@friggframework/core 2.0.0--canary.550.b8b9a2b.0 → 2.0.0--canary.545.e256e95.0

package/handlers/database-migration-handler.js

@@ -1,24 +1,24 @@
 /**
  * Database Migration Handler for AWS Lambda
- * 
+ *
  * Executes Prisma migrations in a Lambda environment.
  * Based on AWS best practices for running migrations in serverless environments.
- * 
+ *
  * Supported Commands:
  * - deploy: Apply pending migrations to the database (production-safe)
  * - reset: Reset database and apply all migrations (DANGEROUS - dev only)
- * 
+ *
  * Usage:
  *   // Via Lambda invoke
  *   {
  *     "command": "deploy"  // or "reset"
  *   }
- * 
+ *
  * Requirements:
  * - Prisma CLI must be included in deployment or Lambda layer
  * - DATABASE_URL environment variable must be set
  * - VPC configuration for Aurora access
- * 
+ *
  * Reference: https://www.prisma.io/docs/guides/deployment/deployment-guides/deploying-to-aws-lambda
  */
 
@@ -27,7 +27,7 @@ const path = require('path');
 
 /**
  * Execute Prisma migration command
- * 
+ *
  * @param {string} command - Migration command ('deploy' or 'reset')
  * @param {string} schemaPath - Path to Prisma schema file
  * @returns {Promise<number>} Exit code
@@ -35,16 +35,18 @@ const path = require('path');
 async function executePrismaMigration(command, schemaPath) {
     console.log(`Executing Prisma migration: ${command}`);
     console.log(`Schema path: ${schemaPath}`);
-    console.log(`Database URL: ${process.env.DATABASE_URL ? '[SET]' : '[NOT SET]'}`);
+    console.log(
+        `Database URL: ${process.env.DATABASE_URL ? '[SET]' : '[NOT SET]'}`
+    );
 
     return new Promise((resolve, reject) => {
         // Build command arguments
         const args = ['migrate', command];
-        
+
         // Add command-specific options
         if (command === 'reset') {
-            args.push('--force');           // Skip confirmation prompt
-            args.push('--skip-generate');   // Skip client generation (already done in layer)
+            args.push('--force'); // Skip confirmation prompt
+            args.push('--skip-generate'); // Skip client generation (already done in layer)
         }
 
         // Add schema path if provided
@@ -53,7 +55,7 @@ async function executePrismaMigration(command, schemaPath) {
         }
 
         console.log(`Running: prisma ${args.join(' ')}`);
-        
+
         // Execute Prisma CLI
         execFile(
             path.resolve('./node_modules/prisma/build/index.js'),
@@ -63,7 +65,7 @@ async function executePrismaMigration(command, schemaPath) {
                     ...process.env,
                     // Ensure Prisma uses the correct binary target
                     PRISMA_CLI_BINARY_TARGETS: 'rhel-openssl-3.0.x',
-                }
+                },
             },
             (error, stdout, stderr) => {
                 // Log all output
@@ -75,7 +77,10 @@ async function executePrismaMigration(command, schemaPath) {
                 }
 
                 if (error) {
-                    console.error(`Migration ${command} exited with error:`, error.message);
+                    console.error(
+                        `Migration ${command} exited with error:`,
+                        error.message
+                    );
                     console.error(`Exit code: ${error.code || 1}`);
                     resolve(error.code || 1);
                 } else {
@@ -92,11 +97,11 @@ async function executePrismaMigration(command, schemaPath) {
  */
 function validateCommand(command) {
     const validCommands = ['deploy', 'reset'];
-    
+
     if (!validCommands.includes(command)) {
         throw new Error(
             `Invalid migration command: "${command}". ` +
-            `Valid commands are: ${validCommands.join(', ')}`
+                `Valid commands are: ${validCommands.join(', ')}`
         );
     }
 
@@ -106,10 +111,12 @@ function validateCommand(command) {
         if (stage === 'production' || stage === 'prod') {
             throw new Error(
                 'BLOCKED: "reset" command is not allowed in production environment. ' +
-                'This command would delete all data. Use "deploy" instead.'
+                    'This command would delete all data. Use "deploy" instead.'
             );
         }
-        console.warn('⚠️  WARNING: "reset" will DELETE all data and reset the database!');
+        console.warn(
+            '⚠️  WARNING: "reset" will DELETE all data and reset the database!'
+        );
     }
 }
 
@@ -119,14 +126,17 @@ function validateCommand(command) {
 function getSchemaPath() {
     // In Lambda, schemas are in @friggframework/core/generated/
     const baseSchemaPath = './node_modules/@friggframework/core/generated';
-    
+
     // Check if Postgres is enabled
-    if (process.env.DATABASE_URL?.includes('postgresql') || process.env.DATABASE_URL?.includes('postgres')) {
+    if (
+        process.env.DATABASE_URL?.includes('postgresql') ||
+        process.env.DATABASE_URL?.includes('postgres')
+    ) {
         const schemaPath = `${baseSchemaPath}/prisma-postgresql/schema.prisma`;
         console.log(`Using PostgreSQL schema: ${schemaPath}`);
         return schemaPath;
     }
-    
+
     // Check if MongoDB is enabled
     if (process.env.DATABASE_URL?.includes('mongodb')) {
         const schemaPath = `${baseSchemaPath}/prisma-mongodb/schema.prisma`;
@@ -135,13 +145,15 @@ function getSchemaPath() {
     }
 
     // Default to PostgreSQL
-    console.log('DATABASE_URL not set or database type unknown, defaulting to PostgreSQL');
+    console.log(
+        'DATABASE_URL not set or database type unknown, defaulting to PostgreSQL'
+    );
     return `${baseSchemaPath}/prisma-postgresql/schema.prisma`;
 }
 
 /**
  * Lambda handler for database migrations
- * 
+ *
  * @param {Object} event - Lambda event
  * @param {string} event.command - Migration command ('deploy' or 'reset')
  * @param {Object} context - Lambda context
@@ -149,41 +161,48 @@ function getSchemaPath() {
  */
 exports.handler = async (event, context) => {
     const startTime = Date.now();
-    
+
     console.log('='.repeat(60));
     console.log('Database Migration Handler');
     console.log('='.repeat(60));
     console.log('Event:', JSON.stringify(event, null, 2));
-    console.log('Context:', JSON.stringify({
-        functionName: context.functionName,
-        functionVersion: context.functionVersion,
-        memoryLimitInMB: context.memoryLimitInMB,
-        logGroupName: context.logGroupName,
-    }, null, 2));
-    
+    console.log(
+        'Context:',
+        JSON.stringify(
+            {
+                functionName: context.functionName,
+                functionVersion: context.functionVersion,
+                memoryLimitInMB: context.memoryLimitInMB,
+                logGroupName: context.logGroupName,
+            },
+            null,
+            2
+        )
+    );
+
     try {
         // Get migration command (default to 'deploy')
         const command = event.command || 'deploy';
-        
+
         // Validate command
         validateCommand(command);
-        
+
         // Check required environment variables
         if (!process.env.DATABASE_URL) {
             throw new Error(
                 'DATABASE_URL environment variable is not set. ' +
-                'Cannot connect to database for migrations.'
+                    'Cannot connect to database for migrations.'
             );
         }
-        
+
         // Determine schema path
         const schemaPath = getSchemaPath();
-        
+
         // Execute migration
         const exitCode = await executePrismaMigration(command, schemaPath);
-        
+
         const duration = Date.now() - startTime;
-        
+
         if (exitCode === 0) {
             const result = {
                 success: true,
@@ -192,26 +211,27 @@ exports.handler = async (event, context) => {
                 duration: `${duration}ms`,
                 timestamp: new Date().toISOString(),
             };
-            
+
             console.log('='.repeat(60));
             console.log('Migration completed successfully');
             console.log(JSON.stringify(result, null, 2));
             console.log('='.repeat(60));
-            
+
             return result;
         } else {
-            throw new Error(`Migration ${command} failed with exit code ${exitCode}`);
+            throw new Error(
+                `Migration ${command} failed with exit code ${exitCode}`
+            );
         }
-        
     } catch (error) {
         const duration = Date.now() - startTime;
-        
+
         console.error('='.repeat(60));
         console.error('Migration failed');
         console.error('Error:', error.message);
         console.error('Stack:', error.stack);
         console.error('='.repeat(60));
-        
+
         const errorResult = {
             success: false,
             command: event.command || 'unknown',
@@ -219,9 +239,8 @@ exports.handler = async (event, context) => {
             duration: `${duration}ms`,
             timestamp: new Date().toISOString(),
         };
-        
+
         // Return error (don't throw) so Lambda doesn't retry
         return errorResult;
     }
 };
-

package/handlers/middleware/admin-auth.js

@@ -0,0 +1,53 @@
+/**
+ * Admin Auth Middleware
+ *
+ * Shared authentication middleware for all admin endpoints:
+ * - /admin/db-migrate/*
+ * - /admin/scripts/*
+ *
+ * Uses simple ENV-based API key validation.
+ * Expects: x-frigg-admin-api-key header
+ */
+
+/**
+ * Validate admin API key from request header
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+function validateAdminApiKey(req, res, next) {
+    const expectedKey = process.env.ADMIN_API_KEY;
+
+    // Check if admin API key is configured
+    if (!expectedKey) {
+        console.error('ADMIN_API_KEY environment variable not configured');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Admin API key not configured'
+        });
+    }
+
+    const apiKey = req.headers['x-frigg-admin-api-key'];
+
+    // Check if header is present
+    if (!apiKey) {
+        console.error('Missing x-frigg-admin-api-key header');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'x-frigg-admin-api-key header required'
+        });
+    }
+
+    // Validate key
+    if (apiKey !== expectedKey) {
+        console.error('Invalid admin API key provided');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Invalid admin API key'
+        });
+    }
+
+    next();
+}
+
+module.exports = { validateAdminApiKey };