@friggframework/core 2.0.0--canary.680.6bacd26.0 → 2.0.0--canary.663.8de669c.0

package/CHANGELOG.md

@@ -1,14 +1,3 @@
-# Unreleased
-
-#### Behaviour change: module credential fields are now encrypted
-
-- `credentialFields` declared in an API module's `encryption` config (for example `Definition.encryption.credentialFields`) were never registered for encryption: `loadModuleEncryptionSchemas` required a path that does not exist and the error was swallowed. They are now registered, for modules bound by integrations and for modules registered in `appDefinition.entities` (ADR-059).
-- Existing rows are not rewritten. A credential saved before this release stays plaintext until it is next written, and is read as stored.
-- Reads now tolerate plaintext: a value is only treated as ciphertext when it has the exact `keyId:iv:ciphertext:encryptedKey` shape (previously any string with three or more colons, such as `https://user:pw@host:443`), and a value with that shape that fails to decrypt throws `FieldDecryptionError` in a deployed runtime (any stage, AWS Lambda or Netlify) and is returned as stored with a warning on a local run.
-- An app's own `encryption.schema` is no longer replaced when module fields are added to it.
-
----
-
 # v1.2.2 (Fri Aug 09 2024)
 
 #### 🐛 Bug Fix

package/application/commands/integration-commands.js

@@ -30,9 +30,8 @@ const {
     PatchIntegrationConfig,
 } = require('../../integrations/use-cases/patch-integration-config');
 const {
-    getEntityTypeRegistry,
-    getEntityTypeDefinitions,
-} = require('../../modules/entity-type-registry');
+    getModulesDefinitionFromIntegrationClasses,
+} = require('../../integrations/utils/map-integration-dto');
 
 const ERROR_CODE_MAP = {
     ENTITY_NOT_FOUND: 401,
@@ -52,16 +51,7 @@ function mapErrorToResponse(error) {
     };
 }
 
-/**
- * @param {Object} [params]
- * @param {Function} [params.integrationClass]
- * @param {Array<object>} [params.moduleDefinitions] - the app's offered module
- *   definitions (`loadAppDefinition().moduleDefinitions`). Integration code
- *   calls this from a constructor with no app definition in hand, so when it
- *   is omitted the commands hydrate with this integration's own modules only
- *   (a registry built from `{ integrations: [integrationClass] }`).
- */
-function createIntegrationCommands({ integrationClass, moduleDefinitions } = {}) {
+function createIntegrationCommands({ integrationClass } = {}) {
     // Always use Frigg's default repositories and use cases
     const integrationRepository = createIntegrationRepository();
 
@@ -118,13 +108,13 @@ function createIntegrationCommands({ integrationClass, moduleDefinitions } = {})
 
     const moduleRepository = createModuleRepository();
 
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses([
+        integrationClass,
+    ]);
+
     const moduleFactory = new ModuleFactory({
         moduleRepository,
-        moduleDefinitions:
-            moduleDefinitions ??
-            getEntityTypeDefinitions(
-                getEntityTypeRegistry({ integrations: [integrationClass] })
-            ),
+        moduleDefinitions,
     });
 
     const loadIntegrationContextUseCase = new LoadIntegrationContextUseCase({

package/application/index.js

@@ -17,7 +17,6 @@ const { createUsageCommands } = require('./commands/usage-commands');
  *
  * @param {Object} params
  * @param {Object} params.integrationClass - Integration class (required)
- * @param {Array<object>} [params.moduleDefinitions] - the app's offered module definitions; defaults to the integration's own modules
  * @returns {Object} Unified commands object with all CRUD operations
  *
  * @example
@@ -25,12 +24,9 @@ const { createUsageCommands } = require('./commands/usage-commands');
  * const user = await commands.createUser({ username: 'user@example.com' });
  * const credential = await commands.createCredential({ userId: user.id, ... });
  */
-function createFriggCommands({ integrationClass, moduleDefinitions }) {
+function createFriggCommands({ integrationClass }) {
     // All commands use Frigg's default repositories and use cases
-    const integrationCommands = createIntegrationCommands({
-        integrationClass,
-        moduleDefinitions,
-    });
+    const integrationCommands = createIntegrationCommands({ integrationClass });
 
     const userCommands = createUserCommands();
 

package/credential/repositories/credential-repository-documentdb.js

@@ -186,40 +186,6 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        const userObjectId = toObjectId(userId);
-        if (!userObjectId) return [];
-        const docs = await findManyDrained(
-            this.prisma,
-            'Credential',
-            { userId: userObjectId },
-            { sort: { createdAt: -1 } }
-        );
-        const credentials = [];
-        for (const doc of docs) {
-            const decrypted = await this.encryptionService.decryptFields(
-                'Credential',
-                doc
-            );
-            credentials.push({
-                ...this._mapCredential(decrypted),
-                id: fromObjectId(doc._id),
-                userId: fromObjectId(doc.userId) ?? doc.userId,
-                externalId: doc.externalId ?? null,
-                authIsValid: doc.authIsValid ?? null,
-                createdAt: doc.createdAt ?? null,
-                updatedAt: doc.updatedAt ?? null,
-            });
-        }
-        return credentials;
-    }
-
     async updateCredential(credentialId, updates) {
         const objectId = toObjectId(credentialId);
         if (!objectId) return null;

package/credential/repositories/credential-repository-interface.js

@@ -80,21 +80,6 @@ class CredentialRepositoryInterface {
         );
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string|number} userId - User ID (string from application layer)
-     * @returns {Promise<Array<Object>>} Credentials with string IDs, `createdAt`
-     *   and `updatedAt`, and the (decrypted) data fields spread in, as
-     *   findCredentialById returns them. Empty when the user has none.
-     * @abstract
-     */
-    async findCredentialsByUserId(userId) {
-        throw new Error(
-            'Method findCredentialsByUserId must be implemented by subclass'
-        );
-    }
-
     /**
      * Update a credential by ID
      *

package/credential/repositories/credential-repository-mongo.js

@@ -188,29 +188,6 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        if (!userId) return [];
-        const credentials = await this.prisma.credential.findMany({
-            where: { userId: String(userId) },
-            orderBy: { createdAt: 'desc' },
-        });
-        return credentials.map((credential) => ({
-            ...(credential.data || {}),
-            id: credential.id,
-            userId: credential.userId,
-            externalId: credential.externalId,
-            authIsValid: credential.authIsValid,
-            createdAt: credential.createdAt,
-            updatedAt: credential.updatedAt,
-        }));
-    }
-
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })

package/credential/repositories/credential-repository-postgres.js

@@ -205,34 +205,6 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
         };
     }
 
-    /**
-     * All credentials owned by a user, newest first.
-     *
-     * @param {string} userId - User ID (string from application layer)
-     * @returns {Promise<Array<Object>>} Credentials with string IDs
-     */
-    async findCredentialsByUserId(userId) {
-        let intUserId;
-        try {
-            intUserId = this._convertId(userId);
-        } catch {
-            return [];
-        }
-        const credentials = await this.prisma.credential.findMany({
-            where: { userId: intUserId },
-            orderBy: { createdAt: 'desc' },
-        });
-        return credentials.map((credential) => ({
-            ...(credential.data || {}),
-            id: credential.id.toString(),
-            userId: credential.userId?.toString(),
-            externalId: credential.externalId,
-            authIsValid: credential.authIsValid,
-            createdAt: credential.createdAt,
-            updatedAt: credential.updatedAt,
-        }));
-    }
-
     /**
      * Update a credential by ID
      *

package/database/encryption/README.md

@@ -456,8 +456,6 @@ Format: "keyId:encryptedText:encryptedKey"
 Example: "base64KeyId:iv:ciphertext:base64EncryptedDataKey"
 ```
 
-**Recognising ciphertext on read.** A value is decrypted only when it has exactly four colon-separated parts: base64 `keyId`, 32-hex-character `iv`, hex ciphertext, base64 `encryptedKey`. Plaintext that merely contains colons (`https://user:pw@host:443`) is left alone. A value with that shape that still fails to decrypt (a wrong, rotated or missing key) fails the read with `FieldDecryptionError` in a deployed runtime (see [When Encryption Runs](#when-encryption-runs)), so ciphertext never reaches an API module as if it were a token. Locally it is returned as stored and logged as a warning, so one bad field does not fail a whole read. A field that becomes encrypted later (for example a module's `credentialFields`) stays plaintext in existing rows until they are next written.
-
 **Why Envelope Encryption?**
 
 -   Reduces KMS API calls (one DEK per field, cached)

package/database/encryption/encryption-schema-registry.js

@@ -10,11 +10,6 @@
 
 const { logger } = require('./logger');
 const { registerDeniedKeys } = require('../../logs/denied-keys');
-const {
-    getEntityTypeRegistry,
-    getEntityTypeDefinitions,
-    EntityRegistryError,
-} = require('../../modules/entity-type-registry');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -44,12 +39,6 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
-
-    // Multi-step authorization (Management API v2): earlier steps can collect
-    // emails, usernames or one-time codes.
-    AuthorizationSession: {
-        fields: ['stepData'],
-    },
 };
 
 let customSchema = {};
@@ -171,9 +160,8 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
  * Each module can declare credentialFields to encrypt in its encryption config.
  *
  * @param {Array} integrations - Array of integration classes with modules
- * @param {object} [entities] - `appDefinition.entities` (ADR-059 registry)
  */
-function loadModuleEncryptionSchemas(integrations, entities) {
+function loadModuleEncryptionSchemas(integrations) {
     if (!integrations) {
         throw new Error('integrations parameter is required');
     }
@@ -182,39 +170,27 @@ function loadModuleEncryptionSchemas(integrations, entities) {
         throw new Error('integrations must be an array');
     }
 
-    // `entities` is the app definition's registry (ADR-059): a module an app
-    // registers without any integration still carries credentials to encrypt.
-    if (integrations.length === 0 && !entities) {
+    if (integrations.length === 0) {
         return;
     }
 
-    const moduleDefinitions = getEntityTypeDefinitions(
-        getEntityTypeRegistry({ integrations, entities })
-    );
+    const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
+
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);
     const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
 
-    // Core fields are encrypted already and a custom schema may not repeat
-    // them. Everything the app registered itself stays: module fields are added
-    // to the custom schema, never substituted for it (other models included).
-    const coreFields = new Set(CORE_ENCRYPTION_SCHEMA.Credential?.fields || []);
-    const fields = [
-        ...new Set([
-            ...(customSchema.Credential?.fields || []),
-            ...credentialFields.filter((field) => !coreFields.has(field)),
-        ]),
-    ];
-
-    if (fields.length === 0) {
+    if (credentialFields.length === 0) {
         return;
     }
 
     const moduleSchema = {
-        ...customSchema,
-        Credential: { ...customSchema.Credential, fields },
+        Credential: {
+            fields: credentialFields
+        }
     };
 
     logger.info(
-        `Registering module-level encryption for ${fields.length} credential fields`
+        `Registering module-level encryption for ${credentialFields.length} credential fields`
     );
 
     registerCustomSchema(moduleSchema);
@@ -266,15 +242,10 @@ function loadCustomEncryptionSchema() {
 
         // Load module-level encryption schemas from integrations
         const integrations = appDefinition.integrations;
-        if (Array.isArray(integrations) || appDefinition.entities) {
-            loadModuleEncryptionSchemas(
-                Array.isArray(integrations) ? integrations : [],
-                appDefinition.entities
-            );
+        if (integrations && Array.isArray(integrations)) {
+            loadModuleEncryptionSchemas(integrations);
         }
     } catch (error) {
-        // A bad entity registry is a configuration error, not "no custom schema".
-        if (error instanceof EntityRegistryError) throw error;
         // Silently ignore errors - custom schema is optional
         // This handles cases like:
         // - Backend package.json not found (tests, standalone usage)

package/database/encryption/field-encryption-service.js

@@ -4,41 +4,8 @@
  * Infrastructure layer service that orchestrates field-level encryption/decryption.
  * Handles nested JSON paths (e.g., 'data.access_token') and bulk operations.
  */
-const { logger } = require('./logger');
-const { isDeployedRuntime } = require('./encryption-config');
-
-/**
- * Thrown when a value that looks like ciphertext cannot be decrypted in a
- * deployed runtime (a wrong, rotated or missing key). Returning the stored
- * ciphertext would hand it to API modules as if it were a token.
- */
-class FieldDecryptionError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'FieldDecryptionError';
-    }
-}
-
-// Cryptor.encrypt() returns `${keyId}:${iv}:${ciphertext}:${encryptedKey}`:
-// keyId and encryptedKey are base64, iv is 16 bytes of hex, ciphertext is hex.
-// Plaintext with three colons (`https://user:pw@host:443`, `a:b:c:d`) must not
-// be mistaken for it.
-const BASE64_PART = /^[A-Za-z0-9+/]+={0,2}$/;
-const IV_PART = /^[0-9a-f]{32}$/i;
-const CIPHERTEXT_PART = /^(?:[0-9a-f]{2})+$/i;
-
 class FieldEncryptionService {
-    /**
-     * @param {Object} params
-     * @param {Object} params.cryptor
-     * @param {Object} params.schema
-     * @param {() => boolean} [params.failClosedOnDecryptError] - whether a
-     *   ciphertext-shaped value that fails to decrypt throws. Defaults to
-     *   "running deployed" (encryption-config's isDeployedRuntime), read on
-     *   each failure. Locally such a value is returned as stored, with a
-     *   warning.
-     */
-    constructor({ cryptor, schema, failClosedOnDecryptError }) {
+    constructor({ cryptor, schema }) {
         if (!cryptor) {
             throw new Error('Cryptor instance required');
         }
@@ -48,10 +15,6 @@ class FieldEncryptionService {
 
         this.cryptor = cryptor;
         this.schema = schema;
-        this.failClosedOnDecryptError =
-            typeof failClosedOnDecryptError === 'function'
-                ? failClosedOnDecryptError
-                : () => isDeployedRuntime();
     }
 
     /**
@@ -134,33 +97,12 @@ class FieldEncryptionService {
         const decryptionPromises = fields.map(async (fieldPath) => {
             const value = this._getNestedValue(decrypted, fieldPath);
 
-            if (!this._isEncrypted(value)) {
-                return null;
-            }
-            try {
+            if (this._isEncrypted(value)) {
                 const decryptedValue = await this.cryptor.decrypt(value);
                 const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
-            } catch (error) {
-                // Deployed: a ciphertext-shaped value under a wrong, rotated or
-                // missing key fails the read rather than reaching an API
-                // module as a token. Legacy plaintext never gets here: it does
-                // not look like ciphertext (_isEncrypted).
-                if (this.failClosedOnDecryptError()) {
-                    throw new FieldDecryptionError(
-                        `Could not decrypt ${modelName}.${fieldPath}`,
-                        { cause: error }
-                    );
-                }
-                // Local: a value that looks like ciphertext but is not is read
-                // as it is stored. One such field must not fail the whole
-                // read, findMany included.
-                logger.warn(
-                    `Could not decrypt ${modelName}.${fieldPath}; returning the stored value`,
-                    { errorName: error?.name }
-                );
-                return null;
             }
+            return null;
         });
 
         const results = await Promise.all(decryptionPromises);
@@ -210,13 +152,7 @@ class FieldEncryptionService {
         }
 
         const parts = value.split(':');
-        return (
-            parts.length === 4 &&
-            BASE64_PART.test(parts[0]) &&
-            IV_PART.test(parts[1]) &&
-            CIPHERTEXT_PART.test(parts[2]) &&
-            BASE64_PART.test(parts[3])
-        );
+        return parts.length >= 4;
     }
 
     _getNestedValue(obj, path) {
@@ -315,4 +251,4 @@ class FieldEncryptionService {
     }
 }
 
-module.exports = { FieldEncryptionService, FieldDecryptionError };
+module.exports = { FieldEncryptionService };