@friggframework/core 2.0.0--canary.461.61382d8.0 → 2.0.0--canary.461.3d6d8ad.0

package/database/encryption/prisma-encryption-extension.test.js

@@ -1,439 +0,0 @@
-const { createEncryptionExtension } = require('./prisma-encryption-extension');
-
-describe('Prisma Encryption Extension', () => {
-    let mockCryptor;
-    let mockQuery;
-
-    beforeEach(() => {
-        // Mock Cryptor
-        mockCryptor = {
-            encrypt: jest
-                .fn()
-                .mockImplementation(
-                    (value) => `encrypted:${value}:iv:enckey`
-                ),
-            decrypt: jest
-                .fn()
-                .mockImplementation((value) => {
-                    const parts = value.split(':');
-                    return parts[1]; // Extract original value
-                }),
-        };
-
-        // Mock Prisma query function
-        mockQuery = jest.fn().mockImplementation((args) => args.mockResult);
-    });
-
-    describe('createEncryptionExtension', () => {
-        it('should create extension with valid config', () => {
-            const extension = createEncryptionExtension({
-                cryptor: mockCryptor,
-                enabled: true,
-            });
-
-            expect(extension).toBeDefined();
-            expect(extension.name).toBe('frigg-field-encryption');
-            expect(extension.query).toBeDefined();
-            expect(extension.query.$allModels).toBeDefined();
-        });
-
-        it('should return no-op extension when disabled', () => {
-            const extension = createEncryptionExtension({
-                cryptor: mockCryptor,
-                enabled: false,
-            });
-
-            // No-op extension is a function that returns its input
-            const mockClient = { $extends: jest.fn() };
-            const result = extension(mockClient);
-
-            expect(result).toBe(mockClient);
-        });
-
-        it('should throw if cryptor not provided when enabled', () => {
-            expect(() => {
-                createEncryptionExtension({ enabled: true });
-            }).toThrow('Cryptor instance required');
-        });
-
-        it('should not throw if cryptor not provided when disabled', () => {
-            expect(() => {
-                createEncryptionExtension({ enabled: false });
-            }).not.toThrow();
-        });
-    });
-
-    describe('Query Interceptors', () => {
-        let extension;
-        let handlers;
-
-        beforeEach(() => {
-            extension = createEncryptionExtension({
-                cryptor: mockCryptor,
-                enabled: true,
-            });
-            handlers = extension.query.$allModels;
-        });
-
-        describe('create', () => {
-            it('should encrypt data before create', async () => {
-                const args = {
-                    data: {
-                        data: { access_token: 'secret123' },
-                    },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:secret123:iv:enckey' },
-                    },
-                };
-
-                await handlers.create({
-                    model: 'Credential',
-                    operation: 'create',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('secret123');
-                expect(args.data.data.access_token).toBe(
-                    'encrypted:secret123:iv:enckey'
-                );
-            });
-
-            it('should decrypt result after create', async () => {
-                const args = {
-                    data: { data: { access_token: 'secret123' } },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:secret123:iv:enckey' },
-                    },
-                };
-
-                const result = await handlers.create({
-                    model: 'Credential',
-                    operation: 'create',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.decrypt).toHaveBeenCalledWith(
-                    'encrypted:secret123:iv:enckey'
-                );
-                expect(result.data.access_token).toBe('secret123');
-            });
-
-            it('should handle null result', async () => {
-                const args = {
-                    data: { data: { access_token: 'secret123' } },
-                    mockResult: null,
-                };
-
-                const result = await handlers.create({
-                    model: 'Credential',
-                    operation: 'create',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result).toBeNull();
-            });
-        });
-
-        describe('createMany', () => {
-            it('should encrypt array of data', async () => {
-                const args = {
-                    data: [
-                        { data: { access_token: 'secret1' } },
-                        { data: { access_token: 'secret2' } },
-                    ],
-                    mockResult: { count: 2 },
-                };
-
-                await handlers.createMany({
-                    model: 'Credential',
-                    operation: 'createMany',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('secret1');
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('secret2');
-                expect(args.data[0].data.access_token).toBe(
-                    'encrypted:secret1:iv:enckey'
-                );
-                expect(args.data[1].data.access_token).toBe(
-                    'encrypted:secret2:iv:enckey'
-                );
-            });
-
-            it('should handle single object in createMany', async () => {
-                const args = {
-                    data: { data: { access_token: 'secret' } },
-                    mockResult: { count: 1 },
-                };
-
-                await handlers.createMany({
-                    model: 'Credential',
-                    operation: 'createMany',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('secret');
-            });
-        });
-
-        describe('update', () => {
-            it('should encrypt update data', async () => {
-                const args = {
-                    data: { data: { access_token: 'newsecret' } },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:newsecret:iv:enckey' },
-                    },
-                };
-
-                await handlers.update({
-                    model: 'Credential',
-                    operation: 'update',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('newsecret');
-            });
-
-            it('should decrypt result after update', async () => {
-                const args = {
-                    data: { data: { access_token: 'newsecret' } },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:newsecret:iv:enckey' },
-                    },
-                };
-
-                const result = await handlers.update({
-                    model: 'Credential',
-                    operation: 'update',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result.data.access_token).toBe('newsecret');
-            });
-        });
-
-        describe('upsert', () => {
-            it('should encrypt both create and update data', async () => {
-                const args = {
-                    create: { data: { access_token: 'createsecret' } },
-                    update: { data: { access_token: 'updatesecret' } },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:createsecret:iv:enckey' },
-                    },
-                };
-
-                await handlers.upsert({
-                    model: 'Credential',
-                    operation: 'upsert',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('createsecret');
-                expect(mockCryptor.encrypt).toHaveBeenCalledWith('updatesecret');
-            });
-        });
-
-        describe('findUnique', () => {
-            it('should decrypt result', async () => {
-                const args = {
-                    where: { id: '1' },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:secret:iv:enckey' },
-                    },
-                };
-
-                const result = await handlers.findUnique({
-                    model: 'Credential',
-                    operation: 'findUnique',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(mockCryptor.decrypt).toHaveBeenCalledWith(
-                    'encrypted:secret:iv:enckey'
-                );
-                expect(result.data.access_token).toBe('secret');
-            });
-
-            it('should handle null result', async () => {
-                const args = {
-                    where: { id: '999' },
-                    mockResult: null,
-                };
-
-                const result = await handlers.findUnique({
-                    model: 'Credential',
-                    operation: 'findUnique',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result).toBeNull();
-                expect(mockCryptor.decrypt).not.toHaveBeenCalled();
-            });
-        });
-
-        describe('findMany', () => {
-            it('should decrypt array of results', async () => {
-                const args = {
-                    mockResult: [
-                        {
-                            id: '1',
-                            data: { access_token: 'encrypted:secret1:iv:enckey' },
-                        },
-                        {
-                            id: '2',
-                            data: { access_token: 'encrypted:secret2:iv:enckey' },
-                        },
-                    ],
-                };
-
-                const results = await handlers.findMany({
-                    model: 'Credential',
-                    operation: 'findMany',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(results).toHaveLength(2);
-                expect(results[0].data.access_token).toBe('secret1');
-                expect(results[1].data.access_token).toBe('secret2');
-            });
-
-            it('should handle empty array', async () => {
-                const args = {
-                    mockResult: [],
-                };
-
-                const results = await handlers.findMany({
-                    model: 'Credential',
-                    operation: 'findMany',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(results).toEqual([]);
-            });
-        });
-
-        describe('delete', () => {
-            it('should decrypt deleted record', async () => {
-                const args = {
-                    where: { id: '1' },
-                    mockResult: {
-                        id: '1',
-                        data: { access_token: 'encrypted:secret:iv:enckey' },
-                    },
-                };
-
-                const result = await handlers.delete({
-                    model: 'Credential',
-                    operation: 'delete',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result.data.access_token).toBe('secret');
-            });
-        });
-
-        describe('count', () => {
-            it('should pass through without encryption', async () => {
-                const args = {
-                    mockResult: { count: 5 },
-                };
-
-                const result = await handlers.count({
-                    model: 'Credential',
-                    operation: 'count',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result).toEqual({ count: 5 });
-                expect(mockCryptor.encrypt).not.toHaveBeenCalled();
-                expect(mockCryptor.decrypt).not.toHaveBeenCalled();
-            });
-        });
-
-        describe('Model without encrypted fields', () => {
-            it('should pass through State model without encryption', async () => {
-                const args = {
-                    data: { state: { some: 'data' } },
-                    mockResult: { id: '1', state: { some: 'data' } },
-                };
-
-                const result = await handlers.create({
-                    model: 'State',
-                    operation: 'create',
-                    args,
-                    query: mockQuery,
-                });
-
-                expect(result.state).toEqual({ some: 'data' });
-                expect(mockCryptor.encrypt).not.toHaveBeenCalled();
-                expect(mockCryptor.decrypt).not.toHaveBeenCalled();
-            });
-        });
-    });
-
-    describe('Integration with FieldEncryptionService', () => {
-        it('should handle nested JSON paths correctly', async () => {
-            const extension = createEncryptionExtension({
-                cryptor: mockCryptor,
-                enabled: true,
-            });
-            const handlers = extension.query.$allModels;
-
-            const args = {
-                data: {
-                    id: '123',
-                    data: {
-                        access_token: 'secret',
-                        refresh_token: 'refresh',
-                        other: 'public',
-                    },
-                },
-                mockResult: {
-                    id: '123',
-                    data: {
-                        access_token: 'encrypted:secret:iv:enckey',
-                        refresh_token: 'encrypted:refresh:iv:enckey',
-                        other: 'public',
-                    },
-                },
-            };
-
-            const result = await handlers.create({
-                model: 'Credential',
-                operation: 'create',
-                args,
-                query: mockQuery,
-            });
-
-            // Verify encryption was called for encrypted fields
-            expect(mockCryptor.encrypt).toHaveBeenCalledWith('secret');
-            expect(mockCryptor.encrypt).toHaveBeenCalledWith('refresh');
-            // 'other' should not be encrypted
-
-            // Verify decryption in result
-            expect(result.data.access_token).toBe('secret');
-            expect(result.data.refresh_token).toBe('refresh');
-            expect(result.data.other).toBe('public');
-        });
-    });
-});

package/database/repositories/migration-status-repository-s3.test.js

@@ -1,158 +0,0 @@
-/**
- * Tests for Migration Status Repository (S3)
- * 
- * Tests S3-based storage for migration status tracking
- * (avoids chicken-and-egg dependency on User/Process tables)
- */
-
-const { MigrationStatusRepositoryS3 } = require('./migration-status-repository-s3');
-
-describe('MigrationStatusRepositoryS3', () => {
-    let repository;
-    let mockS3Client;
-
-    beforeEach(() => {
-        mockS3Client = {
-            send: jest.fn(),
-        };
-        repository = new MigrationStatusRepositoryS3('test-bucket', mockS3Client);
-    });
-
-    describe('create()', () => {
-        it('should create new migration status record in S3', async () => {
-            const migrationData = {
-                migrationId: 'migration-123',
-                stage: 'dev',
-                triggeredBy: 'admin',
-                triggeredAt: '2025-10-19T12:00:00Z',
-            };
-
-            mockS3Client.send.mockResolvedValue({});
-
-            const result = await repository.create(migrationData);
-
-            expect(result.migrationId).toBe('migration-123');
-            expect(result.state).toBe('INITIALIZING');
-            expect(mockS3Client.send).toHaveBeenCalled();
-        });
-
-        it('should generate UUID if migrationId not provided', async () => {
-            const migrationData = {
-                stage: 'dev',
-                triggeredBy: 'admin',
-                triggeredAt: '2025-10-19T12:00:00Z',
-            };
-
-            mockS3Client.send.mockResolvedValue({});
-
-            const result = await repository.create(migrationData);
-
-            expect(result.migrationId).toMatch(/^[a-f0-9-]{36}$/); // UUID format
-            expect(result.state).toBe('INITIALIZING');
-        });
-
-        it('should store status at correct S3 key', async () => {
-            const migrationData = {
-                migrationId: 'migration-123',
-                stage: 'dev',
-            };
-
-            mockS3Client.send.mockResolvedValue({});
-
-            await repository.create(migrationData);
-
-            const putCommand = mockS3Client.send.mock.calls[0][0];
-            expect(putCommand.input.Bucket).toBe('test-bucket');
-            expect(putCommand.input.Key).toBe('migrations/dev/migration-123.json');
-        });
-    });
-
-    describe('update()', () => {
-        it('should update existing migration status', async () => {
-            mockS3Client.send.mockResolvedValue({
-                Body: {
-                    transformToString: () => JSON.stringify({
-                        migrationId: 'migration-123',
-                        state: 'INITIALIZING',
-                        progress: 0,
-                    }),
-                },
-            });
-
-            const updateData = {
-                migrationId: 'migration-123',
-                stage: 'dev',
-                state: 'RUNNING',
-                progress: 50,
-            };
-
-            await repository.update(updateData);
-
-            expect(mockS3Client.send).toHaveBeenCalledTimes(2); // GET then PUT
-        });
-
-        it('should merge updates with existing data', async () => {
-            mockS3Client.send
-                .mockResolvedValueOnce({
-                    Body: {
-                        transformToString: () => JSON.stringify({
-                            migrationId: 'migration-123',
-                            state: 'INITIALIZING',
-                            progress: 0,
-                            triggeredAt: '2025-10-19T12:00:00Z',
-                        }),
-                    },
-                })
-                .mockResolvedValueOnce({});
-
-            await repository.update({
-                migrationId: 'migration-123',
-                stage: 'dev',
-                state: 'COMPLETED',
-                progress: 100,
-            });
-
-            const putCommand = mockS3Client.send.mock.calls[1][0];
-            const storedData = JSON.parse(putCommand.input.Body);
-            expect(storedData.triggeredAt).toBe('2025-10-19T12:00:00Z'); // Preserved
-            expect(storedData.state).toBe('COMPLETED'); // Updated
-        });
-    });
-
-    describe('get()', () => {
-        it('should retrieve migration status from S3', async () => {
-            const statusData = {
-                migrationId: 'migration-123',
-                state: 'COMPLETED',
-                progress: 100,
-            };
-
-            mockS3Client.send.mockResolvedValue({
-                Body: {
-                    transformToString: () => JSON.stringify(statusData),
-                },
-            });
-
-            const result = await repository.get('migration-123', 'dev');
-
-            expect(result).toEqual(statusData);
-            expect(mockS3Client.send).toHaveBeenCalled();
-        });
-
-        it('should throw error if migration not found', async () => {
-            mockS3Client.send.mockRejectedValue({ name: 'NoSuchKey' });
-
-            await expect(repository.get('nonexistent', 'dev')).rejects.toThrow(
-                'Migration not found'
-            );
-        });
-    });
-
-    describe('S3 Key Generation', () => {
-        it('should use consistent key format', () => {
-            const key = repository._buildS3Key('migration-123', 'production');
-            expect(key).toBe('migrations/production/migration-123.json');
-        });
-    });
-});
-