@friggframework/core 2.0.0--canary.499.2ef107f.0 → 2.0.0--canary.499.4c64a49.0

package/credential/repositories/credential-repository-documentdb.js

@@ -21,7 +21,7 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         const objectId = toObjectId(id);
         if (!objectId) return null;
         const doc = await findOne(this.prisma, 'Credential', { _id: objectId });
-        return doc ? this._mapCredential(doc) : null;
+        return doc ? this._mapCredentialById(doc) : null;
     }
 
     async updateAuthenticationStatus(credentialId, authIsValid) {
@@ -95,8 +95,8 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         }
 
         const document = {
-            userId: toObjectId(userId || user) || null,
-            externalId,
+            userId: toObjectId(userId || user || identifiers.user),
+            externalId: externalId !== undefined ? externalId : identifiers.externalId,
             authIsValid: authIsValid ?? null,
             data: oauthData,
             createdAt: now,
@@ -183,7 +183,32 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return query;
     }
 
+    /**
+     * Map credential document to application format (without legacy fields)
+     * Used by findCredential, upsertCredential, updateCredential
+     * Matches MongoDB repository format
+     * @private
+     */
     _mapCredential(doc) {
+        const data = doc?.data || {};
+        const id = fromObjectId(doc?._id);
+        const userId = fromObjectId(doc?.userId);
+        return {
+            id,
+            userId,
+            externalId: doc?.externalId ?? null,
+            authIsValid: doc?.authIsValid ?? null,
+            ...data,
+        };
+    }
+
+    /**
+     * Map credential document with legacy fields for findCredentialById
+     * Includes _id and user fields for backward compatibility
+     * Matches MongoDB repository format
+     * @private
+     */
+    _mapCredentialById(doc) {
         const data = doc?.data || {};
         const id = fromObjectId(doc?._id);
         const userId = fromObjectId(doc?.userId);

package/database/documentdb-utils.js

@@ -35,19 +35,16 @@ async function findOne(client, collection, filter = {}, options = {}) {
 }
 
 async function insertOne(client, collection, document) {
-    const result = await client.$runCommandRaw({
+    // Generate ObjectId if not present (MongoDB raw insert doesn't return insertedIds)
+    const _id = document._id || new ObjectId();
+    const docWithId = { ...document, _id };
+
+    await client.$runCommandRaw({
         insert: collection,
-        documents: [document],
+        documents: [docWithId],
     });
-    if (Array.isArray(result?.insertedIds)) return result.insertedIds[0];
-    if (result?.insertedIds && typeof result.insertedIds === 'object') {
-        const firstKey = Object.keys(result.insertedIds)[0];
-        if (firstKey !== undefined) {
-            return result.insertedIds[firstKey];
-        }
-    }
-    if (result?.insertedId) return result.insertedId;
-    return null;
+
+    return _id;
 }
 
 async function updateOne(client, collection, filter, update, options = {}) {

package/modules/repositories/module-repository-documentdb.js

@@ -9,11 +9,111 @@ const {
     deleteOne,
 } = require('../../database/documentdb-utils');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
+const { Cryptor } = require('../../encrypt/Cryptor');
+const { getEncryptedFields } = require('../../database/encryption/encryption-schema-registry');
 
 class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     constructor() {
         super();
         this.prisma = prisma;
+        this._initializeCryptor();
+    }
+
+    _initializeCryptor() {
+        // Match logic from @friggframework/core/database/prisma.js
+        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
+        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
+
+        if (bypassEncryption) {
+            this.cryptor = null;
+            return;
+        }
+
+        // Determine encryption method
+        const hasKMS = process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+        const hasAES = process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+        if (!hasKMS && !hasAES) {
+            console.warn('No encryption keys configured. Encryption disabled.');
+            this.cryptor = null;
+            return;
+        }
+
+        const shouldUseAws = hasKMS;
+        this.cryptor = new Cryptor({ shouldUseAws });
+    }
+
+    _isEncryptedValue(value) {
+        // Envelope encryption format: "keyId:encryptedPart1:encryptedPart2:encryptedKey"
+        // Must be string with at least 4 colon-separated parts
+        if (typeof value !== 'string') {
+            return false;
+        }
+
+        const parts = value.split(':');
+        return parts.length >= 4;
+    }
+
+    async _decryptField(encryptedValue, context = '') {
+        // If encryption is disabled, return as-is
+        if (!this.cryptor) {
+            return encryptedValue;
+        }
+
+        // If not encrypted format, return as-is
+        if (!this._isEncryptedValue(encryptedValue)) {
+            return encryptedValue;
+        }
+
+        try {
+            // Decrypt using Cryptor
+            const decryptedString = await this.cryptor.decrypt(encryptedValue);
+
+            // Try to parse as JSON (for objects/arrays)
+            try {
+                return JSON.parse(decryptedString);
+            } catch {
+                // Not JSON, return as string
+                return decryptedString;
+            }
+        } catch (error) {
+            console.error(`Failed to decrypt field${context ? ` (${context})` : ''}:`, error.message);
+            // Return null on decryption failure to avoid exposing encrypted data
+            return null;
+        }
+    }
+
+    async _decryptCredentialData(rawData) {
+        if (!rawData || typeof rawData !== 'object') {
+            return rawData;
+        }
+
+        // Get encrypted fields from registry
+        const encryptedFieldsConfig = getEncryptedFields('Credential');
+        if (!encryptedFieldsConfig || !encryptedFieldsConfig.fields) {
+            return rawData;
+        }
+
+        const decrypted = {};
+
+        for (const [key, value] of Object.entries(rawData)) {
+            // Check if this field is in the encrypted fields list
+            const isEncrypted = encryptedFieldsConfig.fields.some(field => {
+                // Support both top-level and nested fields (e.g., 'data.access_token')
+                const fieldPath = field.split('.');
+                return fieldPath[fieldPath.length - 1] === key;
+            });
+
+            if (isEncrypted) {
+                // Decrypt encrypted fields
+                decrypted[key] = await this._decryptField(value, `Credential.data.${key}`);
+            } else {
+                // Pass through non-encrypted fields
+                decrypted[key] = value;
+            }
+        }
+
+        return decrypted;
     }
 
     async findEntityById(entityId) {
@@ -31,10 +131,13 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
 
     async findEntitiesByUserId(userId) {
         const objectId = toObjectId(userId);
-        const filter = objectId ? { userId: objectId } : {};
+        if (!objectId) {
+            throw new Error(`Invalid userId: ${userId}`);
+        }
+        const filter = { userId: objectId };
         const docs = await findMany(this.prisma, 'Entity', filter);
         const credentialMap = await this._fetchCredentialsBulk(docs.map((doc) => doc.credentialId));
-        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || credentialMap.get(doc.credentialId) || null));
+        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
     }
 
     async findEntitiesByIds(entitiesIds) {
@@ -42,18 +145,21 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         if (ids.length === 0) return [];
         const docs = await findMany(this.prisma, 'Entity', { _id: { $in: ids } });
         const credentialMap = await this._fetchCredentialsBulk(docs.map((doc) => doc.credentialId));
-        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || credentialMap.get(doc.credentialId) || null));
+        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
     }
 
     async findEntitiesByUserIdAndModuleName(userId, moduleName) {
         const objectId = toObjectId(userId);
+        if (!objectId) {
+            throw new Error(`Invalid userId: ${userId}`);
+        }
         const filter = {
-            ...(objectId ? { userId: objectId } : {}),
+            userId: objectId,
             moduleName,
         };
         const docs = await findMany(this.prisma, 'Entity', filter);
         const credentialMap = await this._fetchCredentialsBulk(docs.map((doc) => doc.credentialId));
-        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || credentialMap.get(doc.credentialId) || null));
+        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
     }
 
     async unsetCredential(entityId) {
@@ -66,7 +172,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             {
                 $set: {
                     credentialId: null,
-                    updatedAt: new Date(),
                 },
             }
         );
@@ -82,7 +187,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     }
 
     async createEntity(entityData) {
-        const now = new Date();
         const document = {
             userId: toObjectId(entityData.user || entityData.userId),
             credentialId: toObjectId(entityData.credential || entityData.credentialId) || null,
@@ -90,10 +194,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             moduleName: entityData.moduleName ?? null,
             externalId: entityData.externalId ?? null,
             accountId: entityData.accountId ?? null,
-            integrationIds: (entityData.integrationIds || []).map((id) => toObjectId(id)).filter(Boolean),
-            syncIds: (entityData.syncIds || []).map((id) => toObjectId(id)).filter(Boolean),
-            createdAt: now,
-            updatedAt: now,
         };
         const insertedId = await insertOne(this.prisma, 'Entity', document);
         const created = await findOne(this.prisma, 'Entity', { _id: insertedId });
@@ -117,13 +217,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         if (updates.moduleName !== undefined) updatePayload.moduleName = updates.moduleName;
         if (updates.externalId !== undefined) updatePayload.externalId = updates.externalId;
         if (updates.accountId !== undefined) updatePayload.accountId = updates.accountId;
-        if (updates.integrationIds !== undefined) {
-            updatePayload.integrationIds = (updates.integrationIds || []).map((id) => toObjectId(id)).filter(Boolean);
-        }
-        if (updates.syncIds !== undefined) {
-            updatePayload.syncIds = (updates.syncIds || []).map((id) => toObjectId(id)).filter(Boolean);
-        }
-        updatePayload.updatedAt = new Date();
         const result = await updateOne(
             this.prisma,
             'Entity',
@@ -148,9 +241,40 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     async _fetchCredential(credentialId) {
         const id = fromObjectId(credentialId);
         if (!id) return null;
-        return this.prisma.credential.findUnique({
-            where: { id },
-        });
+
+        try {
+            // Convert to ObjectId for raw query
+            const objectId = toObjectId(id);
+            if (!objectId) return null;
+
+            // Use raw findOne to bypass Prisma encryption extension
+            const rawCredential = await findOne(this.prisma, 'Credential', {
+                _id: objectId
+            });
+
+            if (!rawCredential) return null;
+
+            // Manually decrypt data field
+            const decryptedData = await this._decryptCredentialData(
+                rawCredential.data || {}
+            );
+
+            // Return in same format
+            const credential = {
+                id: fromObjectId(rawCredential._id),
+                userId: fromObjectId(rawCredential.userId),
+                externalId: rawCredential.externalId ?? null,
+                authIsValid: rawCredential.authIsValid ?? null,
+                createdAt: rawCredential.createdAt,
+                updatedAt: rawCredential.updatedAt,
+                data: decryptedData
+            };
+
+            return this._convertCredentialIds(credential);
+        } catch (error) {
+            console.error(`Failed to fetch/decrypt credential ${id}:`, error.message);
+            return null;
+        }
     }
 
     async _fetchCredentialsBulk(credentialIds) {
@@ -158,14 +282,76 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             .map((value) => fromObjectId(value))
             .filter((value) => value !== null && value !== undefined);
         if (ids.length === 0) return new Map();
-        const credentials = await this.prisma.credential.findMany({
-            where: { id: { in: ids } },
-        });
-        const map = new Map();
-        for (const credential of credentials) {
-            map.set(credential.id, credential);
+
+        try {
+            // Convert string IDs to ObjectIds for bulk query
+            const objectIds = ids.map(id => toObjectId(id)).filter(Boolean);
+            if (objectIds.length === 0) return new Map();
+
+            // Use raw findMany to bypass Prisma encryption extension
+            const rawCredentials = await findMany(this.prisma, 'Credential', {
+                _id: { $in: objectIds }
+            });
+
+            // Decrypt all credentials in parallel
+            const decryptionPromises = rawCredentials.map(async (rawCredential) => {
+                try {
+                    // Manually decrypt the data field
+                    const decryptedData = await this._decryptCredentialData(
+                        rawCredential.data || {}
+                    );
+
+                    // Build credential object in same format as Prisma would return
+                    const credential = {
+                        id: fromObjectId(rawCredential._id),
+                        userId: fromObjectId(rawCredential.userId),
+                        externalId: rawCredential.externalId ?? null,
+                        authIsValid: rawCredential.authIsValid ?? null,
+                        createdAt: rawCredential.createdAt,
+                        updatedAt: rawCredential.updatedAt,
+                        data: decryptedData
+                    };
+
+                    return this._convertCredentialIds(credential);
+                } catch (error) {
+                    const credId = fromObjectId(rawCredential._id);
+                    console.error(`Failed to decrypt credential ${credId}:`, error.message);
+                    return null;
+                }
+            });
+
+            // Wait for all decryptions to complete
+            const decryptedCredentials = await Promise.all(decryptionPromises);
+
+            // Build Map from results, filtering out nulls
+            const map = new Map();
+            decryptedCredentials.forEach(credential => {
+                if (credential) {
+                    map.set(credential.id, credential);
+                }
+            });
+
+            return map;
+        } catch (error) {
+            console.error('Failed to fetch credentials bulk:', error.message);
+            return new Map();
         }
-        return map;
+    }
+
+    /**
+     * Convert credential object IDs to strings for application layer
+     * Ensures consistent credential format across database adapters
+     * @private
+     * @param {Object|null} credential - Credential object from database
+     * @returns {Object|null} Credential with properly formatted IDs
+     */
+    _convertCredentialIds(credential) {
+        if (!credential) return credential;
+        return {
+            ...credential,
+            id: credential.id ? String(credential.id) : null,
+            userId: credential.userId ? String(credential.userId) : null,
+        };
     }
 
     _buildFilter(filter) {
@@ -183,10 +369,9 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             const credObj = toObjectId(filter.credential || filter.credentialId);
             if (credObj) query.credentialId = credObj;
         }
-        if (filter.name !== undefined) query.name = filter.name;
-        if (filter.moduleName !== undefined) query.moduleName = filter.moduleName;
-        if (filter.externalId !== undefined) query.externalId = filter.externalId;
-        if (filter.accountId !== undefined) query.accountId = filter.accountId;
+        if (filter.name) query.name = filter.name;
+        if (filter.moduleName) query.moduleName = filter.moduleName;
+        if (filter.externalId) query.externalId = filter.externalId;
         return query;
     }
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.499.2ef107f.0",
+    "version": "2.0.0--canary.499.4c64a49.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -38,9 +38,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.499.2ef107f.0",
-        "@friggframework/prettier-config": "2.0.0--canary.499.2ef107f.0",
-        "@friggframework/test": "2.0.0--canary.499.2ef107f.0",
+        "@friggframework/eslint-config": "2.0.0--canary.499.4c64a49.0",
+        "@friggframework/prettier-config": "2.0.0--canary.499.4c64a49.0",
+        "@friggframework/test": "2.0.0--canary.499.4c64a49.0",
         "@prisma/client": "^6.17.0",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -80,5 +80,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "2ef107f34b011aef53330f9c5e4f79316c8fcf3b"
+    "gitHead": "4c64a49a369d67e2c2fb831e134db33c6d4cc6ca"
 }