@friggframework/core 2.0.0--canary.545.ccb5010.0 → 2.0.0--canary.549.b074651.0

package/{database/encryption/prisma-encryption-extension.js → src/database/encryption/prisma-encryption-extension.ts}

@@ -3,16 +3,37 @@
  * Intercepts Prisma queries to encrypt on write and decrypt on read.
  */
 
-const { getEncryptedFields } = require('./encryption-schema-registry');
-const { FieldEncryptionService } = require('./field-encryption-service');
+import { getEncryptedFields } from './encryption-schema-registry';
+import { FieldEncryptionService } from './field-encryption-service';
+import { Cryptor } from '../../encrypt';
 
-function createEncryptionExtension({ cryptor, enabled = true }) {
+interface CreateEncryptionExtensionOptions {
+    cryptor: Cryptor;
+    enabled?: boolean;
+}
+
+interface QueryArgs {
+    model: string;
+    args: Record<string, unknown>;
+    query: (args: Record<string, unknown>) => Promise<unknown>;
+}
+
+type PrismaExtension = {
+    name: string;
+    query: {
+        $allModels: Record<string, (params: QueryArgs) => Promise<unknown>>;
+    };
+} | ((client: unknown) => unknown);
+
+export function createEncryptionExtension({ cryptor, enabled = true }: CreateEncryptionExtensionOptions): PrismaExtension {
     if (!enabled) {
-        return (client) => client;
+        return (client: unknown) => client;
     }
 
     if (!cryptor) {
-        throw new Error('Cryptor instance required for encryption extension');
+        throw new Error(
+            'Cryptor instance required for encryption extension'
+        );
     }
 
     const encryptionService = new FieldEncryptionService({
@@ -24,196 +45,156 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
         name: 'frigg-field-encryption',
         query: {
             $allModels: {
-                async create({ model, args, query }) {
+                async create({ model, args, query }: QueryArgs) {
                     if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,
-                            args.data
+                            args.data as Record<string, unknown>
                         );
                     }
-
                     const result = await query(args);
-
                     if (result) {
                         return await encryptionService.decryptFields(
                             model,
-                            result
+                            result as Record<string, unknown>
                         );
                     }
-
                     return result;
                 },
 
-                async createMany({ model, args, query }) {
+                async createMany({ model, args, query }: QueryArgs) {
                     if (args.data && Array.isArray(args.data)) {
                         args.data = await encryptionService.encryptFieldsInBulk(
                             model,
-                            args.data
+                            args.data as Record<string, unknown>[]
                         );
                     } else if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,
-                            args.data
+                            args.data as Record<string, unknown>
                         );
                     }
-
                     return await query(args);
                 },
 
-                async update({ model, args, query }) {
+                async update({ model, args, query }: QueryArgs) {
                     if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,
-                            args.data
+                            args.data as Record<string, unknown>
                         );
                     }
-
                     const result = await query(args);
-
                     if (result) {
                         return await encryptionService.decryptFields(
                             model,
-                            result
+                            result as Record<string, unknown>
                         );
                     }
-
                     return result;
                 },
 
-                async updateMany({ model, args, query }) {
+                async updateMany({ model, args, query }: QueryArgs) {
                     if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,
-                            args.data
+                            args.data as Record<string, unknown>
                         );
                     }
-
                     return await query(args);
                 },
 
-                async upsert({ model, args, query }) {
+                async upsert({ model, args, query }: QueryArgs) {
                     if (args.create) {
                         args.create = await encryptionService.encryptFields(
                             model,
-                            args.create
+                            args.create as Record<string, unknown>
                         );
                     }
-
                     if (args.update) {
                         args.update = await encryptionService.encryptFields(
                             model,
-                            args.update
+                            args.update as Record<string, unknown>
                         );
                     }
-
                     const result = await query(args);
-
                     if (result) {
                         return await encryptionService.decryptFields(
                             model,
-                            result
+                            result as Record<string, unknown>
                         );
                     }
-
                     return result;
                 },
 
-                async findUnique({ model, args, query }) {
+                async findUnique({ model, args, query }: QueryArgs) {
                     const result = await query(args);
-
                     if (result) {
-                        return await encryptionService.decryptFields(
-                            model,
-                            result
-                        );
+                        return await encryptionService.decryptFields(model, result as Record<string, unknown>);
                     }
-
                     return result;
                 },
 
-                async findFirst({ model, args, query }) {
+                async findFirst({ model, args, query }: QueryArgs) {
                     const result = await query(args);
-
                     if (result) {
-                        return await encryptionService.decryptFields(
-                            model,
-                            result
-                        );
+                        return await encryptionService.decryptFields(model, result as Record<string, unknown>);
                     }
-
                     return result;
                 },
 
-                async findMany({ model, args, query }) {
-                    const results = await query(args);
 
+                async findMany({ model, args, query }: QueryArgs) {
+                    const results = await query(args);
                     if (results && Array.isArray(results)) {
                         return await encryptionService.decryptFieldsInBulk(
                             model,
-                            results
+                            results as Record<string, unknown>[]
                         );
                     }
-
                     return results;
                 },
 
-                async delete({ model, args, query }) {
+                async delete({ model, args, query }: QueryArgs) {
                     const result = await query(args);
-
                     if (result) {
-                        return await encryptionService.decryptFields(
-                            model,
-                            result
-                        );
+                        return await encryptionService.decryptFields(model, result as Record<string, unknown>);
                     }
-
                     return result;
                 },
 
-                async deleteMany({ model, args, query }) {
+                async deleteMany({ model: _model, args, query }: QueryArgs) {
                     return await query(args);
                 },
 
-                async count({ model, args, query }) {
+                async count({ model: _model, args, query }: QueryArgs) {
                     return await query(args);
                 },
 
-                async aggregate({ model, args, query }) {
+                async aggregate({ model: _model, args, query }: QueryArgs) {
                     return await query(args);
                 },
 
-                async groupBy({ model, args, query }) {
+                async groupBy({ model: _model, args, query }: QueryArgs) {
                     return await query(args);
                 },
 
-                async findFirstOrThrow({ model, args, query }) {
+                async findFirstOrThrow({ model, args, query }: QueryArgs) {
                     const result = await query(args);
-
                     if (result) {
-                        return await encryptionService.decryptFields(
-                            model,
-                            result
-                        );
+                        return await encryptionService.decryptFields(model, result as Record<string, unknown>);
                     }
-
                     return result;
                 },
 
-                async findUniqueOrThrow({ model, args, query }) {
+                async findUniqueOrThrow({ model, args, query }: QueryArgs) {
                     const result = await query(args);
-
                     if (result) {
-                        return await encryptionService.decryptFields(
-                            model,
-                            result
-                        );
+                        return await encryptionService.decryptFields(model, result as Record<string, unknown>);
                     }
-
                     return result;
                 },
             },
         },
     };
 }
-
-module.exports = { createEncryptionExtension };

package/src/database/index.ts

@@ -0,0 +1,126 @@
+// Database configuration
+export { default as config } from './config';
+export { getDatabaseType, getDbType } from './config';
+export type { DatabaseType } from './config';
+
+// Prisma client
+export {
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    getEncryptionConfig,
+    ensureMongoDbUrl,
+} from './prisma';
+export type { PrismaClientLike, EncryptionConfig } from './prisma';
+
+// Encryption
+export {
+    logger,
+    EncryptionLogger,
+    CORE_ENCRYPTION_SCHEMA,
+    getEncryptedFields,
+    hasEncryptedFields,
+    getEncryptedModels,
+    registerCustomSchema,
+    loadCustomEncryptionSchema,
+    loadModuleEncryptionSchemas,
+    extractCredentialFieldsFromModules,
+    validateCustomSchema,
+    resetCustomSchema,
+    FieldEncryptionService,
+    createEncryptionExtension,
+} from './encryption';
+export type {
+    EncryptionModelConfig,
+    EncryptionSchema,
+    ValidationResult,
+    ModuleDefinition,
+    IntegrationClass,
+    EncryptionSchemaProvider,
+} from './encryption';
+
+// Repositories
+export {
+    HealthCheckRepositoryInterface,
+    HealthCheckRepositoryMongoDB,
+    HealthCheckRepositoryPostgreSQL,
+    HealthCheckRepositoryDocumentDB,
+    createHealthCheckRepository,
+} from './repositories';
+export type {
+    MigrationStatusRepositoryS3,
+    DatabaseConnectionState,
+    CredentialData,
+    MigrationStatus,
+    CreateMigrationStatusData,
+    UpdateMigrationStatusData,
+} from './repositories';
+
+// Use Cases
+export {
+    CheckDatabaseHealthUseCase,
+    CheckDatabaseStateUseCase,
+    CheckEncryptionHealthUseCase,
+    TestEncryptionUseCase,
+    GetDatabaseStateViaWorkerUseCase,
+    GetMigrationStatusUseCase,
+    RunDatabaseMigrationUseCase,
+    TriggerDatabaseMigrationUseCase,
+    MigrationError,
+    NotFoundError,
+    CheckDatabaseStateValidationError,
+    GetMigrationStatusValidationError,
+    RunMigrationValidationError,
+    TriggerMigrationValidationError,
+} from './use-cases';
+export type {
+    DatabaseHealthResult,
+    PrismaRunner,
+    DatabaseStateResult,
+    EncryptionHealthResult,
+    EncryptionTestResult,
+    MigrationResult,
+    TriggerMigrationResult,
+} from './use-cases';
+
+// Adapters
+export { LambdaInvoker, LambdaInvocationError } from './adapters';
+
+// Utils
+export {
+    ensureCollectionExists,
+    ensureCollectionsExist,
+    collectionExists,
+    initializeMongoDBSchema,
+    getPrismaCollections,
+    getPrismaSchemaPath,
+    runPrismaGenerate,
+    checkDatabaseState,
+    runPrismaMigrate,
+    runPrismaMigrateResolve,
+    runPrismaDbPush,
+    getMigrationCommand,
+    parseCollectionsFromSchema,
+    parseCollectionsFromSchemaSync,
+    extractCollectionNames,
+    findMongoDBSchemaFile,
+    getCollectionsFromSchema,
+    getCollectionsFromSchemaSync,
+} from './utils';
+
+// DocumentDB-specific
+export { DocumentDBEncryptionService } from './documentdb-encryption-service';
+export {
+    toObjectId,
+    toObjectIdArray,
+    fromObjectId,
+    findOne,
+    findMany,
+    insertOne,
+    updateOne,
+    deleteOne,
+    deleteMany,
+    aggregate,
+} from './documentdb-utils';
+export type { FindManyOptions } from './documentdb-utils';
+

package/src/database/prisma.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Tests for Prisma MongoDB adapter initialization
+ * Validates DATABASE_URL configuration with MONGO_URI fallback
+ */
+
+import { ensureMongoDbUrl } from './prisma';
+
+describe('Prisma MongoDB Adapter', () => {
+    let originalEnv: NodeJS.ProcessEnv;
+
+    beforeEach(() => {
+        originalEnv = { ...process.env };
+    });
+
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+
+    describe('ensureMongoDbUrl() - MongoDB DATABASE_URL setup', () => {
+        it('should use DATABASE_URL when already set', () => {
+            process.env.DATABASE_URL = 'mongodb://localhost:27017/primary';
+            process.env.MONGO_URI = 'mongodb://localhost:27017/fallback';
+
+            ensureMongoDbUrl();
+
+            expect(process.env.DATABASE_URL).toBe('mongodb://localhost:27017/primary');
+        });
+
+        it('should set DATABASE_URL from MONGO_URI when DATABASE_URL is not set', () => {
+            delete process.env.DATABASE_URL;
+            process.env.MONGO_URI = 'mongodb://localhost:27017/from-mongo-uri';
+
+            ensureMongoDbUrl();
+
+            expect(process.env.DATABASE_URL).toBe('mongodb://localhost:27017/from-mongo-uri');
+        });
+
+        it('should throw error when neither DATABASE_URL nor MONGO_URI is set', () => {
+            delete process.env.DATABASE_URL;
+            delete process.env.MONGO_URI;
+
+            expect(() => ensureMongoDbUrl()).toThrow(
+                'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB'
+            );
+        });
+
+        it('should throw error when MONGO_URI is empty string', () => {
+            delete process.env.DATABASE_URL;
+            process.env.MONGO_URI = '';
+
+            expect(() => ensureMongoDbUrl()).toThrow(
+                'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB'
+            );
+        });
+
+        it('should throw error when MONGO_URI is whitespace', () => {
+            delete process.env.DATABASE_URL;
+            process.env.MONGO_URI = '   ';
+
+            expect(() => ensureMongoDbUrl()).toThrow(
+                'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB'
+            );
+        });
+    });
+});

package/src/database/prisma.ts

@@ -0,0 +1,166 @@
+import { createEncryptionExtension } from './encryption/prisma-encryption-extension';
+import { loadCustomEncryptionSchema } from './encryption/encryption-schema-registry';
+import { logger } from './encryption/logger';
+import { Cryptor } from '../encrypt';
+import config from './config';
+
+export interface EncryptionConfig {
+    enabled: boolean;
+    method?: 'kms' | 'aes';
+}
+
+export function ensureMongoDbUrl(): void {
+    if (process.env.DATABASE_URL?.trim()) {
+        return;
+    }
+
+    if (process.env.MONGO_URI?.trim()) {
+        process.env.DATABASE_URL = process.env.MONGO_URI;
+        logger.debug('Using MONGO_URI as DATABASE_URL for Mongo-compatible connection');
+        return;
+    }
+
+    throw new Error(
+        'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB/DocumentDB'
+    );
+}
+
+export function getEncryptionConfig(): EncryptionConfig {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS = !!process.env.KMS_KEY_ARN?.trim();
+    const hasAES = !!process.env.AES_KEY_ID?.trim();
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
+export interface PrismaClientLike {
+    $extends(extension: unknown): PrismaClientLike;
+    $connect(): Promise<void>;
+    $disconnect(): Promise<void>;
+    $runCommandRaw?(command: Record<string, unknown>): Promise<unknown>;
+    $queryRaw?(query: TemplateStringsArray, ...values: unknown[]): Promise<unknown[]>;
+    [key: string]: unknown;
+}
+
+const prismaClientSingleton = (): PrismaClientLike => {
+    let PrismaClientConstructor: new (options: Record<string, unknown>) => PrismaClientLike;
+
+    const loadPrismaClient = (dbType: string): new (options: Record<string, unknown>) => PrismaClientLike => {
+        const paths = [
+            `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
+            `../generated/prisma-${dbType}`,
+        ];
+
+        for (const modulePath of paths) {
+            try {
+                return require(modulePath).PrismaClient;
+            } catch {
+                // Continue to next path
+            }
+        }
+
+        throw new Error(
+            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(', ')}`
+        );
+    };
+
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        ensureMongoDbUrl();
+        PrismaClientConstructor = loadPrismaClient('mongodb');
+    } else if (config.DB_TYPE === 'postgresql') {
+        PrismaClientConstructor = loadPrismaClient('postgresql');
+    } else {
+        throw new Error(
+            `Unsupported database type: ${config.DB_TYPE}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+        );
+    }
+
+    let client: PrismaClientLike = new PrismaClientConstructor({
+        log: process.env.PRISMA_LOG_LEVEL
+            ? process.env.PRISMA_LOG_LEVEL.split(',')
+            : ['error', 'warn'],
+        errorFormat: 'pretty',
+    });
+
+    const encryptionConfig = getEncryptionConfig();
+
+    if (encryptionConfig.enabled) {
+        try {
+            loadCustomEncryptionSchema();
+
+            const cryptor = new Cryptor({
+                shouldUseAws: encryptionConfig.method === 'kms',
+            });
+
+            client = client.$extends(
+                createEncryptionExtension({
+                    cryptor,
+                    enabled: true,
+                })
+            );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method!.toUpperCase()}`
+            );
+        } catch (error) {
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
+        }
+    } else {
+        logger.info('Field-level encryption disabled');
+    }
+
+    return client;
+};
+
+const globalForPrisma = globalThis as typeof globalThis & {
+    _prismaInstance?: PrismaClientLike;
+};
+
+function getPrismaClient(): PrismaClientLike {
+    if (!globalForPrisma._prismaInstance) {
+        globalForPrisma._prismaInstance = prismaClientSingleton();
+    }
+    return globalForPrisma._prismaInstance;
+}
+
+export const prisma: PrismaClientLike = new Proxy({} as PrismaClientLike, {
+    get(_target, prop: string | symbol) {
+        return (getPrismaClient() as unknown as Record<string | symbol, unknown>)[prop];
+    },
+});
+
+export async function disconnectPrisma(): Promise<void> {
+    await getPrismaClient().$disconnect();
+}
+
+export async function connectPrisma(): Promise<PrismaClientLike> {
+    await getPrismaClient().$connect();
+
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        const { initializeMongoDBSchema } = require('./utils/mongodb-schema-init');
+        await initializeMongoDBSchema();
+    }
+
+    return getPrismaClient();
+}