fraim-framework 2.0.182 → 2.0.184

package/dist/src/fraim/db-service.js

@@ -74,6 +74,17 @@ function normalizeLabels(labels) {
 function escapeRegex(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * Ordering for persona entitlements, applied in memory. Azure Cosmos DB (Mongo API)
+ * rejects an order-by on these fields without a composite index, so the sort must not
+ * be pushed into the query. Mirrors the former `.sort({ personaKey: 1, hireMode: 1 })`.
+ */
+function comparePersonaEntitlements(a, b) {
+    const byKey = (a.personaKey || '').localeCompare(b.personaKey || '');
+    if (byKey !== 0)
+        return byKey;
+    return (a.hireMode || '').localeCompare(b.hireMode || '');
+}
 function buildLabelMatch(label) {
     return { labels: { $regex: `^${escapeRegex(label)}$`, $options: 'i' } };
 }
@@ -728,12 +739,21 @@ class FraimDbService {
         if (activeOnly) {
             query.status = 'active';
         }
-        return await this.personaEntitlementsCollection.find(query).sort({ personaKey: 1, hireMode: 1 }).toArray();
+        // Sort in memory, not in the query: Azure Cosmos DB (Mongo API) rejects an
+        // order-by on { personaKey, hireMode } with BadRequest 400 unless a matching
+        // composite index exists, and the initializeIndexes() attempt to create one
+        // is swallowed on Cosmos. A throw here bubbles up into getWorkspacePersonaState
+        // → the AI Hub silently falls back to ALL personas locked (no hired employees,
+        // empty manager team, empty project tree). Sorting client-side is index-free.
+        const rows = await this.personaEntitlementsCollection.find(query).toArray();
+        return rows.sort(comparePersonaEntitlements);
     }
     async listPersonaEntitlementsByStripeCustomerId(customerId) {
         if (!this.personaEntitlementsCollection)
             throw new Error('DB not connected');
-        return await this.personaEntitlementsCollection.find({ stripeCustomerId: customerId }).sort({ updatedAt: -1 }).toArray();
+        // In-memory sort — see getPersonaEntitlementsByWorkspaceId (Cosmos order-by).
+        const rows = await this.personaEntitlementsCollection.find({ stripeCustomerId: customerId }).toArray();
+        return rows.sort((a, b) => (b.updatedAt?.getTime() ?? 0) - (a.updatedAt?.getTime() ?? 0));
     }
     async getPersonaEntitlementsByUserId(userId, activeOnly = true) {
         if (!this.personaEntitlementsCollection)
@@ -742,7 +762,9 @@ class FraimDbService {
         if (activeOnly) {
             query.status = 'active';
         }
-        return await this.personaEntitlementsCollection.find(query).sort({ personaKey: 1, hireMode: 1 }).toArray();
+        // In-memory sort — see getPersonaEntitlementsByWorkspaceId (Cosmos order-by).
+        const rows = await this.personaEntitlementsCollection.find(query).toArray();
+        return rows.sort(comparePersonaEntitlements);
     }
     async upsertPersonaEntitlement(entitlement) {
         if (!this.personaEntitlementsCollection)

package/dist/src/routes/oauth-routes.js

@@ -4,6 +4,16 @@ exports.registerOAuthRoutes = registerOAuthRoutes;
 const cookie_service_1 = require("../services/cookie-service");
 const oauth_helpers_1 = require("../services/oauth-helpers");
 const audit_log_1 = require("../services/audit-log");
+const account_provisioning_1 = require("../services/account-provisioning");
+const rate_limit_1 = require("../middleware/rate-limit");
+function pickIntent(value) {
+    return value === 'signup' ? 'signup' : 'signin';
+}
+// Issue #691: intent=signup makes /start reachable as an account-creation path
+// (see completeSignIn below), the same sensitive business flow /api/request-access
+// already rate-limits. Apply the same limiter here, scoped to signup attempts only —
+// the pre-existing sign-in path (no intent) is left at its original, unlimited behavior.
+const signupRateLimiter = (0, rate_limit_1.sensitiveRateLimiter)();
 const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
 const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
@@ -75,13 +85,17 @@ function registerOAuthRoutes(app, deps) {
         NODE_ENV: process.env.NODE_ENV || '(not set)',
     });
     // Helper used by both providers to finalise authentication once we have a verified email.
-    async function completeSignIn(req, res, verifiedEmail, provider, surface, redirectTo) {
+    async function completeSignIn(req, res, params) {
+        const { verifiedEmail, provider, surface, redirectTo, intent } = params;
         const lower = verifiedEmail.toLowerCase();
         const apiKeyData = await dbService.getApiKeyByUserId(lower, false);
-        if (!apiKeyData) {
+        if (!apiKeyData && intent !== 'signup') {
             // Sign-in is NOT a sign-up. If the verified email doesn't already match a
             // FRAIM account, route the user to the sign-up flow. Account creation is
             // owned by /api/request-access, not by login. (Round-2 user feedback.)
+            // Issue #691: this only applies to the sign-in surface (intent !== 'signup').
+            // The dedicated signup surface uses intent='signup' to provision an account
+            // below instead of bouncing to no_account.
             await (0, audit_log_1.auditLog)('OAUTH_CALLBACK_SUCCESS', {
                 userId: lower,
                 provider,
@@ -92,6 +106,9 @@ function registerOAuthRoutes(app, deps) {
             (0, cookie_service_1.clearOAuthPendingCookie)(res);
             return res.redirect(`/auth/error.html?reason=no_account`);
         }
+        if (!apiKeyData && intent === 'signup') {
+            await (0, account_provisioning_1.ensureTrialApiKey)(dbService, lower);
+        }
         const sessionId = (0, oauth_helpers_1.generateSessionId)();
         await dbService.createAuthSession({
             sessionId,
@@ -106,13 +123,18 @@ function registerOAuthRoutes(app, deps) {
         (0, cookie_service_1.clearOAuthPendingCookie)(res);
         res.redirect(redirectTo);
     }
-    app.get('/api/auth/oauth/:provider/start', async (req, res) => {
+    app.get('/api/auth/oauth/:provider/start', (req, res, next) => {
+        if (pickIntent(req.query.intent) === 'signup')
+            return signupRateLimiter(req, res, next);
+        next();
+    }, async (req, res) => {
         const providerRaw = req.params.provider;
         const provider = typeof providerRaw === 'string' ? providerRaw : '';
         if (!(0, oauth_helpers_1.isSupportedProvider)(provider)) {
             return res.status(404).json({ error: 'unsupported_provider' });
         }
         const surface = (0, oauth_helpers_1.pickSurfaceOrDefault)(req.query.surface);
+        const intent = pickIntent(req.query.intent);
         const redirectTo = (0, oauth_helpers_1.safeRedirectPath)(req.query.redirect_to, (0, oauth_helpers_1.defaultRedirectForSurface)(surface));
         try {
             const codeVerifier = (0, oauth_helpers_1.generatePkceVerifier)();
@@ -122,6 +144,7 @@ function registerOAuthRoutes(app, deps) {
                 pendingId,
                 provider,
                 surface,
+                intent,
                 codeVerifier,
                 stateNonce,
                 redirectTo,
@@ -228,7 +251,13 @@ function registerOAuthRoutes(app, deps) {
                 await (0, audit_log_1.auditLog)('OAUTH_UNVERIFIED_EMAIL', { provider: 'google', outcome: 'failure' });
                 return res.redirect('/auth/error.html?reason=unverified_email');
             }
-            await completeSignIn(req, res, payload.email, 'google', pending.surface, pending.redirectTo);
+            await completeSignIn(req, res, {
+                verifiedEmail: payload.email,
+                provider: 'google',
+                surface: pending.surface,
+                redirectTo: pending.redirectTo,
+                intent: pickIntent(pending.intent),
+            });
         }
         catch (err) {
             console.error('[FRAIM AUTH] /api/auth/oauth/google/callback error:', err instanceof Error ? err.message : String(err));
@@ -315,7 +344,13 @@ function registerOAuthRoutes(app, deps) {
                 await (0, audit_log_1.auditLog)('OAUTH_UNVERIFIED_EMAIL', { provider: 'github', outcome: 'failure' });
                 return res.redirect('/auth/error.html?reason=unverified_email');
             }
-            await completeSignIn(req, res, verifiedEmail, 'github', pending.surface, pending.redirectTo);
+            await completeSignIn(req, res, {
+                verifiedEmail,
+                provider: 'github',
+                surface: pending.surface,
+                redirectTo: pending.redirectTo,
+                intent: pickIntent(pending.intent),
+            });
         }
         catch (err) {
             console.error('[FRAIM AUTH] /api/auth/oauth/github/callback error:', err instanceof Error ? err.message : String(err));

package/dist/src/services/account-provisioning.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureTrialApiKey = ensureTrialApiKey;
+const feature_flags_1 = require("../config/feature-flags");
+const TRIAL_DURATION_MS = 14 * 24 * 60 * 60 * 1000;
+/**
+ * Provision a 14-day trial FraimApiKey for `emailLower` if one does not already
+ * exist; otherwise return the existing key. Shared by the email+code signup
+ * flow (`AdminService.verifyRequestAccessCode`) and the OAuth signup-intent
+ * flow (`oauth-routes.ts`) so account creation has exactly one implementation.
+ * Issue #691.
+ */
+async function ensureTrialApiKey(dbService, emailLower) {
+    const existingKey = await dbService.getApiKeyByUserId(emailLower, false);
+    if (existingKey)
+        return existingKey.key;
+    const orgId = 'default';
+    const apiKey = dbService.generateApiKey(emailLower, orgId);
+    const trialExpiresAt = new Date(Date.now() + TRIAL_DURATION_MS);
+    await dbService.createApiKey({
+        key: apiKey,
+        userId: emailLower,
+        orgId,
+        tier: 'trial',
+        status: 'active',
+        expiresAt: trialExpiresAt,
+        stripeCustomerId: null,
+        stripeSubscriptionId: null,
+        currentPeriodEnd: null,
+        cancelAt: null,
+        suspendedAt: null,
+        suspensionReason: null,
+        lastUsedAt: null,
+        apiCallCount: 0,
+        personaSystemActive: (0, feature_flags_1.isPersonaEntitlementsEnabled)() || undefined
+    });
+    return apiKey;
+}

package/dist/src/services/admin-service.js

@@ -7,6 +7,7 @@ const email_service_1 = require("./email-service");
 const dashboard_access_1 = require("./dashboard-access");
 const feature_flags_1 = require("../config/feature-flags");
 const email_code_1 = require("./email-code");
+const account_provisioning_1 = require("./account-provisioning");
 class AdminService {
     constructor(dbService) {
         this.dbService = dbService;
@@ -130,8 +131,11 @@ class AdminService {
      */
     async requestAccess(body, req) {
         const { email, name, company, useCase } = body;
-        if (!email || !name || !company) {
-            throw new Error('Email, name, and company are required');
+        // Issue #691: signup is now email + verification code only. Name/company
+        // are optional lead-capture fields (createWebsiteSignup below already
+        // tolerates missing values); the trial key itself never required them.
+        if (!email) {
+            throw new Error('Email is required');
         }
         if (!(0, request_utils_1.validateEmail)(email))
             throw new Error('Invalid email address');
@@ -140,8 +144,8 @@ class AdminService {
             const { ip: ipAddress, userAgent } = (0, request_utils_1.getRequestMeta)(req);
             await this.dbService.createWebsiteSignup({
                 email: emailLower,
-                name: name.trim(),
-                company: company.trim(),
+                name: name?.trim() || '',
+                company: company?.trim() || '',
                 useCase: useCase?.trim(),
                 source: 'request-access',
                 timestamp: new Date(),
@@ -166,7 +170,7 @@ class AdminService {
         });
         const emailService = new email_service_1.EmailService();
         const baseUrl = process.env.BASE_URL || 'https://fraimworks.ai';
-        await emailService.sendEmailCode(emailLower, `${baseUrl}/get-started`, verificationCode, { purpose: 'request-access' });
+        await emailService.sendEmailCode(emailLower, `${baseUrl}/?email=${encodeURIComponent(emailLower)}`, verificationCode, { purpose: 'request-access' });
         console.log('[FRAIM] request_access email_code_sent', { userId: emailLower });
         return {
             success: true,
@@ -184,38 +188,8 @@ class AdminService {
         if (!verification) {
             return { success: false, error: 'Invalid or expired verification code' };
         }
-        const orgId = 'default';
-        const existingKey = await this.dbService.getApiKeyByUserId(emailLower, false);
-        let apiKey;
-        if (existingKey) {
-            apiKey = existingKey.key;
-            console.log('[FRAIM] verify_email_code existing_key_found', { userId: emailLower });
-        }
-        else {
-            apiKey = this.dbService.generateApiKey(emailLower, orgId);
-            const trialExpiresAt = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000);
-            await this.dbService.createApiKey({
-                key: apiKey,
-                userId: emailLower,
-                orgId,
-                tier: 'trial',
-                status: 'active',
-                expiresAt: trialExpiresAt,
-                stripeCustomerId: null,
-                stripeSubscriptionId: null,
-                currentPeriodEnd: null,
-                cancelAt: null,
-                suspendedAt: null,
-                suspensionReason: null,
-                lastUsedAt: null,
-                apiCallCount: 0,
-                personaSystemActive: (0, feature_flags_1.isPersonaEntitlementsEnabled)() || undefined
-            });
-            console.log('[FRAIM] verify_email_code trial_key_created', {
-                userId: emailLower,
-                expiresAt: trialExpiresAt.toISOString()
-            });
-        }
+        const apiKey = await (0, account_provisioning_1.ensureTrialApiKey)(this.dbService, emailLower);
+        console.log('[FRAIM] verify_email_code key_resolved', { userId: emailLower });
         const access = await (0, dashboard_access_1.createDashboardAccessLink)(this.dbService, emailLower, apiKey);
         console.log('[FRAIM] verify_email_code verification_completed', { userId: emailLower });
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.182",
+  "version": "2.0.184",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/index.html

@@ -428,6 +428,12 @@
   </div>
 
       </div><!-- /.workspace-conv -->
+      <div class="proj-switch-mask" id="proj-switch-mask" role="status" aria-live="polite" aria-hidden="true">
+        <div class="proj-switch-panel">
+          <span class="proj-switch-spinner" aria-hidden="true"></span>
+          <span id="proj-switch-label">Loading project...</span>
+        </div>
+      </div>
     </div><!-- /#proj-workspace -->
   </section><!-- /#area-projects -->