@friggframework/core 2.0.0--canary.522.cbd3d5a.0 → 2.0.0--canary.517.35ee143.0

package/database/config.js

@@ -5,7 +5,7 @@
 
 /**
  * Determines database type from environment or app definition
- *
+ * 
  * Detection order:
  * 1. DB_TYPE environment variable (set for migration handlers)
  * 2. App definition (backend/index.js Definition.database configuration)
@@ -32,7 +32,7 @@ function getDatabaseType() {
         if (!backendPackagePath) {
             throw new Error(
                 '[Frigg] Cannot find backend package.json. ' +
-                    'Ensure backend/package.json exists in your project.'
+                'Ensure backend/package.json exists in your project.'
             );
         }
 
@@ -42,7 +42,7 @@ function getDatabaseType() {
         if (!fs.existsSync(backendIndexPath)) {
             throw new Error(
                 `[Frigg] Backend index.js not found at ${backendIndexPath}. ` +
-                    'Ensure backend/index.js exists with a Definition export.'
+                'Ensure backend/index.js exists with a Definition export.'
             );
         }
 
@@ -57,9 +57,7 @@ function getDatabaseType() {
 
             for (const line of stackLines) {
                 // Match file paths in stack trace, excluding node:internal
-                const match =
-                    line.match(/\(([^)]+\.js):\d+:\d+\)/) ||
-                    line.match(/at ([^(]+\.js):\d+:\d+/);
+                const match = line.match(/\(([^)]+\.js):\d+:\d+\)/) || line.match(/at ([^(]+\.js):\d+:\d+/);
                 if (match && match[1] && !match[1].includes('node:internal')) {
                     errorFile = match[1];
                     break;
@@ -69,11 +67,11 @@ function getDatabaseType() {
             // Provide better error context for syntax/runtime errors
             throw new Error(
                 `[Frigg] Failed to load app definition from ${backendIndexPath}\n` +
-                    `Error: ${requireError.message}\n` +
-                    `File with error: ${errorFile}\n` +
-                    `\nFull stack trace:\n${requireError.stack}\n\n` +
-                    'This error occurred while loading your app definition or its dependencies. ' +
-                    'Check the file listed above for syntax errors (trailing commas, missing brackets, etc.)'
+                `Error: ${requireError.message}\n` +
+                `File with error: ${errorFile}\n` +
+                `\nFull stack trace:\n${requireError.stack}\n\n` +
+                'This error occurred while loading your app definition or its dependencies. ' +
+                'Check the file listed above for syntax errors (trailing commas, missing brackets, etc.)'
             );
         }
 
@@ -82,7 +80,7 @@ function getDatabaseType() {
         if (!database) {
             throw new Error(
                 '[Frigg] App definition missing database configuration. ' +
-                    `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${backendIndexPath}`
+                `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${backendIndexPath}`
             );
         }
 
@@ -100,7 +98,7 @@ function getDatabaseType() {
 
         throw new Error(
             '[Frigg] No database enabled in app definition. ' +
-                'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
+            'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
         );
     } catch (error) {
         // Re-throw with context if it's our error
@@ -152,5 +150,5 @@ Object.defineProperty(module.exports, 'DB_TYPE', {
         return cachedDbType;
     },
     enumerable: true,
-    configurable: true,
-});
+    configurable: true
+});

package/database/documentdb-encryption-service.js

@@ -1,8 +1,5 @@
 const { Cryptor } = require('../encrypt/Cryptor');
-const {
-    getEncryptedFields,
-    loadCustomEncryptionSchema,
-} = require('./encryption/encryption-schema-registry');
+const { getEncryptedFields, loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
 
 /**
  * Encryption service specifically for DocumentDB repositories
@@ -54,11 +51,8 @@ class DocumentDBEncryptionService {
         loadCustomEncryptionSchema();
 
         // Match logic from packages/core/database/prisma.js
-        const stage =
-            process.env.STAGE || process.env.NODE_ENV || 'development';
-        const bypassEncryption = ['dev', 'test', 'local'].includes(
-            stage.toLowerCase()
-        );
+        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
+        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
 
         if (bypassEncryption) {
             this.cryptor = null;
@@ -67,17 +61,11 @@ class DocumentDBEncryptionService {
         }
 
         // Determine encryption method (ensure boolean values)
-        const hasKMS = !!(
-            process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== ''
-        );
-        const hasAES = !!(
-            process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== ''
-        );
+        const hasKMS = !!(process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '');
+        const hasAES = !!(process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '');
 
         if (!hasKMS && !hasAES) {
-            console.warn(
-                '[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.'
-            );
+            console.warn('[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.');
             this.cryptor = null;
             this.enabled = false;
             return;
@@ -214,16 +202,14 @@ class DocumentDBEncryptionService {
 
         try {
             // Convert to string if needed
-            const stringValue =
-                typeof value === 'string' ? value : JSON.stringify(value);
+            const stringValue = typeof value === 'string'
+                ? value
+                : JSON.stringify(value);
 
             // Encrypt using Cryptor
             current[fieldName] = await this.cryptor.encrypt(stringValue);
         } catch (error) {
-            console.error(
-                `[DocumentDBEncryptionService] Failed to encrypt ${modelName}.${fieldPath}:`,
-                error.message
-            );
+            console.error(`[DocumentDBEncryptionService] Failed to encrypt ${modelName}.${fieldPath}:`, error.message);
             throw error;
         }
     }
@@ -275,7 +261,7 @@ class DocumentDBEncryptionService {
                 modelName,
                 fieldPath,
                 encryptedValuePrefix: encryptedValue.substring(0, 20),
-                errorMessage: error.message,
+                errorMessage: error.message
             };
 
             console.error(
@@ -284,9 +270,7 @@ class DocumentDBEncryptionService {
             );
 
             // Throw error to fail fast - don't silently corrupt data
-            throw new Error(
-                `Decryption failed for ${modelName}.${fieldPath}: ${error.message}`
-            );
+            throw new Error(`Decryption failed for ${modelName}.${fieldPath}: ${error.message}`);
         }
     }
 
@@ -323,7 +307,7 @@ class DocumentDBEncryptionService {
         const base64Pattern = /^[A-Za-z0-9+/=]+$/;
 
         // All parts should be base64-encoded
-        if (!parts.every((part) => base64Pattern.test(part))) {
+        if (!parts.every(part => base64Pattern.test(part))) {
             return false;
         }
 

package/database/documentdb-utils.js

@@ -3,10 +3,8 @@ const { ObjectId } = require('mongodb');
 function toObjectId(value) {
     if (value === null || value === undefined || value === '') return undefined;
     if (value instanceof ObjectId) return value;
-    if (typeof value === 'object' && value.$oid)
-        return new ObjectId(value.$oid);
-    if (typeof value === 'string')
-        return ObjectId.isValid(value) ? new ObjectId(value) : undefined;
+    if (typeof value === 'object' && value.$oid) return new ObjectId(value.$oid);
+    if (typeof value === 'string') return ObjectId.isValid(value) ? new ObjectId(value) : undefined;
     return undefined;
 }
 
@@ -17,8 +15,7 @@ function toObjectIdArray(values) {
 
 function fromObjectId(value) {
     if (value instanceof ObjectId) return value.toHexString();
-    if (typeof value === 'object' && value !== null && value.$oid)
-        return value.$oid;
+    if (typeof value === 'object' && value !== null && value.$oid) return value.$oid;
     if (typeof value === 'string') return value;
     return value === undefined || value === null ? value : String(value);
 }
@@ -33,10 +30,7 @@ async function findMany(client, collection, filter = {}, options = {}) {
 }
 
 async function findOne(client, collection, filter = {}, options = {}) {
-    const docs = await findMany(client, collection, filter, {
-        ...options,
-        limit: 1,
-    });
+    const docs = await findMany(client, collection, filter, { ...options, limit: 1 });
     return docs[0] || null;
 }
 
@@ -53,9 +47,7 @@ async function insertOne(client, collection, document) {
     // Validate insert succeeded
     if (result.ok !== 1) {
         throw new Error(
-            `Insert command failed for collection '${collection}': ${JSON.stringify(
-                result
-            )}`
+            `Insert command failed for collection '${collection}': ${JSON.stringify(result)}`
         );
     }
 
@@ -75,7 +67,7 @@ async function insertOne(client, collection, document) {
     if (result.n !== 1) {
         throw new Error(
             `Expected to insert 1 document into '${collection}', but inserted ${result.n}. ` +
-                `Result: ${JSON.stringify(result)}`
+            `Result: ${JSON.stringify(result)}`
         );
     }
 
@@ -83,13 +75,11 @@ async function insertOne(client, collection, document) {
 }
 
 async function updateOne(client, collection, filter, update, options = {}) {
-    const updates = [
-        {
-            q: filter,
-            u: update,
-            upsert: Boolean(options.upsert),
-        },
-    ];
+    const updates = [{
+        q: filter,
+        u: update,
+        upsert: Boolean(options.upsert),
+    }];
     if (options.arrayFilters) updates[0].arrayFilters = options.arrayFilters;
     const result = await client.$runCommandRaw({
         update: collection,
@@ -143,3 +133,4 @@ module.exports = {
     deleteMany,
     aggregate,
 };
+

package/database/encryption/README.md

@@ -125,11 +125,10 @@ Or simply don't configure any encryption keys. In Production field level encrypt
 Core and custom encrypted fields are defined in `encryption-schema-registry.js`. See that file for the current list of encrypted fields.
 
 **Core fields include**:
-
--   OAuth tokens: `access_token`, `refresh_token`, `id_token`
--   API keys: `api_key`, `apiKey`, `API_KEY_VALUE`
--   Basic auth: `password`
--   OAuth client credentials: `client_secret`
+- OAuth tokens: `access_token`, `refresh_token`, `id_token`
+- API keys: `api_key`, `apiKey`, `API_KEY_VALUE`
+- Basic auth: `password`
+- OAuth client credentials: `client_secret`
 
 **Note**: API modules should use `api_key` (snake_case) in their `apiPropertiesToPersist.credential` arrays for consistency with OAuth2Requester and BasicAuthRequester conventions.
 
@@ -138,36 +137,34 @@ Core and custom encrypted fields are defined in `encryption-schema-registry.js`.
 When creating API module definitions, use **snake_case** for credential property names to ensure automatic encryption:
 
 **✅ Recommended (automatically encrypted):**
-
 ```javascript
 // API Module Definition
 const Definition = {
     requiredAuthMethods: {
         apiPropertiesToPersist: {
             // For API key authentication
-            credential: ['api_key'], // ✅ Automatically encrypted
+            credential: ['api_key'],           // ✅ Automatically encrypted
             // or for OAuth authentication
-            credential: ['access_token', 'refresh_token'], // ✅ OAuth - encrypted
+            credential: ['access_token', 'refresh_token'],  // ✅ OAuth - encrypted
             // or for Basic authentication
-            credential: ['username', 'password'], // ✅ Basic auth - encrypted
-        },
-    },
+            credential: ['username', 'password'],           // ✅ Basic auth - encrypted
+        }
+    }
 };
 
 // API class (extends ApiKeyRequester)
 class MyApi extends ApiKeyRequester {
     constructor(params) {
         super(params);
-        this.api_key = params.api_key; // ✅ snake_case convention
+        this.api_key = params.api_key;  // ✅ snake_case convention
     }
 }
 ```
 
 **❌ Avoid (requires manual encryption schema):**
-
 ```javascript
 apiPropertiesToPersist: {
-    credential: ['customToken', 'proprietaryKey']; // ❌ Not in core schema
+    credential: ['customToken', 'proprietaryKey']  // ❌ Not in core schema
 }
 ```
 
@@ -187,61 +184,57 @@ const Definition = {
 
     // Declare which credential fields need encryption
     encryption: {
-        credentialFields: ['api_key', 'webhook_secret'],
+        credentialFields: ['api_key', 'webhook_secret']
     },
 
     requiredAuthMethods: {
         apiPropertiesToPersist: {
-            credential: ['api_key', 'webhook_secret'], // These will be auto-encrypted
-            entity: [],
+            credential: ['api_key', 'webhook_secret'],  // These will be auto-encrypted
+            entity: []
         },
         // ... other methods
-    },
+    }
 };
 ```
 
 **How it works**:
-
 1. Module declares `encryption.credentialFields` array
 2. Framework automatically adds `data.` prefix: `['api_key']` → `['data.api_key']`
 3. Fields are merged with core encryption schema on app startup
 4. All modules across all integrations are scanned and combined
 
 **Benefits**:
-
--   ✅ Module authors control their own security requirements
--   ✅ No need to modify core framework or app configuration
--   ✅ Automatic encryption for API key-based integrations
--   ✅ Works seamlessly with `apiPropertiesToPersist`
+- ✅ Module authors control their own security requirements
+- ✅ No need to modify core framework or app configuration
+- ✅ Automatic encryption for API key-based integrations
+- ✅ Works seamlessly with `apiPropertiesToPersist`
 
 **Example - API Key Module**:
-
 ```javascript
 // API Module Definition
 const Definition = {
     moduleName: 'axiscare',
     API: AxisCareApi,
     encryption: {
-        credentialFields: ['api_key'], // Auto-encrypted as 'data.api_key'
+        credentialFields: ['api_key']  // Auto-encrypted as 'data.api_key'
     },
     requiredAuthMethods: {
         apiPropertiesToPersist: {
-            credential: ['api_key'], // Will be encrypted automatically
-        },
-    },
+            credential: ['api_key']  // Will be encrypted automatically
+        }
+    }
 };
 
 // API Class (extends ApiKeyRequester)
 class AxisCareApi extends ApiKeyRequester {
     constructor(params) {
         super(params);
-        this.api_key = params.api_key; // snake_case convention
+        this.api_key = params.api_key;  // snake_case convention
     }
 }
 ```
 
 **Example - Custom Authentication**:
-
 ```javascript
 const Definition = {
     moduleName: 'customService',
@@ -249,17 +242,16 @@ const Definition = {
         credentialFields: [
             'signing_key',
             'webhook_secret',
-            'data.custom_nested_field', // Can specify data. prefix explicitly
-        ],
-    },
+            'data.custom_nested_field'  // Can specify data. prefix explicitly
+        ]
+    }
 };
 ```
 
 **Limitations**:
-
--   Only supports Credential model fields (stored in `credential.data`)
--   Cannot encrypt entity fields or custom models (use app-level schema for those)
--   Applied globally once - module schemas loaded at app startup
+- Only supports Credential model fields (stored in `credential.data`)
+- Cannot encrypt entity fields or custom models (use app-level schema for those)
+- Applied globally once - module schemas loaded at app startup
 
 #### Option 2: App-Level Custom Schema (Integration Developers)
 
@@ -537,9 +529,7 @@ For DocumentDB repositories, use `DocumentDBEncryptionService` to manually encry
 #### Usage Example
 
 ```javascript
-const {
-    DocumentDBEncryptionService,
-} = require('../documentdb-encryption-service');
+const { DocumentDBEncryptionService } = require('../documentdb-encryption-service');
 const { insertOne, findOne } = require('../documentdb-utils');
 
 class MyRepositoryDocumentDB {
@@ -549,18 +539,12 @@ class MyRepositoryDocumentDB {
 
     async create(data) {
         // Encrypt before write
-        const encrypted = await this.encryptionService.encryptFields(
-            'ModelName',
-            data
-        );
+        const encrypted = await this.encryptionService.encryptFields('ModelName', data);
         const id = await insertOne(this.prisma, 'CollectionName', encrypted);
 
         // Decrypt after read
         const doc = await findOne(this.prisma, 'CollectionName', { _id: id });
-        const decrypted = await this.encryptionService.decryptFields(
-            'ModelName',
-            doc
-        );
+        const decrypted = await this.encryptionService.decryptFields('ModelName', doc);
 
         return decrypted;
     }
@@ -570,10 +554,9 @@ class MyRepositoryDocumentDB {
 #### Configuration
 
 Uses the same environment variables and Cryptor as the Prisma Extension:
-
--   `STAGE`: Bypasses encryption for dev/test/local
--   `KMS_KEY_ARN`: AWS KMS encryption (production)
--   `AES_KEY_ID` + `AES_KEY`: AES encryption (fallback)
+- `STAGE`: Bypasses encryption for dev/test/local
+- `KMS_KEY_ARN`: AWS KMS encryption (production)
+- `AES_KEY_ID` + `AES_KEY`: AES encryption (fallback)
 
 ## Usage Examples
 

package/database/encryption/encryption-schema-registry.js

@@ -72,9 +72,7 @@ function validateCustomSchema(schema) {
 
         for (const fieldPath of config.fields) {
             if (typeof fieldPath !== 'string' || !fieldPath) {
-                errors.push(
-                    `Model "${modelName}" has invalid field path: ${fieldPath}`
-                );
+                errors.push(`Model "${modelName}" has invalid field path: ${fieldPath}`);
             }
 
             // Check if trying to override core fields
@@ -106,17 +104,13 @@ function registerCustomSchema(schema) {
     const validation = validateCustomSchema(schema);
     if (!validation.valid) {
         throw new Error(
-            `Invalid custom encryption schema:\n- ${validation.errors.join(
-                '\n- '
-            )}`
+            `Invalid custom encryption schema:\n- ${validation.errors.join('\n- ')}`
         );
     }
 
     customSchema = { ...schema };
     logger.info(
-        `Registered custom encryption schema for models: ${Object.keys(
-            customSchema
-        ).join(', ')}`
+        `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
     );
 }
 
@@ -139,9 +133,7 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
 
         for (const field of credentialFields) {
-            const prefixedField = field.startsWith('data.')
-                ? field
-                : `data.${field}`;
+            const prefixedField = field.startsWith('data.') ? field : `data.${field}`;
             fields.push(prefixedField);
         }
     }
@@ -168,14 +160,10 @@ function loadModuleEncryptionSchemas(integrations) {
         return;
     }
 
-    const {
-        getModulesDefinitionFromIntegrationClasses,
-    } = require('../integrations/utils/map-integration-dto');
+    const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
 
-    const moduleDefinitions =
-        getModulesDefinitionFromIntegrationClasses(integrations);
-    const credentialFields =
-        extractCredentialFieldsFromModules(moduleDefinitions);
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);
+    const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
 
     if (credentialFields.length === 0) {
         return;
@@ -183,8 +171,8 @@ function loadModuleEncryptionSchemas(integrations) {
 
     const moduleSchema = {
         Credential: {
-            fields: credentialFields,
-        },
+            fields: credentialFields
+        }
     };
 
     logger.info(

package/database/encryption/field-encryption-service.js

@@ -35,9 +35,7 @@ class FieldEncryptionService {
 
             if (this._shouldEncrypt(value)) {
                 const serializedValue = this._serializeForEncryption(value);
-                const encryptedValue = await this.cryptor.encrypt(
-                    serializedValue
-                );
+                const encryptedValue = await this.cryptor.encrypt(serializedValue);
                 return { fieldPath, encryptedValue };
             }
             return null;
@@ -48,11 +46,7 @@ class FieldEncryptionService {
         // Apply encrypted values
         for (const result of results) {
             if (result) {
-                this._setNestedValue(
-                    encrypted,
-                    result.fieldPath,
-                    result.encryptedValue
-                );
+                this._setNestedValue(encrypted, result.fieldPath, result.encryptedValue);
             }
         }
 
@@ -77,8 +71,7 @@ class FieldEncryptionService {
 
             if (this._isEncrypted(value)) {
                 const decryptedValue = await this.cryptor.decrypt(value);
-                const deserializedValue =
-                    this._deserializeAfterDecryption(decryptedValue);
+                const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
             }
             return null;
@@ -89,11 +82,7 @@ class FieldEncryptionService {
         // Apply decrypted values
         for (const result of results) {
             if (result) {
-                this._setNestedValue(
-                    decrypted,
-                    result.fieldPath,
-                    result.decryptedValue
-                );
+                this._setNestedValue(decrypted, result.fieldPath, result.decryptedValue);
             }
         }
 

package/database/encryption/logger.js

@@ -30,9 +30,8 @@ class EncryptionLogger {
         // Remove potential key material or encrypted data from logs
         if (typeof message === 'string') {
             // Truncate long base64 strings that might be keys or encrypted data
-            return message.replace(
-                /([A-Za-z0-9+/=]{50,})/g,
-                (match) => `${match.substring(0, 10)}...[${match.length} chars]`
+            return message.replace(/([A-Za-z0-9+/=]{50,})/g, (match) =>
+                `${match.substring(0, 10)}...[${match.length} chars]`
             );
         }
         return message;

package/database/encryption/prisma-encryption-extension.js

@@ -12,7 +12,9 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
     }
 
     if (!cryptor) {
-        throw new Error('Cryptor instance required for encryption extension');
+        throw new Error(
+            'Cryptor instance required for encryption extension'
+        );
     }
 
     const encryptionService = new FieldEncryptionService({
@@ -46,10 +48,11 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
 
                 async createMany({ model, args, query }) {
                     if (args.data && Array.isArray(args.data)) {
-                        args.data = await encryptionService.encryptFieldsInBulk(
-                            model,
-                            args.data
-                        );
+                        args.data =
+                            await encryptionService.encryptFieldsInBulk(
+                                model,
+                                args.data
+                            );
                     } else if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,

package/database/index.js

@@ -42,8 +42,7 @@ module.exports = {
     },
     get OrganizationUser() {
         if (!_OrganizationUser) {
-            _OrganizationUser =
-                require('./models/OrganizationUser').OrganizationUser;
+            _OrganizationUser = require('./models/OrganizationUser').OrganizationUser;
         }
         return _OrganizationUser;
     },
@@ -55,8 +54,7 @@ module.exports = {
     },
     get WebsocketConnection() {
         if (!_WebsocketConnection) {
-            _WebsocketConnection =
-                require('./models/WebsocketConnection').WebsocketConnection;
+            _WebsocketConnection = require('./models/WebsocketConnection').WebsocketConnection;
         }
         return _WebsocketConnection;
     },