@friggframework/core 2.0.0--canary.548.c8ae0ca.0 → 2.0.0--canary.545.c40eca4.0

package/handlers/routers/health.js

@@ -29,43 +29,58 @@ const {
 } = require('../use-cases/check-integrations-health-use-case');
 
 const router = Router();
-const healthCheckRepository = createHealthCheckRepository({ prismaClient: prisma });
 
-// Load integrations and create factories just like auth router does
-// This verifies the system can properly load integrations
-let moduleFactory, integrationClasses;
-try {
-    const appDef = loadAppDefinition();
-    integrationClasses = appDef.integrations || [];
+// Lazy-initialized use cases (deferred until first request)
+let _checkDatabaseHealthUseCase,
+    _checkEncryptionHealthUseCase,
+    _checkExternalApisHealthUseCase,
+    _checkIntegrationsHealthUseCase;
 
-    const moduleRepository = createModuleRepository();
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrationClasses);
+function ensureInitialized() {
+    if (!_checkDatabaseHealthUseCase) {
+        const healthCheckRepository = createHealthCheckRepository({
+            prismaClient: prisma,
+        });
 
-    moduleFactory = new ModuleFactory({
-        moduleRepository,
-        moduleDefinitions,
-    });
-} catch (error) {
-    console.error('Failed to load integrations for health check:', error.message);
-    // Factories will be undefined, health check will report unhealthy
-    moduleFactory = undefined;
-    integrationClasses = [];
-}
+        let moduleFactory, integrationClasses;
+        try {
+            const appDef = loadAppDefinition();
+            integrationClasses = appDef.integrations || [];
 
-const testEncryptionUseCase = new TestEncryptionUseCase({
-    healthCheckRepository,
-});
-const checkDatabaseHealthUseCase = new CheckDatabaseHealthUseCase({
-    healthCheckRepository,
-});
-const checkEncryptionHealthUseCase = new CheckEncryptionHealthUseCase({
-    testEncryptionUseCase,
-});
-const checkExternalApisHealthUseCase = new CheckExternalApisHealthUseCase();
-const checkIntegrationsHealthUseCase = new CheckIntegrationsHealthUseCase({
-    moduleFactory,
-    integrationClasses,
-});
+            const moduleRepository = createModuleRepository();
+            const moduleDefinitions =
+                getModulesDefinitionFromIntegrationClasses(integrationClasses);
+
+            moduleFactory = new ModuleFactory({
+                moduleRepository,
+                moduleDefinitions,
+            });
+        } catch (error) {
+            console.error(
+                'Failed to load integrations for health check:',
+                error.message
+            );
+            moduleFactory = undefined;
+            integrationClasses = [];
+        }
+
+        const testEncryptionUseCase = new TestEncryptionUseCase({
+            healthCheckRepository,
+        });
+        _checkDatabaseHealthUseCase = new CheckDatabaseHealthUseCase({
+            healthCheckRepository,
+        });
+        _checkEncryptionHealthUseCase = new CheckEncryptionHealthUseCase({
+            testEncryptionUseCase,
+        });
+        _checkExternalApisHealthUseCase =
+            new CheckExternalApisHealthUseCase();
+        _checkIntegrationsHealthUseCase = new CheckIntegrationsHealthUseCase({
+            moduleFactory,
+            integrationClasses,
+        });
+    }
+}
 
 const validateApiKey = (req, res, next) => {
     const apiKey = req.headers['x-frigg-health-api-key'];
@@ -87,256 +102,32 @@ const validateApiKey = (req, res, next) => {
 
 router.use(validateApiKey);
 
-// Helper to detect VPC configuration
-const detectVpcConfiguration = async () => {
-    const results = {
-        isInVpc: false,
-        hasInternetAccess: false,
-        canResolvePublicDns: false,
-        canConnectToAws: false,
-        vpcEndpoints: [],
-    };
+// Provider-specific health checks are loaded via resolveProvider()
+// so core doesn't hardcode any provider package names.
+const { resolveProvider } = require('../../providers/resolve-provider');
 
+function getResolvedProvider() {
     try {
-        // Check if we're in a VPC by looking for VPC-specific environment
-        // Lambda in VPC has specific network interface configuration
-        const dns = require('dns').promises;
-
-        // Test 1: Can we resolve public DNS? (indicates DNS configuration)
-        try {
-            await Promise.race([
-                dns.resolve4('www.google.com'),
-                new Promise((_, reject) =>
-                    setTimeout(() => reject(new Error('timeout')), 2000)
-                ),
-            ]);
-            results.canResolvePublicDns = true;
-        } catch (e) {
-            console.log('Public DNS resolution failed:', e.message);
-        }
-
-        // Test 2: Can we reach internet? (indicates NAT gateway)
-        try {
-            const https = require('https');
-            await new Promise((resolve, reject) => {
-                const req = https.get(
-                    'https://www.google.com',
-                    { timeout: 2000 },
-                    (res) => {
-                        res.destroy();
-                        resolve(true);
-                    }
-                );
-                req.on('error', reject);
-                req.on('timeout', () => {
-                    req.destroy();
-                    reject(new Error('timeout'));
-                });
-            });
-            results.hasInternetAccess = true;
-        } catch (e) {
-            console.log('Internet connectivity test failed:', e.message);
-        }
-
-        // Test 3: Check for VPC endpoints by trying to resolve internal AWS endpoints
-        const region = process.env.AWS_REGION; // Lambda always provides this
-        const vpcEndpointDomains = [
-            `com.amazonaws.${region}.kms`,
-            `com.amazonaws.vpce.${region}`,
-            `kms.${region}.amazonaws.com`,
-        ];
-
-        for (const domain of vpcEndpointDomains) {
-            try {
-                const addresses = await Promise.race([
-                    dns.resolve4(domain).catch(() => dns.resolve6(domain)),
-                    new Promise((_, reject) =>
-                        setTimeout(() => reject(new Error('timeout')), 1000)
-                    ),
-                ]);
-                if (addresses && addresses.length > 0) {
-                    // Check if it's a private IP (VPC endpoint indicator)
-                    const isPrivateIp = addresses.some(
-                        (ip) =>
-                            ip.startsWith('10.') ||
-                            ip.startsWith('172.') ||
-                            ip.startsWith('192.168.')
-                    );
-                    if (isPrivateIp) {
-                        results.vpcEndpoints.push(domain);
-                    }
-                }
-            } catch (e) {
-                // Expected for non-existent endpoints
-            }
-        }
-
-        // Check if Lambda is in VPC using VPC_ENABLED env var set by infrastructure
-        results.isInVpc = process.env.VPC_ENABLED === 'true' ||
-            (!results.hasInternetAccess && results.canResolvePublicDns) ||
-            results.vpcEndpoints.length > 0;
-
-        results.canConnectToAws =
-            results.hasInternetAccess || results.vpcEndpoints.length > 0;
-    } catch (error) {
-        console.error('VPC detection error:', error.message);
+        return resolveProvider();
+    } catch {
+        return null;
     }
+}
 
-    return results;
-};
-
-// KMS decrypt capability check
 const checkKmsDecryptCapability = async () => {
-    const start = Date.now();
-    const { KMS_KEY_ARN } = process.env;
-    if (!KMS_KEY_ARN) {
-        return {
-            status: 'skipped',
-            reason: 'KMS_KEY_ARN not configured',
-        };
+    const provider = getResolvedProvider();
+    if (!provider?.checkKmsDecryptCapability) {
+        return { status: 'skipped', reason: 'Provider does not support KMS health checks' };
     }
+    return provider.checkKmsDecryptCapability();
+};
 
-    // Log environment for debugging
-    console.log('KMS Check Debug:', {
-        hasKmsKeyArn: !!KMS_KEY_ARN,
-        kmsKeyArnPrefix: KMS_KEY_ARN?.substring(0, 30),
-        awsRegion: process.env.AWS_REGION,
-        hasDiscoveryKey: !!process.env.AWS_DISCOVERY_KMS_KEY_ID,
-    });
-
-    // First, detect VPC configuration
-    const vpcConfig = await detectVpcConfiguration();
-    console.log('VPC Configuration:', vpcConfig);
-
-    // Test DNS resolution for KMS endpoint
-    try {
-        const dns = require('dns').promises;
-        const region = process.env.AWS_REGION; // Lambda always provides this
-        const kmsEndpoint = `kms.${region}.amazonaws.com`;
-        console.log('Testing DNS resolution for:', kmsEndpoint);
-
-        // Wrap DNS resolution in a timeout
-        const dnsPromise = dns.resolve4(kmsEndpoint);
-        const timeoutPromise = new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('DNS resolution timeout')), 3000)
-        );
-
-        const addresses = await Promise.race([dnsPromise, timeoutPromise]);
-        console.log('KMS endpoint resolved to:', addresses);
-
-        // Check if resolved to private IP (VPC endpoint)
-        const isVpcEndpoint = addresses.some(
-            (ip) =>
-                ip.startsWith('10.') ||
-                ip.startsWith('172.') ||
-                ip.startsWith('192.168.')
-        );
-
-        if (isVpcEndpoint) {
-            console.log(
-                'KMS VPC Endpoint detected - using private connectivity'
-            );
-        }
-
-        // Test TCP connectivity to KMS (port 443)
-        const net = require('net');
-        const testConnection = () =>
-            new Promise((resolve) => {
-                const socket = new net.Socket();
-                const connectionTimeout = setTimeout(() => {
-                    socket.destroy();
-                    resolve({ connected: false, error: 'Connection timeout' });
-                }, 3000);
-
-                socket.on('connect', () => {
-                    clearTimeout(connectionTimeout);
-                    socket.destroy();
-                    resolve({ connected: true });
-                });
-
-                socket.on('error', (err) => {
-                    clearTimeout(connectionTimeout);
-                    resolve({ connected: false, error: err.message });
-                });
-
-                // Try connecting to first resolved address on HTTPS port
-                socket.connect(443, addresses[0]);
-            });
-
-        const connResult = await testConnection();
-        console.log('TCP connectivity test:', connResult);
-
-        if (!connResult.connected) {
-            return {
-                status: 'unhealthy',
-                error: `Cannot connect to KMS endpoint: ${connResult.error}`,
-                dnsResolved: true,
-                tcpConnection: false,
-                vpcConfig,
-                latencyMs: Date.now() - start,
-            };
-        }
-    } catch (dnsError) {
-        console.error('DNS resolution failed:', dnsError.message);
-        return {
-            status: 'unhealthy',
-            error: `Cannot resolve KMS endpoint: ${dnsError.message}`,
-            dnsResolved: false,
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
-    }
-
-    try {
-        // Use AWS SDK v3 for consistency with the rest of the codebase
-        // eslint-disable-next-line global-require
-        const {
-            KMSClient,
-            GenerateDataKeyCommand,
-            DecryptCommand,
-        } = require('@aws-sdk/client-kms');
-
-        // Lambda always provides AWS_REGION
-        const region = process.env.AWS_REGION;
-
-        const kms = new KMSClient({
-            region,
-            requestHandler: {
-                connectionTimeout: 10000, // 10 second connection timeout
-                requestTimeout: 25000, // 25 second timeout for slow VPC connections
-            },
-            maxAttempts: 1, // No retries on health checks
-        });
-
-        // Generate a data key (without plaintext logging) then immediately decrypt ciphertext to ensure decrypt perms.
-        const dataKeyResp = await kms.send(
-            new GenerateDataKeyCommand({
-                KeyId: KMS_KEY_ARN,
-                KeySpec: 'AES_256',
-            })
-        );
-        const decryptResp = await kms.send(
-            new DecryptCommand({ CiphertextBlob: dataKeyResp.CiphertextBlob })
-        );
-
-        const success = Boolean(
-            dataKeyResp.CiphertextBlob && decryptResp.Plaintext
-        );
-
-        return {
-            status: success ? 'healthy' : 'unhealthy',
-            kmsKeyArnSuffix: KMS_KEY_ARN.slice(-12),
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
-    } catch (error) {
-        return {
-            status: 'unhealthy',
-            error: error.message,
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
+const detectVpcConfiguration = async () => {
+    const provider = getResolvedProvider();
+    if (!provider?.detectVpcConfiguration) {
+        return { status: 'skipped', reason: 'Provider does not support VPC detection' };
     }
+    return provider.detectVpcConfiguration();
 };
 
 router.get('/health', async (_req, res) => {
@@ -350,6 +141,7 @@ router.get('/health', async (_req, res) => {
 });
 
 router.get('/health/detailed', async (_req, res) => {
+    ensureInitialized();
     console.log('Starting detailed health check');
     const startTime = Date.now();
 
@@ -415,7 +207,7 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        response.checks.database = await checkDatabaseHealthUseCase.execute();
+        response.checks.database = await _checkDatabaseHealthUseCase.execute();
         if (response.checks.database.status === 'unhealthy') {
             response.status = 'unhealthy';
         }
@@ -430,7 +222,8 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        response.checks.encryption = await checkEncryptionHealthUseCase.execute();
+        response.checks.encryption =
+            await _checkEncryptionHealthUseCase.execute();
         if (response.checks.encryption.status === 'unhealthy') {
             response.status = 'unhealthy';
         }
@@ -445,12 +238,16 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        const { apiStatuses, allReachable } = await checkExternalApisHealthUseCase.execute();
+        const { apiStatuses, allReachable } =
+            await _checkExternalApisHealthUseCase.execute();
         response.checks.externalApis = apiStatuses;
         if (!allReachable) {
             response.status = 'unhealthy';
         }
-        console.log('External APIs check completed:', response.checks.externalApis);
+        console.log(
+            'External APIs check completed:',
+            response.checks.externalApis
+        );
     } catch (error) {
         response.checks.externalApis = {
             status: 'unhealthy',
@@ -461,8 +258,11 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        response.checks.integrations = checkIntegrationsHealthUseCase.execute();
-        console.log('Integrations check completed:', response.checks.integrations);
+        response.checks.integrations = _checkIntegrationsHealthUseCase.execute();
+        console.log(
+            'Integrations check completed:',
+            response.checks.integrations
+        );
     } catch (error) {
         response.checks.integrations = {
             status: 'unhealthy',
@@ -493,10 +293,11 @@ router.get('/health/live', (_req, res) => {
 });
 
 router.get('/health/ready', async (_req, res) => {
-    const dbHealth = await checkDatabaseHealthUseCase.execute();
+    ensureInitialized();
+    const dbHealth = await _checkDatabaseHealthUseCase.execute();
     const isDbReady = dbHealth.status === 'healthy';
 
-    const integrationsHealth = checkIntegrationsHealthUseCase.execute();
+    const integrationsHealth = _checkIntegrationsHealthUseCase.execute();
     const areModulesReady = integrationsHealth.modules.count > 0;
 
     const isReady = isDbReady && areModulesReady;

package/handlers/routers/integration-defined-routers.js

@@ -1,45 +1,56 @@
 const { createAppHandler } = require('./../app-handler-helpers');
-const {
-    loadAppDefinition,
-} = require('../app-definition-loader');
+const { loadAppDefinition } = require('../app-definition-loader');
 const { Router } = require('express');
 const { loadRouterFromObject } = require('../backend-utils');
 
-const handlers = {};
-const { integrations: integrationClasses } = loadAppDefinition();
+let _handlers;
 
-//todo: this should be in a use case class
-for (const IntegrationClass of integrationClasses) {
-    const router = Router();
-    const basePath = `/api/${IntegrationClass.Definition.name}-integration`;
+function ensureHandlers() {
+    if (!_handlers) {
+        _handlers = {};
+        const { integrations: integrationClasses } = loadAppDefinition();
 
-    console.log(`\n│ Configuring routes for ${IntegrationClass.Definition.name} Integration:`);
+        //todo: this should be in a use case class
+        for (const IntegrationClass of integrationClasses) {
+            const router = Router();
+            const basePath = `/api/${IntegrationClass.Definition.name}-integration`;
 
-    for (const routeDef of IntegrationClass.Definition.routes) {
-        if (typeof routeDef === 'function') {
-            router.use(basePath, routeDef(IntegrationClass));
-            console.log(`│ ANY ${basePath}/* (function handler)`);
-        } else if (typeof routeDef === 'object') {
-            router.use(
-                basePath,
-                loadRouterFromObject(IntegrationClass, routeDef)
+            console.log(
+                `\n│ Configuring routes for ${IntegrationClass.Definition.name} Integration:`
             );
-            const method = (routeDef.method || 'ANY').toUpperCase();
-            const fullPath = `${basePath}${routeDef.path}`;
-            console.log(`│ ${method} ${fullPath}`);
-        } else if (routeDef instanceof express.Router) {
-            router.use(basePath, routeDef);
-            console.log(`│ ANY ${basePath}/* (express router)`);
+
+            for (const routeDef of IntegrationClass.Definition.routes) {
+                if (typeof routeDef === 'function') {
+                    router.use(basePath, routeDef(IntegrationClass));
+                    console.log(`│ ANY ${basePath}/* (function handler)`);
+                } else if (typeof routeDef === 'object') {
+                    router.use(
+                        basePath,
+                        loadRouterFromObject(IntegrationClass, routeDef)
+                    );
+                    const method = (routeDef.method || 'ANY').toUpperCase();
+                    const fullPath = `${basePath}${routeDef.path}`;
+                    console.log(`│ ${method} ${fullPath}`);
+                } else if (routeDef instanceof express.Router) {
+                    router.use(basePath, routeDef);
+                    console.log(`│ ANY ${basePath}/* (express router)`);
+                }
+            }
+            console.log('│');
+
+            _handlers[`${IntegrationClass.Definition.name}`] = {
+                handler: createAppHandler(
+                    `HTTP Event: ${IntegrationClass.Definition.name}`,
+                    router
+                ),
+            };
         }
     }
-    console.log('│');
-
-    handlers[`${IntegrationClass.Definition.name}`] = {
-        handler: createAppHandler(
-            `HTTP Event: ${IntegrationClass.Definition.name}`,
-            router
-        ),
-    };
+    return _handlers;
 }
 
-module.exports = { handlers };
+module.exports = {
+    get handlers() {
+        return ensureHandlers();
+    },
+};

package/handlers/routers/integration-webhook-routers.js

@@ -1,67 +1,88 @@
 const { createAppHandler } = require('./../app-handler-helpers');
 const { loadAppDefinition } = require('../app-definition-loader');
 const { Router } = require('express');
-const { IntegrationEventDispatcher } = require('../integration-event-dispatcher');
+const {
+    IntegrationEventDispatcher,
+} = require('../integration-event-dispatcher');
 
-const handlers = {};
-const { integrations: integrationClasses } = loadAppDefinition();
+let _handlers;
 
-for (const IntegrationClass of integrationClasses) {
-    const webhookConfig = IntegrationClass.Definition.webhooks;
+function ensureHandlers() {
+    if (!_handlers) {
+        _handlers = {};
+        const { integrations: integrationClasses } = loadAppDefinition();
 
-    // Skip if webhooks not enabled
-    if (!webhookConfig || (typeof webhookConfig === 'object' && !webhookConfig.enabled)) {
-        continue;
-    }
+        for (const IntegrationClass of integrationClasses) {
+            const webhookConfig = IntegrationClass.Definition.webhooks;
+
+            // Skip if webhooks not enabled
+            if (
+                !webhookConfig ||
+                (typeof webhookConfig === 'object' && !webhookConfig.enabled)
+            ) {
+                continue;
+            }
 
-    const router = Router();
-    const basePath = `/api/${IntegrationClass.Definition.name}-integration/webhooks`;
+            const router = Router();
+            const basePath = `/api/${IntegrationClass.Definition.name}-integration/webhooks`;
 
-    console.log(`\n│ Configuring webhook routes for ${IntegrationClass.Definition.name}:`);
+            console.log(
+                `\n│ Configuring webhook routes for ${IntegrationClass.Definition.name}:`
+            );
 
-    // General webhook route (no integration ID)
-    router.post(basePath, async (req, res, next) => {
-        try {
-            const integrationInstance = new IntegrationClass();
-            const dispatcher = new IntegrationEventDispatcher(integrationInstance);
-            await dispatcher.dispatchHttp({
-                event: 'WEBHOOK_RECEIVED',
-                req,
-                res,
-                next,
+            // General webhook route (no integration ID)
+            router.post(basePath, async (req, res, next) => {
+                try {
+                    const integrationInstance = new IntegrationClass();
+                    const dispatcher = new IntegrationEventDispatcher(
+                        integrationInstance
+                    );
+                    await dispatcher.dispatchHttp({
+                        event: 'WEBHOOK_RECEIVED',
+                        req,
+                        res,
+                        next,
+                    });
+                } catch (error) {
+                    next(error);
+                }
             });
-        } catch (error) {
-            next(error);
-        }
-    });
-    console.log(`│ POST ${basePath}`);
+            console.log(`│ POST ${basePath}`);
 
-    // Integration-specific webhook route (with integration ID)
-    router.post(`${basePath}/:integrationId`, async (req, res, next) => {
-        try {
-            const integrationInstance = new IntegrationClass();
-            const dispatcher = new IntegrationEventDispatcher(integrationInstance);
-            await dispatcher.dispatchHttp({
-                event: 'WEBHOOK_RECEIVED',
-                req,
-                res,
-                next,
+            // Integration-specific webhook route (with integration ID)
+            router.post(`${basePath}/:integrationId`, async (req, res, next) => {
+                try {
+                    const integrationInstance = new IntegrationClass();
+                    const dispatcher = new IntegrationEventDispatcher(
+                        integrationInstance
+                    );
+                    await dispatcher.dispatchHttp({
+                        event: 'WEBHOOK_RECEIVED',
+                        req,
+                        res,
+                        next,
+                    });
+                } catch (error) {
+                    next(error);
+                }
             });
-        } catch (error) {
-            next(error);
-        }
-    });
-    console.log(`│ POST ${basePath}/:integrationId`);
-    console.log('│');
+            console.log(`│ POST ${basePath}/:integrationId`);
+            console.log('│');
 
-    handlers[`${IntegrationClass.Definition.name}Webhook`] = {
-        handler: createAppHandler(
-            `HTTP Event: ${IntegrationClass.Definition.name} Webhook`,
-            router,
-            false  // shouldUseDatabase = false
-        ),
-    };
+            _handlers[`${IntegrationClass.Definition.name}Webhook`] = {
+                handler: createAppHandler(
+                    `HTTP Event: ${IntegrationClass.Definition.name} Webhook`,
+                    router,
+                    false // shouldUseDatabase = false
+                ),
+            };
+        }
+    }
+    return _handlers;
 }
 
-module.exports = { handlers };
-
+module.exports = {
+    get handlers() {
+        return ensureHandlers();
+    },
+};