@friggframework/core 2.0.0--canary.428.a673c47.0 → 2.0.0--canary.428.edce2a7.0

package/handlers/routers/health.js

@@ -406,6 +406,91 @@ const buildHealthCheckResponse = (startTime) => {
     };
 };
 
+// Helper to detect VPC configuration
+const detectVpcConfiguration = async () => {
+    const results = {
+        isInVpc: false,
+        hasInternetAccess: false,
+        canResolvePublicDns: false,
+        canConnectToAws: false,
+        vpcEndpoints: [],
+    };
+
+    try {
+        // Check if we're in a VPC by looking for VPC-specific environment
+        // Lambda in VPC has specific network interface configuration
+        const dns = require('dns').promises;
+
+        // Test 1: Can we resolve public DNS? (indicates DNS configuration)
+        try {
+            await Promise.race([
+                dns.resolve4('www.google.com'),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 2000))
+            ]);
+            results.canResolvePublicDns = true;
+        } catch (e) {
+            console.log('Public DNS resolution failed:', e.message);
+        }
+
+        // Test 2: Can we reach internet? (indicates NAT gateway)
+        try {
+            const https = require('https');
+            await new Promise((resolve, reject) => {
+                const req = https.get('https://www.google.com', { timeout: 2000 }, (res) => {
+                    res.destroy();
+                    resolve(true);
+                });
+                req.on('error', reject);
+                req.on('timeout', () => {
+                    req.destroy();
+                    reject(new Error('timeout'));
+                });
+            });
+            results.hasInternetAccess = true;
+        } catch (e) {
+            console.log('Internet connectivity test failed:', e.message);
+        }
+
+        // Test 3: Check for VPC endpoints by trying to resolve internal AWS endpoints
+        const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'eu-central-1';
+        const vpcEndpointDomains = [
+            `com.amazonaws.${region}.kms`,
+            `com.amazonaws.vpce.${region}`,
+            `kms.${region}.amazonaws.com`,
+        ];
+
+        for (const domain of vpcEndpointDomains) {
+            try {
+                const addresses = await Promise.race([
+                    dns.resolve4(domain).catch(() => dns.resolve6(domain)),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 1000))
+                ]);
+                if (addresses && addresses.length > 0) {
+                    // Check if it's a private IP (VPC endpoint indicator)
+                    const isPrivateIp = addresses.some(ip =>
+                        ip.startsWith('10.') ||
+                        ip.startsWith('172.') ||
+                        ip.startsWith('192.168.')
+                    );
+                    if (isPrivateIp) {
+                        results.vpcEndpoints.push(domain);
+                    }
+                }
+            } catch (e) {
+                // Expected for non-existent endpoints
+            }
+        }
+
+        results.isInVpc = !results.hasInternetAccess || results.vpcEndpoints.length > 0;
+        results.canConnectToAws = results.hasInternetAccess || results.vpcEndpoints.length > 0;
+
+    } catch (error) {
+        console.error('VPC detection error:', error.message);
+    }
+
+    return results;
+};
+
 // KMS decrypt capability check
 const checkKmsDecryptCapability = async () => {
     const start = Date.now();
@@ -416,11 +501,119 @@ const checkKmsDecryptCapability = async () => {
             reason: 'KMS_KEY_ARN not configured',
         };
     }
+
+    // Log environment for debugging
+    console.log('KMS Check Debug:', {
+        hasKmsKeyArn: !!KMS_KEY_ARN,
+        kmsKeyArnPrefix: KMS_KEY_ARN?.substring(0, 30),
+        awsRegion: process.env.AWS_REGION,
+        awsDefaultRegion: process.env.AWS_DEFAULT_REGION,
+        hasDiscoveryKey: !!process.env.AWS_DISCOVERY_KMS_KEY_ID,
+    });
+
+    // First, detect VPC configuration
+    const vpcConfig = await detectVpcConfiguration();
+    console.log('VPC Configuration:', vpcConfig);
+
+    // Test DNS resolution for KMS endpoint
+    try {
+        const dns = require('dns').promises;
+        const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'eu-central-1';
+        const kmsEndpoint = `kms.${region}.amazonaws.com`;
+        console.log('Testing DNS resolution for:', kmsEndpoint);
+
+        // Wrap DNS resolution in a timeout
+        const dnsPromise = dns.resolve4(kmsEndpoint);
+        const timeoutPromise = new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('DNS resolution timeout')), 3000)
+        );
+
+        const addresses = await Promise.race([dnsPromise, timeoutPromise]);
+        console.log('KMS endpoint resolved to:', addresses);
+
+        // Check if resolved to private IP (VPC endpoint)
+        const isVpcEndpoint = addresses.some(ip =>
+            ip.startsWith('10.') ||
+            ip.startsWith('172.') ||
+            ip.startsWith('192.168.')
+        );
+
+        if (isVpcEndpoint) {
+            console.log('KMS VPC Endpoint detected - using private connectivity');
+        }
+
+        // Test TCP connectivity to KMS (port 443)
+        const net = require('net');
+        const testConnection = () => new Promise((resolve) => {
+            const socket = new net.Socket();
+            const connectionTimeout = setTimeout(() => {
+                socket.destroy();
+                resolve({ connected: false, error: 'Connection timeout' });
+            }, 3000);
+
+            socket.on('connect', () => {
+                clearTimeout(connectionTimeout);
+                socket.destroy();
+                resolve({ connected: true });
+            });
+
+            socket.on('error', (err) => {
+                clearTimeout(connectionTimeout);
+                resolve({ connected: false, error: err.message });
+            });
+
+            // Try connecting to first resolved address on HTTPS port
+            socket.connect(443, addresses[0]);
+        });
+
+        const connResult = await testConnection();
+        console.log('TCP connectivity test:', connResult);
+
+        if (!connResult.connected) {
+            return {
+                status: 'unhealthy',
+                error: `Cannot connect to KMS endpoint: ${connResult.error}`,
+                dnsResolved: true,
+                tcpConnection: false,
+                vpcConfig,
+                latencyMs: Date.now() - start,
+            };
+        }
+    } catch (dnsError) {
+        console.error('DNS resolution failed:', dnsError.message);
+        return {
+            status: 'unhealthy',
+            error: `Cannot resolve KMS endpoint: ${dnsError.message}`,
+            dnsResolved: false,
+            vpcConfig,
+            latencyMs: Date.now() - start,
+        };
+    }
+
     try {
         // Lazy load to avoid cost if unused in some environments
         // eslint-disable-next-line global-require
         const AWS = require('aws-sdk');
-        const kms = new AWS.KMS();
+
+        // Ensure AWS SDK has proper configuration
+        const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+        if (!region) {
+            return {
+                status: 'unhealthy',
+                error: 'AWS_REGION not configured',
+                latencyMs: Date.now() - start,
+            };
+        }
+
+        const kms = new AWS.KMS({
+            region,
+            httpOptions: {
+                timeout: 5000, // 5 second timeout
+                connectTimeout: 5000,
+            },
+            maxRetries: 1, // Don't retry on health checks
+        });
+
         // Generate a data key (without plaintext logging) then immediately decrypt ciphertext to ensure decrypt perms.
         const dataKeyResp = await kms
             .generateDataKey({ KeyId: KMS_KEY_ARN, KeySpec: 'AES_256' })
@@ -436,12 +629,14 @@ const checkKmsDecryptCapability = async () => {
         return {
             status: success ? 'healthy' : 'unhealthy',
             kmsKeyArnSuffix: KMS_KEY_ARN.slice(-12),
+            vpcConfig,
             latencyMs: Date.now() - start,
         };
     } catch (error) {
         return {
             status: 'unhealthy',
             error: error.message,
+            vpcConfig,
             latencyMs: Date.now() - start,
         };
     }
@@ -463,9 +658,45 @@ router.get('/health/detailed', async (_req, res) => {
     const startTime = Date.now();
     const response = buildHealthCheckResponse(startTime);
 
-    // 1. KMS decrypt capability (must succeed before DB assumed healthy if encryption depends on KMS)
+    // Log environment before any async operations
+    console.log('Health Check Environment:', {
+        hasKmsKeyArn: !!process.env.KMS_KEY_ARN,
+        awsRegion: process.env.AWS_REGION,
+        awsDefaultRegion: process.env.AWS_DEFAULT_REGION,
+        nodeEnv: process.env.NODE_ENV,
+        stage: process.env.STAGE,
+    });
+
+    // 1. Network diagnostics (run first to understand connectivity)
     try {
-        response.checks.kms = await checkKmsDecryptCapability();
+        console.log('Running network diagnostics...');
+        const networkStart = Date.now();
+        response.checks.network = await Promise.race([
+            detectVpcConfiguration(),
+            new Promise((_, reject) =>
+                setTimeout(() => reject(new Error('Network diagnostics timeout')), 5000)
+            )
+        ]);
+        response.checks.network.latencyMs = Date.now() - networkStart;
+        console.log('Network diagnostics completed:', response.checks.network);
+    } catch (error) {
+        response.checks.network = {
+            status: 'error',
+            error: error.message,
+        };
+        console.log('Network diagnostics error:', error.message);
+    }
+
+    // 2. KMS decrypt capability (must succeed before DB assumed healthy if encryption depends on KMS)
+    try {
+        console.log('About to check KMS capability...');
+        // Wrap the entire KMS check in a timeout
+        const kmsCheckPromise = checkKmsDecryptCapability();
+        const kmsTimeoutPromise = new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('KMS check timeout after 8 seconds')), 8000)
+        );
+
+        response.checks.kms = await Promise.race([kmsCheckPromise, kmsTimeoutPromise]);
         if (response.checks.kms.status === 'unhealthy') {
             response.status = 'unhealthy';
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/core",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.a673c47.0",
+  "version": "2.0.0--canary.428.edce2a7.0",
   "dependencies": {
     "@hapi/boom": "^10.0.1",
     "aws-sdk": "^2.1200.0",
@@ -22,9 +22,9 @@
     "uuid": "^9.0.1"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.a673c47.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.a673c47.0",
-    "@friggframework/test": "2.0.0--canary.428.a673c47.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.edce2a7.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.edce2a7.0",
+    "@friggframework/test": "2.0.0--canary.428.edce2a7.0",
     "@types/lodash": "4.17.15",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "chai": "^4.3.6",
@@ -56,5 +56,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a673c4784ce0e950d7bbfb3397f855b086524eca"
+  "gitHead": "edce2a70ea28312c91e2f5ddff77028619d7fb71"
 }