@friggframework/admin-scripts 2.0.0--canary.517.b384239.0 → 2.0.0--canary.517.a353e20.0

package/README.md

@@ -6,7 +6,7 @@ Typical use cases:
 
 -   **Healing scripts** — repair broken integration state (e.g. corrupted config).
 -   **Recurring maintenance** — refresh webhooks/subscriptions before they expire.
--   **Built-in utilities** — OAuth token refresh, integration health checks.
+-   **Operational tasks** — OAuth token refresh, integration health checks, one-off data backfills. (You write these — none ship built-in.)
 
 > Admin scripts are a **high-privilege** surface. Every endpoint is protected by an admin API key (`x-frigg-admin-api-key`), scripts run in your private VPC subnets, and every execution is tracked in the `AdminScriptExecution` table. Never expose the admin API key to browsers or end users.
 

package/package.json

@@ -1,19 +1,19 @@
 {
     "name": "@friggframework/admin-scripts",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.517.b384239.0",
+    "version": "2.0.0--canary.517.a353e20.0",
     "description": "Admin Script Runner for Frigg - Execute maintenance and operational scripts in hosted environments",
     "dependencies": {
         "@aws-sdk/client-scheduler": "^3.588.0",
-        "@friggframework/core": "2.0.0--canary.517.b384239.0",
+        "@friggframework/core": "2.0.0--canary.517.a353e20.0",
         "@hapi/boom": "^10.0.1",
         "express": "^4.18.2",
         "serverless-http": "^3.2.0"
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.517.b384239.0",
-        "@friggframework/prettier-config": "2.0.0--canary.517.b384239.0",
-        "@friggframework/test": "2.0.0--canary.517.b384239.0",
+        "@friggframework/eslint-config": "2.0.0--canary.517.a353e20.0",
+        "@friggframework/prettier-config": "2.0.0--canary.517.a353e20.0",
+        "@friggframework/test": "2.0.0--canary.517.a353e20.0",
         "eslint": "^8.22.0",
         "jest": "^29.7.0",
         "prettier": "^2.7.1",
@@ -44,5 +44,5 @@
         "maintenance",
         "operations"
     ],
-    "gitHead": "b384239f327baa975cb82c0f63888e67f40160c3"
+    "gitHead": "a353e204564567f210a23149f4fa7fdb6d779d72"
 }

package/src/application/__tests__/admin-script-context.test.js

@@ -111,27 +111,8 @@ describe('AdminScriptContext', () => {
                 mockFactory.getInstanceFromIntegrationId
             ).toHaveBeenCalledWith({
                 integrationId: 'int_123',
-                _isAdminContext: true,
             });
         });
-
-        it('passes _isAdminContext: true', async () => {
-            const mockInstance = { primary: { api: {} } };
-            const mockFactory = {
-                getInstanceFromIntegrationId: jest
-                    .fn()
-                    .mockResolvedValue(mockInstance),
-            };
-            const ctx = new AdminScriptContext({
-                integrationFactory: mockFactory,
-            });
-
-            await ctx.instantiate('int_123');
-
-            const callArgs =
-                mockFactory.getInstanceFromIntegrationId.mock.calls[0][0];
-            expect(callArgs._isAdminContext).toBe(true);
-        });
     });
 
     describe('queueScript()', () => {

package/src/application/admin-script-context.js

@@ -11,8 +11,8 @@ const { QueuerUtil } = require('@friggframework/core/queues');
  *   `commands.entities`, and `commands.integrations` expose the framework's
  *   command layer. Each command returns data on success or an `{ error }`
  *   object on failure — scripts check `.error` themselves.
- * - **Admin bypass**: `instantiate()` passes `_isAdminContext: true` to
- *   skip user-ownership checks when loading integration instances
+ * - **Integration instantiation**: `instantiate(integrationId)` hydrates a live
+ *   integration instance (system-scoped load) for calling external APIs
  * - **Script chaining**: `queueScript()` / `queueScriptBatch()` let scripts
  *   enqueue follow-up work with parent execution tracking
  * - **Execution-scoped logging**: `log()` collects structured entries tied
@@ -52,7 +52,6 @@ class AdminScriptContext {
         }
         return this.integrationFactory.getInstanceFromIntegrationId({
             integrationId,
-            _isAdminContext: true, // Bypass user ownership check
         });
     }
 

package/src/infrastructure/__tests__/admin-script-router.test.js

@@ -253,6 +253,70 @@ describe('Admin Script Router', () => {
             expect(response.status).toBe(404);
             expect(response.body.code).toBe('SCRIPT_NOT_FOUND');
         });
+
+        it('rejects a sync script whose timeout exceeds the API budget on AWS', async () => {
+            // TestScript.Definition.config.timeout is 300000 (> 25000)
+            process.env.AWS_LAMBDA_FUNCTION_NAME = 'admin-script-router';
+
+            const response = await request(app)
+                .post('/admin/scripts/test-script')
+                .send({ params: {}, mode: 'sync' });
+
+            expect(response.status).toBe(400);
+            expect(response.body.code).toBe('SYNC_TIMEOUT_TOO_LONG');
+            expect(mockRunner.execute).not.toHaveBeenCalled();
+            delete process.env.AWS_LAMBDA_FUNCTION_NAME;
+        });
+
+        it('allows a sync script within the budget on AWS (25000 boundary)', async () => {
+            process.env.AWS_LAMBDA_FUNCTION_NAME = 'admin-script-router';
+            class ShortScript extends AdminScriptBase {
+                static Definition = {
+                    name: 'short-script',
+                    version: '1.0.0',
+                    description: 'within budget',
+                    config: { timeout: 25000 },
+                };
+                async execute() {
+                    return {};
+                }
+            }
+            mockFactory.get.mockReturnValue(ShortScript);
+            mockRunner.execute.mockResolvedValue({
+                executionId: 'exec-1',
+                status: 'COMPLETED',
+                scriptName: 'short-script',
+                output: {},
+                metrics: { durationMs: 1 },
+            });
+
+            const response = await request(app)
+                .post('/admin/scripts/short-script')
+                .send({ params: {}, mode: 'sync' });
+
+            expect(response.status).toBe(200);
+            expect(mockRunner.execute).toHaveBeenCalled();
+            delete process.env.AWS_LAMBDA_FUNCTION_NAME;
+        });
+
+        it('does not queue and surfaces the error when createExecution fails (async)', async () => {
+            process.env.ADMIN_SCRIPT_QUEUE_URL =
+                'https://sqs.us-east-1.amazonaws.com/123/test-queue';
+            mockCommands.createExecution.mockResolvedValue({
+                error: 500,
+                reason: 'DB down',
+                code: 'DB_ERROR',
+            });
+
+            const response = await request(app)
+                .post('/admin/scripts/test-script')
+                .send({ params: { foo: 'bar' }, mode: 'async' });
+
+            expect(response.status).toBe(500);
+            expect(response.body.error).toBe('DB down');
+            expect(QueuerUtil.send).not.toHaveBeenCalled();
+            delete process.env.ADMIN_SCRIPT_QUEUE_URL;
+        });
     });
 
     describe('GET /admin/scripts/:scriptName/executions/:executionId', () => {

package/src/infrastructure/admin-script-router.js

@@ -308,7 +308,7 @@ router.get('/scripts/:scriptName/executions', async (req, res) => {
 
 /**
  * GET /admin/scripts/:scriptName/schedule
- * Get effective schedule (DB override > Definition default > none)
+ * Get the effective schedule (the DB override, or none)
  */
 router.get('/scripts/:scriptName/schedule', async (req, res) => {
     try {
@@ -372,7 +372,7 @@ router.put('/scripts/:scriptName/schedule', async (req, res) => {
 
 /**
  * DELETE /admin/scripts/:scriptName/schedule
- * Remove schedule override (revert to Definition default)
+ * Remove the schedule override
  */
 router.delete('/scripts/:scriptName/schedule', async (req, res) => {
     try {