@friggframework/core 2.0.0--canary.548.c8ae0ca.0 → 2.0.0--canary.545.c40eca4.0

package/core/Worker.js

@@ -1,19 +1,41 @@
-const { SQSClient, GetQueueUrlCommand, SendMessageCommand } = require('@aws-sdk/client-sqs');
 const _ = require('lodash');
 const { RequiredPropertyError } = require('../errors');
 const { get } = require('../assertions');
 
-const sqs = new SQSClient({ region: process.env.AWS_REGION });
-
+/**
+ * Worker - Queue message producer/consumer base class.
+ *
+ * Subclass and override _run() to implement your worker logic.
+ * The queue transport (SQS, Netlify, etc.) is abstracted behind
+ * QueueClientInterface, injected via constructor options.
+ *
+ * BREAKING CHANGE (v3): A queueClient must be explicitly provided.
+ * For AWS/SQS, pass `new SqsQueueClient()` from @friggframework/provider-aws.
+ * See docs/architecture-decisions/010-decouple-aws-from-core.md for migration guide.
+ */
 class Worker {
+    constructor(options = {}) {
+        this._queueClient = options.queueClient || null;
+    }
+
+    /**
+     * Get the queue client. Throws if none was injected.
+     * @returns {QueueClientInterface}
+     */
+    _getQueueClient() {
+        if (!this._queueClient) {
+            throw new Error(
+                'Worker requires a queueClient. Pass one via constructor options, e.g.:\n' +
+                '  const { SqsQueueClient } = require("@friggframework/provider-aws");\n' +
+                '  new MyWorker({ queueClient: new SqsQueueClient() })\n' +
+                'See docs/architecture-decisions/010-decouple-aws-from-core.md for migration guide.'
+            );
+        }
+        return this._queueClient;
+    }
+
     async getQueueURL(params) {
-        // Passing params in because there will be multiple QueueNames
-        // let params = {
-        //     QueueName:  process.env.QueueName
-        // };
-        const command = new GetQueueUrlCommand(params);
-        const data = await sqs.send(command);
-        return data.QueueUrl;
+        return this._getQueueClient().getQueueUrl(params);
     }
 
     async run(params, context = {}) {
@@ -47,8 +69,7 @@ class Worker {
     }
 
     async sendAsyncSQSMessage(params) {
-        const command = new SendMessageCommand(params);
-        const data = await sqs.send(command);
+        const data = await this._getQueueClient().sendMessage(params);
         return data.MessageId;
     }
 

package/credential/credential-router.js

@@ -0,0 +1,262 @@
+const express = require('express');
+const Boom = require('@hapi/boom');
+const catchAsyncError = require('express-async-handler');
+const {
+    createCredentialRepository,
+} = require('./repositories/credential-repository-factory');
+const {
+    createModuleRepository,
+} = require('../modules/repositories/module-repository-factory');
+const {
+    ListCredentialsForUser,
+} = require('./use-cases/list-credentials-for-user');
+const { GetCredentialForUser } = require('./use-cases/get-credential-for-user');
+const {
+    DeleteCredentialForUser,
+} = require('./use-cases/delete-credential-for-user');
+const { ReauthorizeCredential } = require('./use-cases/reauthorize-credential');
+
+/**
+ * Boom Error Handler Middleware
+ * Handles Boom errors and converts them to appropriate HTTP responses
+ * @param {Error} err - Error object
+ * @param {Request} req - Express request
+ * @param {Response} res - Express response
+ * @param {Function} next - Express next function
+ */
+function boomErrorHandler(err, req, res, next) {
+    // Handle Boom errors
+    if (err.isBoom) {
+        return res.status(err.output.statusCode).json({
+            error: err.output.payload.message,
+            statusCode: err.output.statusCode,
+        });
+    }
+
+    // Handle generic errors (500)
+    console.error('Unexpected error:', err);
+    return res.status(500).json({
+        error: 'Internal server error',
+        statusCode: 500,
+    });
+}
+
+/**
+ * Create Credential Router
+ * Factory function that creates an Express router with credential management endpoints
+ *
+ * Endpoints:
+ * - GET /api/credentials - List all credentials for authenticated user
+ * - GET /api/credentials/:id - Get a single credential
+ * - DELETE /api/credentials/:id - Delete a credential
+ * - POST /api/credentials/:id/reauthorize - Reauthorize a credential
+ *
+ * Security:
+ * - All endpoints require authentication (via authenticateUser middleware)
+ * - Credentials are filtered to only belong to the authenticated user
+ * - Sensitive data (tokens) are filtered from responses
+ *
+ * @returns {express.Router} Configured Express router
+ */
+function createCredentialRouter() {
+    const router = express.Router();
+
+    // Load configuration and create repositories
+    const credentialRepository = createCredentialRepository();
+    const moduleRepository = createModuleRepository();
+
+    // Create credential use cases
+    const listCredentialsForUser = new ListCredentialsForUser({
+        credentialRepository,
+    });
+
+    const getCredentialForUser = new GetCredentialForUser({
+        credentialRepository,
+    });
+
+    const deleteCredentialForUser = new DeleteCredentialForUser({
+        credentialRepository,
+    });
+
+    const reauthorizeCredential = new ReauthorizeCredential({
+        credentialRepository,
+        moduleRepository,
+    });
+
+    /**
+     * Filter sensitive data from credential objects
+     * Removes tokens and other sensitive fields from credentials before sending to client
+     *
+     * @param {Object|Array} credentials - Credential(s) to filter
+     * @returns {Object|Array} Filtered credential(s)
+     */
+    function filterSensitiveData(credentials) {
+        const filter = (cred) => {
+            if (!cred) return cred;
+
+            // Create a copy without sensitive fields
+            const {
+                data,
+                access_token,
+                refresh_token,
+                id_token,
+                domain,
+                ...safeCredential
+            } = cred;
+
+            // Ensure we have timestamps in ISO format
+            if (
+                safeCredential.createdAt &&
+                !(safeCredential.createdAt instanceof Date)
+            ) {
+                safeCredential.createdAt = new Date(
+                    safeCredential.createdAt
+                ).toISOString();
+            }
+            if (
+                safeCredential.updatedAt &&
+                !(safeCredential.updatedAt instanceof Date)
+            ) {
+                safeCredential.updatedAt = new Date(
+                    safeCredential.updatedAt
+                ).toISOString();
+            }
+
+            return safeCredential;
+        };
+
+        return Array.isArray(credentials)
+            ? credentials.map(filter)
+            : filter(credentials);
+    }
+
+    // GET /api/credentials - List all credentials for authenticated user
+    router.get(
+        '/',
+        catchAsyncError(async (req, res) => {
+            // Expect authentication middleware to have set req.user
+            if (!req.user) {
+                throw Boom.unauthorized('Authentication required');
+            }
+            const userId =
+                typeof req.user.getId === 'function'
+                    ? req.user.getId()
+                    : req.user.id;
+
+            const credentials = await listCredentialsForUser.execute(userId);
+
+            // Filter out sensitive data before responding
+            const safeCredentials = filterSensitiveData(credentials);
+
+            res.json({ credentials: safeCredentials });
+        })
+    );
+
+    // GET /api/credentials/:id - Get a single credential
+    router.get(
+        '/:id',
+        catchAsyncError(async (req, res) => {
+            if (!req.user) {
+                throw Boom.unauthorized('Authentication required');
+            }
+            const userId =
+                typeof req.user.getId === 'function'
+                    ? req.user.getId()
+                    : req.user.id;
+            const credentialId = req.params.id;
+
+            const credential = await getCredentialForUser.execute(
+                credentialId,
+                userId
+            );
+
+            // Filter out sensitive data before responding
+            const safeCredential = filterSensitiveData(credential);
+
+            res.json(safeCredential);
+        })
+    );
+
+    // DELETE /api/credentials/:id - Delete a credential
+    router.delete(
+        '/:id',
+        catchAsyncError(async (req, res) => {
+            if (!req.user) {
+                throw Boom.unauthorized('Authentication required');
+            }
+            const userId =
+                typeof req.user.getId === 'function'
+                    ? req.user.getId()
+                    : req.user.id;
+            const credentialId = req.params.id;
+
+            const result = await deleteCredentialForUser.execute(
+                credentialId,
+                userId
+            );
+
+            // Check if deletion was successful
+            if (result.deletedCount === 0) {
+                throw Boom.internal('Failed to delete credential');
+            }
+
+            res.json({
+                success: true,
+                message: `Credential ${credentialId} deleted successfully`,
+            });
+        })
+    );
+
+    // POST /api/credentials/:id/reauthorize - Reauthorize a credential
+    router.post(
+        '/:id/reauthorize',
+        catchAsyncError(async (req, res) => {
+            if (!req.user) {
+                throw Boom.unauthorized('Authentication required');
+            }
+            const userId =
+                typeof req.user.getId === 'function'
+                    ? req.user.getId()
+                    : req.user.id;
+            const credentialId = req.params.id;
+
+            // Validate request body
+            if (!req.body.data) {
+                throw Boom.badRequest('data is required in request body');
+            }
+
+            // Get step and sessionId from request
+            const step = parseInt(req.body.step || '1', 10);
+            const sessionId = req.body.sessionId;
+
+            // Validate step is a positive integer
+            if (step < 1 || !Number.isInteger(step)) {
+                throw Boom.badRequest('step must be a positive integer');
+            }
+
+            // Validate sessionId is present for steps > 1
+            if (step > 1 && !sessionId) {
+                throw Boom.badRequest('sessionId is required for step > 1');
+            }
+
+            // Execute the reauthorization
+            const result = await reauthorizeCredential.execute(
+                credentialId,
+                userId,
+                req.body.data,
+                step,
+                sessionId
+            );
+
+            res.json(result);
+        })
+    );
+
+    // Boom error handler middleware
+    // Must be added after all routes to catch errors from handlers
+    router.use(boomErrorHandler);
+
+    return router;
+}
+
+module.exports = { createCredentialRouter, boomErrorHandler };

package/credential/repositories/credential-repository-documentdb.js

@@ -3,6 +3,7 @@ const {
     toObjectId,
     fromObjectId,
     findOne,
+    findMany,
     insertOne,
     updateOne,
     deleteOne,
@@ -106,7 +107,10 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
             const updateDocument = {
                 userId: existing.userId,
                 externalId: existing.externalId,
-                authIsValid: authIsValid !== undefined ? authIsValid : existing.authIsValid,
+                authIsValid:
+                    authIsValid !== undefined
+                        ? authIsValid
+                        : existing.authIsValid,
                 data: mergedData,
                 updatedAt: now,
             };
@@ -172,8 +176,50 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
+    /**
+     * Find credential(s) by filter criteria
+     *
+     * When filter includes only userId, returns an array of all credentials for that user
+     * When filter includes credentialId or externalId, returns a single credential or null
+     *
+     * @param {Object} filter
+     * @param {string} [filter.userId] - User ID
+     * @param {string} [filter.externalId] - External ID
+     * @param {string} [filter.credentialId] - Credential ID
+     * @returns {Promise<Array|Object|null>} Credential array, single credential, or null
+     */
     async findCredential(filter) {
         const query = this._buildFilter(filter);
+
+        // If filtering by userId only, return all credentials for that user
+        const hasOnlyUserId =
+            filter.userId &&
+            !filter.credentialId &&
+            !filter.externalId &&
+            !filter.id;
+
+        if (hasOnlyUserId) {
+            const credentials = await findMany(
+                this.prisma,
+                'Credential',
+                query
+            );
+
+            const decryptedCredentials = await Promise.all(
+                credentials.map(async (credential) => {
+                    const decrypted =
+                        await this.encryptionService.decryptFields(
+                            'Credential',
+                            credential
+                        );
+                    return this._mapCredentialWithMetadata(decrypted);
+                })
+            );
+
+            return decryptedCredentials;
+        }
+
+        // Otherwise, find single credential
         const credential = await findOne(this.prisma, 'Credential', query);
         if (!credential) return null;
 
@@ -299,6 +345,30 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
             ...data,
         };
     }
+
+    /**
+     * Map credential document with metadata (for list views)
+     * Includes timestamps and additional fields needed by API
+     * @private
+     */
+    _mapCredentialWithMetadata(doc) {
+        const data = doc?.data || {};
+        const id = fromObjectId(doc?._id);
+        const userId = doc?.userId;
+        return {
+            id,
+            type: doc?.type,
+            userId,
+            externalId: doc?.externalId ?? null,
+            authIsValid: doc?.authIsValid ?? null,
+            entityCount: doc?.entityCount,
+            createdAt: doc?.createdAt,
+            updatedAt: doc?.updatedAt,
+            access_token: data.access_token,
+            refresh_token: data.refresh_token,
+            ...data,
+        };
+    }
 }
 
 module.exports = { CredentialRepositoryDocumentDB };

package/credential/repositories/credential-repository-factory.js

@@ -1,10 +1,6 @@
-const { CredentialRepositoryMongo } = require('./credential-repository-mongo');
 const {
     CredentialRepositoryPostgres,
 } = require('./credential-repository-postgres');
-const {
-    CredentialRepositoryDocumentDB,
-} = require('./credential-repository-documentdb');
 const config = require('../../database/config');
 
 /**
@@ -30,12 +26,14 @@ function createCredentialRepository() {
 
     switch (dbType) {
         case 'mongodb':
+            const { CredentialRepositoryMongo } = require('./credential-repository-mongo');
             return new CredentialRepositoryMongo();
 
         case 'postgresql':
             return new CredentialRepositoryPostgres();
 
         case 'documentdb':
+            const { CredentialRepositoryDocumentDB } = require('./credential-repository-documentdb');
             return new CredentialRepositoryDocumentDB();
 
         default:
@@ -48,7 +46,7 @@ function createCredentialRepository() {
 module.exports = {
     createCredentialRepository,
     // Export adapters for direct testing
-    CredentialRepositoryMongo,
+    get CredentialRepositoryMongo() { return require('./credential-repository-mongo').CredentialRepositoryMongo; },
     CredentialRepositoryPostgres,
-    CredentialRepositoryDocumentDB,
+    get CredentialRepositoryDocumentDB() { return require('./credential-repository-documentdb').CredentialRepositoryDocumentDB; },
 };

package/credential/repositories/credential-repository-interface.js

@@ -68,10 +68,16 @@ class CredentialRepositoryInterface {
     }
 
     /**
-     * Find a credential by filter criteria
+     * Find credential(s) by filter criteria
+     *
+     * When filter includes only userId, returns an array of all credentials for that user
+     * When filter includes credentialId or externalId, returns a single credential or null
      *
      * @param {Object} filter - Filter criteria
-     * @returns {Promise<Object|null>} Credential object or null if not found
+     * @param {string} [filter.userId] - User ID
+     * @param {string} [filter.externalId] - External ID
+     * @param {string} [filter.credentialId] - Credential ID
+     * @returns {Promise<Array|Object|null>} Credential array, single credential, or null
      * @abstract
      */
     async findCredential(filter) {

package/credential/repositories/credential-repository-mongo.js

@@ -121,7 +121,10 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
                 data: {
                     userId: existing.userId,
                     externalId: existing.externalId,
-                    authIsValid: authIsValid !== undefined ? authIsValid : existing.authIsValid,
+                    authIsValid:
+                        authIsValid !== undefined
+                            ? authIsValid
+                            : existing.authIsValid,
                     data: mergedData,
                 },
             });
@@ -154,18 +157,52 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
     }
 
     /**
-     * Find a credential by filter criteria
-     * Replaces: Credential.findOne(query)
+     * Find credential(s) by filter criteria
+     * Replaces: Credential.find(query) or Credential.findOne(query)
+     *
+     * When filter includes only userId, returns an array of all credentials for that user
+     * When filter includes credentialId or externalId, returns a single credential or null
      *
      * @param {Object} filter
      * @param {string} [filter.userId] - User ID
      * @param {string} [filter.externalId] - External ID
      * @param {string} [filter.credentialId] - Credential ID
-     * @returns {Promise<Object|null>} Credential object or null if not found
+     * @returns {Promise<Array|Object|null>} Credential array, single credential, or null
      */
     async findCredential(filter) {
         const where = this._convertFilterToWhere(filter);
 
+        // If filtering by userId only, return all credentials for that user
+        const hasOnlyUserId =
+            filter.userId &&
+            !filter.credentialId &&
+            !filter.externalId &&
+            !filter.id;
+
+        if (hasOnlyUserId) {
+            const credentials = await this.prisma.credential.findMany({
+                where,
+            });
+
+            return credentials.map((credential) => {
+                const data = credential.data || {};
+                return {
+                    id: credential.id,
+                    type: credential.type,
+                    userId: credential.userId,
+                    externalId: credential.externalId,
+                    authIsValid: credential.authIsValid,
+                    entityCount: credential.entityCount,
+                    createdAt: credential.createdAt,
+                    updatedAt: credential.updatedAt,
+                    access_token: data.access_token,
+                    refresh_token: data.refresh_token,
+                    ...data,
+                };
+            });
+        }
+
+        // Otherwise, find single credential
         const credential = await this.prisma.credential.findFirst({
             where,
         });
@@ -178,9 +215,13 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
 
         return {
             id: credential.id,
+            type: credential.type,
             userId: credential.userId,
             externalId: credential.externalId,
             authIsValid: credential.authIsValid,
+            entityCount: credential.entityCount,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
             access_token: data.access_token,
             refresh_token: data.refresh_token,
             ...data,

package/credential/repositories/credential-repository-postgres.js

@@ -138,7 +138,10 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
                 data: {
                     userId: this._convertId(existing.userId),
                     externalId: existing.externalId,
-                    authIsValid: authIsValid !== undefined ? authIsValid : existing.authIsValid,
+                    authIsValid:
+                        authIsValid !== undefined
+                            ? authIsValid
+                            : existing.authIsValid,
                     data: mergedData,
                 },
             });
@@ -172,17 +175,51 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
     }
 
     /**
-     * Find a credential by filter criteria
+     * Find credential(s) by filter criteria
+     *
+     * When filter includes only userId, returns an array of all credentials for that user
+     * When filter includes credentialId or externalId, returns a single credential or null
      *
      * @param {Object} filter
      * @param {string} [filter.userId] - User ID (string from application layer)
      * @param {string} [filter.externalId] - External ID
      * @param {string} [filter.credentialId] - Credential ID (string from application layer)
-     * @returns {Promise<Object|null>} Credential object with string IDs or null if not found
+     * @returns {Promise<Array|Object|null>} Credential array, single credential with string IDs, or null
      */
     async findCredential(filter) {
         const where = this._convertFilterToWhere(filter);
 
+        // If filtering by userId only, return all credentials for that user
+        const hasOnlyUserId =
+            filter.userId &&
+            !filter.credentialId &&
+            !filter.externalId &&
+            !filter.id;
+
+        if (hasOnlyUserId) {
+            const credentials = await this.prisma.credential.findMany({
+                where,
+            });
+
+            return credentials.map((credential) => {
+                const data = credential.data || {};
+                return {
+                    id: credential.id.toString(),
+                    type: credential.type,
+                    userId: credential.userId?.toString(),
+                    externalId: credential.externalId,
+                    authIsValid: credential.authIsValid,
+                    entityCount: credential.entityCount,
+                    createdAt: credential.createdAt,
+                    updatedAt: credential.updatedAt,
+                    access_token: data.access_token,
+                    refresh_token: data.refresh_token,
+                    ...data,
+                };
+            });
+        }
+
+        // Otherwise, find single credential
         const credential = await this.prisma.credential.findFirst({
             where,
         });
@@ -195,9 +232,13 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
 
         return {
             id: credential.id.toString(),
+            type: credential.type,
             userId: credential.userId?.toString(),
             externalId: credential.externalId,
             authIsValid: credential.authIsValid,
+            entityCount: credential.entityCount,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
             access_token: data.access_token,
             refresh_token: data.refresh_token,
             ...data,

package/credential/repositories/credential-repository.js

@@ -243,7 +243,9 @@ class CredentialRepository extends CredentialRepositoryInterface {
                 externalId:
                     externalId !== undefined ? externalId : existing.externalId,
                 authIsValid:
-                    authIsValid !== undefined ? authIsValid : existing.authIsValid,
+                    authIsValid !== undefined
+                        ? authIsValid
+                        : existing.authIsValid,
                 data: mergedData,
             },
         });