@friggframework/core 2.0.0--canary.654.be44e66.0 → 2.0.0--canary.654.42e42b2.0

package/core/Worker.js

@@ -3,8 +3,10 @@ const _ = require('lodash');
 const { RequiredPropertyError } = require('../errors');
 const { get } = require('../assertions');
 const { runMessageScope } = require('./invocation-scope');
+const { getLogger } = require('../logs');
 
 const sqs = new SQSClient({ region: process.env.AWS_REGION });
+const log = getLogger('frigg.worker');
 
 class Worker {
     async getQueueURL(params) {
@@ -55,15 +57,18 @@ class Worker {
                         // Treat as success so SQS deletes it from the queue.
                         // Logged explicitly — silent discards made prod debugging
                         // extremely hard; keep this visible.
-                        console.warn(`[Worker] record halted (discarded, no retry)`, {
-                            messageId: record.messageId,
-                            event: parsedEvent,
-                            reason: error.message,
+                        log.error('Record halted (discarded, no retry)', {
+                            eventName: 'frigg.worker.record_halted',
                             statusCode: error.statusCode,
+                            error,
                         });
                         return;
                     }
-                    console.error(`[Worker] Failed to process record ${record.messageId}:`, error);
+                    // The message goes back to SQS, so WARN (ADR-048 §4).
+                    log.warn('Record failed, returned for retry', {
+                        eventName: 'frigg.worker.record_failed',
+                        error,
+                    });
                     batchItemFailures.push({ itemIdentifier: record.messageId });
                 }
             });

package/core/create-handler.js

@@ -6,6 +6,7 @@ const { getLogger, toSanitizedSurrogate } = require('../logs');
 const {
     summarizeLambdaEvent,
     toScopeInvocation,
+    toRequestDetails,
 } = require('../logs/summarize-event');
 const {
     runInvocationScope,
@@ -64,6 +65,7 @@ const createHandler = (optionByName = {}) => {
                 try {
                     log.info('Handler invoked', {
                         eventName: 'frigg.handler.invoked',
+                        ...toRequestDetails(eventSummary),
                     });
 
                     // If enabled (i.e. if SECRET_ARN is set in process.env) Fetch secrets from AWS Secrets Manager, and set them as environment variables.

package/handlers/app-definition-loader.js

@@ -3,6 +3,7 @@ const path = require('node:path');
 const fs = require('fs-extra');
 const { resolveTelemetryConfig } = require('../telemetry/telemetry-config');
 const { addDeniedKeys } = require('../logs/redact');
+const { getLogger } = require('../logs');
 const {
     extractCredentialFieldsFromModules,
 } = require('../database/encryption/encryption-schema-registry');
@@ -12,18 +13,32 @@ const {
 
 // Handlers without a database never load the encryption registry, so the
 // credential leaf keys are registered for redaction here too.
+const warnedIgnoredKeys = new Set();
+
+function warnIgnoredKeys(ignored) {
+    for (const key of ignored) {
+        if (warnedIgnoredKeys.has(key)) continue;
+        warnedIgnoredKeys.add(key);
+        getLogger('frigg.logger').warn(
+            'Credential field name is a record field; it stays visible in logs',
+            { eventName: 'frigg.logger.denied_key_ignored', key }
+        );
+    }
+}
+
 function registerCredentialLogKeys(appDefinition, integrations) {
     try {
-        extractCredentialFieldsFromModules(
+        const fields = extractCredentialFieldsFromModules(
             getModulesDefinitionFromIntegrationClasses(integrations)
         );
+        warnIgnoredKeys(addDeniedKeys(fields));
     } catch {
         // An odd integration shape must not stop the app from loading.
     }
     const schema = appDefinition.encryption?.schema;
     if (schema && typeof schema === 'object') {
         for (const config of Object.values(schema)) {
-            addDeniedKeys(config?.fields);
+            warnIgnoredKeys(addDeniedKeys(config?.fields));
         }
     }
 }

package/handlers/app-handler-helpers.js

@@ -39,10 +39,11 @@ const createApp = (applyMiddleware) => {
             });
             res.status(statusCode).json({ error: 'Internal Server Error' });
         } else {
+            // A client error needs no stack; the logger scrubs the reason.
             log.warn('Request rejected', {
                 eventName: 'frigg.http.request_rejected',
                 statusCode,
-                error: boomError,
+                reason: boomError.message,
             });
             res.status(statusCode).json({ error: err.message });
         }

package/logs/__fixtures__/vectors.js

@@ -7,6 +7,16 @@ const { summarizeLambdaEvent } = require('../summarize-event');
 const secretUrl = `https://api.example.com/v1/items?api_key=${S.apiKeyQuery}`;
 const SIGNATURE_VALUE = 'fakeSgnValue2Gh9Tc5Wp7LmQx3';
 
+// Built by concatenation so push protection does not match the prefixes.
+const TOKEN_TAIL = 'ZqPr3fixTail8Hn2Kd8Ws1Yc6';
+const PREFIXED_TOKENS = [
+    'sk_' + 'live_' + TOKEN_TAIL,
+    'whsec' + '_' + TOKEN_TAIL,
+    'xox' + 'b-' + TOKEN_TAIL,
+    'gh' + 'p_' + TOKEN_TAIL,
+    'AK' + 'IA' + 'ZQPR3FIXTAIL8HN2',
+];
+
 function errorWithMessage(message, name = 'Error') {
     const error = new Error(message);
     error.name = name;
@@ -188,6 +198,13 @@ function vectors() {
             fields: () => ({ note: `blob ${S.base64Run} end` }),
             secrets: [S.base64Run],
         },
+        {
+            name: 'provider token prefixes',
+            level: 'warn',
+            message: () => `provider rejected ${PREFIXED_TOKENS.join(' and ')}`,
+            fields: () => ({ note: PREFIXED_TOKENS.join(',') }),
+            secrets: PREFIXED_TOKENS,
+        },
         {
             name: '40-hex token',
             level: 'error',

package/logs/debug-shims.js

@@ -1,7 +1,11 @@
 const util = require('node:util');
 const { getLogger } = require('./logger');
 const { getContext } = require('./context');
-const { summarizeLambdaEvent, toScopeInvocation } = require('./summarize-event');
+const {
+    summarizeLambdaEvent,
+    toScopeInvocation,
+    toRequestDetails,
+} = require('./summarize-event');
 
 // Deprecated. Kept for one major version; use getLogger or this.logger.
 const LEGACY_LOGGER_NAME = 'frigg.legacy';
@@ -28,8 +32,10 @@ function initDebugLog(...initMessages) {
     const log = legacy();
     if (!log.isLevelEnabled('DEBUG')) return;
     const event = initMessages.find((m) => m && typeof m === 'object');
+    const summary = summarizeLambdaEvent(event);
     log.debug('Debug log initialized', {
-        invocation: toScopeInvocation(summarizeLambdaEvent(event)),
+        invocation: toScopeInvocation(summary),
+        ...toRequestDetails(summary),
     });
 }
 

package/logs/redact.js

@@ -14,8 +14,8 @@ const DENIED_SUFFIXES = [
 ];
 
 // Core encryption registry leaves and exact names the suffix rule does not
-// cover. `header` is Node's raw `_header` request text. `domain` stays
-// allowed: it is too common a key.
+// cover. `header` is Node's raw `_header` request text. `domain` is not
+// seeded (too common); a module can still register it as a credential field.
 const deniedKeys = new Set([
     'hashword',
     'cookies',
@@ -25,6 +25,29 @@ const deniedKeys = new Set([
     'header',
 ]);
 
+// Record-contract fields. A credential field with one of these names must not
+// blank the field in every record.
+const PROTECTED_KEYS = new Set(
+    [
+        'integrationId',
+        'integrationType',
+        'userId',
+        'version',
+        'entityId',
+        'credentialId',
+        'requestId',
+        'messageId',
+        'processId',
+        'integrationEvent',
+        'eventName',
+        'handlerName',
+        'method',
+        'route',
+        'routeKey',
+        'statusCode',
+    ].map((key) => key.toLowerCase())
+);
+
 const PAIR_KEYS = new Set(['code', 'codeverifier']);
 const DIGEST_KEY = /(sha(1|256)|hash|digest|checksum)$/;
 
@@ -34,6 +57,8 @@ const URL_IN_TEXT = /\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s"'<>`]+/g;
 const URL_TRAILING_PUNCT = /[.,;:!?)\]}]+$/;
 const ABSOLUTE_URL = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
 const ROOT_SLASH = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#]*\//;
+const PREFIXED_TOKEN =
+    /(?<![A-Za-z0-9_-])(?:(?:sk|rk)_(?:live|test)_|whsec_|xox[abprs]-|gh[opsu]_|github_pat_|shp(?:at|ss)_|glpat-|npm_)[A-Za-z0-9_-]{16,}|\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
 const AUTH_SCHEME = /\b(Bearer|bearer|BEARER|Basic|basic|BASIC|Token|token|TOKEN)(\s+)([A-Za-z0-9._~+/=-]{8,})/g;
 const AUTH_SCHEME_WORD = /^(bearer|basic|token)$/i;
@@ -62,7 +87,7 @@ function normalizeKey(key) {
 
 function isDeniedKey(key) {
     const normalized = normalizeKey(key);
-    if (!normalized) return false;
+    if (!normalized || PROTECTED_KEYS.has(normalized)) return false;
     if (deniedKeys.has(normalized)) return true;
     return DENIED_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
 }
@@ -80,13 +105,19 @@ function isPairKey(key, { withState = false } = {}) {
     );
 }
 
+// Returns the leaves it skipped as record-contract keys, so a caller can warn.
 function addDeniedKeys(keys) {
-    if (!Array.isArray(keys)) return;
+    const ignored = [];
+    if (!Array.isArray(keys)) return ignored;
     for (const key of keys) {
         if (typeof key !== 'string') continue;
-        const leaf = normalizeKey(key.split('.').pop());
-        if (leaf) deniedKeys.add(leaf);
+        const rawLeaf = key.split('.').pop();
+        const leaf = normalizeKey(rawLeaf);
+        if (!leaf) continue;
+        if (PROTECTED_KEYS.has(leaf)) ignored.push(rawLeaf);
+        else deniedKeys.add(leaf);
     }
+    return ignored;
 }
 
 function hasMixedClasses(run) {
@@ -107,7 +138,8 @@ function isRedactedValue(value) {
 }
 
 function scrubTokens(text, { allowHex = false, segment = false } = {}) {
-    let out = text.replace(JWT, redacted);
+    let out = text.replace(PREFIXED_TOKEN, redacted);
+    out = out.replace(JWT, redacted);
     out = out.replace(AUTH_SCHEME, (match, scheme, space, credential) => {
         const classes = [/[A-Z]/, /[a-z]/, /[0-9]/, /[._~+/=-]/].filter((re) =>
             re.test(credential)

package/logs/summarize-event.js

@@ -32,13 +32,26 @@ function unique(list) {
     return [...new Set(list)];
 }
 
+// The route template keeps ids out of the field: REST v1 `resource`, or the
+// path part of an HTTP API v2 `routeKey` such as `GET /api/{id}`.
+function routeTemplate(event, path) {
+    if (typeof event.resource === 'string' && event.resource) {
+        return event.resource;
+    }
+    if (typeof event.routeKey === 'string') {
+        const space = event.routeKey.indexOf(' ');
+        if (space > 0) return event.routeKey.slice(space + 1);
+    }
+    return path;
+}
+
 function summarizeHttp(event) {
     const path = event.path || event.rawPath;
     const summary = {
         source: 'http',
         method: event.httpMethod || event.requestContext?.http?.method,
         path,
-        route: path,
+        route: routeTemplate(event, path),
         queryKeys: unique([
             ...objectKeys(event.queryStringParameters),
             ...objectKeys(event.multiValueQueryStringParameters),
@@ -98,8 +111,6 @@ function toScopeInvocation(summary) {
             source: 'http',
             method: summary.method,
             route: summary.route,
-            queryKeys: summary.queryKeys ?? [],
-            headerNames: summary.headerNames ?? [],
         };
         if (summary.routeKey) invocation.routeKey = summary.routeKey;
         return invocation;
@@ -107,4 +118,19 @@ function toScopeInvocation(summary) {
     return { source: summary.source };
 }
 
-module.exports = { summarizeLambdaEvent, summarizeMessageBody, toScopeInvocation };
+// Per-request detail for the one entry record, never for the scope.
+function toRequestDetails(summary) {
+    if (!summary || summary.source !== 'http') return {};
+    return {
+        path: summary.path,
+        queryKeys: summary.queryKeys ?? [],
+        headerNames: summary.headerNames ?? [],
+    };
+}
+
+module.exports = {
+    summarizeLambdaEvent,
+    summarizeMessageBody,
+    toScopeInvocation,
+    toRequestDetails,
+};

package/modules/module.js

@@ -32,7 +32,7 @@ class Module extends Delegate {
         this.credential = entityObj?.credential;
         this.definition = definition;
         this.name = this.definition.moduleName;
-        this.logger = getLogger(`module.${this.name}`).child(() => ({
+        this.logger = getLogger(`module.${this.name ?? 'unknown'}`).child(() => ({
             entityId: this.entity?.id,
             credentialId:
                 this.credential?.id ??

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.654.be44e66.0",
+    "version": "2.0.0--canary.654.42e42b2.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.654.be44e66.0",
-        "@friggframework/prettier-config": "2.0.0--canary.654.be44e66.0",
-        "@friggframework/test": "2.0.0--canary.654.be44e66.0",
+        "@friggframework/eslint-config": "2.0.0--canary.654.42e42b2.0",
+        "@friggframework/prettier-config": "2.0.0--canary.654.42e42b2.0",
+        "@friggframework/test": "2.0.0--canary.654.42e42b2.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "be44e66226ec1db051c264a5f8cf02998f3aa14c"
+    "gitHead": "42e42b2b48e90e9b46ffe6bcf009150a66a010cd"
 }