+        const created = await createMissingAppUsers(
+            this.userRepository,
+            this.userConfig,
+            {
+                appUserId,
+                appOrgId,
+                individual: individualUserData,
+                organization: organizationUserData,
             }
+        );
+        individualUserData = created.individual;
+        organizationUserData = created.organization;
+
+        // The organization named by the header is the active one: join it
+        // rather than re-linking the person's single organizationId.
+        const ensured = await this.ensureOrganizationMembership.execute({
+            individual: individualUserData,
+            organization: organizationUserData,
+            requireExisting: refuseNewMembers,
+        });
+        if (refuseNewMembers && individualUserData && !ensured.membership) {
+            throw Boom.badRequest(NOT_A_MEMBER_MESSAGE);
         }
+        individualUserData = ensured.individual;
 
-        const user = new User(
+        return buildUser(
+            this.userConfig,
             individualUserData,
-            organizationUserData,
-            this.userConfig.usePassword,
-            this.userConfig.primary,
-            this.userConfig.individualUserRequired,
-            this.userConfig.organizationUserRequired
+            organizationUserData
         );
-
-        return user;
     }
 }
 

package/user/user.js

@@ -1,5 +1,20 @@
 const bcrypt = require('bcryptjs');
 
+/**
+ * How the request that produced a `User` proved who it is. Set by
+ * AuthenticateUser, never inferred from a missing value. Organization roles
+ * (ADR-056 §3, §3.6) depend on it: a shared-secret caller is the app's own
+ * backend and is trusted to manage; a Frigg bearer token keeps its pre-roles
+ * behaviour unless the app opts in (`user.orgAdminGateBearerTokens`); an
+ * adopter token has the role it carries, else the stored membership role,
+ * else `MEMBER`.
+ */
+const AUTH_SOURCES = Object.freeze({
+    SHARED_SECRET: 'shared-secret',
+    ADOPTER_JWT: 'adopter-jwt',
+    BEARER_TOKEN: 'bearer-token',
+});
+
 /**
  * Represents a user in the system. The User class is a domain entity,
  * @class User
@@ -18,6 +33,14 @@ class User {
         this.individualUser = individualUser;
         this.organizationUser = organizationUser;
         this.usePassword = usePassword;
+        // Organization role from an adopter token claim (ADR-056 §2), per
+        // request. When present it wins over the stored membership role.
+        this.orgRole = null;
+        // The role stored on the person's membership of the active organization
+        // (OrganizationMembership.orgRole); used when the token carries none.
+        this.membershipRole = null;
+        // How this request authenticated (one of AUTH_SOURCES); null until AuthenticateUser says.
+        this.authSource = null;
 
         this.config = {
             primary,
@@ -26,6 +49,17 @@ class User {
         };
     }
 
+    /**
+     * The organization this request acts in (ADR-056 §3.6): the one the token or
+     * `x-frigg-appOrgId` named, not the person's legacy `organizationId`
+     * pointer. Null when the request has no organization.
+     * @returns {string|null}
+     */
+    getActiveOrganizationId() {
+        const id = this.organizationUser?.id;
+        return id === undefined || id === null || id === '' ? null : String(id);
+    }
+
     getPrimaryUser() {
         if (this.config.primary === 'organization') {
             return this.organizationUser;
@@ -33,6 +67,11 @@ class User {
         return this.individualUser;
     }
 
+    /**
+     * The id of the primary user. With `primary: 'organization'` this is the
+     * active organization (the one the request named), never the organization
+     * the person was first linked to.
+     */
     getId() {
         return this.getPrimaryUser()?.id;
     }
@@ -65,6 +104,30 @@ class User {
         return this.config.individualUserRequired;
     }
 
+    getAuthSource() {
+        return this.authSource;
+    }
+
+    setAuthSource(authSource) {
+        this.authSource = authSource ?? null;
+    }
+
+    getOrgRole() {
+        return this.orgRole;
+    }
+
+    setOrgRole(orgRole) {
+        this.orgRole = orgRole ?? null;
+    }
+
+    getMembershipRole() {
+        return this.membershipRole;
+    }
+
+    setMembershipRole(membershipRole) {
+        this.membershipRole = membershipRole ?? null;
+    }
+
     getIndividualUser() {
         return this.individualUser;
     }
@@ -122,4 +185,4 @@ class User {
     }
 }
 
-module.exports = { User }; 
+module.exports = { User, AUTH_SOURCES }; 

package/errors/mapping-already-exists-error.js

@@ -1,14 +0,0 @@
-const { BaseError } = require('./base-error');
-
-class MappingAlreadyExistsError extends BaseError {
-    constructor(integrationId, sourceId, ...errorOptions) {
-        super(
-            `Mapping already exists for integration ${integrationId} and sourceId ${sourceId}`,
-            ...errorOptions
-        );
-        this.integrationId = integrationId;
-        this.sourceId = sourceId;
-    }
-}
-
-module.exports = { MappingAlreadyExistsError };

package/integrations/use-cases/add-entities-to-integration.js

@@ -1,92 +0,0 @@
-const {
-    assertEntityIdsInput,
-    integrationNotFound,
-    loadIntegration,
-} = require('../utils/assert-entity-ids-input');
-
-/**
- * Attaches entities to an existing integration, e.g. when a user grants
- * access to more accounts after the integration was created. Every entity
- * must exist, belong to the integration's user, and be of a module the
- * integration already holds (so hydration can load it). Entities that are
- * already attached are left as they are.
- * @class AddEntitiesToIntegration
- */
-class AddEntitiesToIntegration {
-    /**
-     * @param {Object} params
-     * @param {import('../repositories/integration-repository-interface').IntegrationRepositoryInterface} params.integrationRepository
-     * @param {import('../../modules/repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository
-     */
-    constructor({ integrationRepository, moduleRepository }) {
-        this.integrationRepository = integrationRepository;
-        this.moduleRepository = moduleRepository;
-    }
-
-    /**
-     * @param {string} integrationId
-     * @param {string[]} entityIds
-     * @returns {Promise<Object>} The updated integration record.
-     */
-    async execute(integrationId, entityIds) {
-        assertEntityIdsInput(integrationId, entityIds);
-
-        const integration = await loadIntegration(
-            this.integrationRepository,
-            integrationId
-        );
-
-        const entities = await this.moduleRepository.findEntitiesByIds(
-            entityIds
-        );
-        const foundIds = new Set(entities.map((e) => String(e.id)));
-        const missing = entityIds.filter((id) => !foundIds.has(String(id)));
-        if (missing.length > 0) {
-            const error = new Error(
-                `Entities not found: ${missing.join(', ')}`
-            );
-            error.code = 'ENTITIES_NOT_FOUND';
-            throw error;
-        }
-
-        const foreign = entities.filter(
-            (e) => String(e.userId) !== String(integration.userId)
-        );
-        if (foreign.length > 0) {
-            const error = new Error(
-                `Entities do not belong to the integration's user: ${foreign
-                    .map((e) => e.id)
-                    .join(', ')}`
-            );
-            error.code = 'ENTITY_USER_MISMATCH';
-            throw error;
-        }
-
-        const attached = await this.moduleRepository.findEntitiesByIds(
-            integration.entitiesIds ?? []
-        );
-        const heldModules = new Set(attached.map((e) => e.moduleName));
-        const otherModules = entities.filter(
-            (e) => !heldModules.has(e.moduleName)
-        );
-        if (otherModules.length > 0) {
-            const error = new Error(
-                `Entities belong to a module the integration does not hold: ${otherModules
-                    .map((e) => `${e.id} (${e.moduleName})`)
-                    .join(', ')}`
-            );
-            error.code = 'ENTITY_MODULE_MISMATCH';
-            throw error;
-        }
-
-        const updated =
-            await this.integrationRepository.addEntitiesToIntegration(
-                integrationId,
-                entityIds
-            );
-        if (!updated) throw integrationNotFound(integrationId);
-        return updated;
-    }
-}
-
-module.exports = { AddEntitiesToIntegration };

package/integrations/use-cases/remove-entities-from-integration.js

@@ -1,70 +0,0 @@
-const {
-    assertEntityIdsInput,
-    integrationNotFound,
-    loadIntegration,
-} = require('../utils/assert-entity-ids-input');
-
-/**
- * Detaches entities from an integration. Entities that are not attached are
- * ignored, and detached entities are not deleted. Every module the
- * integration holds must keep at least one entity, so the integration can
- * still hydrate each of its modules.
- * @class RemoveEntitiesFromIntegration
- */
-class RemoveEntitiesFromIntegration {
-    /**
-     * @param {Object} params
-     * @param {import('../repositories/integration-repository-interface').IntegrationRepositoryInterface} params.integrationRepository
-     * @param {import('../../modules/repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository
-     */
-    constructor({ integrationRepository, moduleRepository }) {
-        this.integrationRepository = integrationRepository;
-        this.moduleRepository = moduleRepository;
-    }
-
-    /**
-     * @param {string} integrationId
-     * @param {string[]} entityIds
-     * @returns {Promise<Object>} The updated integration record.
-     */
-    async execute(integrationId, entityIds) {
-        assertEntityIdsInput(integrationId, entityIds);
-
-        const integration = await loadIntegration(
-            this.integrationRepository,
-            integrationId
-        );
-
-        const removing = new Set(entityIds.map(String));
-        const attached = await this.moduleRepository.findEntitiesByIds(
-            integration.entitiesIds ?? []
-        );
-        const emptied = [...new Set(attached.map((e) => e.moduleName))].filter(
-            (moduleName) =>
-                !attached.some(
-                    (e) =>
-                        e.moduleName === moduleName &&
-                        !removing.has(String(e.id))
-                )
-        );
-        if (emptied.length > 0) {
-            const error = new Error(
-                `Removing these entities would leave no entity for module(s): ${emptied.join(
-                    ', '
-                )}`
-            );
-            error.code = 'LAST_ENTITY_OF_MODULE';
-            throw error;
-        }
-
-        const updated =
-            await this.integrationRepository.removeEntitiesFromIntegration(
-                integrationId,
-                entityIds
-            );
-        if (!updated) throw integrationNotFound(integrationId);
-        return updated;
-    }
-}
-
-module.exports = { RemoveEntitiesFromIntegration };

package/integrations/utils/assert-entity-ids-input.js

@@ -1,42 +0,0 @@
-/**
- * Throws INVALID_INTEGRATION_DATA unless an integration id and a non-empty
- * list of entity ids are given.
- * @param {string} integrationId
- * @param {string[]} entityIds
- */
-function assertEntityIdsInput(integrationId, entityIds) {
-    if (!integrationId || !Array.isArray(entityIds) || entityIds.length === 0) {
-        const error = new Error(
-            'integrationId and a non-empty entityIds array are required'
-        );
-        error.code = 'INVALID_INTEGRATION_DATA';
-        throw error;
-    }
-}
-
-function integrationNotFound(integrationId) {
-    const error = new Error(`Integration ${integrationId} not found`);
-    error.code = 'INTEGRATION_NOT_FOUND';
-    return error;
-}
-
-/**
- * Loads an integration, mapping the repositories' "not found" error to
- * INTEGRATION_NOT_FOUND. Any other failure (connection, invalid id) is
- * rethrown unchanged.
- * @param {Object} integrationRepository
- * @param {string} integrationId
- * @returns {Promise<Object>} The integration record.
- */
-async function loadIntegration(integrationRepository, integrationId) {
-    try {
-        return await integrationRepository.findIntegrationById(integrationId);
-    } catch (error) {
-        if (/^Integration with id .* not found$/.test(error?.message)) {
-            throw integrationNotFound(integrationId);
-        }
-        throw error;
-    }
-}
-
-module.exports = { assertEntityIdsInput, integrationNotFound, loadIntegration };

package/modules/utils/to-credential-id.js

@@ -1,14 +0,0 @@
-/**
- * Resolve the credential id from an entity's or module's `credential`, which
- * repositories return as the decrypted credential object (or a bare id).
- * @param {Object|string|number|null|undefined} credential
- * @returns {string|null}
- */
-function toCredentialId(credential) {
-    if (credential && typeof credential === 'object') {
-        return credential.id?.toString() ?? null;
-    }
-    return credential?.toString() ?? null;
-}
-
-module.exports = { toCredentialId };