@friggframework/core 2.0.0--canary.548.c8ae0ca.0 → 2.0.0--canary.545.c40eca4.0

package/credential/use-cases/delete-credential-for-user.js

@@ -0,0 +1,50 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Delete Credential For User Use Case
+ * Removes a credential after verifying ownership
+ *
+ * Business Logic:
+ * - Verify credential exists
+ * - Verify credential belongs to user (authorization)
+ * - Delete the credential
+ * - Return success status
+ */
+class DeleteCredentialForUser {
+    constructor({ credentialRepository }) {
+        this.credentialRepository = credentialRepository;
+    }
+
+    /**
+     * Execute the use case
+     * @param {string} credentialId - Credential ID
+     * @param {string} userId - User ID (for ownership verification)
+     * @returns {Promise<Object>} Deletion result { deletedCount: number }
+     */
+    async execute(credentialId, userId) {
+        // Check if credential exists
+        const credential = await this.credentialRepository.findCredentialById(
+            credentialId
+        );
+
+        if (!credential) {
+            throw Boom.notFound(`Credential ${credentialId} not found`);
+        }
+
+        // Verify ownership - compare as strings to handle both MongoDB and PostgreSQL
+        if (credential.userId.toString() !== userId.toString()) {
+            throw Boom.forbidden(
+                'You do not have permission to delete this credential'
+            );
+        }
+
+        // Delete the credential
+        const result = await this.credentialRepository.deleteCredentialById(
+            credentialId
+        );
+
+        return result;
+    }
+}
+
+module.exports = { DeleteCredentialForUser };

package/credential/use-cases/get-credential-for-user.js

@@ -1,20 +1,38 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Get Credential For User Use Case
+ * Retrieves a single credential after verifying ownership
+ *
+ * Business Logic:
+ * - Verify credential exists
+ * - Verify credential belongs to user (authorization)
+ * - Return credential
+ */
 class GetCredentialForUser {
     constructor({ credentialRepository }) {
         this.credentialRepository = credentialRepository;
     }
 
+    /**
+     * Execute the use case
+     * @param {string} credentialId - Credential ID
+     * @param {string} userId - User ID (for ownership verification)
+     * @returns {Promise<Object>} Credential object
+     */
     async execute(credentialId, userId) {
         const credential = await this.credentialRepository.findCredentialById(
             credentialId
         );
 
         if (!credential) {
-            throw new Error(`Credential with id ${credentialId} not found`);
+            throw Boom.notFound(`Credential ${credentialId} not found`);
         }
 
+        // Verify ownership - compare as strings to handle both MongoDB and PostgreSQL
         if (credential.userId.toString() !== userId.toString()) {
-            throw new Error(
-                `Credential ${credentialId} does not belong to user ${userId}`
+            throw Boom.forbidden(
+                'You do not have permission to access this credential'
             );
         }
 

package/credential/use-cases/list-credentials-for-user.js

@@ -0,0 +1,31 @@
+/**
+ * List Credentials For User Use Case
+ * Retrieves all credentials belonging to a specific user
+ *
+ * Business Logic:
+ * - Fetches credentials for the authenticated user
+ * - Returns list of credentials (sensitive data filtered by handler)
+ * - Repository returns an array when filtering by userId only
+ */
+class ListCredentialsForUser {
+    constructor({ credentialRepository }) {
+        this.credentialRepository = credentialRepository;
+    }
+
+    /**
+     * Execute the use case
+     * @param {string} userId - User ID
+     * @returns {Promise<Array>} List of credentials (empty array if none found)
+     */
+    async execute(userId) {
+        const credentials = await this.credentialRepository.findCredential({
+            userId,
+        });
+
+        // Repository returns array for userId-only queries
+        // Ensure we always return an array (defensive programming)
+        return Array.isArray(credentials) ? credentials : [];
+    }
+}
+
+module.exports = { ListCredentialsForUser };

package/credential/use-cases/reauthorize-credential.js

@@ -0,0 +1,103 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Reauthorize Credential Use Case
+ * Re-authorizes an existing credential with new authentication data
+ * Supports both single-step and multi-step authorization flows
+ *
+ * Business Logic:
+ * - Verify credential exists and belongs to user
+ * - Load the appropriate module for the credential type
+ * - Process authorization callback (OAuth code, API keys, etc.)
+ * - Update credential with new tokens
+ * - Return success or next step requirements
+ */
+class ReauthorizeCredential {
+    constructor({ credentialRepository, moduleRepository }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+    }
+
+    /**
+     * Execute the use case
+     * @param {string} credentialId - Credential ID to reauthorize
+     * @param {string} userId - User ID (for ownership verification)
+     * @param {Object} authData - Authorization data
+     * @param {number} [step=1] - Current step in multi-step flow
+     * @param {string} [sessionId] - Session ID for multi-step flows
+     * @returns {Promise<Object>} Success response or next step requirements
+     */
+    async execute(credentialId, userId, authData, step = 1, sessionId = null) {
+        // Check if credential exists
+        const credential = await this.credentialRepository.findCredentialById(
+            credentialId
+        );
+
+        if (!credential) {
+            throw Boom.notFound(`Credential ${credentialId} not found`);
+        }
+
+        // Verify ownership - compare as strings to handle both MongoDB and PostgreSQL
+        if (credential.userId.toString() !== userId.toString()) {
+            throw Boom.forbidden(
+                'You do not have permission to reauthorize this credential'
+            );
+        }
+
+        // Load the module for this credential type
+        const module = await this.moduleRepository.findModuleById(
+            credential.id
+        );
+
+        if (!module) {
+            throw Boom.badRequest(
+                `Module not found for credential type: ${
+                    credential.type || 'unknown'
+                }`
+            );
+        }
+
+        // Process the authorization callback
+        const result = await module.processAuthorizationCallback({
+            credentialId,
+            userId,
+            data: authData,
+            step,
+            sessionId,
+        });
+
+        // Multi-step flow - return next step requirements
+        if (result.step && result.step > 1) {
+            return {
+                step: result.step,
+                totalSteps: result.totalSteps,
+                sessionId: result.sessionId,
+                requirements: result.requirements,
+                message: result.message,
+            };
+        }
+
+        // Single-step or final step - update credential and return success
+        if (result.success) {
+            // Fetch the updated credential to get the new authIsValid status
+            const updatedCredential =
+                await this.credentialRepository.findCredentialById(
+                    credentialId
+                );
+
+            return {
+                success: true,
+                credential_id: credentialId,
+                authIsValid: updatedCredential?.authIsValid || true,
+                ...(result.message && { message: result.message }),
+            };
+        }
+
+        // If we get here, something unexpected happened
+        throw new Error(
+            'Authorization callback did not return expected result format'
+        );
+    }
+}
+
+module.exports = { ReauthorizeCredential };

package/credential/use-cases/update-authentication-status.js

@@ -8,8 +8,11 @@ class UpdateAuthenticationStatus {
      * @param {boolean} authIsValid
      */
     async execute(credentialId, authIsValid) {
-        await this.credentialRepository.updateAuthenticationStatus(credentialId, authIsValid);
+        await this.credentialRepository.updateAuthenticationStatus(
+            credentialId,
+            authIsValid
+        );
     }
 }
 
-module.exports = { UpdateAuthenticationStatus };
+module.exports = { UpdateAuthenticationStatus };

package/database/MONGODB_TRANSACTION_FIX.md

@@ -15,9 +15,9 @@ MongoDB does not allow creating collections (namespaces) inside multi-document t
 
 ### Technical Details
 
-- **MongoDB Constraint**: Collections must exist before being used in multi-document transactions
-- **Prisma Behavior**: Prisma may implicitly use transactions for certain operations
-- **Impact**: Health checks fail on fresh databases or when collections haven't been created yet
+-   **MongoDB Constraint**: Collections must exist before being used in multi-document transactions
+-   **Prisma Behavior**: Prisma may implicitly use transactions for certain operations
+-   **Impact**: Health checks fail on fresh databases or when collections haven't been created yet
 
 ## Solution
 
@@ -37,30 +37,34 @@ This follows the **"fail fast"** principle and ensures consistent state across a
 ### Changes Made
 
 1. **Created MongoDB Schema Initialization** (`packages/core/database/utils/mongodb-schema-init.js`)
-   - `initializeMongoDBSchema()` - Ensures all Prisma collections exist at startup
-   - `getPrismaCollections()` - Returns list of all Prisma collection names
-   - `PRISMA_COLLECTIONS` - Constant array of all 13 Prisma collections
-   - Only runs for MongoDB (skips PostgreSQL)
-   - Fails fast if database not connected
+
+    - `initializeMongoDBSchema()` - Ensures all Prisma collections exist at startup
+    - `getPrismaCollections()` - Returns list of all Prisma collection names
+    - `PRISMA_COLLECTIONS` - Constant array of all 13 Prisma collections
+    - Only runs for MongoDB (skips PostgreSQL)
+    - Fails fast if database not connected
 
 2. **Created MongoDB Collection Utilities** (`packages/core/database/utils/mongodb-collection-utils.js`)
-   - `ensureCollectionExists(collectionName)` - Ensures a single collection exists
-   - `ensureCollectionsExist(collectionNames)` - Batch creates multiple collections
-   - `collectionExists(collectionName)` - Checks if a collection exists
-   - Handles race conditions gracefully (NamespaceExists errors)
+
+    - `ensureCollectionExists(collectionName)` - Ensures a single collection exists
+    - `ensureCollectionsExist(collectionNames)` - Batch creates multiple collections
+    - `collectionExists(collectionName)` - Checks if a collection exists
+    - Handles race conditions gracefully (NamespaceExists errors)
 
 3. **Integrated into Database Connection** (`packages/core/database/prisma.js`)
-   - Modified `connectPrisma()` to call `initializeMongoDBSchema()` after connection
-   - Ensures all collections exist before application handles requests
+
+    - Modified `connectPrisma()` to call `initializeMongoDBSchema()` after connection
+    - Ensures all collections exist before application handles requests
 
 4. **Updated Health Check Repository** (`packages/core/database/repositories/health-check-repository-mongodb.js`)
-   - Removed per-operation collection existence checks
-   - Added documentation noting schema is initialized at startup
+
+    - Removed per-operation collection existence checks
+    - Added documentation noting schema is initialized at startup
 
 5. **Added Comprehensive Tests**
-   - `mongodb-schema-init.test.js` - Tests schema initialization system
-   - `mongodb-collection-utils.test.js` - Tests collection utility functions
-   - Tests error handling, race conditions, and edge cases
+    - `mongodb-schema-init.test.js` - Tests schema initialization system
+    - `mongodb-collection-utils.test.js` - Tests collection utility functions
+    - Tests error handling, race conditions, and edge cases
 
 ### Implementation Flow
 
@@ -93,23 +97,26 @@ await prisma.credential.create({ data: {...} }); // Works without namespace erro
 ## Benefits
 
 ### Immediate Benefits
-- ✅ Fixes encryption health check failures on fresh databases
-- ✅ Prevents transaction namespace errors across **all** Prisma operations
-- ✅ No per-operation overhead - collections created once at startup
-- ✅ Fail fast - database issues discovered immediately at startup
-- ✅ Idempotent - safe to run multiple times and across multiple instances
+
+-   ✅ Fixes encryption health check failures on fresh databases
+-   ✅ Prevents transaction namespace errors across **all** Prisma operations
+-   ✅ No per-operation overhead - collections created once at startup
+-   ✅ Fail fast - database issues discovered immediately at startup
+-   ✅ Idempotent - safe to run multiple times and across multiple instances
 
 ### Architectural Benefits
-- ✅ **Clean separation of concerns**: Schema initialization is infrastructure concern, handled at startup
-- ✅ **Follows DDD/Hexagonal Architecture**: Infrastructure layer handles database setup, repositories focus on business operations
-- ✅ **Consistent across all environments**: Dev, test, staging, production all follow same pattern
-- ✅ **No repository-level checks needed**: All repositories benefit automatically
-- ✅ **Well-tested and documented**: Comprehensive test coverage and documentation
+
+-   ✅ **Clean separation of concerns**: Schema initialization is infrastructure concern, handled at startup
+-   ✅ **Follows DDD/Hexagonal Architecture**: Infrastructure layer handles database setup, repositories focus on business operations
+-   ✅ **Consistent across all environments**: Dev, test, staging, production all follow same pattern
+-   ✅ **No repository-level checks needed**: All repositories benefit automatically
+-   ✅ **Well-tested and documented**: Comprehensive test coverage and documentation
 
 ### Operational Benefits
-- ✅ **Predictable startup**: Clear logging of schema initialization
-- ✅ **Zero runtime overhead**: Collections created once, not on every operation
-- ✅ **Production-ready**: Handles race conditions, errors, and edge cases gracefully
+
+-   ✅ **Predictable startup**: Clear logging of schema initialization
+-   ✅ **Zero runtime overhead**: Collections created once, not on every operation
+-   ✅ **Production-ready**: Handles race conditions, errors, and edge cases gracefully
 
 ## Design Decisions
 
@@ -118,16 +125,19 @@ await prisma.credential.create({ data: {...} }); // Works without namespace erro
 We considered two approaches:
 
 **❌ Per-Operation Checks (Initial approach)**
+
 ```javascript
 async createCredential(data) {
     await ensureCollectionExists('Credential'); // Check every time
     return await prisma.credential.create({ data });
 }
 ```
-- Pros: Guarantees collection exists before each operation
-- Cons: Runtime overhead, repeated checks, scattered logic
+
+-   Pros: Guarantees collection exists before each operation
+-   Cons: Runtime overhead, repeated checks, scattered logic
 
 **✅ Startup Initialization (Final approach)**
+
 ```javascript
 // Once at startup
 await connectPrisma(); // Initializes all collections
@@ -137,8 +147,9 @@ async createCredential(data) {
     return await prisma.credential.create({ data }); // No checks needed
 }
 ```
-- Pros: Zero runtime overhead, centralized logic, fail fast, consistent
-- Cons: Requires database connection at startup (already required)
+
+-   Pros: Zero runtime overhead, centralized logic, fail fast, consistent
+-   Cons: Requires database connection at startup (already required)
 
 ### Benefits of Startup Approach
 
@@ -159,6 +170,7 @@ MongoDB schema initialization complete - 13 collections verified (45ms)
 ```
 
 On subsequent startups (collections already exist):
+
 ```
 Initializing MongoDB schema - ensuring all collections exist...
 MongoDB schema initialization complete - 13 collections verified (12ms)
@@ -166,33 +178,41 @@ MongoDB schema initialization complete - 13 collections verified (12ms)
 
 ## References
 
-- [Prisma Issue #8305](https://github.com/prisma/prisma/issues/8305) - MongoDB "Cannot create namespace" error
-- [Mongoose Issue #6699](https://github.com/Automattic/mongoose/issues/6699) - Similar issue in Mongoose
-- [MongoDB Transactions Documentation](https://www.mongodb.com/docs/manual/core/transactions/#transactions-and-operations) - Operations allowed in transactions
-- [Prisma MongoDB Guide](https://www.prisma.io/docs/guides/database/mongodb) - Using Prisma with MongoDB
+-   [Prisma Issue #8305](https://github.com/prisma/prisma/issues/8305) - MongoDB "Cannot create namespace" error
+-   [Mongoose Issue #6699](https://github.com/Automattic/mongoose/issues/6699) - Similar issue in Mongoose
+-   [MongoDB Transactions Documentation](https://www.mongodb.com/docs/manual/core/transactions/#transactions-and-operations) - Operations allowed in transactions
+-   [Prisma MongoDB Guide](https://www.prisma.io/docs/guides/database/mongodb) - Using Prisma with MongoDB
 
 ## Future Considerations
 
 ### Automatic Schema Sync
+
 Consider enhancing the system to:
-- Parse Prisma schema file dynamically to extract collection names
-- Auto-detect schema changes and create new collections
-- Provide CLI command for manual schema initialization
+
+-   Parse Prisma schema file dynamically to extract collection names
+-   Auto-detect schema changes and create new collections
+-   Provide CLI command for manual schema initialization
 
 ### Migration Support
+
 For production deployments with existing data:
-- Document migration procedures for new collections
-- Consider pre-migration scripts for blue-green deployments
-- Add health check for schema initialization status
+
+-   Document migration procedures for new collections
+-   Consider pre-migration scripts for blue-green deployments
+-   Add health check for schema initialization status
 
 ### Multi-Database Support
+
 The system already handles:
-- ✅ MongoDB - Full schema initialization
-- ✅ PostgreSQL - Skips initialization (uses Prisma migrations)
-- Consider adding explicit migration support for DocumentDB-specific features
+
+-   ✅ MongoDB - Full schema initialization
+-   ✅ PostgreSQL - Skips initialization (uses Prisma migrations)
+-   Consider adding explicit migration support for DocumentDB-specific features
 
 ### Index Creation
+
 Future enhancement could also create indexes at startup:
-- Parse Prisma schema for `@@index` directives
-- Create indexes if they don't exist
-- Provide index health checks
+
+-   Parse Prisma schema for `@@index` directives
+-   Create indexes if they don't exist
+-   Provide index health checks

package/database/config.js

@@ -5,7 +5,7 @@
 
 /**
  * Determines database type from environment or app definition
- * 
+ *
  * Detection order:
  * 1. DB_TYPE environment variable (set for migration handlers)
  * 2. App definition (backend/index.js Definition.database configuration)
@@ -20,67 +20,21 @@ function getDatabaseType() {
     }
 
     // Fallback: Load app definition
+    // Uses loadAppDefinition() which respects setAppDefinition() cache.
+    // This is critical for platforms like Netlify where process.cwd()-based
+    // discovery fails at runtime (process.cwd() is /var/task, not the project root).
     try {
-        const path = require('node:path');
-        const fs = require('node:fs');
-        const { findNearestBackendPackageJson } = require('../utils');
-
-        let backendIndexPath;
-        let database;
-        const backendPackagePath = findNearestBackendPackageJson();
-
-        if (!backendPackagePath) {
-            throw new Error(
-                '[Frigg] Cannot find backend package.json. ' +
-                'Ensure backend/package.json exists in your project.'
-            );
-        }
-
-        const backendDir = path.dirname(backendPackagePath);
-        backendIndexPath = path.join(backendDir, 'index.js');
-
-        if (!fs.existsSync(backendIndexPath)) {
-            throw new Error(
-                `[Frigg] Backend index.js not found at ${backendIndexPath}. ` +
-                'Ensure backend/index.js exists with a Definition export.'
-            );
-        }
-
-        let backendModule;
-        try {
-            backendModule = require(backendIndexPath);
-        } catch (requireError) {
-            // Extract the actual file with the error from the stack trace
-            // Skip internal Node.js files (node:internal/*) and find first user file
-            let errorFile = 'unknown file';
-            const stackLines = requireError.stack?.split('\n') || [];
-
-            for (const line of stackLines) {
-                // Match file paths in stack trace, excluding node:internal
-                const match = line.match(/\(([^)]+\.js):\d+:\d+\)/) || line.match(/at ([^(]+\.js):\d+:\d+/);
-                if (match && match[1] && !match[1].includes('node:internal')) {
-                    errorFile = match[1];
-                    break;
-                }
-            }
-
-            // Provide better error context for syntax/runtime errors
-            throw new Error(
-                `[Frigg] Failed to load app definition from ${backendIndexPath}\n` +
-                `Error: ${requireError.message}\n` +
-                `File with error: ${errorFile}\n` +
-                `\nFull stack trace:\n${requireError.stack}\n\n` +
-                'This error occurred while loading your app definition or its dependencies. ' +
-                'Check the file listed above for syntax errors (trailing commas, missing brackets, etc.)'
-            );
-        }
+        const {
+            loadAppDefinition,
+        } = require('../handlers/app-definition-loader');
 
-        database = backendModule?.Definition?.database;
+        const { appDefinition } = loadAppDefinition();
+        const database = appDefinition?.database;
 
         if (!database) {
             throw new Error(
                 '[Frigg] App definition missing database configuration. ' +
-                `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${backendIndexPath}`
+                    'Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to your backend/index.js'
             );
         }
 
@@ -98,7 +52,7 @@ function getDatabaseType() {
 
         throw new Error(
             '[Frigg] No database enabled in app definition. ' +
-            'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
+                'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
         );
     } catch (error) {
         // Re-throw with context if it's our error
@@ -150,5 +104,5 @@ Object.defineProperty(module.exports, 'DB_TYPE', {
         return cachedDbType;
     },
     enumerable: true,
-    configurable: true
-});
+    configurable: true,
+});

package/database/documentdb-encryption-service.js

@@ -1,5 +1,8 @@
 const { Cryptor } = require('../encrypt/Cryptor');
-const { getEncryptedFields, loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const {
+    getEncryptedFields,
+    loadCustomEncryptionSchema,
+} = require('./encryption/encryption-schema-registry');
 
 /**
  * Encryption service specifically for DocumentDB repositories
@@ -51,8 +54,11 @@ class DocumentDBEncryptionService {
         loadCustomEncryptionSchema();
 
         // Match logic from packages/core/database/prisma.js
-        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
-        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
+        const stage =
+            process.env.STAGE || process.env.NODE_ENV || 'development';
+        const bypassEncryption = ['dev', 'test', 'local'].includes(
+            stage.toLowerCase()
+        );
 
         if (bypassEncryption) {
             this.cryptor = null;
@@ -61,11 +67,17 @@ class DocumentDBEncryptionService {
         }
 
         // Determine encryption method (ensure boolean values)
-        const hasKMS = !!(process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '');
-        const hasAES = !!(process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '');
+        const hasKMS = !!(
+            process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== ''
+        );
+        const hasAES = !!(
+            process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== ''
+        );
 
         if (!hasKMS && !hasAES) {
-            console.warn('[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.');
+            console.warn(
+                '[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.'
+            );
             this.cryptor = null;
             this.enabled = false;
             return;
@@ -202,14 +214,16 @@ class DocumentDBEncryptionService {
 
         try {
             // Convert to string if needed
-            const stringValue = typeof value === 'string'
-                ? value
-                : JSON.stringify(value);
+            const stringValue =
+                typeof value === 'string' ? value : JSON.stringify(value);
 
             // Encrypt using Cryptor
             current[fieldName] = await this.cryptor.encrypt(stringValue);
         } catch (error) {
-            console.error(`[DocumentDBEncryptionService] Failed to encrypt ${modelName}.${fieldPath}:`, error.message);
+            console.error(
+                `[DocumentDBEncryptionService] Failed to encrypt ${modelName}.${fieldPath}:`,
+                error.message
+            );
             throw error;
         }
     }
@@ -261,7 +275,7 @@ class DocumentDBEncryptionService {
                 modelName,
                 fieldPath,
                 encryptedValuePrefix: encryptedValue.substring(0, 20),
-                errorMessage: error.message
+                errorMessage: error.message,
             };
 
             console.error(
@@ -270,7 +284,9 @@ class DocumentDBEncryptionService {
             );
 
             // Throw error to fail fast - don't silently corrupt data
-            throw new Error(`Decryption failed for ${modelName}.${fieldPath}: ${error.message}`);
+            throw new Error(
+                `Decryption failed for ${modelName}.${fieldPath}: ${error.message}`
+            );
         }
     }
 
@@ -307,7 +323,7 @@ class DocumentDBEncryptionService {
         const base64Pattern = /^[A-Za-z0-9+/=]+$/;
 
         // All parts should be base64-encoded
-        if (!parts.every(part => base64Pattern.test(part))) {
+        if (!parts.every((part) => base64Pattern.test(part))) {
             return false;
         }