@friggframework/core 2.0.0--canary.652.b14f3b5.0 → 2.0.0--canary.654.42e42b2.0

package/handlers/workers/db-migration.js

@@ -55,6 +55,9 @@ const {
 
 // Inject prisma-runner as dependency
 const prismaRunner = require('../../database/utils/prisma-runner');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.database.migration');
 
 // Use S3 repository for migration status tracking (no User table dependency)
 const bucketName = process.env.S3_BUCKET_NAME || process.env.MIGRATION_STATUS_BUCKET;
@@ -144,7 +147,6 @@ exports.handler = async (event, context) => {
     console.log('========================================');
     console.log('Database Migration Lambda Started');
     console.log('========================================');
-    console.log('Event:', JSON.stringify(event, null, 2));
     console.log('Context:', JSON.stringify({
         requestId: context.requestId,
         functionName: context.functionName,
@@ -157,6 +159,15 @@ exports.handler = async (event, context) => {
     // Check for action parameter (direct invocation for status checks)
     const action = event.action || 'migrate'; // Default to migration
 
+    // targetStage, not stage: the record's own stage field would win.
+    log.info('Database migration invoked', {
+        eventName: 'frigg.database.migration.invoked',
+        migrationId,
+        dbType,
+        targetStage: stage,
+        action,
+    });
+
     // Handle checkStatus action
     if (action === 'checkStatus') {
         console.log(`\n========================================`);

package/handlers/workers/dlq-processor.js

@@ -5,6 +5,18 @@
  * This handler MUST NOT throw. If it throws, the message goes back to
  * the DLQ and creates an infinite loop. All errors are caught and logged.
  */
+const crypto = require('node:crypto');
+const { getLogger } = require('../../logs');
+const {
+    summarizeLambdaEvent,
+    toScopeInvocation,
+} = require('../../logs/summarize-event');
+const {
+    runInvocationScope,
+    runMessageScope,
+} = require('../../core/invocation-scope');
+
+const log = getLogger('frigg.queue.dlq');
 
 function extractQueueName(eventSourceARN) {
     if (!eventSourceARN) return 'UNKNOWN';
@@ -12,50 +24,66 @@ function extractQueueName(eventSourceARN) {
     return parts[parts.length - 1] || 'UNKNOWN';
 }
 
-function parseMessageBody(body) {
+// The body can hold credentials, so only its size and digest are logged.
+function describeBody(body) {
+    const text = typeof body === 'string' ? body : String(body ?? '');
+    return {
+        bodyLength: Buffer.byteLength(text),
+        bodySha256: crypto.createHash('sha256').update(text).digest('hex'),
+    };
+}
+
+function isJson(body) {
     try {
-        const parsed = JSON.parse(body);
-        return {
-            event: parsed.event || 'UNKNOWN',
-            integrationId: parsed.data?.integrationId || null,
-            processId: parsed.data?.processId || null,
-            data: parsed.data,
-        };
-    } catch (error) {
-        console.warn('[DLQ] Failed to parse message body', { error: error.message, body });
-        return {
-            event: 'UNKNOWN',
-            integrationId: null,
-            processId: null,
-            rawBody: body,
-        };
+        JSON.parse(body);
+        return true;
+    } catch {
+        return false;
     }
 }
 
-async function dlqProcessor(event) {
+function logRecord(record) {
+    const body = describeBody(record.body);
+    if (!isJson(record.body)) {
+        log.warn('DLQ message body is not JSON', {
+            eventName: 'frigg.queue.dlq.body_unparsed',
+            ...body,
+        });
+    }
+    // messageId, receiveCount and the body ids come from the message scope.
+    log.error('Message reached the DLQ', {
+        eventName: 'frigg.queue.dlq.message_failed',
+        sentTimestamp: record.attributes?.SentTimestamp,
+        sourceQueue: extractQueueName(record.eventSourceARN),
+        ...body,
+    });
+}
+
+async function dlqProcessor(event, context) {
     if (!event?.Records?.length) return { batchItemFailures: [] };
 
-    for (const record of event.Records) {
-        try {
-            const parsed = parseMessageBody(record.body);
-
-            console.error('[DLQ] Failed message', {
-                messageId: record.messageId,
-                event: parsed.event,
-                integrationId: parsed.integrationId,
-                processId: parsed.processId,
-                receiveCount: record.attributes?.ApproximateReceiveCount,
-                sentTimestamp: record.attributes?.SentTimestamp,
-                sourceQueue: extractQueueName(record.eventSourceARN),
-                ...(parsed.rawBody !== undefined && { rawBody: parsed.rawBody }),
-            });
-        } catch (error) {
-            console.error('[DLQ] Error processing DLQ record', {
-                messageId: record.messageId,
-                error: error.message,
-            });
-        }
-    }
+    await runInvocationScope(
+        {
+            requestId: context?.awsRequestId,
+            handlerName: 'dlqProcessor',
+            invocation: toScopeInvocation(summarizeLambdaEvent(event)),
+        },
+        async () => {
+            for (const record of event.Records) {
+                await runMessageScope(record, async () => {
+                    try {
+                        logRecord(record);
+                    } catch (error) {
+                        log.error('DLQ record failed', {
+                            eventName: 'frigg.queue.dlq.record_failed',
+                            error,
+                        });
+                    }
+                });
+            }
+        },
+        { shouldUseDatabase: false, context }
+    );
 
     return { batchItemFailures: [] };
 }

package/index.js

@@ -11,6 +11,7 @@ const {
     Worker,
     loadInstalledModules,
     createHandler,
+    runInvocationScope,
 } = require('./core/index');
 const {
     prisma,
@@ -78,7 +79,17 @@ const {
 } = require('./telemetry/index');
 const { createUsageRepository } = require('./usage/index');
 const { TimeoutCatcher } = require('./lambda/index');
-const { debug, initDebugLog, flushDebugLog } = require('./logs/index');
+const {
+    getLogger,
+    createMemorySink,
+    resetLoggerForTests,
+    serializeError,
+    redactValue,
+    toSanitizedSurrogate,
+    debug,
+    initDebugLog,
+    flushDebugLog,
+} = require('./logs/index');
 const {
     Credential,
     Entity,
@@ -108,6 +119,7 @@ module.exports = {
     Worker,
     loadInstalledModules,
     createHandler,
+    runInvocationScope,
 
     // database
     prisma,
@@ -175,6 +187,12 @@ module.exports = {
     TimeoutCatcher,
 
     // logs
+    getLogger,
+    createMemorySink,
+    resetLoggerForTests,
+    serializeError,
+    redactValue,
+    toSanitizedSurrogate,
     debug,
     initDebugLog,
     flushDebugLog,

package/integrations/integration-base.js

@@ -21,6 +21,7 @@ const { validateExtensionBinding } = require('./extension');
 const { getTelemetry } = require('../telemetry/telemetry-runtime');
 const { instrumentHandler } = require('../telemetry/instrument-handler');
 const { bindTelemetryContext } = require('../telemetry/bind-telemetry-context');
+const { getLogger } = require('../logs');
 
 const constantsToBeMigrated = {
     defaultEvents: {
@@ -64,6 +65,10 @@ class IntegrationBase {
         this.getTelemetryContext()
     );
 
+    logger = getLogger(
+        `integration.${this.constructor.Definition?.name ?? 'unknown'}`
+    ).child(() => this.getLoggerBindings());
+
     static getOptionDetails() {
         const options = new Options({
             module: Object.values(this.Definition.modules)[0], // This is a placeholder until we revamp the frontend
@@ -254,6 +259,14 @@ class IntegrationBase {
         };
     }
 
+    // Stage and appName are record resource fields; binding them would
+    // only land in droppedKeys.
+    getLoggerBindings() {
+        const { integrationId, integrationType, userId, version } =
+            this.getTelemetryContext();
+        return { integrationId, integrationType, userId, version };
+    }
+
     assertHydrated(message = 'Integration instance is not hydrated') {
         if (!this.isHydrated) {
             throw new Error(message);
@@ -411,15 +424,15 @@ class IntegrationBase {
      */
     async reconcileAuthStatus(authPassed) {
         if (!authPassed) {
-            console.log(
-                `[Frigg] Integration ${this.id} failed to authenticate`
-            );
+            this.logger.warn('Integration failed to authenticate', {
+                eventName: `${this.logger.name}.auth_failed`,
+            });
             await this.persistStatus('ERROR');
         }
         if (authPassed && this.status === 'ERROR') {
-            console.log(
-                `[Frigg] auth confirmed for integration ${this.id} — clearing ERROR → ENABLED`
-            );
+            this.logger.info('Auth confirmed, clearing ERROR', {
+                eventName: `${this.logger.name}.auth_confirmed`,
+            });
             await this.persistStatus('ENABLED');
         }
     }
@@ -615,12 +628,22 @@ class IntegrationBase {
         this[key] = module;
     }
 
+    // The raw error can echo a request with its credentials, and messages
+    // reach end users, so only a fixed text is stored.
     addError(error) {
         if (!this.messages.errors) {
             this.messages.errors = [];
         }
-        this.messages.errors.push(error);
+        this.messages.errors.push({
+            title: 'Integration Error',
+            message: `Integration ${this.id} hit an error. Contact support.`,
+            timestamp: Date.now(),
+        });
         this.status = 'ERROR';
+        this.logger.error('Integration error recorded', {
+            eventName: `${this.logger.name}.error_recorded`,
+            error,
+        });
     }
 
     addWarning(warning) {
@@ -639,9 +662,10 @@ class IntegrationBase {
     async persistStatus(status) {
         await this.updateIntegrationStatus.execute(this.id, status);
         this.status = status;
-        console.log(
-            `[Frigg] Integration ${this.id} status changed to ${status}`
-        );
+        this.logger.info('Integration status changed', {
+            eventName: `${this.logger.name}.status_changed`,
+            integrationStatus: status,
+        });
     }
 
     /**
@@ -753,10 +777,14 @@ class IntegrationBase {
                 // it wins. Warn if the binding tried to wire an override that's now ignored.
                 if (this.events[eventName]) {
                     if (typeof handlers[eventName] === 'string') {
-                        console.warn(
-                            `[Frigg] Integration "${integrationName}" binding "${bindingName}": ` +
-                                `handler "${handlers[eventName]}" for event "${eventName}" is ignored because ` +
-                                `this.events["${eventName}"] was already set (subclass constructor or earlier merge)`
+                        this.logger.warn(
+                            `Binding handler "${handlers[eventName]}" for event "${eventName}" is ignored because this.events["${eventName}"] was already set`,
+                            {
+                                eventName: `${this.logger.name}.extension_handler_shadowed`,
+                                bindingName,
+                                handler: handlers[eventName],
+                                event: eventName,
+                            }
                         );
                     }
                     continue;
@@ -858,19 +886,12 @@ class IntegrationBase {
             if (this.status === 'ERROR') return;
 
             const moduleName = notifier?.name;
-            const detail =
-                object?.reason || object?.statusCode
-                    ? ` (status ${object?.statusCode ?? '?'}: ${
-                          object?.reason ?? 'no reason given'
-                      })`
-                    : '';
-            console.log(
-                `[Frigg] Module ${
-                    moduleName || '?'
-                } reported invalid credentials for integration ${
-                    this.id
-                } — marking ERROR${detail}`
-            );
+            this.logger.warn('Module reported invalid credentials, marking ERROR', {
+                eventName: `${this.logger.name}.credentials_invalidated`,
+                moduleName,
+                statusCode: object?.statusCode,
+                reason: object?.reason,
+            });
             await this._recordCredentialRejection(
                 moduleName,
                 object?.statusCode
@@ -881,13 +902,10 @@ class IntegrationBase {
 
         if (delegateString === 'CREDENTIAL_VALIDATED') {
             if (this.status !== 'ERROR') return;
-            console.log(
-                `[Frigg] Module ${
-                    notifier?.name || '?'
-                } reported valid credentials for integration ${
-                    this.id
-                } — clearing ERROR → ENABLED`
-            );
+            this.logger.info('Module reported valid credentials, clearing ERROR', {
+                eventName: `${this.logger.name}.credentials_validated`,
+                moduleName: notifier?.name,
+            });
             await this.persistStatus('ENABLED');
         }
     }
@@ -909,10 +927,10 @@ class IntegrationBase {
                 Date.now()
             );
         } catch (error) {
-            console.error(
-                `[Frigg] Failed to record credential rejection for integration ${this.id}:`,
-                error
-            );
+            this.logger.error('Failed to record credential rejection', {
+                eventName: `${this.logger.name}.credential_rejection_record_failed`,
+                error,
+            });
         }
     }
 }

package/integrations/integration-router.js

@@ -2,6 +2,7 @@ const express = require('express');
 const { get } = require('../assertions');
 const Boom = require('@hapi/boom');
 const catchAsyncError = require('express-async-handler');
+const { getLogger } = require('../logs');
 const {
     createIntegrationRepository,
 } = require('./repositories/integration-repository-factory');
@@ -70,6 +71,8 @@ const {
     ProcessAuthorizationCallback,
 } = require('../modules/use-cases/process-authorization-callback');
 
+const log = getLogger('frigg.integrations');
+
 function createIntegrationRouter() {
     const { integrations: integrationClasses, userConfig } =
         loadAppDefinition();
@@ -536,29 +539,27 @@ function setEntityRoutes(router, authenticateUser, useCases) {
                 params.data && typeof params.data === 'object'
                     ? Object.keys(params.data)
                     : [];
-            console.log(
-                `[Frigg] POST /api/authorize userId=${userId} entityType=${params.entityType} dataKeys=${JSON.stringify(dataKeys)}`
-            );
+            log.debug('Authorize requested', {
+                userId,
+                entityType: params.entityType,
+                dataKeys,
+            });
 
-            try {
-                const entityDetails =
-                    await processAuthorizationCallback.execute(
-                        userId,
-                        params.entityType,
-                        params.data
-                    );
+            const entityDetails = await processAuthorizationCallback.execute(
+                userId,
+                params.entityType,
+                params.data
+            );
 
-                console.log(
-                    `[Frigg] POST /api/authorize success userId=${userId} entityType=${params.entityType} credentialId=${entityDetails?.credential_id} entityId=${entityDetails?.entity_id}`
-                );
+            log.info('Entity authorized', {
+                eventName: 'frigg.integrations.authorized',
+                userId,
+                entityType: params.entityType,
+                credentialId: entityDetails?.credential_id,
+                entityId: entityDetails?.entity_id,
+            });
 
-                res.json(entityDetails);
-            } catch (err) {
-                console.error(
-                    `[Frigg] POST /api/authorize failed userId=${userId} entityType=${params.entityType} error=${err?.message || err}`
-                );
-                throw err;
-            }
+            res.json(entityDetails);
         })
     );
 

package/integrations/use-cases/delete-integration-for-user.js

@@ -1,4 +1,7 @@
 const Boom = require('@hapi/boom');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.integrations');
 // Removed Integration wrapper - using IntegrationBase directly
 
 /**
@@ -65,17 +68,25 @@ class DeleteIntegrationForUser {
                 );
                 modules.push(moduleInstance);
             } catch (error) {
-                console.error(
-                    `[Integration Deletion] Failed to load module for entity ${entityId}:`,
-                    error.message
-                );
+                log.warn('Failed to load module for deletion', {
+                    eventName: 'frigg.integrations.delete_module_load_failed',
+                    integrationId,
+                    entityId,
+                    error,
+                });
                 failedModuleLoads.push({ entityId, error: error.message });
             }
         }
 
         if (failedModuleLoads.length > 0) {
-            console.warn(
-                `[Integration Deletion] ${failedModuleLoads.length}/${integrationRecord.entitiesIds.length} module(s) failed to load. Webhooks for these modules may require manual cleanup.`
+            log.warn(
+                'Some modules failed to load. Webhooks for these modules may require manual cleanup.',
+                {
+                    eventName: 'frigg.integrations.delete_modules_incomplete',
+                    integrationId,
+                    failedCount: failedModuleLoads.length,
+                    totalCount: integrationRecord.entitiesIds.length,
+                }
             );
         }
 
@@ -97,19 +108,19 @@ class DeleteIntegrationForUser {
         try {
             await integrationInstance.send('ON_DELETE');
         } catch (error) {
-            const reason = error?.message ?? String(error);
-            console.error(
-                `[Integration Deletion] onDelete failed for integration ${integrationId}, leaving it IN_DELETION:`,
-                reason
-            );
+            // The error text can echo a request with its credentials and
+            // messages reach end users; the boundary logs the cause once.
             await integrationInstance.updateIntegrationMessages.execute(
                 integrationId,
                 'errors',
                 'Integration Deletion Error',
-                `Deletion did not complete: ${reason}`,
+                'Deletion did not complete. Contact support.',
                 Date.now()
             );
-            throw error;
+            throw new Error(
+                `Integration ${integrationId} deletion did not complete`,
+                { cause: error }
+            );
         }
 
         await this.integrationRepository.deleteIntegrationById(integrationId);

package/jest.config.js

@@ -18,4 +18,6 @@ module.exports = {
 
     // A path to a module which exports an async function that is triggered once after all test suites
     globalTeardown: './jest-teardown.js',
+
+    setupFilesAfterEnv: ['./logs/jest-logger-setup.js'],
 };

package/logs/.eslintrc.json

@@ -1,3 +1,28 @@
 {
-    "extends": "@friggframework/eslint-config"
+    "extends": "@friggframework/eslint-config",
+    "rules": {
+        "no-console": "error",
+        "no-restricted-syntax": [
+            "error",
+            {
+                "selector": "CallExpression[callee.object.object.name='process'][callee.object.property.name=/^(stdout|stderr)$/][callee.property.name='write']",
+                "message": "Write through the logger; only logs/sinks.js writes to fd 1"
+            }
+        ]
+    },
+    "overrides": [
+        {
+            "files": ["*.test.js", "__fixtures__/**", "jest-logger-setup.js"],
+            "rules": {
+                "no-console": "off",
+                "no-restricted-syntax": "off"
+            }
+        },
+        {
+            "files": ["sinks.js"],
+            "rules": {
+                "no-restricted-syntax": "off"
+            }
+        }
+    ]
 }

package/logs/__fixtures__/events.js

@@ -0,0 +1,82 @@
+const { SECRETS } = require('./secrets');
+
+function httpApiV2Event() {
+    return {
+        version: '2.0',
+        routeKey: 'GET /api/authorize',
+        rawPath: '/api/authorize',
+        rawQueryString: `code=${SECRETS.oauthCode}&state=abc123&api_key=${SECRETS.apiKeyQuery}`,
+        cookies: [`session=${SECRETS.cookie}`],
+        headers: {
+            'x-frigg-api-key': SECRETS.friggApiKey,
+            authorization: `Bearer ${SECRETS.bearer}`,
+            cookie: `session=${SECRETS.cookie}`,
+            'content-type': 'application/json',
+        },
+        queryStringParameters: {
+            code: SECRETS.oauthCode,
+            state: 'abc123',
+            api_key: SECRETS.apiKeyQuery,
+        },
+        requestContext: {
+            http: { method: 'GET', path: '/api/authorize', sourceIp: '203.0.113.9' },
+            requestId: 'req-v2-1',
+        },
+        body: JSON.stringify({
+            code: SECRETS.oauthCode,
+            code_verifier: SECRETS.codeVerifier,
+            client_secret: SECRETS.clientSecret,
+        }),
+        isBase64Encoded: false,
+    };
+}
+
+function restV1Event() {
+    return {
+        resource: '/api/{proxy+}',
+        path: '/api/integrations',
+        httpMethod: 'POST',
+        headers: {
+            Authorization: `Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`,
+            'X-Frigg-Api-Key': SECRETS.friggApiKey,
+            Cookie: `session=${SECRETS.cookie}`,
+        },
+        multiValueHeaders: {
+            Authorization: [`Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`],
+            'Set-Cookie': [`session=${SECRETS.cookie}`],
+        },
+        queryStringParameters: { access_token: SECRETS.accessToken },
+        multiValueQueryStringParameters: { access_token: [SECRETS.accessToken] },
+        requestContext: { requestId: 'req-v1-1', stage: 'dev' },
+        body: JSON.stringify({ password: SECRETS.password, refresh_token: SECRETS.refreshToken }),
+        isBase64Encoded: false,
+    };
+}
+
+function sqsEvent() {
+    return {
+        Records: [
+            {
+                messageId: 'msg-1',
+                receiptHandle: 'receipt-1',
+                attributes: { ApproximateReceiveCount: '1' },
+                body: JSON.stringify({
+                    event: 'PROCESS_BATCH',
+                    data: {
+                        processId: 'proc-1',
+                        integrationId: 'int-1',
+                        access_token: SECRETS.accessToken,
+                        credentials: { client_secret: SECRETS.clientSecret },
+                    },
+                }),
+            },
+            {
+                messageId: 'msg-2',
+                attributes: { ApproximateReceiveCount: '3' },
+                body: `not json Authorization: Bearer ${SECRETS.bearer}`,
+            },
+        ],
+    };
+}
+
+module.exports = { httpApiV2Event, restV1Event, sqsEvent };

package/logs/__fixtures__/matchers.js

@@ -0,0 +1,45 @@
+const WINDOW = 8;
+
+function forms(secret) {
+    return [
+        secret,
+        encodeURIComponent(secret),
+        Buffer.from(secret).toString('base64'),
+    ];
+}
+
+function windows(value) {
+    if (value.length <= WINDOW) return [value];
+    const result = [];
+    for (let i = 0; i + WINDOW <= value.length; i += 1) {
+        result.push(value.slice(i, i + WINDOW));
+    }
+    return result;
+}
+
+function findSecretWindow(received, secrets) {
+    const haystack =
+        typeof received === 'string' ? received : JSON.stringify(received);
+    for (const secret of secrets) {
+        for (const form of forms(secret)) {
+            for (const w of windows(form)) {
+                if (haystack.includes(w)) return { secret, window: w };
+            }
+        }
+    }
+    return null;
+}
+
+function toContainNoSecretWindow(received, secrets) {
+    const list = Array.isArray(secrets) ? secrets : Object.values(secrets);
+    const hit = findSecretWindow(received, list);
+    return {
+        pass: hit === null,
+        message: () =>
+            hit
+                ? `expected no ${WINDOW}-char window of a secret, found "${hit.window}" (from a secret of length ${hit.secret.length})`
+                : 'expected a secret window, found none',
+    };
+}
+
+module.exports = { toContainNoSecretWindow, findSecretWindow, WINDOW };