@friggframework/core 2.0.0--canary.427.972de91.0 → 2.0.0--canary.428.42e0806.0

package/handlers/routers/health.js

@@ -248,53 +248,9 @@ const testEncryption = async () => {
     };
 
     const testDoc = new TestModel(testData);
-
-    try {
-        // eslint-disable-next-line no-console
-        console.log('Attempting to save document with encryption...');
-        const startTime = Date.now();
-
-        await withTimeout(
-            testDoc.save(),
-            30000,
-            'Save operation timed out after 30 seconds'
-        );
-
-        const duration = Date.now() - startTime;
-        // eslint-disable-next-line no-console
-        console.log(`Test document saved successfully in ${duration}ms`);
-    } catch (error) {
-        // eslint-disable-next-line no-console
-        console.error('Save operation failed:', {
-            errorName: error.name,
-            errorMessage: error.message,
-            errorStack: error.stack,
-            mongooseConnectionState: testDoc.db.readyState,
-            modelName: TestModel.modelName,
-        });
-
-        // Try to get more details about the connection
-        if (mongoose.connection && mongoose.connection.db) {
-            try {
-                const admin = mongoose.connection.db.admin();
-                const serverStatus = await admin.serverStatus();
-                // eslint-disable-next-line no-console
-                console.log('DocumentDB Server Status:', {
-                    version: serverStatus.version,
-                    uptime: serverStatus.uptime,
-                    connections: serverStatus.connections,
-                });
-            } catch (statusError) {
-                // eslint-disable-next-line no-console
-                console.error(
-                    'Could not get server status:',
-                    statusError.message
-                );
-            }
-        }
-
-        throw error;
-    }
+    await withTimeout(testDoc.save(), 5000, 'Save operation timed out');
+    // eslint-disable-next-line no-console
+    console.log('Test document saved');
 
     try {
         const retrievedDoc = await withTimeout(
@@ -333,193 +289,6 @@ const testEncryption = async () => {
     }
 };
 
-const checkKMSAccess = async () => {
-    const { KMS_KEY_ARN } = process.env;
-
-    if (!KMS_KEY_ARN || KMS_KEY_ARN.trim() === '') {
-        return {
-            status: 'disabled',
-            testResult: 'No KMS key configured',
-            canAccessKey: false,
-        };
-    }
-
-    try {
-        // eslint-disable-next-line no-console
-        console.log(
-            'Testing KMS key access with key:',
-            KMS_KEY_ARN.substring(0, 50) + '...'
-        );
-
-        const AWS = require('aws-sdk');
-        const kms = new AWS.KMS();
-
-        // First, check if the master key exists and is accessible
-        let keyExists = false;
-        let keyMetadata = null;
-
-        try {
-            // eslint-disable-next-line no-console
-            console.log('Checking if KMS master key exists...');
-            const describeResult = await withTimeout(
-                kms.describeKey({ KeyId: KMS_KEY_ARN }).promise(),
-                5000,
-                'KMS describeKey operation timed out after 5 seconds'
-            );
-
-            keyMetadata = describeResult.KeyMetadata;
-            keyExists = true;
-            // eslint-disable-next-line no-console
-            console.log('KMS master key found:', {
-                KeyId: keyMetadata.KeyId,
-                KeyState: keyMetadata.KeyState,
-                Enabled: keyMetadata.Enabled,
-                KeyUsage: keyMetadata.KeyUsage,
-            });
-        } catch (describeError) {
-            // eslint-disable-next-line no-console
-            console.error(
-                'KMS master key does not exist or is not accessible:',
-                describeError.message
-            );
-
-            if (describeError.code === 'NotFoundException') {
-                return {
-                    status: 'unhealthy',
-                    testResult: 'KMS master key not found',
-                    canAccessKey: false,
-                    error: 'Master key does not exist',
-                    keyExists: false,
-                };
-            } else if (describeError.code === 'AccessDeniedException') {
-                return {
-                    status: 'unhealthy',
-                    testResult: 'No permission to access KMS master key',
-                    canAccessKey: false,
-                    error: 'Access denied to master key',
-                    keyExists: 'unknown',
-                };
-            }
-            // Continue to try generateDataKey even if describeKey fails
-            // as permissions might be limited
-        }
-
-        // Check if key is in a usable state
-        if (keyExists && keyMetadata) {
-            // Only 'Enabled' state allows cryptographic operations
-            if (keyMetadata.KeyState !== 'Enabled') {
-                // eslint-disable-next-line no-console
-                console.error(
-                    `KMS master key exists but is in state: ${keyMetadata.KeyState}`
-                );
-
-                let testResult = '';
-                switch (keyMetadata.KeyState) {
-                    case 'Disabled':
-                        testResult = 'KMS master key is disabled';
-                        break;
-                    case 'PendingDeletion':
-                        testResult = 'KMS master key is pending deletion';
-                        break;
-                    case 'PendingImport':
-                        testResult = 'KMS master key is pending import';
-                        break;
-                    case 'Unavailable':
-                        testResult =
-                            'KMS master key is unavailable (custom key store disconnected)';
-                        break;
-                    case 'Creating':
-                        testResult = 'KMS master key is still being created';
-                        break;
-                    case 'Updating':
-                        testResult = 'KMS master key is being updated';
-                        break;
-                    default:
-                        testResult = `KMS master key is in unusable state: ${keyMetadata.KeyState}`;
-                }
-
-                return {
-                    status: 'unhealthy',
-                    testResult,
-                    canAccessKey: false,
-                    keyExists: true,
-                    keyState: keyMetadata.KeyState,
-                };
-            }
-        }
-
-        // Try to generate a data key to test full KMS access
-        // eslint-disable-next-line no-console
-        console.log('Attempting to generate data key...');
-        const startTime = Date.now();
-        const result = await withTimeout(
-            kms
-                .generateDataKey({
-                    KeyId: KMS_KEY_ARN,
-                    KeySpec: 'AES_256',
-                })
-                .promise(),
-            10000,
-            'KMS generateDataKey operation timed out after 10 seconds'
-        );
-
-        const responseTime = Date.now() - startTime;
-
-        // If we got a result with plaintext key, KMS access works
-        if (result && result.Plaintext) {
-            // eslint-disable-next-line no-console
-            console.log(
-                `KMS key access successful, response time: ${responseTime}ms`
-            );
-            return {
-                status: 'healthy',
-                testResult:
-                    'Successfully requested and received decrypt key from KMS',
-                canAccessKey: true,
-                responseTime,
-                keyExists: true,
-                keyState: keyMetadata?.KeyState || 'Enabled',
-            };
-        }
-
-        return {
-            status: 'unhealthy',
-            testResult: 'KMS responded but no key data received',
-            canAccessKey: false,
-            responseTime,
-            keyExists: keyExists,
-        };
-    } catch (error) {
-        // eslint-disable-next-line no-console
-        console.error('KMS generateDataKey failed:', error.message);
-
-        // Provide more specific error messages based on error codes
-        let testResult = `KMS access failed: ${error.message}`;
-        if (error.code === 'NotFoundException') {
-            testResult = 'KMS master key not found during data key generation';
-            // eslint-disable-next-line no-console
-            console.error('Master key does not exist in KMS');
-        } else if (error.code === 'AccessDeniedException') {
-            testResult =
-                'Access denied - check IAM permissions for kms:GenerateDataKey';
-            // eslint-disable-next-line no-console
-            console.error('IAM permissions insufficient for KMS operations');
-        } else if (error.code === 'InvalidKeyId.NotFound') {
-            testResult = 'Invalid KMS key ID format or key not found';
-            // eslint-disable-next-line no-console
-            console.error('KMS key ID is invalid or does not exist');
-        }
-
-        return {
-            status: 'unhealthy',
-            testResult,
-            canAccessKey: false,
-            error: error.message,
-            errorCode: error.code,
-        };
-    }
-};
-
 const checkEncryptionHealth = async () => {
     const config = getEncryptionConfiguration();
 
@@ -637,6 +406,131 @@ const buildHealthCheckResponse = (startTime) => {
     };
 };
 
+// KMS decrypt capability check
+const checkKmsDecryptCapability = async () => {
+    const start = Date.now();
+    const { KMS_KEY_ARN } = process.env;
+    if (!KMS_KEY_ARN) {
+        return {
+            status: 'skipped',
+            reason: 'KMS_KEY_ARN not configured',
+        };
+    }
+
+    // Log environment for debugging
+    console.log('KMS Check Debug:', {
+        hasKmsKeyArn: !!KMS_KEY_ARN,
+        kmsKeyArnPrefix: KMS_KEY_ARN?.substring(0, 30),
+        awsRegion: process.env.AWS_REGION,
+        awsDefaultRegion: process.env.AWS_DEFAULT_REGION,
+        hasDiscoveryKey: !!process.env.AWS_DISCOVERY_KMS_KEY_ID,
+    });
+
+    // Test DNS resolution for KMS endpoint
+    try {
+        const dns = require('dns').promises;
+        const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'eu-central-1';
+        const kmsEndpoint = `kms.${region}.amazonaws.com`;
+        console.log('Testing DNS resolution for:', kmsEndpoint);
+        const addresses = await dns.resolve4(kmsEndpoint);
+        console.log('KMS endpoint resolved to:', addresses);
+
+        // Test TCP connectivity to KMS (port 443)
+        const net = require('net');
+        const testConnection = () => new Promise((resolve) => {
+            const socket = new net.Socket();
+            const connectionTimeout = setTimeout(() => {
+                socket.destroy();
+                resolve({ connected: false, error: 'Connection timeout' });
+            }, 3000);
+
+            socket.on('connect', () => {
+                clearTimeout(connectionTimeout);
+                socket.destroy();
+                resolve({ connected: true });
+            });
+
+            socket.on('error', (err) => {
+                clearTimeout(connectionTimeout);
+                resolve({ connected: false, error: err.message });
+            });
+
+            // Try connecting to first resolved address on HTTPS port
+            socket.connect(443, addresses[0]);
+        });
+
+        const connResult = await testConnection();
+        console.log('TCP connectivity test:', connResult);
+
+        if (!connResult.connected) {
+            return {
+                status: 'unhealthy',
+                error: `Cannot connect to KMS endpoint: ${connResult.error}`,
+                dnsResolved: true,
+                tcpConnection: false,
+                latencyMs: Date.now() - start,
+            };
+        }
+    } catch (dnsError) {
+        console.error('DNS resolution failed:', dnsError.message);
+        return {
+            status: 'unhealthy',
+            error: `Cannot resolve KMS endpoint: ${dnsError.message}`,
+            dnsResolved: false,
+            latencyMs: Date.now() - start,
+        };
+    }
+
+    try {
+        // Lazy load to avoid cost if unused in some environments
+        // eslint-disable-next-line global-require
+        const AWS = require('aws-sdk');
+
+        // Ensure AWS SDK has proper configuration
+        const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+        if (!region) {
+            return {
+                status: 'unhealthy',
+                error: 'AWS_REGION not configured',
+                latencyMs: Date.now() - start,
+            };
+        }
+
+        const kms = new AWS.KMS({
+            region,
+            httpOptions: {
+                timeout: 5000, // 5 second timeout
+                connectTimeout: 5000,
+            },
+            maxRetries: 1, // Don't retry on health checks
+        });
+
+        // Generate a data key (without plaintext logging) then immediately decrypt ciphertext to ensure decrypt perms.
+        const dataKeyResp = await kms
+            .generateDataKey({ KeyId: KMS_KEY_ARN, KeySpec: 'AES_256' })
+            .promise();
+        const decryptResp = await kms
+            .decrypt({ CiphertextBlob: dataKeyResp.CiphertextBlob })
+            .promise();
+
+        const success = Boolean(
+            dataKeyResp.CiphertextBlob && decryptResp.Plaintext
+        );
+
+        return {
+            status: success ? 'healthy' : 'unhealthy',
+            kmsKeyArnSuffix: KMS_KEY_ARN.slice(-12),
+            latencyMs: Date.now() - start,
+        };
+    } catch (error) {
+        return {
+            status: 'unhealthy',
+            error: error.message,
+            latencyMs: Date.now() - start,
+        };
+    }
+};
+
 router.get('/health', async (_req, res) => {
     const status = {
         status: 'ok',
@@ -653,113 +547,79 @@ router.get('/health/detailed', async (_req, res) => {
     const startTime = Date.now();
     const response = buildHealthCheckResponse(startTime);
 
-    // Run all health checks in parallel for faster response
-    // eslint-disable-next-line no-console
-    console.log('Running all health checks in parallel...');
-
-    const [
-        kmsResult,
-        databaseResult,
-        encryptionResult,
-        externalApisResult,
-        integrationsResult,
-    ] = await Promise.allSettled([
-        checkKMSAccess(),
-        checkDatabaseHealth(),
-        checkEncryptionHealth(),
-        checkExternalAPIs(),
-        Promise.resolve(checkIntegrations()), // Wrap sync function in Promise
-    ]);
-
-    // Process KMS check result
-    if (kmsResult.status === 'fulfilled') {
-        response.checks.kmsAccess = kmsResult.value;
-        if (kmsResult.value.status === 'unhealthy') {
+    // 1. KMS decrypt capability (must succeed before DB assumed healthy if encryption depends on KMS)
+    try {
+        response.checks.kms = await checkKmsDecryptCapability();
+        if (response.checks.kms.status === 'unhealthy') {
             response.status = 'unhealthy';
         }
         // eslint-disable-next-line no-console
-        console.log('KMS access check completed:', response.checks.kmsAccess);
-    } else {
-        response.checks.kmsAccess = {
-            status: 'unhealthy',
-            error: kmsResult.reason?.message || 'KMS check failed',
-        };
+        console.log('KMS check completed:', response.checks.kms);
+    } catch (error) {
+        response.checks.kms = { status: 'unhealthy', error: error.message };
         response.status = 'unhealthy';
         // eslint-disable-next-line no-console
-        console.log('KMS access check error:', kmsResult.reason?.message);
+        console.log('KMS check error:', error.message);
     }
 
-    // Process database check result
-    if (databaseResult.status === 'fulfilled') {
-        response.checks.database = databaseResult.value;
+    try {
+        response.checks.database = await checkDatabaseHealth();
         const dbState = getDatabaseState();
         if (!dbState.isConnected) {
             response.status = 'unhealthy';
         }
         // eslint-disable-next-line no-console
         console.log('Database check completed:', response.checks.database);
-    } else {
+    } catch (error) {
         response.checks.database = {
             status: 'unhealthy',
-            error: databaseResult.reason?.message || 'Database check failed',
+            error: error.message,
         };
         response.status = 'unhealthy';
         // eslint-disable-next-line no-console
-        console.log('Database check error:', databaseResult.reason?.message);
+        console.log('Database check error:', error.message);
     }
 
-    // Process encryption check result
-    if (encryptionResult.status === 'fulfilled') {
-        response.checks.encryption = encryptionResult.value;
-        if (encryptionResult.value.status === 'unhealthy') {
+    try {
+        response.checks.encryption = await checkEncryptionHealth();
+        if (response.checks.encryption.status === 'unhealthy') {
             response.status = 'unhealthy';
         }
         // eslint-disable-next-line no-console
         console.log('Encryption check completed:', response.checks.encryption);
-    } else {
+    } catch (error) {
         response.checks.encryption = {
             status: 'unhealthy',
-            error: encryptionResult.reason?.message || 'Encryption check failed',
+            error: error.message,
         };
         response.status = 'unhealthy';
         // eslint-disable-next-line no-console
-        console.log('Encryption check error:', encryptionResult.reason?.message);
+        console.log('Encryption check error:', error.message);
     }
 
-    // Process external APIs check result
-    if (externalApisResult.status === 'fulfilled') {
-        const { apiStatuses, allReachable } = externalApisResult.value;
-        response.checks.externalApis = apiStatuses;
-        if (!allReachable) {
-            response.status = 'unhealthy';
-        }
-        // eslint-disable-next-line no-console
-        console.log('External APIs check completed:', response.checks.externalApis);
-    } else {
-        response.checks.externalApis = {
-            error: externalApisResult.reason?.message || 'External APIs check failed',
-        };
+    const { apiStatuses, allReachable } = await checkExternalAPIs();
+    response.checks.externalApis = apiStatuses;
+    if (!allReachable) {
         response.status = 'unhealthy';
-        // eslint-disable-next-line no-console
-        console.log('External APIs check error:', externalApisResult.reason?.message);
     }
+    // eslint-disable-next-line no-console
+    console.log('External APIs check completed:', response.checks.externalApis);
 
-    // Process integrations check result
-    if (integrationsResult.status === 'fulfilled') {
-        response.checks.integrations = integrationsResult.value;
+    try {
+        response.checks.integrations = checkIntegrations();
         // eslint-disable-next-line no-console
         console.log(
             'Integrations check completed:',
             response.checks.integrations
         );
-    } else {
+    } catch (error) {
         response.checks.integrations = {
             status: 'unhealthy',
-            error: integrationsResult.reason?.message || 'Integrations check failed',
+            error: error.message,
         };
         response.status = 'unhealthy';
         // eslint-disable-next-line no-console
-        console.log('Integrations check error:', integrationsResult.reason?.message);
+        console.log('Integrations check error:', error.message);
     }
 
     response.responseTime = response.calculateResponseTime();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/core",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.427.972de91.0",
+  "version": "2.0.0--canary.428.42e0806.0",
   "dependencies": {
     "@hapi/boom": "^10.0.1",
     "aws-sdk": "^2.1200.0",
@@ -22,9 +22,9 @@
     "uuid": "^9.0.1"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.427.972de91.0",
-    "@friggframework/prettier-config": "2.0.0--canary.427.972de91.0",
-    "@friggframework/test": "2.0.0--canary.427.972de91.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.42e0806.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.42e0806.0",
+    "@friggframework/test": "2.0.0--canary.428.42e0806.0",
     "@types/lodash": "4.17.15",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "chai": "^4.3.6",
@@ -56,5 +56,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "972de918c8273da9f1ffb85e1eedfc088f880f54"
+  "gitHead": "42e0806db6ef878a5397b3e1752ae6cf21e6a845"
 }