Implement Dart OrganizationIntegration data models
epic-external-system-integration-configuration-foundation-task-007 — Create fully typed Dart data model classes for OrganizationIntegration including fromJson/toJson serialization, JSONB field_mappings deserialization into typed FieldMapping objects, and sync schedule representation. Include copyWith, equality, and toString. Models must align exactly with the database schema columns.
Acceptance Criteria
Technical Requirements
Execution Context
Tier 2 - 518 tasks
Can start after Tier 1 completes
Handles integration between different epics or system components. Requires coordination across multiple development streams.
Implementation Notes
Place models in lib/domain/integrations/models/. Use @immutable annotation. For equality, consider using the equatable package if already in pubspec.yaml — otherwise implement == and hashCode manually. For the JSONB field: in fromJson, cast the raw value as List
and map each element through FieldMapping.fromJson(). In toJson, encode fieldMappings as a List
Testing Requirements
Write unit tests using flutter_test. Test: (1) fromJson round-trip with a complete fixture row; (2) fromJson handles null optional fields (credentialVaultId, syncSchedule, lastSyncAt) without throwing; (3) fromJson correctly decodes JSONB field_mappings array; (4) toJson produces correct structure for Supabase; (5) copyWith changes only the specified field; (6) equality check — two models with identical fields are equal; (7) DateTime parsing from ISO 8601 string with UTC offset; (8) empty/null field_mappings produces empty list. Use hardcoded fixture maps as inputs — no Supabase calls needed.
Supabase Vault API has limited documentation for Dart/Flutter clients; wrapping it correctly for credential rotation and secret reference management may require significant trial and error, delaying the vault component and blocking all downstream credential-dependent work.
Mitigation & Contingency
Mitigation: Spike the Vault integration in the first sprint using a minimal proof-of-concept (store, retrieve, rotate one secret). Document the API surface before building the full vault client. Identify any missing Dart SDK bindings early.
Contingency: If Supabase Vault is too complex, fall back to Supabase's encrypted column approach (pgcrypto) for credential storage as a temporary measure, with a planned migration path to Vault once the API is understood.
Incorrect RLS policy configuration on organization_integrations could allow org admins of one organization to read or modify another organization's integration credentials, creating a serious data breach and compliance violation.
Mitigation & Contingency
Mitigation: Write integration tests that explicitly attempt cross-org data access using different JWT tokens and assert 0 rows returned. Include RLS policy review in PR checklist. Use Supabase's local development stack for policy validation before deployment.
Contingency: If a breach is discovered post-deployment, immediately revoke all integration credentials, rotate vault secrets, notify affected organizations, and apply emergency RLS patches.
JSONB columns for field_mappings and sync_schedule lack database-level schema enforcement; AI-generated or malformed JSON could silently corrupt integration configurations, causing export failures that are hard to diagnose.
Mitigation & Contingency
Mitigation: Define TypeScript/Dart model classes with strict deserialization and validation. Add database check constraints or triggers that validate JSONB structure at write time. Version the JSONB schema to enable forward-compatible migrations.
Contingency: Build a repair script that scans organization_integrations for invalid JSONB and resets corrupted records to a safe default state, alerting the admin of the affected organization.