@friggframework/core 2.0.0--canary.643.45b1fbc.0 → 2.0.0--canary.636.7dc8dca.0

package/handlers/routers/user.js

@@ -1,19 +1,9 @@
+const express = require('express');
 const { createAppHandler } = require('../app-handler-helpers');
+const { checkRequiredParams } = require('@friggframework/core');
 const {
     createUserRepository,
 } = require('../../user/repositories/user-repository-factory');
-const {
-    createModuleRepository,
-} = require('../../modules/repositories/module-repository-factory');
-const {
-    createCredentialRepository,
-} = require('../../credential/repositories/credential-repository-factory');
-const {
-    createIntegrationRepository,
-} = require('../../integrations/repositories/integration-repository-factory');
-const {
-    getModulesDefinitionFromIntegrationClasses,
-} = require('../../integrations/utils/map-integration-dto');
 const {
     CreateIndividualUser,
 } = require('../../user/use-cases/create-individual-user');
@@ -21,101 +11,52 @@ const { LoginUser } = require('../../user/use-cases/login-user');
 const {
     CreateTokenForUserId,
 } = require('../../user/use-cases/create-token-for-user-id');
-const {
-    GetUserFromXFriggHeaders,
-} = require('../../user/use-cases/get-user-from-x-frigg-headers');
-const { LoginWithApiKey } = require('../../user/use-cases/login-with-api-key');
-const {
-    validateApiKeyAuthMode,
-} = require('../../user/use-cases/validate-api-key-auth-mode');
-const {
-    ProcessAuthorizationCallback,
-} = require('../../modules/use-cases/process-authorization-callback');
-const { FixedWindowRateLimiter } = require('../rate-limiter');
+const catchAsyncError = require('express-async-handler');
 const { loadAppDefinition } = require('../app-definition-loader');
-const { buildUserRouter } = require('./user-router');
-
-// ---------------------------------------------------------------------------
-// Module-scope wiring (production). Kept thin; all logic lives in use cases.
-// The route factory (buildUserRouter) is side-effect-free and lives in
-// ./user-router.js so it can be unit-tested without loading an app definition.
-// ---------------------------------------------------------------------------
-const { integrations: integrationClasses, userConfig } = loadAppDefinition();
-const moduleDefinitions =
-    getModulesDefinitionFromIntegrationClasses(integrationClasses);
-
-// Fail fast if apiKey mode names a module the app does not have (no-op when off).
-validateApiKeyAuthMode(userConfig, moduleDefinitions);
-
-const apiKeyModeEnabled = Boolean(userConfig?.authModes?.apiKey);
 
-// One-time wiring-time warning: apiKey mode is enabled but no Origin/Referer
-// allowlist is configured, so the CSRF check (assertOriginAllowed) is a no-op
-// and the SameSite=strict session cookie is the only residual protection. This
-// is intentionally NOT a hard failure — it must not break unconfigured local
-// dev — but adopters serving a browser SPA should set allowedOrigins (ADR-034 §7).
-if (
-    apiKeyModeEnabled &&
-    !Array.isArray(userConfig?.authModes?.apiKey?.allowedOrigins)
-) {
-    // eslint-disable-next-line no-console
-    console.warn(
-        '[Frigg] apiKey auth mode is enabled without user.authModes.apiKey.allowedOrigins. ' +
-            'CSRF Origin/Referer enforcement is OFF; the SameSite=strict session cookie is the only ' +
-            'residual protection. Set allowedOrigins to a list of trusted browser origins to lock this down (ADR-034 §7).'
-    );
-}
+const router = express();
+const { userConfig } = loadAppDefinition();
 const userRepository = createUserRepository();
 const createIndividualUser = new CreateIndividualUser({
     userRepository,
     userConfig,
 });
-const loginUser = new LoginUser({ userRepository, userConfig });
-const createTokenForUserId = new CreateTokenForUserId({ userRepository });
-
-// apiKey-mode collaborators are only wired when the mode is enabled, so an app
-// that never opts in pays nothing and behaves exactly as before.
-let loginWithApiKey = null;
-if (apiKeyModeEnabled) {
-    const moduleRepository = createModuleRepository();
-    const credentialRepository = createCredentialRepository();
-    const integrationRepository = createIntegrationRepository();
-
-    const getUserFromXFriggHeaders = new GetUserFromXFriggHeaders({
-        userRepository,
-        userConfig,
-    });
-    const processAuthorizationCallback = new ProcessAuthorizationCallback({
-        moduleRepository,
-        credentialRepository,
-        integrationRepository,
-        moduleDefinitions,
-    });
-
-    loginWithApiKey = new LoginWithApiKey({
-        userConfig,
-        moduleDefinitions,
-        getUserFromXFriggHeaders,
-        processAuthorizationCallback,
-        createTokenForUserId,
-    });
-}
-
-const rlConfig = userConfig?.authModes?.apiKey?.rateLimit || {};
-const apiKeyLoginLimiter = new FixedWindowRateLimiter({
-    windowMs: rlConfig.windowMs ?? 60000,
-    maxPerKey: rlConfig.maxPerKey ?? 10,
-    maxGlobal: rlConfig.maxGlobal ?? 1000,
-});
-
-const router = buildUserRouter({
+const loginUser = new LoginUser({
+    userRepository,
     userConfig,
-    loginUser,
-    createIndividualUser,
-    createTokenForUserId,
-    loginWithApiKey,
-    apiKeyLoginLimiter,
 });
+const createTokenForUserId = new CreateTokenForUserId({ userRepository });
+
+// define the login endpoint
+router.route('/user/login').post(
+    catchAsyncError(async (req, res) => {
+        const { username, password } = checkRequiredParams(req.body, [
+            'username',
+            'password',
+        ]);
+        const user = await loginUser.execute({ username, password });
+        const token = await createTokenForUserId.execute(user.getId(), 120);
+        res.status(201);
+        res.json({ token });
+    })
+);
+
+router.route('/user/create').post(
+    catchAsyncError(async (req, res) => {
+        const { username, password } = checkRequiredParams(req.body, [
+            'username',
+            'password',
+        ]);
+
+        const user = await createIndividualUser.execute({
+            username,
+            password,
+        });
+        const token = await createTokenForUserId.execute(user.getId(), 120);
+        res.status(201);
+        res.json({ token });
+    })
+);
 
 const handler = createAppHandler('HTTP Event: User', router);
 

package/index.js

@@ -31,10 +31,6 @@ const {
     GetUserFromAdopterJwt,
 } = require('./user/use-cases/get-user-from-adopter-jwt');
 const { AuthenticateUser } = require('./user/use-cases/authenticate-user');
-const { LoginWithApiKey } = require('./user/use-cases/login-with-api-key');
-const {
-    validateApiKeyAuthMode,
-} = require('./user/use-cases/validate-api-key-auth-mode');
 
 const {
     CredentialRepository,
@@ -125,8 +121,6 @@ module.exports = {
     GetUserFromXFriggHeaders,
     GetUserFromAdopterJwt,
     AuthenticateUser,
-    LoginWithApiKey,
-    validateApiKeyAuthMode,
     CredentialRepository,
     ModuleRepository,
     IntegrationMappingRepository,

package/logs/index.js

@@ -1,15 +1,7 @@
-const {
-    debug,
-    initDebugLog,
-    flushDebugLog,
-    redactSensitive,
-    SENSITIVE_KEYS,
-} = require('./logger');
+const {debug, initDebugLog, flushDebugLog} = require('./logger');
 
 module.exports = {
     debug,
     initDebugLog,
-    flushDebugLog,
-    redactSensitive,
-    SENSITIVE_KEYS,
-};
+    flushDebugLog
+}

package/logs/logger.js

@@ -6,127 +6,6 @@ const util = require('util');
 const logs = [];
 let flushCalled = false;
 
-/**
- * Keys whose values must never reach the logs. Matched case-insensitively.
- * These are the credential-bearing fields a request body / headers can carry —
- * the apiKey-login body (`{ apiKey }`), the friggToken body (`{ password }`),
- * OAuth material, and Authorization headers. Buffered debug output (and the
- * verbose `DEBUG_VERBOSE=1` path) is dumped verbatim on any 5xx, so a raw secret
- * in `event.body` would otherwise land in CloudWatch (ADR-034 §4).
- * @constant {Set<string>}
- */
-const SENSITIVE_KEYS = new Set([
-    'apikey',
-    'api_key',
-    'password',
-    'token',
-    'authorization',
-    'refresh_token',
-    'access_token',
-]);
-
-const REDACTED = '[REDACTED]';
-// Bound recursion and body-parse cost so a pathological event can never hang or
-// blow the stack inside the logger. The logger must never throw.
-const MAX_REDACT_DEPTH = 8;
-const MAX_BODY_PARSE_LENGTH = 100000;
-
-function isSensitiveKey(key) {
-    return typeof key === 'string' && SENSITIVE_KEYS.has(key.toLowerCase());
-}
-
-/**
- * Substring/regex fallback for a request body we could not (or should not)
- * JSON-parse: a non-JSON body, a form-urlencoded body, or one too large to parse
- * cheaply. Masks `"key":"value"` (JSON-ish) and `key=value` (form) shapes for the
- * denylisted keys. Best-effort — never throws.
- */
-function redactBodyStringFallback(body) {
-    let out = body;
-    for (const key of SENSITIVE_KEYS) {
-        // JSON-ish:  "apiKey": "secret"  ->  "apiKey":"[REDACTED]"
-        out = out.replace(
-            new RegExp(`("${key}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`, 'gi'),
-            `$1"${REDACTED}"`
-        );
-        // Form-urlencoded:  apiKey=secret  ->  apiKey=[REDACTED]
-        out = out.replace(
-            new RegExp(`(${key}=)[^&\\s]*`, 'gi'),
-            `$1${REDACTED}`
-        );
-    }
-    return out;
-}
-
-/**
- * Redact a serialized request `body` string. JSON bodies are parsed, deep-redacted
- * and re-serialized; non-JSON / oversized bodies fall back to pattern masking.
- * Never throws.
- */
-function redactBodyString(body) {
-    if (body.length <= MAX_BODY_PARSE_LENGTH) {
-        try {
-            const parsed = JSON.parse(body);
-            if (parsed && typeof parsed === 'object') {
-                return JSON.stringify(redactValue(parsed, 0, new Set()));
-            }
-        } catch (_) {
-            // Not JSON — fall through to pattern masking below.
-        }
-    }
-    return redactBodyStringFallback(body);
-}
-
-/**
- * Deep-clone `value`, masking any denylisted key anywhere in the structure and
- * redacting an embedded `body` string (the Lambda/API-Gateway convention).
- * Returns a NEW object so the caller's data is never mutated; circular refs and
- * excessive depth are handled defensively. Never throws (guarded by the public
- * `redactSensitive`).
- */
-function redactValue(value, depth, seen) {
-    if (value === null || typeof value !== 'object') {
-        return value;
-    }
-    if (depth > MAX_REDACT_DEPTH || seen.has(value)) {
-        return value;
-    }
-    seen.add(value);
-
-    if (Array.isArray(value)) {
-        return value.map((v) => redactValue(v, depth + 1, seen));
-    }
-
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-        if (isSensitiveKey(k)) {
-            out[k] = REDACTED;
-        } else if (k.toLowerCase() === 'body' && typeof v === 'string') {
-            out[k] = redactBodyString(v);
-        } else {
-            out[k] = redactValue(v, depth + 1, seen);
-        }
-    }
-    return out;
-}
-
-/**
- * Framework-wide redaction applied to anything buffered for logging. Strips
- * credential-bearing fields from objects (e.g. a buffered Lambda event) before
- * they are serialized. Non-object arguments (the event name, plain strings) pass
- * through untouched. Guaranteed not to throw.
- * @param {*} value
- * @returns {*}
- */
-function redactSensitive(value) {
-    try {
-        return redactValue(value, 0, new Set());
-    } catch (_) {
-        // A logger must never break the request it is trying to describe.
-        return value;
-    }
-}
-
 function debug(...messages) {
     if (messages.length) {
         const date = new Date();
@@ -146,11 +25,8 @@ function initDebugLog(...initMessages) {
     // Hacky but fast way to empty an array.
     logs.length = 0;
 
-    // Redact credential-bearing fields (e.g. the login request body buffered in
-    // the Lambda event) BEFORE they are serialized and buffered. This is the one
-    // choke point every handler passes its raw event through, so masking here
-    // protects both the buffered dump and the DEBUG_VERBOSE=1 immediate path.
-    debug(...initMessages.map(redactSensitive));
+    // Log initial event
+    debug(...initMessages);
 }
 
 function flushDebugLog(error) {
@@ -186,10 +62,4 @@ function flushDebugLog(error) {
     }
 }
 
-module.exports = {
-    debug,
-    initDebugLog,
-    flushDebugLog,
-    redactSensitive,
-    SENSITIVE_KEYS,
-};
+module.exports = { debug, initDebugLog, flushDebugLog };

package/modules/module.js

@@ -148,9 +148,29 @@ class Module extends Delegate {
             await this.deauthorize();
         } else if (delegateString === this.api.DLGT_INVALID_AUTH) {
             await this.markCredentialsInvalid(object);
+        } else if (delegateString === this.api.DLGT_CREDENTIAL_RELOAD) {
+            return this.reloadCredential();
         }
     }
 
+    /**
+     * Re-reads the credential row from the database. The requester can then
+     * adopt a concurrent invocation's refresh and does not race it.
+     * @returns {Promise<Object|null>} The persisted token fields, or null
+     *   when no credential row is available. The requester treats null as
+     *   "nothing to adopt" and continues with its own refresh.
+     */
+    async reloadCredential() {
+        if (!this.credential?.id) return null;
+        const freshFromDatabase =
+            await this.credentialRepository.findCredentialById(
+                this.credential.id
+            );
+        if (!freshFromDatabase) return null;
+        this.credential = freshFromDatabase;
+        return this.apiParamsFromCredential(freshFromDatabase);
+    }
+
     async markCredentialsInvalid(diagnosticInfo = null) {
         if (!this.credential) return;
 

package/modules/requester/oauth-2.js

@@ -60,9 +60,26 @@ class OAuth2Requester extends Requester {
         this.DLGT_TOKEN_UPDATE = 'TOKEN_UPDATE';
         /** @type {string} Delegate type for token deauthorization notifications */
         this.DLGT_TOKEN_DEAUTHORIZED = 'TOKEN_DEAUTHORIZED';
+        /**
+         * @type {string} Delegate type that asks the Module for the stored
+         * credential. The requester can then adopt a concurrent invocation's
+         * refresh and does not race it. See _adoptNewerCredential.
+         */
+        this.DLGT_CREDENTIAL_RELOAD = 'CREDENTIAL_RELOAD';
 
         this.delegateTypes.push(this.DLGT_TOKEN_UPDATE);
         this.delegateTypes.push(this.DLGT_TOKEN_DEAUTHORIZED);
+        this.delegateTypes.push(this.DLGT_CREDENTIAL_RELOAD);
+
+        /**
+         * Re-read delays after an invalid_grant, in ms. The winner's write
+         * can arrive after the loser's rejection (716 ms measured in
+         * production). Wait between re-reads before you decide that the
+         * credential is dead. Tests can inject other values.
+         */
+        this.credentialReloadBackoffMs = params?.credentialReloadBackoffMs ?? [
+            500, 1000, 1500,
+        ];
 
         /** @type {string} OAuth grant type */
         this.grant_type = get(params, 'grant_type', 'authorization_code');
@@ -295,6 +312,16 @@ class OAuth2Requester extends Requester {
      * @returns {Promise<boolean>} True if refresh succeeded, false if failed
      */
     async refreshAuth() {
+        // The wrapper runs this check before it calls refreshAuth(). Callers
+        // that reach this method directly skip the wrapper, so the check runs
+        // here for them. The guard keeps it at one read per refresh.
+        if (
+            !this._isInsideRefreshFlow() &&
+            (await this._adoptNewerCredential())
+        ) {
+            return true;
+        }
+
         try {
             console.log('[Frigg] Starting token refresh', {
                 grant_type: this.grant_type,
@@ -310,7 +337,11 @@ class OAuth2Requester extends Requester {
                     refresh_token: this.refresh_token,
                 });
             } else {
-                await this.getTokenFromClientCredentials();
+                // getTokenFromClientCredentials() reports a failed token
+                // request itself and resolves to undefined. Without this
+                // check, the refresh counts as a success with no new token.
+                const tokenRes = await this.getTokenFromClientCredentials();
+                if (!tokenRes) return false;
             }
             console.log('[Frigg] Token refresh succeeded');
             return true;
@@ -322,8 +353,21 @@ class OAuth2Requester extends Requester {
                 response_status: error?.response?.status,
                 response_data: error?.response?.data,
             });
-            // Status only: the refresh body carries client_secret, and
-            // FetchError embeds the body in its message outside prod.
+
+            if (!this._isDefinitiveAuthRejection(error)) {
+                throw this._transportFailureError(error, moduleName);
+            }
+
+            if (await this._adoptNewerCredentialWithBackoff()) return true;
+
+            // The provider rejected the grant, and the store has nothing
+            // newer. The credential is dead.
+            this.telemetry?.count?.('frigg.auth.refresh_race_lost', 1, {
+                module: this._telemetryModuleLabel(),
+            });
+            // Send the status only. The refresh body contains the
+            // client_secret, and FetchError puts the body in its message
+            // outside prod.
             await this.notify(this.DLGT_INVALID_AUTH, {
                 statusCode: error?.statusCode,
             });
@@ -331,6 +375,106 @@ class OAuth2Requester extends Requester {
         }
     }
 
+    /**
+     * A timeout, a 429, or a 5xx from the token endpoint says nothing about
+     * the credential. The error must stay retryable: the caller fails loudly
+     * (worker throw → SQS retry → DLQ) and does not flag a healthy
+     * credential. This is a fresh Error on purpose. Outside prod, the
+     * original message can contain the request body, and the body carries
+     * the client_secret.
+     */
+    _transportFailureError(error, moduleName) {
+        const status =
+            error?.statusCode ?? error?.status ?? error?.response?.status;
+        const transportError = new Error(
+            `[Frigg] Token refresh transport failure for ${moduleName}` +
+                (status != null ? ` (status ${status})` : '')
+        );
+        transportError.statusCode = status;
+        transportError.isTokenRefreshTransportFailure = true;
+        return transportError;
+    }
+
+    /**
+     * A definitive rejection can mean that another invocation consumed this
+     * refresh token first. That invocation's write can be unreadable for a
+     * short time. Re-read with a bounded backoff before you decide that the
+     * credential is dead.
+     */
+    async _adoptNewerCredentialWithBackoff() {
+        for (const delayMs of this.credentialReloadBackoffMs) {
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            if (await this._adoptNewerCredential()) {
+                console.log(
+                    '[Frigg] Adopted a newer credential after a refresh rejection',
+                    { module: this._telemetryModuleLabel() }
+                );
+                this.telemetry?.count?.('frigg.auth.refresh_race_recovered', 1, {
+                    module: this._telemetryModuleLabel(),
+                });
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * True when the token endpoint refused the grant. RFC 6749 §5.2 sets
+     * the status: 400, or 401 for invalid_client. A 429 or a 5xx is never a
+     * verdict on the credential. Body markers are only a fallback for SDK
+     * errors that have no status code. Production FetchErrors have a
+     * sanitized body, so a marker cannot be the primary signal.
+     */
+    _isDefinitiveAuthRejection(error) {
+        const status =
+            error?.statusCode ?? error?.status ?? error?.response?.status;
+        if (status !== undefined && status !== null) {
+            return status === 400 || status === 401;
+        }
+        const haystack = [
+            error?.message,
+            error?.body,
+            typeof error?.error === 'string' ? error.error : null,
+            error?.response?.data && JSON.stringify(error.response.data),
+        ]
+            .filter(Boolean)
+            .join(' ');
+        return /\b(invalid_grant|invalid_client)\b/i.test(haystack);
+    }
+
+    /**
+     * Adopts the credential stored in the database if it is newer than the
+     * credential from the instance. The refresh token decides "newer": a
+     * provider can rotate it and return an identical access-token string.
+     * The reload only reads. A reload failure is not fatal: a database blip
+     * must not change the auth behavior.
+     *
+     * @returns {Promise<boolean>} True if the module adopted a newer
+     *   credential.
+     */
+    async _adoptNewerCredential() {
+        let stored = null;
+        try {
+            stored = await this.notify(this.DLGT_CREDENTIAL_RELOAD);
+        } catch (_) {
+            return false;
+        }
+        if (!stored?.refresh_token) return false;
+        if (stored.refresh_token === this.refresh_token) return false;
+
+        if (stored.access_token) {
+            this.access_token = stored.access_token;
+        }
+        this.refresh_token = stored.refresh_token;
+        if (stored.accessTokenExpire !== undefined) {
+            this.accessTokenExpire = stored.accessTokenExpire;
+        }
+        if (stored.refreshTokenExpire !== undefined) {
+            this.refreshTokenExpire = stored.refreshTokenExpire;
+        }
+        return true;
+    }
+
     /**
      * Obtains tokens using the Resource Owner Password Credentials grant.
      * Requires username and password to be set.