@friggframework/core 2.0.0--canary.707.df80bfd.0 → 2.0.0--canary.680.d670696.0

package/modules/repositories/module-repository-postgres.js

@@ -1,6 +1,5 @@
 const { prisma } = require('../../database/prisma');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
-const { entityNotFoundError } = require('./entity-not-found');
 
 /**
  * PostgreSQL Module Repository Adapter
@@ -109,26 +108,6 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         return credentialMap;
     }
 
-    /**
-     * The one place a stored entity row becomes the entity the application sees.
-     * The provider's `data` is spread FIRST and every column is pinned after it:
-     * a stored `id`, `userId` or `organizationId` in `data` must not decide who
-     * owns the entity or who sees it.
-     * @private
-     */
-    _mapEntity(row, credential) {
-        return {
-            ...(row.data || {}),
-            id: row.id.toString(),
-            credential,
-            userId: row.userId?.toString(),
-            name: row.name,
-            externalId: row.externalId,
-            moduleName: row.moduleName,
-            organizationId: row.organizationId?.toString() ?? null,
-        };
-    }
-
     /**
      * Find entity by ID with credential
      * Replaces: Entity.findById(entityId).populate('credential')
@@ -145,12 +124,20 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         });
 
         if (!entity) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
 
         const credential = await this._fetchCredential(entity.credentialId);
 
-        return this._mapEntity(entity, credential);
+        return {
+            id: entity.id.toString(),
+            credential,
+            userId: entity.userId?.toString(),
+            name: entity.name,
+            externalId: entity.externalId,
+            moduleName: entity.moduleName,
+            ...(entity.data || {}),
+        };
     }
 
     /**
@@ -170,7 +157,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         const credentialIds = entities.map(e => e.credentialId).filter(Boolean);
         const credentialMap = await this._fetchCredentialsBulk(credentialIds);
 
-        return entities.map((e) => (this._mapEntity(e, credentialMap.get(e.credentialId) || null)));
+        return entities.map((e) => ({
+            id: e.id.toString(),
+            credential: credentialMap.get(e.credentialId) || null,
+            userId: e.userId?.toString(),
+            name: e.name,
+            externalId: e.externalId,
+            moduleName: e.moduleName,
+            ...(e.data || {}),
+        }));
     }
 
     /**
@@ -190,7 +185,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         const credentialIds = entities.map(e => e.credentialId).filter(Boolean);
         const credentialMap = await this._fetchCredentialsBulk(credentialIds);
 
-        return entities.map((e) => (this._mapEntity(e, credentialMap.get(e.credentialId) || null)));
+        return entities.map((e) => ({
+            id: e.id.toString(),
+            credential: credentialMap.get(e.credentialId) || null,
+            userId: e.userId?.toString(),
+            name: e.name,
+            externalId: e.externalId,
+            moduleName: e.moduleName,
+            ...(e.data || {}),
+        }));
     }
 
     /**
@@ -214,32 +217,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         const credentialIds = entities.map(e => e.credentialId).filter(Boolean);
         const credentialMap = await this._fetchCredentialsBulk(credentialIds);
 
-        return entities.map((e) => (this._mapEntity(e, credentialMap.get(e.credentialId) || null)));
-    }
-
-    /**
-     * Find entities matching any of the owner/organization pairs, in one query.
-     * `organizationId: null` matches rows with no organization. The caller
-     * (a use case) decides which pairs; this only runs them.
-     *
-     * @param {Array<{userId: string, organizationId: (string|null)}>} clauses
-     * @returns {Promise<Array>} Array of entity objects with string IDs
-     */
-    async findEntitiesByOwnership(clauses) {
-        if (!Array.isArray(clauses) || clauses.length === 0) return [];
-        const entities = await this.prisma.entity.findMany({
-            where: {
-                OR: clauses.map(({ userId, organizationId }) => ({
-                    userId: this._convertId(userId),
-                    organizationId: this._convertId(organizationId),
-                })),
-            },
-        });
-
-        const credentialIds = entities.map(e => e.credentialId).filter(Boolean);
-        const credentialMap = await this._fetchCredentialsBulk(credentialIds);
-
-        return entities.map((e) => (this._mapEntity(e, credentialMap.get(e.credentialId) || null)));
+        return entities.map((e) => ({
+            id: e.id.toString(),
+            credential: credentialMap.get(e.credentialId) || null,
+            userId: e.userId?.toString(),
+            name: e.name,
+            externalId: e.externalId,
+            moduleName: e.moduleName,
+            ...(e.data || {}),
+        }));
     }
 
     /**
@@ -278,7 +264,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
 
         const credential = await this._fetchCredential(entity.credentialId);
 
-        return this._mapEntity(entity, credential);
+        return {
+            id: entity.id.toString(),
+            credential,
+            userId: entity.userId?.toString(),
+            name: entity.name,
+            externalId: entity.externalId,
+            moduleName: entity.moduleName,
+            ...(entity.data || {}),
+        };
     }
 
     /**
@@ -298,7 +292,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
             .filter(Boolean);
         const credentialMap = await this._fetchCredentialsBulk(credentialIds);
 
-        return entities.map((e) => (this._mapEntity(e, credentialMap.get(e.credentialId) || null)));
+        return entities.map((e) => ({
+            id: e.id.toString(),
+            credential: credentialMap.get(e.credentialId) || null,
+            userId: e.userId?.toString(),
+            name: e.name,
+            externalId: e.externalId,
+            moduleName: e.moduleName,
+            ...(e.data || {}),
+        }));
     }
 
     /**
@@ -306,13 +308,9 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
      * Replaces: Entity.create(entityData)
      *
      * @param {Object} entityData - Entity data (with string IDs from application layer)
-     * @param {{organizationId?: (string|null)}} [tenancy] - the organization the entity
-     *   belongs to (ADR-056 §3.6). A separate argument, not a field of `entityData`,
-     *   because `entityData` carries provider fields and one named `organizationId`
-     *   must not be taken for ours.
      * @returns {Promise<Object>} Created entity object with string IDs
      */
-    async createEntity(entityData, tenancy = {}) {
+    async createEntity(entityData) {
         const {
             user,
             userId,
@@ -330,7 +328,6 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
             name,
             moduleName,
             externalId,
-            organizationId: this._convertId(tenancy.organizationId ?? null),
             data: dynamicData,
         };
 
@@ -340,7 +337,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
 
         const credentialObj = await this._fetchCredential(entity.credentialId);
 
-        return this._mapEntity(entity, credentialObj);
+        return {
+            id: entity.id.toString(),
+            credential: credentialObj,
+            userId: entity.userId?.toString(),
+            name: entity.name,
+            externalId: entity.externalId,
+            moduleName: entity.moduleName,
+            ...(entity.data || {}),
+        };
     }
 
     /**
@@ -396,7 +401,15 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
 
             const credentialObj = await this._fetchCredential(entity.credentialId);
 
-            return this._mapEntity(entity, credentialObj);
+            return {
+                id: entity.id.toString(),
+                credential: credentialObj,
+                userId: entity.userId?.toString(),
+                name: entity.name,
+                externalId: entity.externalId,
+                moduleName: entity.moduleName,
+                ...(entity.data || {}),
+            };
         } catch (error) {
             if (error.code === 'P2025') {
                 return null;
@@ -461,11 +474,6 @@ class ModuleRepositoryPostgres extends ModuleRepositoryInterface {
         if (filter.moduleName) where.moduleName = filter.moduleName;
         if (filter.externalId) where.externalId = this._toString(filter.externalId);
 
-        // `null` means "no organization"; absent means "any".
-        if (filter.organizationId !== undefined) {
-            where.organizationId = this._convertId(filter.organizationId);
-        }
-
         return where;
     }
 }

package/modules/repositories/module-repository.js

@@ -1,6 +1,5 @@
 const { prisma } = require('../../database/prisma');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
-const { entityNotFoundError } = require('./entity-not-found');
 
 /**
  * Prisma-based Module Repository
@@ -38,7 +37,7 @@ class ModuleRepository extends ModuleRepositoryInterface {
         });
 
         if (!entity) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
 
         return {

package/modules/requester/proxy-request.js

@@ -28,8 +28,7 @@ const MAX_REDIRECTS = 3;
  * @param {Object} [params.query]
  * @param {Object} [params.headers] - already filtered by the caller's policy
  * @param {string|Buffer} [params.body] - already serialised
- * @param {string} [params.baseUrl] - the module-declared URL of the base the
- *   caller named (ADR-052 amendment; resolved by the use case); falls
+ * @param {string} [params.baseUrl] - module-declared proxy base URL; falls
  *   back to the requester's `proxyBaseUrl`, `baseUrl` or `baseURL`
  * @param {number} params.timeoutMs - budget for the whole call
  * @param {number} params.maxResponseBytes

package/modules/requester/requester.js

@@ -219,14 +219,9 @@ class Requester extends Delegate {
         if (options.query) {
             let queryBuild = '?';
             for (const key in options.query) {
-                const value = options.query[key];
-                // `fields[]: ['a', 'b']` -> `fields%5B%5D=a&fields%5B%5D=b`.
-                // Any other array keeps String(value), i.e. comma-joined.
-                const values =
-                    Array.isArray(value) && key.endsWith('[]') ? value : [value];
-                for (const v of values) {
-                    queryBuild += `${encodeURIComponent(key)}=${encodeURIComponent(v)}&`;
-                }
+                queryBuild += `${encodeURIComponent(key)}=${encodeURIComponent(
+                    options.query[key]
+                )}&`;
             }
             encodedUrl += queryBuild.slice(0, -1);
         }

package/modules/use-cases/entity-operations-for-user.js

@@ -1,11 +1,4 @@
 const Boom = require('@hapi/boom');
-const {
-    describeRecord,
-    visibilityClauses,
-    matchesListFilters,
-} = require('../scope-visibility');
-const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
-const { assertCanManage } = require('./manage-access');
 
 /**
  * Management API v2 entity operations. Each one starts from
@@ -13,55 +6,29 @@ const { assertCanManage } = require('./manage-access');
  * (missing or foreign entity = 404).
  */
 
-/**
- * The entities the caller may see in the active organization (ADR-056 §3.4,
- * §3.6): the organization's own, and the caller's individual ones by the
- * visibility rule. Each carries `tenancy` ({scope, owner, organizationId,
- * access}); the stored entity is otherwise untouched.
- */
+/** The caller's connected entities. */
 class ListEntitiesForUser {
-    constructor({ moduleRepository, scopePolicy }) {
+    constructor({ moduleRepository }) {
         this.moduleRepository = moduleRepository;
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
     }
 
-    /**
-     * @param {Object} user - authenticated User
-     * @param {{scope?: string, owner?: string}} [filters] - `?scope=` and `?owner=`
-     */
-    async execute(user, filters = {}) {
-        const ctx = this.scopePolicy.accessContext(user);
-        const entities = await this.moduleRepository.findEntitiesByOwnership(
-            visibilityClauses(ctx, 'entity')
+    /** @param {Object} user - authenticated User */
+    async execute(user) {
+        const entities = await this.moduleRepository.findEntitiesByUserId(
+            user.getId()
         );
-        const listed = [];
-        for (const entity of Array.isArray(entities) ? entities : []) {
-            // The query is the filter; this is the same rule applied again,
-            // so a repository that returns too much cannot widen the list.
-            const tenancy = describeRecord(entity, ctx, 'entity');
-            if (tenancy && matchesListFilters(tenancy, filters)) {
-                listed.push({ ...entity, tenancy });
-            }
-        }
-        return listed;
+        return Array.isArray(entities) ? entities : [];
     }
 }
 
-/** One entity the caller may use, with its `tenancy`. */
+/** One entity the caller owns. */
 class GetEntityForUser {
     constructor({ getEntityModuleForUser }) {
         this.getEntityModuleForUser = getEntityModuleForUser;
     }
 
     async execute(entityId, user) {
-        const entity = await this.getEntityModuleForUser.loadOwnedEntity(
-            entityId,
-            user
-        );
-        return {
-            ...entity,
-            tenancy: this.getEntityModuleForUser.describe(entity, user),
-        };
+        return this.getEntityModuleForUser.loadOwnedEntity(entityId, user);
     }
 }
 
@@ -112,10 +79,10 @@ class RefreshEntityOptionsForUser {
 }
 
 /**
- * Deletes an entity the caller may manage (the owner; for an organization
- * entity, an organization admin). Refuses with 409 while integrations still
- * use it, so an integration never points at a missing entity. The credential
- * is left alone (others may share it); delete it through /api/v2/credentials.
+ * Deletes an entity the caller owns. Refuses with 409 while integrations
+ * still use it, so an integration never points at a missing entity. The
+ * credential is left alone (others may share it); delete it through
+ * /api/v2/credentials.
  */
 class DeleteEntityForUser {
     constructor({ getEntityModuleForUser, moduleRepository, integrationRepository }) {
@@ -129,10 +96,6 @@ class DeleteEntityForUser {
             entityId,
             user
         );
-        assertCanManage(
-            this.getEntityModuleForUser.describe(entity, user)?.access,
-            `entity ${entity.id}`
-        );
         const integrations =
             (await this.integrationRepository.findIntegrationsByEntityId(
                 entity.id

package/modules/use-cases/entity-types.js

@@ -59,31 +59,10 @@ function findDefinition(moduleDefinitions, entityType) {
     return definition;
 }
 
-/**
- * With a scope policy the entry also says which scope a new connection gets
- * and which a request may choose (ADR-056 §3.1), so a UI can offer the choice.
- * `global` is never offered: a tenant request cannot create one.
- */
-const scopeOf = (scopePolicy, name, user) => {
-    if (!scopePolicy) return {};
-    const { scope, source, allow } = scopePolicy.resolveScope({
-        entityType: name,
-        user,
-    });
-    return {
-        scope: {
-            default: scope,
-            allow: allow.filter((value) => value !== 'global'),
-            source,
-        },
-    };
-};
-
-const describeEntry = (name, entry, scopePolicy, user) => ({
+const describeEntry = (name, entry) => ({
     // The registry key is the name the API uses, whatever the definition spells.
     ...describeEntityType(entry.definition, name),
     usedBy: usedByOf(entry),
-    ...scopeOf(scopePolicy, name, user),
 });
 
 function requireRegistry(entityTypeRegistry) {
@@ -99,34 +78,31 @@ function requireRegistry(entityTypeRegistry) {
  * bind each type; it is empty for a registry-only type.
  */
 class ListEntityTypes {
-    constructor({ entityTypeRegistry, scopePolicy }) {
+    constructor({ entityTypeRegistry }) {
         this.registry = requireRegistry(entityTypeRegistry);
-        this.scopePolicy = scopePolicy;
     }
 
-    /** @param {{user?: Object}} [params] - the caller, for the level-6 scope default */
-    async execute({ user } = {}) {
+    async execute() {
         return [...this.registry]
-            .map(([name, entry]) => describeEntry(name, entry, this.scopePolicy, user))
+            .map(([name, entry]) => describeEntry(name, entry))
             .sort((a, b) => a.name.localeCompare(b.name));
     }
 }
 
 /** Describes one entity type, looked up by its registry key; 404 when absent. */
 class GetEntityType {
-    constructor({ entityTypeRegistry, scopePolicy }) {
+    constructor({ entityTypeRegistry }) {
         this.registry = requireRegistry(entityTypeRegistry);
-        this.scopePolicy = scopePolicy;
     }
 
-    async execute(entityType, { user } = {}) {
+    async execute(entityType) {
         const entry = this.registry.get(entityType);
         if (!entry) {
             throw Boom.notFound(`Entity type '${entityType}' not found`, {
                 code: 'ENTITY_TYPE_NOT_FOUND',
             });
         }
-        return describeEntry(entityType, entry, this.scopePolicy, user);
+        return describeEntry(entityType, entry);
     }
 }
 

package/modules/use-cases/execute-entity-proxy-request.js

@@ -1,11 +1,8 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
 const { getTelemetry } = require('../../telemetry/telemetry-runtime');
-const { ProxyRequestError, ProxyConfigError } = require('../proxy/proxy-errors');
-const { SCOPES } = require('../scope-resolution');
-const { grantsUse } = require('../scope-visibility');
+const { ProxyRequestError } = require('../proxy/proxy-errors');
 const { normalizeProxyPath, matchAllowRule } = require('../proxy/proxy-path');
-const { DEFAULT_BASE, resolveModuleBases } = require('../proxy/proxy-bases');
 const {
     validateProxyRequest,
     resolveAllowRules,
@@ -19,7 +16,6 @@ const log = getLogger('frigg.api.proxy');
 /** HTTP status and audit outcome for each proxy error code (ADR-052 §10). */
 const ERROR_MAP = {
     INVALID_PROXY_REQUEST: { status: 400, outcome: 'denied' },
-    PROXY_UNKNOWN_BASE: { status: 400, outcome: 'denied' },
     PROXY_NOT_ALLOWED: { status: 403, outcome: 'denied' },
     PAYLOAD_TOO_LARGE: { status: 413, outcome: 'too_large' },
     UNSUPPORTED_MEDIA_TYPE: { status: 415, outcome: 'denied' },
@@ -59,11 +55,9 @@ const authHeaderNamesOf = (api) =>
  * through its module with the stored credential, inside the limits the app
  * and the module set.
  *
- * Order of checks: request shape and size, path rules, entity visibility in
- * the active organization (404), `use` access (403), the entity's scope
- * against `managementApi.proxy.scopes` (403), the module's allow-list (403,
- * deny by default), credential readiness (401), then the call through
- * Requester._proxyRequest. Every call,
+ * Order of checks: request shape and size, path rules, entity ownership
+ * (404), the module's allow-list (403, deny by default), credential
+ * readiness (401), then the call through Requester._proxyRequest. Every call,
  * allowed or denied, writes one audit record and one usage count. Bodies,
  * headers, query values and the raw path are never logged.
  */
@@ -104,27 +98,9 @@ class ExecuteEntityProxyRequest {
             audit.requestBytes = validated.requestBytes;
             const path = normalizeProxyPath(validated.path);
 
-            // Visible in the active organization, or 404 (ADR-056 §3.6): the
-            // same clauses the v2 lists use, so a missing entity, another
-            // person's and one paired with another organization look alike.
             const { entity, definition, module } =
                 await this.getEntityModuleForUser.execute(entityId, user);
             audit.module = definition.moduleName;
-            this.assertProxyable(entityId, entity, definition, user);
-
-            // The base is a name the module declared; the host comes from the
-            // module's declaration, never from the request.
-            const base = validated.base ?? DEFAULT_BASE;
-            audit.base = base;
-            const bases = this.basesOf(definition);
-            if (!bases.names.includes(base)) {
-                throw new ProxyRequestError(
-                    'PROXY_UNKNOWN_BASE',
-                    `Module ${definition.moduleName} has no base named ${base}; use one of: ${bases.names.join(', ')}`,
-                    { module: definition.moduleName, base, bases: bases.names }
-                );
-            }
-
             const credentialRef = entity.credential;
             const credentialId =
                 credentialRef && typeof credentialRef === 'object'
@@ -135,14 +111,12 @@ class ExecuteEntityProxyRequest {
             }
 
             const { rules } = resolveAllowRules(definition, this.proxyConfig.modules);
-            const rule = matchAllowRule(rules, validated.method, path, base);
+            const rule = matchAllowRule(rules, validated.method, path);
             if (!rule) {
                 throw new ProxyRequestError(
                     'PROXY_NOT_ALLOWED',
-                    `Module ${definition.moduleName} does not allow ${validated.method} on this path` +
-                        // Single-base modules keep the message they always had.
-                        (bases.names.length > 1 ? ` of base ${base}` : ''),
-                    { module: definition.moduleName, method: validated.method, base }
+                    `Module ${definition.moduleName} does not allow ${validated.method} on this path`,
+                    { module: definition.moduleName, method: validated.method }
                 );
             }
             audit.pattern = rule.path;
@@ -170,11 +144,11 @@ class ExecuteEntityProxyRequest {
                 query: validated.query,
                 headers,
                 body: validated.body,
-                baseUrl: this.resolveBaseUrl(bases, module.api, base),
+                baseUrl: this.resolveBaseUrl(definition, module.api),
                 timeoutMs: this.proxyConfig.timeoutMs,
                 maxResponseBytes: this.proxyConfig.maxResponseBytes,
                 isAllowedRedirect: (nextPath, nextMethod) =>
-                    Boolean(matchAllowRule(rules, nextMethod, nextPath, base)),
+                    Boolean(matchAllowRule(rules, nextMethod, nextPath)),
             });
             audit.upstreamStatus = upstream.status;
             audit.responseBytes = upstream.body?.length ?? 0;
@@ -228,78 +202,12 @@ class ExecuteEntityProxyRequest {
         }
     }
 
-    /**
-     * ADR-056 §3.5: the caller needs `use` access to the entity in the active
-     * organization, and the entity's scope must be one the app lets the proxy
-     * accept. `access` and `scope` come from the description the v2 lists
-     * return (GetEntityModuleForUser.describe), never from a second rule.
-     *
-     * Both refusals are 403 PROXY_NOT_ALLOWED: the caller can already see the
-     * entity, so saying it exists leaks nothing. `details.reason` tells them
-     * apart ('access' or 'scope').
-     */
-    assertProxyable(entityId, entity, definition, user) {
-        const tenancy = this.getEntityModuleForUser.describe(entity, user);
-        if (!tenancy) {
-            // Not visible after all: the same 404 as a missing entity.
-            throw Boom.notFound(`Entity ${entityId} not found`, {
-                code: 'ENTITY_NOT_FOUND',
-            });
-        }
-        if (!grantsUse(tenancy.access)) {
-            throw new ProxyRequestError(
-                'PROXY_NOT_ALLOWED',
-                'Proxying through an entity needs use access to it; you can only view this one',
-                { module: definition.moduleName, reason: 'access' }
-            );
-        }
-        // Narrowest by default (§3.5): with no setting only individual
-        // entities are proxied, because proxying through a shared credential
-        // lets any member act on the organization's account.
-        const acceptedScopes = this.proxyConfig.scopes ?? [SCOPES.INDIVIDUAL];
-        if (!acceptedScopes.includes(tenancy.scope)) {
-            throw new ProxyRequestError(
-                'PROXY_NOT_ALLOWED',
-                `The entity proxy does not accept ${tenancy.scope} entities in this app`,
-                { module: definition.moduleName, reason: 'scope', scope: tenancy.scope }
-            );
-        }
-    }
-
-    /**
-     * The module's bases. Load already validated the definition
-     * (assertProxyConfig), so this only fails for a definition that skipped
-     * load; that is a configuration fault (501), never an unmapped 500.
-     */
-    basesOf(definition) {
-        try {
-            return resolveModuleBases(definition);
-        } catch (error) {
-            if (!(error instanceof ProxyConfigError)) throw error;
-            throw new ProxyRequestError(
-                'PROXY_NOT_CONFIGURED',
-                `Module ${definition.moduleName} has invalid proxy settings`
-            );
-        }
-    }
-
-    /**
-     * The URL of the named base. A base the module declared never falls back
-     * to the requester's own host (that would send the module's token to a
-     * host the module did not name); only a module that declares nothing at
-     * all uses the requester's base URL, signalled by undefined.
-     */
-    resolveBaseUrl(bases, api, name) {
-        const declared = bases.values.get(name);
-        if (!bases.declared) return undefined;
-        const url = typeof declared === 'function' ? declared(api) : declared;
-        if (typeof url !== 'string' || url === '') {
-            throw new ProxyRequestError(
-                'PROXY_NOT_CONFIGURED',
-                `The module declares no usable URL for base ${name}`
-            );
-        }
-        return url;
+    /** A module may pin its proxy base URL (string, or a function of the api). */
+    resolveBaseUrl(definition, api) {
+        const declared = definition.proxy?.baseUrl;
+        if (typeof declared === 'function') return declared(api);
+        if (typeof declared === 'string') return declared;
+        return undefined;
     }
 
     /** One audit record (ADR-048) and one usage count (ADR-011) per call. */

package/modules/use-cases/get-authorization-requirements.js

@@ -3,7 +3,7 @@ const { findDefinition, getAuthStepCount } = require('./entity-types');
 
 const defaultCreateModule = (params) => {
     const { Module } = require('../module');
-    return Module.create(params);
+    return new Module(params);
 };
 
 /**
@@ -80,7 +80,7 @@ class GetAuthorizationRequirements {
         if (typeof definition.getAuthRequirementsForStep === 'function') {
             raw = await definition.getAuthRequirementsForStep(step);
         } else {
-            const module = await this.createModule({
+            const module = this.createModule({
                 userId,
                 definition,
                 ...(state ? { state } : {}),