@friggframework/core 2.0.0--canary.464.f9d3fc0.0 → 2.0.0--canary.454.25d396a.0

package/handlers/workers/db-migration.js

@@ -0,0 +1,208 @@
+/**
+ * Database Migration Lambda Handler
+ *
+ * Lambda function that runs Prisma database migrations from within the VPC,
+ * enabling CI/CD pipelines to migrate databases without requiring public access.
+ *
+ * This handler uses the prisma-runner utilities from @friggframework/core,
+ * ensuring consistency with the `frigg db:setup` command.
+ *
+ * Environment Variables Required:
+ * - DATABASE_URL: PostgreSQL connection string (automatically set from Secrets Manager)
+ * - DB_TYPE: Database type ('postgresql' or 'mongodb')
+ * - STAGE: Deployment stage (determines migration command: 'dev' or 'deploy')
+ *
+ * Invocation:
+ *   aws lambda invoke \
+ *     --function-name my-app-production-dbMigrate \
+ *     --region us-east-1 \
+ *     response.json
+ *
+ * Success Response:
+ *   {
+ *     "statusCode": 200,
+ *     "body": {
+ *       "success": true,
+ *       "message": "Database migration completed successfully",
+ *       "dbType": "postgresql",
+ *       "stage": "production",
+ *       "migrationCommand": "deploy"
+ *     }
+ *   }
+ *
+ * Error Response:
+ *   {
+ *     "statusCode": 500,
+ *     "body": {
+ *       "success": false,
+ *       "error": "Migration failed: ...",
+ *       "stack": "Error: ..."
+ *     }
+ *   }
+ */
+
+const {
+    RunDatabaseMigrationUseCase,
+    MigrationError,
+    ValidationError,
+} = require('../../database/use-cases/run-database-migration-use-case');
+
+// Inject prisma-runner as dependency
+const prismaRunner = require('../../database/utils/prisma-runner');
+
+/**
+ * Sanitizes error messages to prevent credential leaks
+ * @param {string} errorMessage - Error message that might contain credentials
+ * @returns {string} Sanitized error message
+ */
+function sanitizeError(errorMessage) {
+    if (!errorMessage) return 'Unknown error';
+
+    return String(errorMessage)
+        // Remove PostgreSQL connection strings
+        .replace(/postgresql:\/\/[^@\s]+@[^\s/]+/gi, 'postgresql://***:***@***')
+        // Remove MongoDB connection strings
+        .replace(/mongodb(\+srv)?:\/\/[^@\s]+@[^\s/]+/gi, 'mongodb$1://***:***@***')
+        // Remove password parameters
+        .replace(/password[=:]\s*[^\s,;)]+/gi, 'password=***')
+        // Remove API keys
+        .replace(/apikey[=:]\s*[^\s,;)]+/gi, 'apikey=***')
+        .replace(/api[_-]?key[=:]\s*[^\s,;)]+/gi, 'api_key=***')
+        // Remove tokens
+        .replace(/token[=:]\s*[^\s,;)]+/gi, 'token=***')
+        .replace(/bearer\s+[^\s,;)]+/gi, 'bearer ***');
+}
+
+/**
+ * Sanitizes DATABASE_URL for safe logging
+ * @param {string} url - Database URL
+ * @returns {string} Sanitized URL
+ */
+function sanitizeDatabaseUrl(url) {
+    if (!url) return '';
+
+    // Replace credentials in connection string
+    return url.replace(/(:\/\/)([^:]+):([^@]+)@/, '$1***:***@');
+}
+
+/**
+ * Lambda handler entry point
+ * @param {Object} event - Lambda event (not used, migrations don't need input)
+ * @param {Object} context - Lambda context (contains AWS request ID, timeout info)
+ * @returns {Promise<Object>} Response with statusCode and body
+ */
+exports.handler = async (event, context) => {
+    console.log('========================================');
+    console.log('Database Migration Lambda Started');
+    console.log('========================================');
+    console.log('Event:', JSON.stringify(event, null, 2));
+    console.log('Context:', JSON.stringify({
+        requestId: context.requestId,
+        functionName: context.functionName,
+        remainingTimeInMillis: context.getRemainingTimeInMillis(),
+    }, null, 2));
+
+    // Get environment variables
+    const databaseUrl = process.env.DATABASE_URL;
+    const dbType = process.env.DB_TYPE || 'postgresql';
+    const stage = process.env.STAGE || 'production';
+
+    try {
+        // Validate DATABASE_URL is set
+        if (!databaseUrl) {
+            const error = 'DATABASE_URL environment variable is not set';
+            console.error('❌ Validation failed:', error);
+            return {
+                statusCode: 500,
+                body: JSON.stringify({
+                    success: false,
+                    error,
+                }),
+            };
+        }
+
+        console.log('✓ Environment validated');
+        console.log(`  Database Type: ${dbType}`);
+        console.log(`  Stage: ${stage}`);
+        console.log(`  Database URL: ${sanitizeDatabaseUrl(databaseUrl)}`);
+
+        // Create use case with dependencies (Dependency Injection)
+        const runDatabaseMigrationUseCase = new RunDatabaseMigrationUseCase({
+            prismaRunner,
+        });
+
+        console.log('\n========================================');
+        console.log('Executing Database Migration');
+        console.log('========================================');
+
+        // Execute use case (business logic layer)
+        const result = await runDatabaseMigrationUseCase.execute({
+            dbType,
+            stage,
+            verbose: true, // Enable verbose output for Lambda CloudWatch logs
+        });
+
+        console.log('✓ Database migration completed successfully');
+        console.log('\n========================================');
+        console.log('Migration Summary');
+        console.log('========================================');
+        console.log(`  Status: Success`);
+        console.log(`  Database: ${result.dbType}`);
+        console.log(`  Stage: ${result.stage}`);
+        console.log(`  Command: ${result.command}`);
+        console.log('========================================');
+
+        // Return success response (adapter layer - HTTP mapping)
+        return {
+            statusCode: 200,
+            body: JSON.stringify({
+                success: true,
+                message: result.message,
+                dbType: result.dbType,
+                stage: result.stage,
+                migrationCommand: result.command,
+                timestamp: new Date().toISOString(),
+            }),
+        };
+
+    } catch (error) {
+        console.error('\n========================================');
+        console.error('Migration Failed');
+        console.error('========================================');
+        console.error('Error:', error.name, error.message);
+
+        // Log full stack trace to CloudWatch (only visible to developers)
+        if (error.stack) {
+            console.error('Stack:', error.stack);
+        }
+
+        // Log context if available (from MigrationError)
+        if (error.context) {
+            console.error('Context:', JSON.stringify(error.context, null, 2));
+        }
+
+        // Map domain errors to HTTP status codes (adapter layer)
+        let statusCode = 500;
+        let errorMessage = error.message || 'Unknown error occurred';
+
+        if (error instanceof ValidationError) {
+            statusCode = 400; // Bad Request for validation errors
+        } else if (error instanceof MigrationError) {
+            statusCode = 500; // Internal Server Error for migration failures
+        }
+
+        // Sanitize error message before returning
+        const sanitizedError = sanitizeError(errorMessage);
+
+        return {
+            statusCode,
+            body: JSON.stringify({
+                success: false,
+                error: sanitizedError,
+                errorType: error.name || 'Error',
+                // Only include stack traces in development environments
+                ...(stage === 'dev' || stage === 'local' || stage === 'test' ? { stack: error.stack } : {}),
+            }),
+        };
+    }
+};

package/handlers/workers/db-migration.test.js

@@ -0,0 +1,437 @@
+/**
+ * Unit tests for Database Migration Lambda Handler
+ *
+ * Tests the db-migration Lambda handler which runs Prisma migrations
+ * from within the VPC for CI/CD pipelines.
+ */
+
+// Mock the use case module before requiring the handler
+jest.mock('../../database/use-cases/run-database-migration-use-case', () => {
+    const mockExecute = jest.fn();
+    return {
+        RunDatabaseMigrationUseCase: jest.fn().mockImplementation(() => ({
+            execute: mockExecute,
+        })),
+        MigrationError: class MigrationError extends Error {
+            constructor(message, context) {
+                super(message);
+                this.name = 'MigrationError';
+                this.context = context;
+            }
+        },
+        ValidationError: class ValidationError extends Error {
+            constructor(message) {
+                super(message);
+                this.name = 'ValidationError';
+            }
+        },
+        __mockExecute: mockExecute, // Expose for test access
+    };
+});
+
+const { handler } = require('./db-migration');
+const {
+    RunDatabaseMigrationUseCase,
+    MigrationError,
+    ValidationError,
+    __mockExecute: mockExecute,
+} = require('../../database/use-cases/run-database-migration-use-case');
+
+describe('db-migration Lambda Handler', () => {
+    let originalEnv;
+    let mockContext;
+
+    beforeEach(() => {
+        // Save original environment
+        originalEnv = { ...process.env };
+
+        // Setup mock context
+        mockContext = {
+            requestId: 'test-request-id',
+            functionName: 'test-function',
+            getRemainingTimeInMillis: jest.fn(() => 300000), // 5 minutes
+        };
+
+        // Reset all mocks
+        jest.clearAllMocks();
+
+        // Set default environment variables
+        process.env.DATABASE_URL = 'postgresql://user:pass@localhost:5432/test_db';
+        process.env.DB_TYPE = 'postgresql';
+        process.env.STAGE = 'production';
+
+        // Setup default mock implementation - successful migration
+        mockExecute.mockResolvedValue({
+            success: true,
+            dbType: 'postgresql',
+            stage: 'production',
+            command: 'deploy',
+            message: 'Database migration completed successfully',
+        });
+    });
+
+    afterEach(() => {
+        // Restore original environment
+        process.env = originalEnv;
+    });
+
+    describe('Successful Migrations', () => {
+        test('should successfully run PostgreSQL migration in production', async () => {
+            process.env.STAGE = 'production';
+            mockExecute.mockResolvedValue({
+                success: true,
+                dbType: 'postgresql',
+                stage: 'production',
+                command: 'deploy',
+                message: 'Database migration completed successfully',
+            });
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(200);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(true);
+            expect(body.message).toBe('Database migration completed successfully');
+            expect(body.dbType).toBe('postgresql');
+            expect(body.stage).toBe('production');
+            expect(body.migrationCommand).toBe('deploy');
+
+            // Verify use case was called with correct parameters
+            expect(mockExecute).toHaveBeenCalledWith({
+                dbType: 'postgresql',
+                stage: 'production',
+                verbose: true,
+            });
+        });
+
+        test('should successfully run PostgreSQL migration in development', async () => {
+            process.env.STAGE = 'dev';
+            mockExecute.mockResolvedValue({
+                success: true,
+                dbType: 'postgresql',
+                stage: 'dev',
+                command: 'dev',
+                message: 'Database migration completed successfully',
+            });
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(200);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(true);
+            expect(body.migrationCommand).toBe('dev');
+
+            expect(mockExecute).toHaveBeenCalledWith({
+                dbType: 'postgresql',
+                stage: 'dev',
+                verbose: true,
+            });
+        });
+
+        test('should successfully run MongoDB migration', async () => {
+            process.env.DB_TYPE = 'mongodb';
+            process.env.DATABASE_URL = 'mongodb://localhost:27017/test_db';
+            mockExecute.mockResolvedValue({
+                success: true,
+                dbType: 'mongodb',
+                stage: 'production',
+                command: 'db push',
+                message: 'Database migration completed successfully',
+            });
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(200);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(true);
+            expect(body.dbType).toBe('mongodb');
+            expect(body.migrationCommand).toBe('db push');
+
+            expect(mockExecute).toHaveBeenCalledWith({
+                dbType: 'mongodb',
+                stage: 'production',
+                verbose: true,
+            });
+        });
+
+        test('should use default values when environment variables are missing', async () => {
+            delete process.env.DB_TYPE;
+            delete process.env.STAGE;
+            mockExecute.mockResolvedValue({
+                success: true,
+                dbType: 'postgresql',
+                stage: 'production',
+                command: 'deploy',
+                message: 'Database migration completed successfully',
+            });
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(200);
+            const body = JSON.parse(result.body);
+            expect(body.dbType).toBe('postgresql'); // Default
+            expect(body.stage).toBe('production'); // Default
+
+            expect(mockExecute).toHaveBeenCalledWith({
+                dbType: 'postgresql', // Default
+                stage: 'production',  // Default
+                verbose: true,
+            });
+        });
+    });
+
+    describe('Error Handling', () => {
+        test('should fail when DATABASE_URL is not set', async () => {
+            delete process.env.DATABASE_URL;
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('DATABASE_URL environment variable is not set');
+
+            // Verify use case was not called
+            expect(mockExecute).not.toHaveBeenCalled();
+        });
+
+        test('should fail when Prisma generate fails (MigrationError)', async () => {
+            mockExecute.mockRejectedValue(
+                new MigrationError('Failed to generate Prisma client: Schema file not found', {
+                    dbType: 'postgresql',
+                    stage: 'production',
+                    step: 'generate',
+                })
+            );
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('Failed to generate Prisma client');
+            expect(body.error).toContain('Schema file not found');
+            expect(body.errorType).toBe('MigrationError');
+        });
+
+        test('should fail when PostgreSQL migration fails', async () => {
+            mockExecute.mockRejectedValue(
+                new MigrationError('PostgreSQL migration failed: Migration conflict detected', {
+                    dbType: 'postgresql',
+                    stage: 'production',
+                    command: 'deploy',
+                    step: 'migrate',
+                })
+            );
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('PostgreSQL migration failed');
+            expect(body.error).toContain('Migration conflict detected');
+            expect(body.errorType).toBe('MigrationError');
+        });
+
+        test('should fail when MongoDB push fails', async () => {
+            process.env.DB_TYPE = 'mongodb';
+            mockExecute.mockRejectedValue(
+                new MigrationError('MongoDB push failed: Connection timeout', {
+                    dbType: 'mongodb',
+                    stage: 'production',
+                    command: 'db push',
+                    step: 'push',
+                })
+            );
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('MongoDB push failed');
+            expect(body.error).toContain('Connection timeout');
+            expect(body.errorType).toBe('MigrationError');
+        });
+
+        test('should fail for unsupported database type (ValidationError)', async () => {
+            process.env.DB_TYPE = 'mysql';
+            mockExecute.mockRejectedValue(
+                new ValidationError("Unsupported database type: mysql. Must be 'postgresql' or 'mongodb'.")
+            );
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(400); // Validation errors return 400
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('Unsupported database type: mysql');
+            expect(body.errorType).toBe('ValidationError');
+        });
+
+        test('should handle unexpected errors gracefully', async () => {
+            mockExecute.mockRejectedValue(new Error('Unexpected error'));
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            expect(body.error).toContain('Unexpected error');
+            expect(body.errorType).toBe('Error');
+            expect(body.stack).toBeUndefined(); // Stack NOT included in production (default stage)
+        });
+
+        test('should sanitize error messages containing credentials', async () => {
+            mockExecute.mockRejectedValue(
+                new MigrationError(
+                    'Connection failed to postgresql://user:password@host:5432/db',
+                    { dbType: 'postgresql', stage: 'production' }
+                )
+            );
+
+            const result = await handler({}, mockContext);
+
+            expect(result.statusCode).toBe(500);
+            const body = JSON.parse(result.body);
+            expect(body.success).toBe(false);
+            // Credentials should be sanitized
+            expect(body.error).toContain('postgresql://***:***@***');
+            expect(body.error).not.toContain('user:password');
+        });
+
+        test('should only include stack traces in development stages', async () => {
+            process.env.STAGE = 'dev';
+            mockExecute.mockRejectedValue(new Error('Test error'));
+
+            const result = await handler({}, mockContext);
+
+            const body = JSON.parse(result.body);
+            expect(body.stack).toBeDefined();
+        });
+
+        test('should not include stack traces in production stage', async () => {
+            process.env.STAGE = 'production';
+            mockExecute.mockRejectedValue(new Error('Test error'));
+
+            const result = await handler({}, mockContext);
+
+            const body = JSON.parse(result.body);
+            expect(body.stack).toBeUndefined();
+        });
+    });
+
+    describe('Environment Variable Handling', () => {
+        test('should sanitize DATABASE_URL in logs', async () => {
+            const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+            process.env.DATABASE_URL = 'postgresql://user:password@very-long-host.amazonaws.com:5432/database';
+
+            await handler({}, mockContext);
+
+            // Verify URL credentials are masked in logs
+            expect(consoleSpy).toHaveBeenCalledWith(
+                expect.stringContaining('postgresql://***:***@')
+            );
+            expect(consoleSpy).not.toHaveBeenCalledWith(
+                expect.stringContaining('user:password')
+            );
+
+            consoleSpy.mockRestore();
+        });
+
+        test('should handle different stage values correctly', async () => {
+            const stages = ['dev', 'test', 'local', 'staging', 'production'];
+
+            for (const stage of stages) {
+                process.env.STAGE = stage;
+                const command = ['dev', 'test', 'local'].includes(stage) ? 'dev' : 'deploy';
+
+                jest.clearAllMocks();
+                mockExecute.mockResolvedValue({
+                    success: true,
+                    dbType: 'postgresql',
+                    stage,
+                    command,
+                    message: 'Database migration completed successfully',
+                });
+
+                const result = await handler({}, mockContext);
+
+                expect(result.statusCode).toBe(200);
+                const body = JSON.parse(result.body);
+                expect(body.stage).toBe(stage);
+                expect(mockExecute).toHaveBeenCalledWith({
+                    dbType: 'postgresql',
+                    stage,
+                    verbose: true,
+                });
+            }
+        });
+    });
+
+    describe('Response Format', () => {
+        test('should return properly formatted success response', async () => {
+            const result = await handler({}, mockContext);
+
+            expect(result).toHaveProperty('statusCode', 200);
+            expect(result).toHaveProperty('body');
+
+            const body = JSON.parse(result.body);
+            expect(body).toHaveProperty('success', true);
+            expect(body).toHaveProperty('message');
+            expect(body).toHaveProperty('dbType');
+            expect(body).toHaveProperty('stage');
+            expect(body).toHaveProperty('migrationCommand');
+            expect(body).toHaveProperty('timestamp');
+
+            // Verify timestamp is valid ISO string
+            expect(() => new Date(body.timestamp)).not.toThrow();
+        });
+
+        test('should return properly formatted error response', async () => {
+            delete process.env.DATABASE_URL;
+
+            const result = await handler({}, mockContext);
+
+            expect(result).toHaveProperty('statusCode', 500);
+            expect(result).toHaveProperty('body');
+
+            const body = JSON.parse(result.body);
+            expect(body).toHaveProperty('success', false);
+            expect(body).toHaveProperty('error');
+            expect(typeof body.error).toBe('string');
+        });
+    });
+
+    describe('Logging', () => {
+        test('should log migration progress', async () => {
+            const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            await handler({}, mockContext);
+
+            // Verify key log messages
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Database Migration Lambda Started'));
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Executing Database Migration'));
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Migration Summary'));
+
+            consoleSpy.mockRestore();
+        });
+
+        test('should log errors with details', async () => {
+            const consoleSpy = jest.spyOn(console, 'error').mockImplementation();
+            const testError = new MigrationError('Test migration error', {
+                dbType: 'postgresql',
+                stage: 'production',
+            });
+            mockExecute.mockRejectedValue(testError);
+
+            await handler({}, mockContext);
+
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Migration Failed'));
+            expect(consoleSpy).toHaveBeenCalledWith('Error:', 'MigrationError', 'Test migration error');
+
+            consoleSpy.mockRestore();
+        });
+    });
+});