@friggframework/core 2.0.0--canary.499.897122d.0 → 2.0.0--canary.499.5d51f03.0

package/credential/repositories/credential-repository-documentdb.js

@@ -10,18 +10,39 @@ const {
 const {
     CredentialRepositoryInterface,
 } = require('./credential-repository-interface');
+const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
 
+/**
+ * Credential repository for DocumentDB.
+ * Uses DocumentDBEncryptionService for field-level encryption.
+ *
+ * Encrypted fields:
+ * - Credential.data.access_token
+ * - Credential.data.refresh_token
+ * - Credential.data.id_token
+ * - Credential.data.domain
+ *
+ * SECURITY CRITICAL: All OAuth credentials must be encrypted at rest.
+ *
+ * @see DocumentDBEncryptionService
+ * @see encryption-schema-registry.js
+ */
 class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
     constructor() {
         super();
         this.prisma = prisma;
+        this.encryptionService = new DocumentDBEncryptionService();
     }
 
     async findCredentialById(id) {
         const objectId = toObjectId(id);
         if (!objectId) return null;
         const doc = await findOne(this.prisma, 'Credential', { _id: objectId });
-        return doc ? this._mapCredentialById(doc) : null;
+        if (!doc) return null;
+
+        // Decrypt sensitive fields using service
+        const decryptedCredential = await this.encryptionService.decryptFields('Credential', doc);
+        return this._mapCredentialById(decryptedCredential);
     }
 
     async updateAuthenticationStatus(credentialId, authIsValid) {
@@ -73,28 +94,48 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         const now = new Date();
 
         if (existing) {
-            const mergedData = { ...(existing.data || {}), ...oauthData };
+            // Decrypt existing credential data first
+            const decryptedExisting = await this.encryptionService.decryptFields('Credential', existing);
+            const mergedData = { ...(decryptedExisting.data || {}), ...oauthData };
+
+            // Build update document
+            const updateDocument = {
+                userId: toObjectId(userId || user) || existing.userId || null,
+                externalId: externalId !== undefined ? externalId : existing.externalId,
+                authIsValid: authIsValid !== undefined ? authIsValid : existing.authIsValid,
+                data: mergedData,
+                updatedAt: now,
+            };
+
+            // Encrypt before storing
+            const encryptedUpdate = await this.encryptionService.encryptFields(
+                'Credential',
+                { data: updateDocument.data }
+            );
+
             await updateOne(
                 this.prisma,
                 'Credential',
                 { _id: existing._id },
                 {
                     $set: {
-                        userId: toObjectId(userId || user) || existing.userId || null,
-                        externalId:
-                            externalId !== undefined ? externalId : existing.externalId,
-                        authIsValid:
-                            authIsValid !== undefined ? authIsValid : existing.authIsValid,
-                        data: mergedData,
-                        updatedAt: now,
+                        userId: updateDocument.userId,
+                        externalId: updateDocument.externalId,
+                        authIsValid: updateDocument.authIsValid,
+                        data: encryptedUpdate.data,
+                        updatedAt: updateDocument.updatedAt,
                     },
                 }
             );
+
+            // Read back and decrypt
             const updated = await findOne(this.prisma, 'Credential', { _id: existing._id });
-            return this._mapCredential(updated);
+            const decryptedCredential = await this.encryptionService.decryptFields('Credential', updated);
+            return this._mapCredential(decryptedCredential);
         }
 
-        const document = {
+        // Build plain text document
+        const plainDocument = {
             userId: toObjectId(userId || user || identifiers.user),
             externalId: externalId !== undefined ? externalId : identifiers.externalId,
             authIsValid: authIsValid ?? null,
@@ -103,15 +144,28 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
             updatedAt: now,
         };
 
-        const insertedId = await insertOne(this.prisma, 'Credential', document);
+        // Encrypt before storing
+        const encryptedDocument = await this.encryptionService.encryptFields(
+            'Credential',
+            plainDocument
+        );
+
+        const insertedId = await insertOne(this.prisma, 'Credential', encryptedDocument);
+
+        // Read back and decrypt
         const created = await findOne(this.prisma, 'Credential', { _id: insertedId });
-        return this._mapCredential(created);
+        const decryptedCredential = await this.encryptionService.decryptFields('Credential', created);
+        return this._mapCredential(decryptedCredential);
     }
 
     async findCredential(filter) {
         const query = this._buildFilter(filter);
         const credential = await findOne(this.prisma, 'Credential', query);
-        return credential ? this._mapCredential(credential) : null;
+        if (!credential) return null;
+
+        // Decrypt sensitive fields using service
+        const decryptedCredential = await this.encryptionService.decryptFields('Credential', credential);
+        return this._mapCredential(decryptedCredential);
     }
 
     async updateCredential(credentialId, updates) {
@@ -128,26 +182,44 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
             ...oauthData
         } = updates || {};
 
-        const mergedData = { ...(existing.data || {}), ...oauthData };
+        // Decrypt existing credential data first
+        const decryptedExisting = await this.encryptionService.decryptFields('Credential', existing);
+        const mergedData = { ...(decryptedExisting.data || {}), ...oauthData };
+
+        // Build update document
+        const updateDocument = {
+            userId: toObjectId(userId || user) || existing.userId || null,
+            externalId: externalId !== undefined ? externalId : existing.externalId,
+            authIsValid: authIsValid !== undefined ? authIsValid : existing.authIsValid,
+            data: mergedData,
+            updatedAt: new Date(),
+        };
+
+        // Encrypt before storing
+        const encryptedUpdate = await this.encryptionService.encryptFields(
+            'Credential',
+            { data: updateDocument.data }
+        );
+
         await updateOne(
             this.prisma,
             'Credential',
             { _id: objectId },
             {
                 $set: {
-                    userId: toObjectId(userId || user) || existing.userId || null,
-                    externalId:
-                        externalId !== undefined ? externalId : existing.externalId,
-                    authIsValid:
-                        authIsValid !== undefined ? authIsValid : existing.authIsValid,
-                    data: mergedData,
-                    updatedAt: new Date(),
+                    userId: updateDocument.userId,
+                    externalId: updateDocument.externalId,
+                    authIsValid: updateDocument.authIsValid,
+                    data: encryptedUpdate.data,
+                    updatedAt: updateDocument.updatedAt,
                 },
             }
         );
 
+        // Read back and decrypt
         const updated = await findOne(this.prisma, 'Credential', { _id: objectId });
-        return updated ? this._mapCredential(updated) : null;
+        const decryptedCredential = await this.encryptionService.decryptFields('Credential', updated);
+        return this._mapCredential(decryptedCredential);
     }
 
     _buildIdentifierFilter(identifiers) {

package/database/documentdb-encryption-service.js

@@ -0,0 +1,326 @@
+const { Cryptor } = require('../encrypt/Cryptor');
+const { getEncryptedFields } = require('./encryption/encryption-schema-registry');
+
+/**
+ * Encryption service specifically for DocumentDB repositories
+ * that use $runCommandRaw and bypass Prisma Client Extensions.
+ *
+ * Provides document-level encryption/decryption, handling nested fields
+ * according to the encryption schema registry.
+ *
+ * @class DocumentDBEncryptionService
+ * @example
+ * const service = new DocumentDBEncryptionService();
+ *
+ * // Encrypt before write
+ * const encrypted = await service.encryptFields('Credential', document);
+ * await insertOne(prisma, 'Credential', encrypted);
+ *
+ * // Decrypt after read
+ * const doc = await findOne(prisma, 'Credential', filter);
+ * const decrypted = await service.decryptFields('Credential', doc);
+ */
+class DocumentDBEncryptionService {
+    /**
+     * @param {Object} options - Configuration options
+     * @param {Cryptor} [options.cryptor] - Optional Cryptor instance for dependency injection (useful for testing)
+     */
+    constructor({ cryptor = null } = {}) {
+        if (cryptor) {
+            // Dependency injection - use provided Cryptor (for testing)
+            this.cryptor = cryptor;
+            this.enabled = true;
+        } else {
+            // Default behavior - create Cryptor from environment
+            this._initializeCryptor();
+        }
+    }
+
+    /**
+     * Initialize Cryptor with environment-based configuration.
+     * Matches the logic from @friggframework/core/database/prisma.js
+     *
+     * Encryption is bypassed in dev/test/local stages.
+     * Production uses AWS KMS (if available) or AES encryption.
+     *
+     * @private
+     */
+    _initializeCryptor() {
+        // Match logic from packages/core/database/prisma.js
+        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
+        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
+
+        if (bypassEncryption) {
+            this.cryptor = null;
+            this.enabled = false;
+            return;
+        }
+
+        // Determine encryption method (ensure boolean values)
+        const hasKMS = !!(process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '');
+        const hasAES = !!(process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '');
+
+        if (!hasKMS && !hasAES) {
+            console.warn('[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.');
+            this.cryptor = null;
+            this.enabled = false;
+            return;
+        }
+
+        // KMS takes precedence over AES
+        const shouldUseAws = hasKMS;
+        this.cryptor = new Cryptor({ shouldUseAws });
+        this.enabled = true;
+    }
+
+    /**
+     * Encrypt sensitive fields in a document before storing to DocumentDB.
+     *
+     * Reads field paths from encryption-schema-registry.js and encrypts
+     * only the fields defined for the given model.
+     *
+     * @param {string} modelName - Model name from schema registry (e.g., 'User', 'Credential')
+     * @param {Object} document - Document to encrypt
+     * @returns {Promise<Object>} - New document with encrypted fields (original unchanged)
+     *
+     * @example
+     * const plainDoc = {
+     *   userId: '123',
+     *   data: { access_token: 'plain_secret' }
+     * };
+     * const encrypted = await service.encryptFields('Credential', plainDoc);
+     * // encrypted.data.access_token = "keyId:iv:cipher:encKey"
+     */
+    async encryptFields(modelName, document) {
+        // Bypass if encryption disabled
+        if (!this.enabled || !this.cryptor) {
+            return document;
+        }
+
+        // Validate input
+        if (!document || typeof document !== 'object') {
+            return document;
+        }
+
+        // Get encrypted fields from registry
+        const encryptedFieldsConfig = getEncryptedFields(modelName);
+        if (!encryptedFieldsConfig || !encryptedFieldsConfig.fields || encryptedFieldsConfig.fields.length === 0) {
+            return document;
+        }
+
+        // Deep clone to prevent mutation (preserves Date, RegExp, Buffer)
+        const result = structuredClone(document);
+
+        // Encrypt each field path
+        for (const fieldPath of encryptedFieldsConfig.fields) {
+            await this._encryptFieldPath(result, fieldPath, modelName);
+        }
+
+        return result;
+    }
+
+    /**
+     * Decrypt sensitive fields in a document after reading from DocumentDB.
+     *
+     * Reads field paths from encryption-schema-registry.js and decrypts
+     * only the fields defined for the given model.
+     *
+     * @param {string} modelName - Model name from schema registry
+     * @param {Object} document - Document to decrypt
+     * @returns {Promise<Object>} - New document with decrypted fields (original unchanged)
+     *
+     * @example
+     * const encryptedDoc = {
+     *   userId: '123',
+     *   data: { access_token: 'keyId:iv:cipher:encKey' }
+     * };
+     * const decrypted = await service.decryptFields('Credential', encryptedDoc);
+     * // decrypted.data.access_token = "plain_secret"
+     */
+    async decryptFields(modelName, document) {
+        // Bypass if encryption disabled
+        if (!this.enabled || !this.cryptor) {
+            return document;
+        }
+
+        // Validate input
+        if (!document || typeof document !== 'object') {
+            return document;
+        }
+
+        // Get encrypted fields from registry
+        const encryptedFieldsConfig = getEncryptedFields(modelName);
+        if (!encryptedFieldsConfig || !encryptedFieldsConfig.fields || encryptedFieldsConfig.fields.length === 0) {
+            return document;
+        }
+
+        // Deep clone to prevent mutation (preserves Date, RegExp, Buffer)
+        const result = structuredClone(document);
+
+        // Decrypt each field path
+        for (const fieldPath of encryptedFieldsConfig.fields) {
+            await this._decryptFieldPath(result, fieldPath, modelName);
+        }
+
+        return result;
+    }
+
+    /**
+     * Encrypt a specific field path in a document (handles nested fields).
+     *
+     * @private
+     * @param {Object} document - Document to modify (mutated in place)
+     * @param {string} fieldPath - Field path from schema registry (e.g., 'data.access_token')
+     * @param {string} modelName - For error logging context
+     */
+    async _encryptFieldPath(document, fieldPath, modelName) {
+        // Parse field path
+        const parts = fieldPath.split('.');
+
+        // Navigate to parent object
+        let current = document;
+        for (let i = 0; i < parts.length - 1; i++) {
+            if (!current[parts[i]]) {
+                // Path doesn't exist, nothing to encrypt
+                return;
+            }
+            current = current[parts[i]];
+        }
+
+        // Get field name and value
+        const fieldName = parts[parts.length - 1];
+        const value = current[fieldName];
+
+        // Skip if already encrypted or empty
+        if (!value || this._isEncryptedValue(value)) {
+            return;
+        }
+
+        try {
+            // Convert to string if needed
+            const stringValue = typeof value === 'string'
+                ? value
+                : JSON.stringify(value);
+
+            // Encrypt using Cryptor
+            current[fieldName] = await this.cryptor.encrypt(stringValue);
+        } catch (error) {
+            console.error(`[DocumentDBEncryptionService] Failed to encrypt ${modelName}.${fieldPath}:`, error.message);
+            throw error;
+        }
+    }
+
+    /**
+     * Decrypt a specific field path in a document (handles nested fields).
+     *
+     * @private
+     * @param {Object} document - Document to modify (mutated in place)
+     * @param {string} fieldPath - Field path from schema registry
+     * @param {string} modelName - For error logging context
+     */
+    async _decryptFieldPath(document, fieldPath, modelName) {
+        // Parse field path
+        const parts = fieldPath.split('.');
+
+        // Navigate to parent object
+        let current = document;
+        for (let i = 0; i < parts.length - 1; i++) {
+            if (!current[parts[i]]) {
+                // Path doesn't exist, nothing to decrypt
+                return;
+            }
+            current = current[parts[i]];
+        }
+
+        // Get field name and encrypted value
+        const fieldName = parts[parts.length - 1];
+        const encryptedValue = current[fieldName];
+
+        // Skip if not encrypted format
+        if (!encryptedValue || !this._isEncryptedValue(encryptedValue)) {
+            return;
+        }
+
+        try {
+            // Decrypt using Cryptor
+            const decryptedString = await this.cryptor.decrypt(encryptedValue);
+
+            // Try to parse as JSON (for objects/arrays)
+            try {
+                current[fieldName] = JSON.parse(decryptedString);
+            } catch {
+                // Not JSON, return as string
+                current[fieldName] = decryptedString;
+            }
+        } catch (error) {
+            const errorContext = {
+                modelName,
+                fieldPath,
+                encryptedValuePrefix: encryptedValue.substring(0, 20),
+                errorMessage: error.message
+            };
+
+            console.error(
+                `[DocumentDBEncryptionService] Failed to decrypt ${modelName}.${fieldPath}:`,
+                JSON.stringify(errorContext)
+            );
+
+            // Throw error to fail fast - don't silently corrupt data
+            throw new Error(`Decryption failed for ${modelName}.${fieldPath}: ${error.message}`);
+        }
+    }
+
+    /**
+     * Check if a value is in encrypted format.
+     *
+     * Encrypted format: "keyId:iv:cipher:encKey" (envelope encryption)
+     * All parts are base64-encoded strings.
+     *
+     * @private
+     * @param {any} value - Value to check
+     * @returns {boolean} - True if value is encrypted
+     *
+     * @example
+     * _isEncryptedValue("plain_text")  // false
+     * _isEncryptedValue("YWVzLWtleS0x:TXlJVkhlcmU=:QWN0dWFsQ2lwaGVy:RW5jcnlwdGVk")  // true
+     * _isEncryptedValue(null)  // false
+     * _isEncryptedValue({})  // false
+     */
+    _isEncryptedValue(value) {
+        // Must be string
+        if (typeof value !== 'string') {
+            return false;
+        }
+
+        // Must have exactly 4 colon-separated parts
+        const parts = value.split(':');
+        if (parts.length !== 4) {
+            return false;
+        }
+
+        // Enhanced validation: check for base64 pattern
+        // This prevents false positives on URLs, connection strings, etc.
+        const base64Pattern = /^[A-Za-z0-9+/=]+$/;
+
+        // All parts should be base64-encoded
+        if (!parts.every(part => base64Pattern.test(part))) {
+            return false;
+        }
+
+        // Encrypted values should be sufficiently long to be valid
+        // Real encrypted values from Cryptor are always >50 chars due to envelope encryption format:
+        // - keyId (base64): ~12 chars minimum
+        // - iv (base64): ~24 chars for 16-byte IV
+        // - ciphertext (base64): varies, minimum ~16 chars for small values
+        // - encryptedKey (base64): ~44 chars for 32-byte data key
+        // Total minimum: ~96 chars, so 50 is a safe lower bound
+        // This prevents false positives on non-encrypted strings that happen to have 4 colons
+        if (value.length < 50) {
+            return false;
+        }
+
+        return true;
+    }
+}
+
+module.exports = { DocumentDBEncryptionService };

package/database/encryption/README.md

@@ -267,6 +267,14 @@ const CORE_ENCRYPTION_SCHEMA = {
 -   Integration-specific sensitive data (use custom schema instead)
 -   Temporary/experimental encryption (use custom schema instead)
 
+#### After Adding Encrypted Fields
+
+After adding fields to `encryption-schema-registry.js`:
+
+1. **For MongoDB/PostgreSQL**: No code changes needed (automatic via Prisma Extension)
+2. **For DocumentDB**: Encryption is automatic via DocumentDBEncryptionService
+   (service reads from same registry)
+
 ## How It Works
 
 ### Write Operation (Create/Update)
@@ -403,6 +411,48 @@ return entities.map((e) => ({
 
 See `modules/repositories/module-repository-postgres.js` and `module-repository-mongo.js` for complete implementation examples using `_fetchCredential()` and `_fetchCredentialsBulk()` helper methods.
 
+## DocumentDB Encryption
+
+### Why DocumentDB Needs Manual Encryption
+
+DocumentDB repositories use `$runCommandRaw()` for MongoDB protocol compatibility, which bypasses Prisma Client Extensions. This means the automatic encryption extension does not apply.
+
+### DocumentDBEncryptionService
+
+For DocumentDB repositories, use `DocumentDBEncryptionService` to manually encrypt/decrypt documents before/after database operations.
+
+#### Usage Example
+
+```javascript
+const { DocumentDBEncryptionService } = require('../documentdb-encryption-service');
+const { insertOne, findOne } = require('../documentdb-utils');
+
+class MyRepositoryDocumentDB {
+    constructor() {
+        this.encryptionService = new DocumentDBEncryptionService();
+    }
+
+    async create(data) {
+        // Encrypt before write
+        const encrypted = await this.encryptionService.encryptFields('ModelName', data);
+        const id = await insertOne(this.prisma, 'CollectionName', encrypted);
+
+        // Decrypt after read
+        const doc = await findOne(this.prisma, 'CollectionName', { _id: id });
+        const decrypted = await this.encryptionService.decryptFields('ModelName', doc);
+
+        return decrypted;
+    }
+}
+```
+
+#### Configuration
+
+Uses the same environment variables and Cryptor as the Prisma Extension:
+- `STAGE`: Bypasses encryption for dev/test/local
+- `KMS_KEY_ARN`: AWS KMS encryption (production)
+- `AES_KEY_ID` + `AES_KEY`: AES encryption (fallback)
+
 ## Usage Examples
 
 ### Repository Code (No Changes Needed!)

package/database/repositories/health-check-repository-mongodb.js

@@ -52,9 +52,7 @@ class HealthCheckRepositoryMongoDB extends HealthCheckRepositoryInterface {
             }),
             timeoutPromise
         ]);
-        
-        return Date.now() - pingStart;
-    }
+
         return Date.now() - pingStart;
     }
 

package/integrations/repositories/integration-mapping-repository-documentdb.js

@@ -132,3 +132,4 @@ class IntegrationMappingRepositoryDocumentDB extends IntegrationMappingRepositor
 
 module.exports = { IntegrationMappingRepositoryDocumentDB };
 
+

package/integrations/repositories/integration-repository-documentdb.js

@@ -186,3 +186,4 @@ class IntegrationRepositoryDocumentDB extends IntegrationRepositoryInterface {
 
 module.exports = { IntegrationRepositoryDocumentDB };
 
+

package/integrations/repositories/process-repository-documentdb.js

@@ -138,3 +138,4 @@ class ProcessRepositoryDocumentDB extends ProcessRepositoryInterface {
 
 module.exports = { ProcessRepositoryDocumentDB };
 
+

package/modules/repositories/module-repository-documentdb.js

@@ -9,111 +9,25 @@ const {
     deleteOne,
 } = require('../../database/documentdb-utils');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
-const { Cryptor } = require('../../encrypt/Cryptor');
-const { getEncryptedFields } = require('../../database/encryption/encryption-schema-registry');
-
+const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
+
+/**
+ * Module/Entity repository for DocumentDB.
+ * Uses DocumentDBEncryptionService for credential decryption.
+ *
+ * Encrypted fields: Credential.data.*
+ *
+ * Note: This repository only reads credentials. CredentialRepository
+ * handles credential creation/updates with encryption.
+ *
+ * @see DocumentDBEncryptionService
+ * @see CredentialRepositoryDocumentDB
+ */
 class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     constructor() {
         super();
         this.prisma = prisma;
-        this._initializeCryptor();
-    }
-
-    _initializeCryptor() {
-        // Match logic from @friggframework/core/database/prisma.js
-        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
-        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
-
-        if (bypassEncryption) {
-            this.cryptor = null;
-            return;
-        }
-
-        // Determine encryption method
-        const hasKMS = process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
-        const hasAES = process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
-
-        if (!hasKMS && !hasAES) {
-            console.warn('No encryption keys configured. Encryption disabled.');
-            this.cryptor = null;
-            return;
-        }
-
-        const shouldUseAws = hasKMS;
-        this.cryptor = new Cryptor({ shouldUseAws });
-    }
-
-    _isEncryptedValue(value) {
-        // Envelope encryption format: "keyId:encryptedPart1:encryptedPart2:encryptedKey"
-        // Must be string with at least 4 colon-separated parts
-        if (typeof value !== 'string') {
-            return false;
-        }
-
-        const parts = value.split(':');
-        return parts.length >= 4;
-    }
-
-    async _decryptField(encryptedValue, context = '') {
-        // If encryption is disabled, return as-is
-        if (!this.cryptor) {
-            return encryptedValue;
-        }
-
-        // If not encrypted format, return as-is
-        if (!this._isEncryptedValue(encryptedValue)) {
-            return encryptedValue;
-        }
-
-        try {
-            // Decrypt using Cryptor
-            const decryptedString = await this.cryptor.decrypt(encryptedValue);
-
-            // Try to parse as JSON (for objects/arrays)
-            try {
-                return JSON.parse(decryptedString);
-            } catch {
-                // Not JSON, return as string
-                return decryptedString;
-            }
-        } catch (error) {
-            console.error(`Failed to decrypt field${context ? ` (${context})` : ''}:`, error.message);
-            // Return null on decryption failure to avoid exposing encrypted data
-            return null;
-        }
-    }
-
-    async _decryptCredentialData(rawData) {
-        if (!rawData || typeof rawData !== 'object') {
-            return rawData;
-        }
-
-        // Get encrypted fields from registry
-        const encryptedFieldsConfig = getEncryptedFields('Credential');
-        if (!encryptedFieldsConfig || !encryptedFieldsConfig.fields) {
-            return rawData;
-        }
-
-        const decrypted = {};
-
-        for (const [key, value] of Object.entries(rawData)) {
-            // Check if this field is in the encrypted fields list
-            const isEncrypted = encryptedFieldsConfig.fields.some(field => {
-                // Support both top-level and nested fields (e.g., 'data.access_token')
-                const fieldPath = field.split('.');
-                return fieldPath[fieldPath.length - 1] === key;
-            });
-
-            if (isEncrypted) {
-                // Decrypt encrypted fields
-                decrypted[key] = await this._decryptField(value, `Credential.data.${key}`);
-            } else {
-                // Pass through non-encrypted fields
-                decrypted[key] = value;
-            }
-        }
-
-        return decrypted;
+        this.encryptionService = new DocumentDBEncryptionService();
     }
 
     async findEntityById(entityId) {
@@ -254,25 +168,28 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
 
             if (!rawCredential) return null;
 
-            // Manually decrypt data field
-            const decryptedData = await this._decryptCredentialData(
-                rawCredential.data || {}
-            );
+            // Decrypt sensitive fields using service
+            const decryptedCredential = await this.encryptionService.decryptFields('Credential', rawCredential);
 
             // Return in same format
             const credential = {
-                id: fromObjectId(rawCredential._id),
-                userId: fromObjectId(rawCredential.userId),
-                externalId: rawCredential.externalId ?? null,
-                authIsValid: rawCredential.authIsValid ?? null,
-                createdAt: rawCredential.createdAt,
-                updatedAt: rawCredential.updatedAt,
-                data: decryptedData
+                id: fromObjectId(decryptedCredential._id),
+                userId: fromObjectId(decryptedCredential.userId),
+                externalId: decryptedCredential.externalId ?? null,
+                authIsValid: decryptedCredential.authIsValid ?? null,
+                createdAt: decryptedCredential.createdAt,
+                updatedAt: decryptedCredential.updatedAt,
+                data: decryptedCredential.data
             };
 
             return this._convertCredentialIds(credential);
         } catch (error) {
             console.error(`Failed to fetch/decrypt credential ${id}:`, error.message);
+            // Return null instead of throwing to allow graceful degradation
+            // This repository is read-only (doesn't create/update credentials)
+            // Entities can still be loaded even if their credential is corrupted/unreadable
+            // The entity will have null credential, which calling code must handle
+            // This is intentional behavior: prefer partial data over complete failure
             return null;
         }
     }
@@ -296,20 +213,18 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             // Decrypt all credentials in parallel
             const decryptionPromises = rawCredentials.map(async (rawCredential) => {
                 try {
-                    // Manually decrypt the data field
-                    const decryptedData = await this._decryptCredentialData(
-                        rawCredential.data || {}
-                    );
+                    // Decrypt sensitive fields using service
+                    const decryptedCredential = await this.encryptionService.decryptFields('Credential', rawCredential);
 
                     // Build credential object in same format as Prisma would return
                     const credential = {
-                        id: fromObjectId(rawCredential._id),
-                        userId: fromObjectId(rawCredential.userId),
-                        externalId: rawCredential.externalId ?? null,
-                        authIsValid: rawCredential.authIsValid ?? null,
-                        createdAt: rawCredential.createdAt,
-                        updatedAt: rawCredential.updatedAt,
-                        data: decryptedData
+                        id: fromObjectId(decryptedCredential._id),
+                        userId: fromObjectId(decryptedCredential.userId),
+                        externalId: decryptedCredential.externalId ?? null,
+                        authIsValid: decryptedCredential.authIsValid ?? null,
+                        createdAt: decryptedCredential.createdAt,
+                        updatedAt: decryptedCredential.updatedAt,
+                        data: decryptedCredential.data
                     };
 
                     return this._convertCredentialIds(credential);

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.499.897122d.0",
+    "version": "2.0.0--canary.499.5d51f03.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -38,9 +38,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.499.897122d.0",
-        "@friggframework/prettier-config": "2.0.0--canary.499.897122d.0",
-        "@friggframework/test": "2.0.0--canary.499.897122d.0",
+        "@friggframework/eslint-config": "2.0.0--canary.499.5d51f03.0",
+        "@friggframework/prettier-config": "2.0.0--canary.499.5d51f03.0",
+        "@friggframework/test": "2.0.0--canary.499.5d51f03.0",
         "@prisma/client": "^6.17.0",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -80,5 +80,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "897122d48b86791284a25d3f3bcc3b087d8bb077"
+    "gitHead": "5d51f03b5b8de0c3d48bf6055f492ad5c761e5fa"
 }

package/syncs/repositories/sync-repository-documentdb.js

@@ -237,3 +237,4 @@ class SyncRepositoryDocumentDB extends SyncRepositoryInterface {
 
 module.exports = { SyncRepositoryDocumentDB };
 
+

package/token/repositories/token-repository-documentdb.js

@@ -122,3 +122,4 @@ class TokenRepositoryDocumentDB extends TokenRepositoryInterface {
 
 module.exports = { TokenRepositoryDocumentDB };
 
+

package/user/repositories/user-repository-documentdb.js

@@ -10,141 +10,23 @@ const {
 } = require('../../database/documentdb-utils');
 const { createTokenRepository } = require('../../token/repositories/token-repository-factory');
 const { UserRepositoryInterface } = require('./user-repository-interface');
-const { Cryptor } = require('../../encrypt/Cryptor');
-const { getEncryptedFields } = require('../../database/encryption/encryption-schema-registry');
-
+const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
+
+/**
+ * User repository for DocumentDB.
+ * Uses DocumentDBEncryptionService for field-level encryption.
+ *
+ * Encrypted fields: User.hashword
+ *
+ * @see DocumentDBEncryptionService
+ * @see encryption-schema-registry.js
+ */
 class UserRepositoryDocumentDB extends UserRepositoryInterface {
     constructor() {
         super();
         this.prisma = prisma;
         this.tokenRepository = createTokenRepository();
-        this._initializeCryptor();
-    }
-
-    _initializeCryptor() {
-        // Match logic from @friggframework/core/database/prisma.js
-        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
-        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
-
-        if (bypassEncryption) {
-            this.cryptor = null;
-            return;
-        }
-
-        // Determine encryption method
-        const hasKMS = process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
-        const hasAES = process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
-
-        if (!hasKMS && !hasAES) {
-            console.warn('No encryption keys configured. Encryption disabled.');
-            this.cryptor = null;
-            return;
-        }
-
-        const shouldUseAws = hasKMS;
-        this.cryptor = new Cryptor({ shouldUseAws });
-    }
-
-    _isEncryptedValue(value) {
-        // Envelope encryption format: "keyId:encryptedPart1:encryptedPart2:encryptedKey"
-        // Must be string with at least 4 colon-separated parts
-        if (typeof value !== 'string') {
-            return false;
-        }
-
-        const parts = value.split(':');
-        return parts.length >= 4;
-    }
-
-    async _decryptField(encryptedValue, context = '') {
-        // If encryption is disabled, return as-is
-        if (!this.cryptor) {
-            return encryptedValue;
-        }
-
-        // If not encrypted format, return as-is
-        if (!this._isEncryptedValue(encryptedValue)) {
-            return encryptedValue;
-        }
-
-        try {
-            // Decrypt using Cryptor
-            const decryptedString = await this.cryptor.decrypt(encryptedValue);
-
-            // Try to parse as JSON (for objects/arrays)
-            try {
-                return JSON.parse(decryptedString);
-            } catch {
-                // Not JSON, return as string
-                return decryptedString;
-            }
-        } catch (error) {
-            console.error(`Failed to decrypt field${context ? ` (${context})` : ''}:`, error.message);
-            // Return null on decryption failure to avoid exposing encrypted data
-            return null;
-        }
-    }
-
-    async _encryptField(plainValue, context = '') {
-        // If encryption is disabled, return as-is
-        if (!this.cryptor) {
-            return plainValue;
-        }
-
-        // Don't encrypt null/undefined
-        if (plainValue === null || plainValue === undefined) {
-            return plainValue;
-        }
-
-        try {
-            // Convert objects/arrays to JSON string
-            const stringValue = typeof plainValue === 'string'
-                ? plainValue
-                : JSON.stringify(plainValue);
-
-            // Encrypt using Cryptor
-            return await this.cryptor.encrypt(stringValue);
-        } catch (error) {
-            console.error(`Failed to encrypt field${context ? ` (${context})` : ''}:`, error.message);
-            throw error;
-        }
-    }
-
-    async _decryptHashword(rawUser) {
-        if (!rawUser || !rawUser.hashword) {
-            return rawUser;
-        }
-
-        // Get encrypted fields from registry
-        const encryptedFieldsConfig = getEncryptedFields('User');
-        const shouldDecrypt = encryptedFieldsConfig?.fields?.includes('hashword');
-
-        if (!shouldDecrypt) {
-            return rawUser;
-        }
-
-        const decryptedHashword = await this._decryptField(rawUser.hashword, 'User.hashword');
-
-        return {
-            ...rawUser,
-            hashword: decryptedHashword
-        };
-    }
-
-    async _encryptHashword(hashword) {
-        if (!hashword) {
-            return hashword;
-        }
-
-        // Get encrypted fields from registry
-        const encryptedFieldsConfig = getEncryptedFields('User');
-        const shouldEncrypt = encryptedFieldsConfig?.fields?.includes('hashword');
-
-        if (!shouldEncrypt) {
-            return hashword;
-        }
-
-        return await this._encryptField(hashword, 'User.hashword');
+        this.encryptionService = new DocumentDBEncryptionService();
     }
 
     async getSessionToken(token) {
@@ -158,7 +40,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             _id: toObjectId(userId),
             type: 'ORGANIZATION',
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -167,7 +49,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             _id: toObjectId(userId),
             type: 'INDIVIDUAL',
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -212,13 +94,12 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             }
 
             // Bcrypt hash the password
-            const hashedPassword = await bcrypt.hash(params.hashword, 10);
-
-            // Encrypt the bcrypt hash if encryption is enabled
-            document.hashword = await this._encryptHashword(hashedPassword);
+            document.hashword = await bcrypt.hash(params.hashword, 10);
         }
 
-        const insertedId = await insertOne(this.prisma, 'User', document);
+        // Encrypt sensitive fields before insert
+        const encryptedDocument = await this.encryptionService.encryptFields('User', document);
+        const insertedId = await insertOne(this.prisma, 'User', encryptedDocument);
         const created = await findOne(this.prisma, 'User', { _id: insertedId });
 
         // Defensive check: verify document was found after insert
@@ -237,8 +118,8 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             );
         }
 
-        // Decrypt hashword if present
-        const decrypted = await this._decryptHashword(created);
+        // Decrypt sensitive fields after read
+        const decrypted = await this.encryptionService.decryptFields('User', created);
 
         return this._mapUser(decrypted);
     }
@@ -263,7 +144,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             type: 'INDIVIDUAL',
             username,
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -272,7 +153,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             type: 'INDIVIDUAL',
             appUserId,
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -281,13 +162,13 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             type: 'ORGANIZATION',
             appOrgId,
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
     async findUserById(userId) {
         const doc = await findOne(this.prisma, 'User', { _id: toObjectId(userId) });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -296,7 +177,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
             type: 'INDIVIDUAL',
             email,
         });
-        const decrypted = await this._decryptHashword(doc);
+        const decrypted = await this.encryptionService.decryptFields('User', doc);
         return this._mapUser(decrypted);
     }
 
@@ -307,20 +188,18 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         const payload = await this._prepareUpdatePayload(updates);
         payload.updatedAt = new Date();
 
-        // Encrypt hashword if present in payload
-        if (payload.hashword) {
-            payload.hashword = await this._encryptHashword(payload.hashword);
-        }
+        // Encrypt sensitive fields before update
+        const encryptedPayload = await this.encryptionService.encryptFields('User', payload);
 
         await updateOne(
             this.prisma,
             'User',
             { _id: objectId, type: 'INDIVIDUAL' },
-            { $set: payload }
+            { $set: encryptedPayload }
         );
 
         const updated = await findOne(this.prisma, 'User', { _id: objectId });
-        const decrypted = await this._decryptHashword(updated);
+        const decrypted = await this.encryptionService.decryptFields('User', updated);
         return this._mapUser(decrypted);
     }
 
@@ -338,7 +217,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         );
 
         const updated = await findOne(this.prisma, 'User', { _id: objectId });
-        const decrypted = await this._decryptHashword(updated);
+        const decrypted = await this.encryptionService.decryptFields('User', updated);
         return this._mapUser(decrypted);
     }
 

package/websocket/repositories/websocket-connection-repository-documentdb.js

@@ -116,3 +116,4 @@ class WebsocketConnectionRepositoryDocumentDB extends WebsocketConnectionReposit
 
 module.exports = { WebsocketConnectionRepositoryDocumentDB };
 
+