@friggframework/core 2.0.0--canary.654.ebad223.0 → 2.0.0--canary.651.dadf4d6.0

package/core/create-handler.js

@@ -2,16 +2,7 @@
 // REMOVING FOR NOW UNTIL WE ADD WEBPACK BACK IN
 // require('source-map-support').install();
 
-const { getLogger, toSanitizedSurrogate } = require('../logs');
-const {
-    summarizeLambdaEvent,
-    toScopeInvocation,
-    toRequestInvocation,
-} = require('../logs/summarize-event');
-const {
-    runInvocationScope,
-    DEFAULT_FLUSH_TIMEOUT_MS,
-} = require('./invocation-scope');
+const { initDebugLog, flushDebugLog } = require('../logs');
 const { secretsToEnv } = require('./secrets-to-env');
 const { parametersToEnv } = require('./parameters-to-env');
 const {
@@ -20,7 +11,123 @@ const {
     getPluginTelemetrySubscribers,
 } = require('../telemetry/telemetry-runtime');
 
-const log = getLogger('frigg.handler');
+// Bounds the tail latency telemetry adds to every warm invocation. Kept low so
+// an unreachable OTLP endpoint (e.g. a VPC Lambda with no NAT/egress) costs at
+// most this, not multiple seconds. Override with OTEL_FLUSH_TIMEOUT_MS.
+const DEFAULT_FLUSH_TIMEOUT_MS =
+    Number(process.env.OTEL_FLUSH_TIMEOUT_MS) || 500;
+
+/**
+ * Fold the invocation's buffered usage counters into the durable store, then
+ * clear the buffer. On an SQS redelivery (ApproximateReceiveCount > 1) we
+ * DISCARD rather than flush — the prior delivery already counted, and the usage
+ * accuracy contract is "approximate, skip obvious redeliveries". Fully guarded.
+ */
+async function flushUsageRollup(subscriber, eventSummary, shouldUseDatabase) {
+    if (!subscriber) return;
+    try {
+        // Persisting usage requires a DB connection. DB-free handlers (e.g. the
+        // webhook-receipt route) never called connectPrisma, so drop the buffer
+        // instead of issuing a connectionless Prisma write.
+        if (!shouldUseDatabase) {
+            subscriber.discard();
+            return;
+        }
+        // Discard only when EVERY record in the batch is a redelivery. The buffer
+        // is invocation-scoped (not per-message), so discarding on *any*
+        // redelivery would drop the fresh records' counts too (silent
+        // under-count). For a mixed batch we flush: preserving fresh counts and
+        // at worst re-counting the one redelivered record is strictly better than
+        // losing fresh data for an approximate store. (Integration queue workers
+        // are batchSize:1 today, so a batch is all-or-nothing; this keeps it
+        // correct if batchSize is ever raised.)
+        const records = Array.isArray(eventSummary?.records)
+            ? eventSummary.records
+            : [];
+        const allRedelivered =
+            records.length > 0 &&
+            records.every((r) => Number(r.receiveCount) > 1);
+        if (allRedelivered) {
+            subscriber.discard();
+        } else {
+            await subscriber.flush();
+        }
+    } catch (_) {
+        // Usage rollup must never break the handler.
+    }
+}
+
+/**
+ * Flush telemetry before the Lambda container freezes. Because
+ * `callbackWaitsForEmptyEventLoop=false` (below) stops the event loop the moment
+ * the handler returns, OTel's timer-driven batch processors would never fire —
+ * so spans/metrics must be flushed synchronously here. Bounded by a timeout so a
+ * stalled exporter can never block the response, and fully guarded so a flush
+ * failure never breaks the handler.
+ */
+async function flushTelemetry(telemetry, timeoutMs) {
+    try {
+        if (
+            !telemetry ||
+            typeof telemetry.isEnabled !== 'function' ||
+            !telemetry.isEnabled()
+        ) {
+            return;
+        }
+        let timer;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(resolve, timeoutMs);
+        });
+        try {
+            await Promise.race([
+                Promise.resolve(telemetry.forceFlush()),
+                deadline,
+            ]);
+        } finally {
+            clearTimeout(timer);
+        }
+    } catch (_) {
+        // Telemetry flush must never break the handler.
+    }
+}
+
+// Best-effort extraction of correlation identifiers from a Lambda event.
+// For SQS: pulls messageIds + parsed event/processId/integrationId from each
+// record body. For HTTP: pulls method+path. Never throws.
+const summarizeLambdaEvent = (event) => {
+    if (!event) return {};
+    if (Array.isArray(event.Records)) {
+        return {
+            source: 'sqs',
+            records: event.Records.map((r) => {
+                let parsed = {};
+                try {
+                    const body = JSON.parse(r.body);
+                    parsed = {
+                        event: body?.event,
+                        processId: body?.data?.processId,
+                        integrationId: body?.data?.integrationId,
+                    };
+                } catch {
+                    // ignore unparseable bodies
+                }
+                return {
+                    messageId: r.messageId,
+                    receiveCount: r.attributes?.ApproximateReceiveCount,
+                    ...parsed,
+                };
+            }),
+        };
+    }
+    if (event.httpMethod || event.requestContext?.http) {
+        return {
+            source: 'http',
+            method: event.httpMethod || event.requestContext?.http?.method,
+            path: event.path || event.rawPath,
+        };
+    }
+    return { source: 'other' };
+};
 
 const createHandler = (optionByName = {}) => {
     const {
@@ -50,101 +157,95 @@ const createHandler = (optionByName = {}) => {
         // no-op after the first invocation.
         getPluginTelemetrySubscribers();
 
-        const scopeFields = {
-            requestId: context?.awsRequestId,
-            handlerName: eventName,
-            method: eventSummary.method,
-            route: eventSummary.route,
-            routeKey: eventSummary.routeKey,
-            invocation: toScopeInvocation(eventSummary),
-        };
-        // The full redacted summary goes only on the entry and failure records.
-        const requestInvocation = toRequestInvocation(eventSummary);
+        try {
+            console.info(`[createHandler] ${eventName}: handler entry`, {
+                eventName,
+                awsRequestId: context?.awsRequestId,
+                ...eventSummary,
+            });
 
-        return runInvocationScope(
-            scopeFields,
-            async () => {
-                try {
-                    log.info('Handler invoked', {
-                        eventName: 'frigg.handler.invoked',
-                        invocation: requestInvocation,
-                    });
+            initDebugLog(eventName, event);
 
-                    // If enabled (i.e. if SECRET_ARN is set in process.env) Fetch secrets from AWS Secrets Manager, and set them as environment variables.
-                    await secretsToEnv();
+            const requestMethod = event.httpMethod;
+            const requestPath = event.path;
+            if (requestMethod && requestPath) {
+                console.info(`${requestMethod} ${requestPath}`);
+            }
 
-                    // If enabled (i.e. if SSM_PARAMETER_PREFIX and FRIGG_SSM_OFFLOADED_KEYS are set) fetch offloaded params from SSM Parameter Store into process.env.
-                    await parametersToEnv();
+            // If enabled (i.e. if SECRET_ARN is set in process.env) Fetch secrets from AWS Secrets Manager, and set them as environment variables.
+            await secretsToEnv();
 
-                    // Lazy-required so DB-free handlers never load the Prisma client.
-                    if (shouldUseDatabase) {
-                        const { connectPrisma } = require('../database/prisma');
-                        await connectPrisma();
-                    }
+            // If enabled (i.e. if SSM_PARAMETER_PREFIX and FRIGG_SSM_OFFLOADED_KEYS are set) fetch offloaded params from SSM Parameter Store into process.env.
+            await parametersToEnv();
 
-                    // Helps reuse the database connection.  Lowers response times.
-                    context.callbackWaitsForEmptyEventLoop = false;
-
-                    // Run the Lambda
-                    return await method(event, context);
-                } catch (error) {
-                    // Allow client-safe errors to pass through with their actual message
-                    if (isUserFacingResponse && error.isClientSafe === true) {
-                        const statusCode = error.statusCode || 400;
-                        log.warn('Request rejected', {
-                            eventName: 'frigg.handler.rejected',
-                            statusCode,
-                            error,
-                        });
-                        return {
-                            statusCode,
-                            body: JSON.stringify({
-                                error: error.message,
-                            }),
-                        };
-                    }
+            // Lazy-required so DB-free handlers never load the Prisma client.
+            if (shouldUseDatabase) {
+                const { connectPrisma } = require('../database/prisma');
+                await connectPrisma();
+            }
 
-                    // Server-to-server: halt errors succeed and won't be
-                    // retried, so the halt itself is the failure record.
-                    if (!isUserFacingResponse && error.isHaltError === true) {
-                        log.error('Handler halted', {
-                            eventName: 'frigg.handler.halted',
-                            invocation: requestInvocation,
-                            error,
-                        });
-                        return;
-                    }
+            // Helps reuse the database connection.  Lowers response times.
+            context.callbackWaitsForEmptyEventLoop = false;
+
+            // Run the Lambda
+            return await method(event, context);
+        } catch (error) {
+            flushDebugLog(error);
+
+            // Don't leak implementation details to end users.
+            if (isUserFacingResponse) {
+                // Allow client-safe errors to pass through with their actual message
+                if (error.isClientSafe === true) {
+                    const statusCode = error.statusCode || 400;
+                    return {
+                        statusCode,
+                        body: JSON.stringify({
+                            error: error.message,
+                        }),
+                    };
+                }
+
+                // Hide other errors with generic message
+                return {
+                    statusCode: 500,
+                    body: JSON.stringify({
+                        error: 'An Internal Error Occurred',
+                    }),
+                };
+            }
 
-                    log.error('Handler failed', {
-                        eventName: 'frigg.handler.failed',
-                        invocation: requestInvocation,
-                        error,
-                    });
-
-                    // Don't leak implementation details to end users.
-                    if (isUserFacingResponse) {
-                        return {
-                            statusCode: 500,
-                            body: JSON.stringify({
-                                error: 'An Internal Error Occurred',
-                            }),
-                        };
+            // Handle server-to-server responses.
+
+            // Halt errors are logged but suceed and won't be retried.
+            // Log explicitly — silent suppression here previously made stuck
+            // messages invisible to observability tooling. Include
+            // eventSummary so operators can correlate across concurrent
+            // invocations (processId / messageIds / HTTP path).
+            if (error.isHaltError === true) {
+                console.warn(
+                    `[createHandler] ${eventName}: halt error suppressed (no retry)`,
+                    {
+                        eventName,
+                        errorName: error.name,
+                        errorMessage: error.message,
+                        statusCode: error.statusCode,
+                        ...eventSummary,
                     }
+                );
+                return;
+            }
 
-                    // The Lambda runtime writes a rethrown error itself, so
-                    // rethrow a sanitized copy (ADR-048 §6 item 11).
-                    throw toSanitizedSurrogate(error);
-                }
-            },
-            {
-                telemetry: activeTelemetry,
-                usageRollup: activeUsageRollup,
+            // Here we can just rethrow and let AWS build the response.
+            throw error;
+        } finally {
+            // Flush telemetry + usage before the container freezes.
+            await flushTelemetry(activeTelemetry, flushTimeoutMs);
+            await flushUsageRollup(
+                activeUsageRollup,
                 eventSummary,
-                shouldUseDatabase,
-                flushTimeoutMs,
-                context,
-            }
-        );
+                shouldUseDatabase
+            );
+        }
     };
 };
 

package/core/index.js

@@ -2,12 +2,5 @@ const { Delegate } = require('./Delegate');
 const { Worker } = require('./Worker');
 const { loadInstalledModules } = require('./load-installed-modules');
 const { createHandler } = require('./create-handler');
-const { runInvocationScope } = require('./invocation-scope');
 
-module.exports = {
-    Delegate,
-    Worker,
-    loadInstalledModules,
-    createHandler,
-    runInvocationScope,
-};
+module.exports = { Delegate, Worker, loadInstalledModules, createHandler };

package/core/secrets-to-env.js

@@ -1,9 +1,5 @@
-const { getLogger } = require('../logs');
-
-const log = getLogger('frigg.core.secrets');
-
 const getSecretValue = async () => {
-    log.debug('Fetching secrets', { eventName: 'frigg.core.secrets.fetching' });
+    console.log('Fetching secrets...');
 
     const httpPort = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT || 2773;
     const url = `http://localhost:${httpPort}/secretsmanager/get?secretId=${encodeURIComponent(
@@ -19,7 +15,10 @@ const getSecretValue = async () => {
     const response = await fetch(url, options);
 
     if (!response.ok) {
-        throw new Error(`Secrets fetch failed with ${response.status}`);
+        const json = await response.json().catch((err) => err.message);
+        console.error('Invalid response - response:', JSON.stringify(response));
+        console.error('Invalid response - json:', json);
+        throw new Error(`Invalid ${response.status} response`);
     }
 
     const result = await response.json();
@@ -45,7 +44,7 @@ const secretsToEnv = async () => {
     if (!process.env.SECRET_ARN) {
         return;
     }
-    log.debug('Secrets to env', { eventName: 'frigg.core.secrets.to_env' });
+    console.log('Secrets to env');
 
     try {
         const secrets = await getSecretValue();

package/database/config.js

@@ -125,9 +125,16 @@ let cachedDbType = null;
  */
 const PRISMA_LOG_LEVEL = process.env.PRISMA_LOG_LEVEL || 'error,warn';
 
+/**
+ * Enable Prisma query logging for performance monitoring
+ * @type {boolean}
+ */
+const PRISMA_QUERY_LOGGING = process.env.PRISMA_QUERY_LOGGING === 'true';
+
 module.exports = {
     getDatabaseType, // Export for testing and direct use
     PRISMA_LOG_LEVEL,
+    PRISMA_QUERY_LOGGING,
 };
 
 /**

package/database/documentdb-encryption-service.js

@@ -1,5 +1,9 @@
 const { Cryptor } = require('../encrypt/Cryptor');
-const { getEncryptedFields, loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const {
+    getEncryptedFields,
+    getFieldsToEncryptOnWrite,
+    loadCustomEncryptionSchema,
+} = require('./encryption/encryption-schema-registry');
 
 /**
  * Encryption service specifically for DocumentDB repositories
@@ -107,7 +111,7 @@ class DocumentDBEncryptionService {
         }
 
         // Get encrypted fields from registry
-        const encryptedFieldsConfig = getEncryptedFields(modelName);
+        const encryptedFieldsConfig = getFieldsToEncryptOnWrite(modelName);
         if (!encryptedFieldsConfig || encryptedFieldsConfig.length === 0) {
             return document;
         }

package/database/documentdb-utils.js

@@ -166,11 +166,12 @@ async function findManyDrained(client, collection, filter = {}, options = {}) {
     return drainCursor(client, collection, first);
 }
 
-async function aggregateDrained(client, collection, pipeline) {
+async function aggregateDrained(client, collection, pipeline, options = {}) {
     const first = await client.$runCommandRaw({
         aggregate: collection,
         pipeline,
         cursor: { batchSize: DRAIN_BATCH_SIZE },
+        ...options,
     });
     return drainCursor(client, collection, first);
 }

package/database/encryption/README.md

@@ -680,11 +680,7 @@ The encryption system uses **fail-fast error handling**:
 
 ### Logging Configuration
 
-`FRIGG_LOG_LEVEL` is the one Frigg log level. The level rules, the record
-fields and the redaction rules are in the
-[Logging guide](../../../../docs/guides/LOGGING.md). The encryption logger
-still writes text lines through `console` with the same level names until it
-moves to the structured logger (ADR-048, incremental adoption).
+Configure log verbosity with `FRIGG_LOG_LEVEL`:
 
 ```bash
 # Production (minimal logging)
@@ -818,6 +814,26 @@ export AES_KEY=$(openssl rand -hex 16)  # Generate 32-char key
 ❌ Query on encrypted fields (not supported)
 ❌ Manually decrypt data (use extension)
 
+The integration mapping repositories' `queryMappings()` (PostgreSQL, MongoDB
+and DocumentDB) filters and sorts inside the `mapping` JSON, so it refuses to
+run while field-level encryption still encrypts `IntegrationMapping.mapping` on
+write. Opt the field out in the app definition, together with any nested
+`mapping.*` path that `encryption.schema` encrypts; the Prisma extension and
+`DocumentDBEncryptionService` both honor the opt-out:
+
+```javascript
+encryption: {
+    disable: { IntegrationMapping: ['mapping'] },
+}
+```
+
+The opt-out applies to writes only. Rows written encrypted before it stay
+readable, but `queryMappings()` does not match them until they are written
+again. It returns the rows it matches decrypted, like
+`findMappingsByIntegration()`: a nested `mapping.*` path written encrypted
+before its opt-out reads plain, though conditions and ordering on that path
+still see the ciphertext until the row is written again.
+
 ## Future Enhancements
 
 ### Planned

package/database/encryption/encryption-schema-registry.js

@@ -9,7 +9,6 @@
  */
 
 const { logger } = require('./logger');
-const { addDeniedKeys } = require('../../logs/redact');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -121,7 +120,6 @@ function registerCustomSchema(schema) {
     }
 
     customSchema = { ...schema };
-    addDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
     logger.info(
         `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
     );
@@ -151,7 +149,6 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
     }
 
-    addDeniedKeys(fields);
     return [...new Set(fields)];
 }
 

package/database/encryption/integration-mapping-encryption.js

@@ -0,0 +1,97 @@
+const { getEncryptionConfig } = require('../prisma');
+const { Cryptor } = require('../../encrypt/Cryptor');
+const {
+    getFieldsToDecryptOnRead,
+    getFieldsToEncryptOnWrite,
+    loadCustomEncryptionSchema,
+} = require('./encryption-schema-registry');
+const {
+    createFieldEncryptionService,
+} = require('./prisma-encryption-extension');
+
+let plainMappingEncryption = null;
+
+/**
+ * The `IntegrationMapping` fields, `mapping` itself or a nested `mapping.*`
+ * path, that field-level encryption encrypts on write. An empty result is
+ * kept for the life of the process.
+ *
+ * @returns {string[]} Empty when every mapping path is written as plain JSON
+ */
+function getMappingFieldsEncryptedOnWrite() {
+    return mappingEncryption().encryptedOnWrite;
+}
+
+/**
+ * @throws {Error} When field-level encryption still encrypts `mapping`, or a
+ *   nested `mapping.*` path, on write, naming the opt-out that lifts it
+ */
+function assertMappingWrittenUnencrypted() {
+    const fields = getMappingFieldsEncryptedOnWrite();
+    if (fields.length === 0) return;
+
+    const encrypted = fields
+        .map((field) => `IntegrationMapping.${field}`)
+        .join(', ');
+    const optOut = fields.map((field) => `'${field}'`).join(', ');
+    throw new Error(
+        `queryMappings: field-level encryption still encrypts ${encrypted} on write, so it cannot be queried. Opt out by adding ${optOut} to appDefinition.encryption.disable.IntegrationMapping.`
+    );
+}
+
+/**
+ * Decrypts rows that `queryMappings` read around the Prisma encryption
+ * extension, the way reads through the extension do: every
+ * `IntegrationMapping` field the schema lists, opted-out paths included, so a
+ * path written encrypted before its opt-out comes back plain.
+ *
+ * @param {Object[]} rows - Rows whose `mapping` is a JSON object
+ * @returns {Promise<Object[]>} `rows` itself when encryption is off or the
+ *   schema lists no field besides `mapping`
+ */
+async function decryptQueriedMappings(rows) {
+    const { decryptor } = mappingEncryption();
+    if (!decryptor) return rows;
+    return decryptor.decryptFieldsInBulk('IntegrationMapping', rows);
+}
+
+function mappingEncryption() {
+    if (plainMappingEncryption) return plainMappingEncryption;
+
+    const encryption = currentMappingEncryption();
+    if (encryption.encryptedOnWrite.length === 0) {
+        plainMappingEncryption = encryption;
+    }
+    return encryption;
+}
+
+function currentMappingEncryption() {
+    const config = getEncryptionConfig();
+    if (!config.enabled) return { encryptedOnWrite: [], decryptor: null };
+
+    loadCustomEncryptionSchema();
+    const encryptedOnWrite = getFieldsToEncryptOnWrite(
+        'IntegrationMapping'
+    ).filter((field) => field === 'mapping' || field.startsWith('mapping.'));
+    const decryptsBesidesMapping = getFieldsToDecryptOnRead(
+        'IntegrationMapping'
+    ).some((field) => field !== 'mapping');
+    const decryptor = decryptsBesidesMapping
+        ? createFieldEncryptionService(
+              new Cryptor({ shouldUseAws: config.method === 'kms' })
+          )
+        : null;
+    return { encryptedOnWrite, decryptor };
+}
+
+/** Test helper: forget a kept result. */
+function resetMappingEncryptionCheck() {
+    plainMappingEncryption = null;
+}
+
+module.exports = {
+    assertMappingWrittenUnencrypted,
+    decryptQueriedMappings,
+    getMappingFieldsEncryptedOnWrite,
+    resetMappingEncryptionCheck,
+};

package/database/encryption/prisma-encryption-extension.js

@@ -10,6 +10,24 @@ const {
 } = require('./encryption-schema-registry');
 const { FieldEncryptionService } = require('./field-encryption-service');
 
+/**
+ * The FieldEncryptionService the extension runs, with field paths from the
+ * encryption schema registry.
+ *
+ * @param {import('../../encrypt/Cryptor').Cryptor} cryptor
+ * @returns {FieldEncryptionService}
+ */
+function createFieldEncryptionService(cryptor) {
+    return new FieldEncryptionService({
+        cryptor,
+        schema: {
+            getEncryptedFields,
+            getFieldsToEncryptOnWrite,
+            getFieldsToDecryptOnRead,
+        },
+    });
+}
+
 function createEncryptionExtension({ cryptor, enabled = true }) {
     if (!enabled) {
         return (client) => client;
@@ -21,14 +39,7 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
         );
     }
 
-    const encryptionService = new FieldEncryptionService({
-        cryptor,
-        schema: {
-            getEncryptedFields,
-            getFieldsToEncryptOnWrite,
-            getFieldsToDecryptOnRead,
-        },
-    });
+    const encryptionService = createFieldEncryptionService(cryptor);
 
     return {
         name: 'frigg-field-encryption',
@@ -227,4 +238,4 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
     };
 }
 
-module.exports = { createEncryptionExtension };
+module.exports = { createEncryptionExtension, createFieldEncryptionService };