@friggframework/core 2.0.0--canary.548.c8ae0ca.0 → 2.0.0--canary.545.dba001a.0

package/handlers/routers/health.js

@@ -29,7 +29,9 @@ const {
 } = require('../use-cases/check-integrations-health-use-case');
 
 const router = Router();
-const healthCheckRepository = createHealthCheckRepository({ prismaClient: prisma });
+const healthCheckRepository = createHealthCheckRepository({
+    prismaClient: prisma,
+});
 
 // Load integrations and create factories just like auth router does
 // This verifies the system can properly load integrations
@@ -39,14 +41,18 @@ try {
     integrationClasses = appDef.integrations || [];
 
     const moduleRepository = createModuleRepository();
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrationClasses);
+    const moduleDefinitions =
+        getModulesDefinitionFromIntegrationClasses(integrationClasses);
 
     moduleFactory = new ModuleFactory({
         moduleRepository,
         moduleDefinitions,
     });
 } catch (error) {
-    console.error('Failed to load integrations for health check:', error.message);
+    console.error(
+        'Failed to load integrations for health check:',
+        error.message
+    );
     // Factories will be undefined, health check will report unhealthy
     moduleFactory = undefined;
     integrationClasses = [];
@@ -87,256 +93,32 @@ const validateApiKey = (req, res, next) => {
 
 router.use(validateApiKey);
 
-// Helper to detect VPC configuration
-const detectVpcConfiguration = async () => {
-    const results = {
-        isInVpc: false,
-        hasInternetAccess: false,
-        canResolvePublicDns: false,
-        canConnectToAws: false,
-        vpcEndpoints: [],
-    };
+// Provider-specific health checks are loaded via resolveProvider()
+// so core doesn't hardcode any provider package names.
+const { resolveProvider } = require('../../providers/resolve-provider');
 
+function getResolvedProvider() {
     try {
-        // Check if we're in a VPC by looking for VPC-specific environment
-        // Lambda in VPC has specific network interface configuration
-        const dns = require('dns').promises;
-
-        // Test 1: Can we resolve public DNS? (indicates DNS configuration)
-        try {
-            await Promise.race([
-                dns.resolve4('www.google.com'),
-                new Promise((_, reject) =>
-                    setTimeout(() => reject(new Error('timeout')), 2000)
-                ),
-            ]);
-            results.canResolvePublicDns = true;
-        } catch (e) {
-            console.log('Public DNS resolution failed:', e.message);
-        }
-
-        // Test 2: Can we reach internet? (indicates NAT gateway)
-        try {
-            const https = require('https');
-            await new Promise((resolve, reject) => {
-                const req = https.get(
-                    'https://www.google.com',
-                    { timeout: 2000 },
-                    (res) => {
-                        res.destroy();
-                        resolve(true);
-                    }
-                );
-                req.on('error', reject);
-                req.on('timeout', () => {
-                    req.destroy();
-                    reject(new Error('timeout'));
-                });
-            });
-            results.hasInternetAccess = true;
-        } catch (e) {
-            console.log('Internet connectivity test failed:', e.message);
-        }
-
-        // Test 3: Check for VPC endpoints by trying to resolve internal AWS endpoints
-        const region = process.env.AWS_REGION; // Lambda always provides this
-        const vpcEndpointDomains = [
-            `com.amazonaws.${region}.kms`,
-            `com.amazonaws.vpce.${region}`,
-            `kms.${region}.amazonaws.com`,
-        ];
-
-        for (const domain of vpcEndpointDomains) {
-            try {
-                const addresses = await Promise.race([
-                    dns.resolve4(domain).catch(() => dns.resolve6(domain)),
-                    new Promise((_, reject) =>
-                        setTimeout(() => reject(new Error('timeout')), 1000)
-                    ),
-                ]);
-                if (addresses && addresses.length > 0) {
-                    // Check if it's a private IP (VPC endpoint indicator)
-                    const isPrivateIp = addresses.some(
-                        (ip) =>
-                            ip.startsWith('10.') ||
-                            ip.startsWith('172.') ||
-                            ip.startsWith('192.168.')
-                    );
-                    if (isPrivateIp) {
-                        results.vpcEndpoints.push(domain);
-                    }
-                }
-            } catch (e) {
-                // Expected for non-existent endpoints
-            }
-        }
-
-        // Check if Lambda is in VPC using VPC_ENABLED env var set by infrastructure
-        results.isInVpc = process.env.VPC_ENABLED === 'true' ||
-            (!results.hasInternetAccess && results.canResolvePublicDns) ||
-            results.vpcEndpoints.length > 0;
-
-        results.canConnectToAws =
-            results.hasInternetAccess || results.vpcEndpoints.length > 0;
-    } catch (error) {
-        console.error('VPC detection error:', error.message);
+        return resolveProvider();
+    } catch {
+        return null;
     }
+}
 
-    return results;
-};
-
-// KMS decrypt capability check
 const checkKmsDecryptCapability = async () => {
-    const start = Date.now();
-    const { KMS_KEY_ARN } = process.env;
-    if (!KMS_KEY_ARN) {
-        return {
-            status: 'skipped',
-            reason: 'KMS_KEY_ARN not configured',
-        };
-    }
-
-    // Log environment for debugging
-    console.log('KMS Check Debug:', {
-        hasKmsKeyArn: !!KMS_KEY_ARN,
-        kmsKeyArnPrefix: KMS_KEY_ARN?.substring(0, 30),
-        awsRegion: process.env.AWS_REGION,
-        hasDiscoveryKey: !!process.env.AWS_DISCOVERY_KMS_KEY_ID,
-    });
-
-    // First, detect VPC configuration
-    const vpcConfig = await detectVpcConfiguration();
-    console.log('VPC Configuration:', vpcConfig);
-
-    // Test DNS resolution for KMS endpoint
-    try {
-        const dns = require('dns').promises;
-        const region = process.env.AWS_REGION; // Lambda always provides this
-        const kmsEndpoint = `kms.${region}.amazonaws.com`;
-        console.log('Testing DNS resolution for:', kmsEndpoint);
-
-        // Wrap DNS resolution in a timeout
-        const dnsPromise = dns.resolve4(kmsEndpoint);
-        const timeoutPromise = new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('DNS resolution timeout')), 3000)
-        );
-
-        const addresses = await Promise.race([dnsPromise, timeoutPromise]);
-        console.log('KMS endpoint resolved to:', addresses);
-
-        // Check if resolved to private IP (VPC endpoint)
-        const isVpcEndpoint = addresses.some(
-            (ip) =>
-                ip.startsWith('10.') ||
-                ip.startsWith('172.') ||
-                ip.startsWith('192.168.')
-        );
-
-        if (isVpcEndpoint) {
-            console.log(
-                'KMS VPC Endpoint detected - using private connectivity'
-            );
-        }
-
-        // Test TCP connectivity to KMS (port 443)
-        const net = require('net');
-        const testConnection = () =>
-            new Promise((resolve) => {
-                const socket = new net.Socket();
-                const connectionTimeout = setTimeout(() => {
-                    socket.destroy();
-                    resolve({ connected: false, error: 'Connection timeout' });
-                }, 3000);
-
-                socket.on('connect', () => {
-                    clearTimeout(connectionTimeout);
-                    socket.destroy();
-                    resolve({ connected: true });
-                });
-
-                socket.on('error', (err) => {
-                    clearTimeout(connectionTimeout);
-                    resolve({ connected: false, error: err.message });
-                });
-
-                // Try connecting to first resolved address on HTTPS port
-                socket.connect(443, addresses[0]);
-            });
-
-        const connResult = await testConnection();
-        console.log('TCP connectivity test:', connResult);
-
-        if (!connResult.connected) {
-            return {
-                status: 'unhealthy',
-                error: `Cannot connect to KMS endpoint: ${connResult.error}`,
-                dnsResolved: true,
-                tcpConnection: false,
-                vpcConfig,
-                latencyMs: Date.now() - start,
-            };
-        }
-    } catch (dnsError) {
-        console.error('DNS resolution failed:', dnsError.message);
-        return {
-            status: 'unhealthy',
-            error: `Cannot resolve KMS endpoint: ${dnsError.message}`,
-            dnsResolved: false,
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
+    const provider = getResolvedProvider();
+    if (!provider?.checkKmsDecryptCapability) {
+        return { status: 'skipped', reason: 'Provider does not support KMS health checks' };
     }
+    return provider.checkKmsDecryptCapability();
+};
 
-    try {
-        // Use AWS SDK v3 for consistency with the rest of the codebase
-        // eslint-disable-next-line global-require
-        const {
-            KMSClient,
-            GenerateDataKeyCommand,
-            DecryptCommand,
-        } = require('@aws-sdk/client-kms');
-
-        // Lambda always provides AWS_REGION
-        const region = process.env.AWS_REGION;
-
-        const kms = new KMSClient({
-            region,
-            requestHandler: {
-                connectionTimeout: 10000, // 10 second connection timeout
-                requestTimeout: 25000, // 25 second timeout for slow VPC connections
-            },
-            maxAttempts: 1, // No retries on health checks
-        });
-
-        // Generate a data key (without plaintext logging) then immediately decrypt ciphertext to ensure decrypt perms.
-        const dataKeyResp = await kms.send(
-            new GenerateDataKeyCommand({
-                KeyId: KMS_KEY_ARN,
-                KeySpec: 'AES_256',
-            })
-        );
-        const decryptResp = await kms.send(
-            new DecryptCommand({ CiphertextBlob: dataKeyResp.CiphertextBlob })
-        );
-
-        const success = Boolean(
-            dataKeyResp.CiphertextBlob && decryptResp.Plaintext
-        );
-
-        return {
-            status: success ? 'healthy' : 'unhealthy',
-            kmsKeyArnSuffix: KMS_KEY_ARN.slice(-12),
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
-    } catch (error) {
-        return {
-            status: 'unhealthy',
-            error: error.message,
-            vpcConfig,
-            latencyMs: Date.now() - start,
-        };
+const detectVpcConfiguration = async () => {
+    const provider = getResolvedProvider();
+    if (!provider?.detectVpcConfiguration) {
+        return { status: 'skipped', reason: 'Provider does not support VPC detection' };
     }
+    return provider.detectVpcConfiguration();
 };
 
 router.get('/health', async (_req, res) => {
@@ -430,7 +212,8 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        response.checks.encryption = await checkEncryptionHealthUseCase.execute();
+        response.checks.encryption =
+            await checkEncryptionHealthUseCase.execute();
         if (response.checks.encryption.status === 'unhealthy') {
             response.status = 'unhealthy';
         }
@@ -445,12 +228,16 @@ router.get('/health/detailed', async (_req, res) => {
     }
 
     try {
-        const { apiStatuses, allReachable } = await checkExternalApisHealthUseCase.execute();
+        const { apiStatuses, allReachable } =
+            await checkExternalApisHealthUseCase.execute();
         response.checks.externalApis = apiStatuses;
         if (!allReachable) {
             response.status = 'unhealthy';
         }
-        console.log('External APIs check completed:', response.checks.externalApis);
+        console.log(
+            'External APIs check completed:',
+            response.checks.externalApis
+        );
     } catch (error) {
         response.checks.externalApis = {
             status: 'unhealthy',
@@ -462,7 +249,10 @@ router.get('/health/detailed', async (_req, res) => {
 
     try {
         response.checks.integrations = checkIntegrationsHealthUseCase.execute();
-        console.log('Integrations check completed:', response.checks.integrations);
+        console.log(
+            'Integrations check completed:',
+            response.checks.integrations
+        );
     } catch (error) {
         response.checks.integrations = {
             status: 'unhealthy',

package/handlers/routers/integration-defined-routers.js

@@ -1,7 +1,5 @@
 const { createAppHandler } = require('./../app-handler-helpers');
-const {
-    loadAppDefinition,
-} = require('../app-definition-loader');
+const { loadAppDefinition } = require('../app-definition-loader');
 const { Router } = require('express');
 const { loadRouterFromObject } = require('../backend-utils');
 
@@ -13,7 +11,9 @@ for (const IntegrationClass of integrationClasses) {
     const router = Router();
     const basePath = `/api/${IntegrationClass.Definition.name}-integration`;
 
-    console.log(`\n│ Configuring routes for ${IntegrationClass.Definition.name} Integration:`);
+    console.log(
+        `\n│ Configuring routes for ${IntegrationClass.Definition.name} Integration:`
+    );
 
     for (const routeDef of IntegrationClass.Definition.routes) {
         if (typeof routeDef === 'function') {

package/handlers/routers/integration-webhook-routers.js

@@ -1,7 +1,9 @@
 const { createAppHandler } = require('./../app-handler-helpers');
 const { loadAppDefinition } = require('../app-definition-loader');
 const { Router } = require('express');
-const { IntegrationEventDispatcher } = require('../integration-event-dispatcher');
+const {
+    IntegrationEventDispatcher,
+} = require('../integration-event-dispatcher');
 
 const handlers = {};
 const { integrations: integrationClasses } = loadAppDefinition();
@@ -10,20 +12,27 @@ for (const IntegrationClass of integrationClasses) {
     const webhookConfig = IntegrationClass.Definition.webhooks;
 
     // Skip if webhooks not enabled
-    if (!webhookConfig || (typeof webhookConfig === 'object' && !webhookConfig.enabled)) {
+    if (
+        !webhookConfig ||
+        (typeof webhookConfig === 'object' && !webhookConfig.enabled)
+    ) {
         continue;
     }
 
     const router = Router();
     const basePath = `/api/${IntegrationClass.Definition.name}-integration/webhooks`;
 
-    console.log(`\n│ Configuring webhook routes for ${IntegrationClass.Definition.name}:`);
+    console.log(
+        `\n│ Configuring webhook routes for ${IntegrationClass.Definition.name}:`
+    );
 
     // General webhook route (no integration ID)
     router.post(basePath, async (req, res, next) => {
         try {
             const integrationInstance = new IntegrationClass();
-            const dispatcher = new IntegrationEventDispatcher(integrationInstance);
+            const dispatcher = new IntegrationEventDispatcher(
+                integrationInstance
+            );
             await dispatcher.dispatchHttp({
                 event: 'WEBHOOK_RECEIVED',
                 req,
@@ -40,7 +49,9 @@ for (const IntegrationClass of integrationClasses) {
     router.post(`${basePath}/:integrationId`, async (req, res, next) => {
         try {
             const integrationInstance = new IntegrationClass();
-            const dispatcher = new IntegrationEventDispatcher(integrationInstance);
+            const dispatcher = new IntegrationEventDispatcher(
+                integrationInstance
+            );
             await dispatcher.dispatchHttp({
                 event: 'WEBHOOK_RECEIVED',
                 req,
@@ -58,10 +69,9 @@ for (const IntegrationClass of integrationClasses) {
         handler: createAppHandler(
             `HTTP Event: ${IntegrationClass.Definition.name} Webhook`,
             router,
-            false  // shouldUseDatabase = false
+            false // shouldUseDatabase = false
         ),
     };
 }
 
 module.exports = { handlers };
-

package/handlers/routers/middleware/loadUser.js

@@ -0,0 +1,39 @@
+const catchAsyncError = require('express-async-handler');
+const {
+    GetUserFromBearerToken,
+} = require('../../../user/use-cases/get-user-from-bearer-token');
+const {
+    createUserRepository,
+} = require('../../../user/repositories/user-repository-factory');
+const { loadAppDefinition } = require('../../app-definition-loader');
+
+/**
+ * Load user from bearer token middleware
+ * Uses DDD pattern: Handler → Use Case → Repository
+ */
+module.exports = catchAsyncError(async (req, res, next) => {
+    const authorizationHeader = req.headers.authorization;
+
+    if (authorizationHeader) {
+        // Initialize dependencies following DDD pattern
+        const { userConfig } = loadAppDefinition();
+        const userRepository = createUserRepository({ userConfig });
+        const getUserFromBearerToken = new GetUserFromBearerToken({
+            userRepository,
+            userConfig,
+        });
+
+        try {
+            // Execute use case to load user
+            req.user = await getUserFromBearerToken.execute(
+                authorizationHeader
+            );
+        } catch (error) {
+            // Don't fail - just leave req.user undefined
+            // Let requireLoggedInUser middleware handle auth failures
+            console.debug('Failed to load user from token:', error.message);
+        }
+    }
+
+    return next();
+});

package/handlers/routers/middleware/requireAdmin.js

@@ -0,0 +1,43 @@
+/**
+ * Middleware to require admin API key authentication.
+ * Checks for x-frigg-admin-api-key header matching ADMIN_API_KEY environment variable.
+ * In non-production environments, allows all requests through for easier development.
+ *
+ * Uses the same header convention as validateAdminApiKey (handlers/middleware/admin-auth.js).
+ *
+ * @param {import('express').Request} req - Express request object
+ * @param {import('express').Response} res - Express response object
+ * @param {import('express').NextFunction} next - Express next middleware function
+ */
+const requireAdmin = (req, res, next) => {
+    // Allow access in local development (when NODE_ENV is not production)
+    if (process.env.NODE_ENV !== 'production') {
+        console.log('[requireAdmin] Development mode - bypassing admin auth');
+        return next();
+    }
+
+    const apiKey = req.headers['x-frigg-admin-api-key'];
+
+    if (!apiKey) {
+        console.error('[requireAdmin] Missing x-frigg-admin-api-key header');
+        return res.status(401).json({
+            status: 'error',
+            message: 'Unauthorized - Admin API key required',
+            code: 'MISSING_API_KEY',
+        });
+    }
+
+    if (apiKey !== process.env.ADMIN_API_KEY) {
+        console.error('[requireAdmin] Invalid API key provided');
+        return res.status(401).json({
+            status: 'error',
+            message: 'Unauthorized - Invalid admin API key',
+            code: 'INVALID_API_KEY',
+        });
+    }
+
+    console.log('[requireAdmin] Admin authentication successful');
+    next();
+};
+
+module.exports = { requireAdmin };

package/handlers/routers/middleware/requireLoggedInUser.js

@@ -0,0 +1,19 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Require logged in user middleware
+ * Ensures req.user was successfully loaded by loadUser middleware
+ *
+ * Uses DDD pattern: Middleware checks domain entity existence
+ * req.user is populated by loadUser middleware using GetUserFromBearerToken use case
+ */
+const requireLoggedInUser = (req, res, next) => {
+    // Check if user was successfully loaded by loadUser middleware
+    if (!req.user || !req.user.getId()) {
+        throw Boom.unauthorized('Invalid Token');
+    }
+
+    next();
+};
+
+module.exports = { requireLoggedInUser };

package/handlers/routers/websocket.js

@@ -1,5 +1,7 @@
 const { createHandler } = require('@friggframework/core');
-const { createWebsocketConnectionRepository } = require('../../database/websocket-connection-repository-factory');
+const {
+    createWebsocketConnectionRepository,
+} = require('../../database/websocket-connection-repository-factory');
 
 const websocketConnectionRepository = createWebsocketConnectionRepository();
 
@@ -10,7 +12,9 @@ const handleWebSocketConnection = async (event, context) => {
             // Handle new connection
             try {
                 const connectionId = event.requestContext.connectionId;
-                await websocketConnectionRepository.createConnection(connectionId);
+                await websocketConnectionRepository.createConnection(
+                    connectionId
+                );
                 console.log(`Stored new connection: ${connectionId}`);
                 return { statusCode: 200, body: 'Connected.' };
             } catch (error) {
@@ -22,7 +26,9 @@ const handleWebSocketConnection = async (event, context) => {
             // Handle disconnection
             try {
                 const connectionId = event.requestContext.connectionId;
-                await websocketConnectionRepository.deleteConnection(connectionId);
+                await websocketConnectionRepository.deleteConnection(
+                    connectionId
+                );
                 console.log(`Removed connection: ${connectionId}`);
                 return { statusCode: 200, body: 'Disconnected.' };
             } catch (error) {

package/handlers/use-cases/check-integrations-health-use-case.js

@@ -5,9 +5,10 @@ class CheckIntegrationsHealthUseCase {
     }
 
     execute() {
-        const moduleDefinitions = (this.moduleFactory && this.moduleFactory.moduleDefinitions)
-            ? this.moduleFactory.moduleDefinitions
-            : [];
+        const moduleDefinitions =
+            this.moduleFactory && this.moduleFactory.moduleDefinitions
+                ? this.moduleFactory.moduleDefinitions
+                : [];
 
         const integrationClasses = Array.isArray(this.integrationClasses)
             ? this.integrationClasses
@@ -15,13 +16,19 @@ class CheckIntegrationsHealthUseCase {
 
         // Extract module names from definitions
         const moduleTypes = Array.isArray(moduleDefinitions)
-            ? moduleDefinitions.map(def => def.moduleName || def.name || def.label || 'Unknown')
+            ? moduleDefinitions.map(
+                  (def) => def.moduleName || def.name || def.label || 'Unknown'
+              )
             : [];
 
         // Extract integration names from classes
-        const integrationNames = integrationClasses.map(IntegrationClass => {
+        const integrationNames = integrationClasses.map((IntegrationClass) => {
             try {
-                return IntegrationClass.Definition?.name || IntegrationClass.name || 'Unknown';
+                return (
+                    IntegrationClass.Definition?.name ||
+                    IntegrationClass.name ||
+                    'Unknown'
+                );
             } catch {
                 return 'Unknown';
             }