@friggframework/core 2.0.0--canary.690.3fe2b27.0 → 2.0.0--canary.705.9cfd819.0

package/database/encryption/encryption-schema-registry.js

@@ -10,11 +10,6 @@
 
 const { logger } = require('./logger');
 const { registerDeniedKeys } = require('../../logs/denied-keys');
-const {
-    getEntityTypeRegistry,
-    getEntityTypeDefinitions,
-    EntityRegistryError,
-} = require('../../modules/entity-type-registry');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -44,12 +39,6 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
-
-    // Multi-step authorization (Management API v2): earlier steps can collect
-    // emails, usernames or one-time codes.
-    AuthorizationSession: {
-        fields: ['stepData'],
-    },
 };
 
 let customSchema = {};
@@ -171,9 +160,8 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
  * Each module can declare credentialFields to encrypt in its encryption config.
  *
  * @param {Array} integrations - Array of integration classes with modules
- * @param {object} [entities] - `appDefinition.entities` (ADR-059 registry)
  */
-function loadModuleEncryptionSchemas(integrations, entities) {
+function loadModuleEncryptionSchemas(integrations) {
     if (!integrations) {
         throw new Error('integrations parameter is required');
     }
@@ -182,39 +170,27 @@ function loadModuleEncryptionSchemas(integrations, entities) {
         throw new Error('integrations must be an array');
     }
 
-    // `entities` is the app definition's registry (ADR-059): a module an app
-    // registers without any integration still carries credentials to encrypt.
-    if (integrations.length === 0 && !entities) {
+    if (integrations.length === 0) {
         return;
     }
 
-    const moduleDefinitions = getEntityTypeDefinitions(
-        getEntityTypeRegistry({ integrations, entities })
-    );
+    const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
+
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);
     const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
 
-    // Core fields are encrypted already and a custom schema may not repeat
-    // them. Everything the app registered itself stays: module fields are added
-    // to the custom schema, never substituted for it (other models included).
-    const coreFields = new Set(CORE_ENCRYPTION_SCHEMA.Credential?.fields || []);
-    const fields = [
-        ...new Set([
-            ...(customSchema.Credential?.fields || []),
-            ...credentialFields.filter((field) => !coreFields.has(field)),
-        ]),
-    ];
-
-    if (fields.length === 0) {
+    if (credentialFields.length === 0) {
         return;
     }
 
     const moduleSchema = {
-        ...customSchema,
-        Credential: { ...customSchema.Credential, fields },
+        Credential: {
+            fields: credentialFields
+        }
     };
 
     logger.info(
-        `Registering module-level encryption for ${fields.length} credential fields`
+        `Registering module-level encryption for ${credentialFields.length} credential fields`
     );
 
     registerCustomSchema(moduleSchema);
@@ -229,80 +205,22 @@ function loadModuleEncryptionSchemas(integrations, entities) {
  *
  * Used by both Prisma (MongoDB/PostgreSQL) and DocumentDB encryption services.
  */
-/**
- * Registers encryption schemas declared by app-level extensions
- * (`appDefinition.coreExtensions[].encryption`), e.g. the db-credentials
- * extension's `OAuthAppCredential.clientSecret`.
- *
- * @param {Array<Object>} extensions - Normalized extensions (extension-loader)
- */
-function loadExtensionEncryptionSchemas(extensions) {
-    if (!extensions || !Array.isArray(extensions) || extensions.length === 0) {
-        return;
-    }
-
-    for (const ext of extensions) {
-        if (!ext.encryption || typeof ext.encryption !== 'object') {
-            continue;
-        }
-
-        const schema = {};
-        for (const [modelName, config] of Object.entries(ext.encryption)) {
-            if (config && Array.isArray(config.fields) && config.fields.length > 0) {
-                schema[modelName] = { fields: config.fields };
-            }
-        }
+function loadCustomEncryptionSchema() {
+    try {
+        // Lazy require to avoid circular dependency issues
+        const path = require('node:path');
+        const { findNearestBackendPackageJson } = require('../../utils');
 
-        if (Object.keys(schema).length > 0) {
-            logger.info(
-                `Registering encryption schema from extension "${ext.name}" for models: ${Object.keys(schema).join(', ')}`
-            );
-            // registerCustomSchema replaces the registered schema, so merge:
-            // an extension adds its models to the app's encryption.schema
-            // rather than dropping it.
-            const merged = { ...customSchema };
-            for (const [modelName, config] of Object.entries(schema)) {
-                const existing = merged[modelName]?.fields || [];
-                merged[modelName] = {
-                    ...merged[modelName],
-                    fields: [...new Set([...existing, ...config.fields])],
-                };
-            }
-            registerCustomSchema(merged);
+        const backendPackagePath = findNearestBackendPackageJson();
+        if (!backendPackagePath) {
+            return; // No backend found, skip custom schema
         }
-    }
-}
 
-function readAppDefinitionForEncryption() {
-    // Lazy require to avoid circular dependency issues
-    const {
-        getPresetAppDefinition,
-    } = require('../../handlers/app-definition-loader');
-    // A definition preset with setAppDefinition() (provider-netlify's
-    // preamble) wins: on Netlify process.cwd() cannot find the backend.
-    const preset = getPresetAppDefinition();
-    if (preset) {
-        return preset;
-    }
-
-    const path = require('node:path');
-    const { findNearestBackendPackageJson } = require('../../utils');
-
-    const backendPackagePath = findNearestBackendPackageJson();
-    if (!backendPackagePath) {
-        return null; // No backend found, skip custom schema
-    }
+        const backendDir = path.dirname(backendPackagePath);
+        const backendIndexPath = path.join(backendDir, 'index.js');
 
-    const backendDir = path.dirname(backendPackagePath);
-    const backendIndexPath = path.join(backendDir, 'index.js');
-
-    const backendModule = require(backendIndexPath);
-    return backendModule?.Definition || null;
-}
-
-function loadCustomEncryptionSchema() {
-    try {
-        const appDefinition = readAppDefinitionForEncryption();
+        const backendModule = require(backendIndexPath);
+        const appDefinition = backendModule?.Definition;
 
         if (!appDefinition) {
             return; // No app definition found
@@ -322,26 +240,12 @@ function loadCustomEncryptionSchema() {
             registerEncryptionOptOut(disable);
         }
 
-        // Load app-level extension encryption schemas. Before the module
-        // schemas: loadModuleEncryptionSchemas currently throws (see the
-        // NOTE inside it) and the throw would skip anything after it.
-        const { loadExtensions } = require('../../extensions/extension-loader');
-        const extensions = loadExtensions(appDefinition);
-        if (extensions.length > 0) {
-            loadExtensionEncryptionSchemas(extensions);
-        }
-
         // Load module-level encryption schemas from integrations
         const integrations = appDefinition.integrations;
-        if (Array.isArray(integrations) || appDefinition.entities) {
-            loadModuleEncryptionSchemas(
-                Array.isArray(integrations) ? integrations : [],
-                appDefinition.entities
-            );
+        if (integrations && Array.isArray(integrations)) {
+            loadModuleEncryptionSchemas(integrations);
         }
     } catch (error) {
-        // A bad entity registry is a configuration error, not "no custom schema".
-        if (error instanceof EntityRegistryError) throw error;
         // Silently ignore errors - custom schema is optional
         // This handles cases like:
         // - Backend package.json not found (tests, standalone usage)
@@ -492,7 +396,6 @@ module.exports = {
     registerEncryptionOptOut,
     loadCustomEncryptionSchema,
     loadModuleEncryptionSchemas,
-    loadExtensionEncryptionSchemas,
     extractCredentialFieldsFromModules,
     validateCustomSchema,
     validateOptOut,

package/database/encryption/field-encryption-service.js

@@ -4,41 +4,8 @@
  * Infrastructure layer service that orchestrates field-level encryption/decryption.
  * Handles nested JSON paths (e.g., 'data.access_token') and bulk operations.
  */
-const { logger } = require('./logger');
-const { isDeployedRuntime } = require('./encryption-config');
-
-/**
- * Thrown when a value that looks like ciphertext cannot be decrypted in a
- * deployed runtime (a wrong, rotated or missing key). Returning the stored
- * ciphertext would hand it to API modules as if it were a token.
- */
-class FieldDecryptionError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'FieldDecryptionError';
-    }
-}
-
-// Cryptor.encrypt() returns `${keyId}:${iv}:${ciphertext}:${encryptedKey}`:
-// keyId and encryptedKey are base64, iv is 16 bytes of hex, ciphertext is hex.
-// Plaintext with three colons (`https://user:pw@host:443`, `a:b:c:d`) must not
-// be mistaken for it.
-const BASE64_PART = /^[A-Za-z0-9+/]+={0,2}$/;
-const IV_PART = /^[0-9a-f]{32}$/i;
-const CIPHERTEXT_PART = /^(?:[0-9a-f]{2})+$/i;
-
 class FieldEncryptionService {
-    /**
-     * @param {Object} params
-     * @param {Object} params.cryptor
-     * @param {Object} params.schema
-     * @param {() => boolean} [params.failClosedOnDecryptError] - whether a
-     *   ciphertext-shaped value that fails to decrypt throws. Defaults to
-     *   "running deployed" (encryption-config's isDeployedRuntime), read on
-     *   each failure. Locally such a value is returned as stored, with a
-     *   warning.
-     */
-    constructor({ cryptor, schema, failClosedOnDecryptError }) {
+    constructor({ cryptor, schema }) {
         if (!cryptor) {
             throw new Error('Cryptor instance required');
         }
@@ -48,10 +15,6 @@ class FieldEncryptionService {
 
         this.cryptor = cryptor;
         this.schema = schema;
-        this.failClosedOnDecryptError =
-            typeof failClosedOnDecryptError === 'function'
-                ? failClosedOnDecryptError
-                : () => isDeployedRuntime();
     }
 
     /**
@@ -134,33 +97,12 @@ class FieldEncryptionService {
         const decryptionPromises = fields.map(async (fieldPath) => {
             const value = this._getNestedValue(decrypted, fieldPath);
 
-            if (!this._isEncrypted(value)) {
-                return null;
-            }
-            try {
+            if (this._isEncrypted(value)) {
                 const decryptedValue = await this.cryptor.decrypt(value);
                 const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
-            } catch (error) {
-                // Deployed: a ciphertext-shaped value under a wrong, rotated or
-                // missing key fails the read rather than reaching an API
-                // module as a token. Legacy plaintext never gets here: it does
-                // not look like ciphertext (_isEncrypted).
-                if (this.failClosedOnDecryptError()) {
-                    throw new FieldDecryptionError(
-                        `Could not decrypt ${modelName}.${fieldPath}`,
-                        { cause: error }
-                    );
-                }
-                // Local: a value that looks like ciphertext but is not is read
-                // as it is stored. One such field must not fail the whole
-                // read, findMany included.
-                logger.warn(
-                    `Could not decrypt ${modelName}.${fieldPath}; returning the stored value`,
-                    { errorName: error?.name }
-                );
-                return null;
             }
+            return null;
         });
 
         const results = await Promise.all(decryptionPromises);
@@ -210,13 +152,7 @@ class FieldEncryptionService {
         }
 
         const parts = value.split(':');
-        return (
-            parts.length === 4 &&
-            BASE64_PART.test(parts[0]) &&
-            IV_PART.test(parts[1]) &&
-            CIPHERTEXT_PART.test(parts[2]) &&
-            BASE64_PART.test(parts[3])
-        );
+        return parts.length >= 4;
     }
 
     _getNestedValue(obj, path) {
@@ -315,4 +251,4 @@ class FieldEncryptionService {
     }
 }
 
-module.exports = { FieldEncryptionService, FieldDecryptionError };
+module.exports = { FieldEncryptionService };

package/database/encryption/integration-mapping-encryption.js

@@ -1,4 +1,4 @@
-const { getEncryptionConfig } = require('./encryption-config');
+const { getEncryptionConfig } = require('../prisma');
 const { Cryptor } = require('../../encrypt/Cryptor');
 const {
     getFieldsToDecryptOnRead,

package/database/prisma.js

@@ -4,7 +4,6 @@ const {
 const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
 const { logger } = require('./encryption/logger');
 const { Cryptor } = require('../encrypt/Cryptor');
-const { getEncryptionConfig } = require('./encryption/encryption-config');
 const config = require('./config');
 
 /**
@@ -33,6 +32,33 @@ function ensureMongoDbUrl() {
     );
 }
 
+function getEncryptionConfig() {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS =
+        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+    const hasAES =
+        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
 const prismaClientSingleton = () => {
     let PrismaClient;
 
@@ -41,15 +67,13 @@ const prismaClientSingleton = () => {
         const paths = [
             // Lambda layer location (when using Prisma Lambda layer)
             `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
-            // __dirname-based absolute path (Netlify functions and bundlers)
-            require('node:path').resolve(__dirname, `../generated/prisma-${dbType}`),
             // Local development location (relative to core package)
             `../generated/prisma-${dbType}`,
         ];
 
-        for (const candidate of paths) {
+        for (const path of paths) {
             try {
-                return require(candidate).PrismaClient;
+                return require(path).PrismaClient;
             } catch (err) {
                 // Continue to next path
             }
@@ -79,13 +103,9 @@ const prismaClientSingleton = () => {
         errorFormat: 'pretty',
     });
 
-    // Throws when a deployed runtime has no encryption key: the app must not
-    // start and write sensitive fields in plaintext.
     const encryptionConfig = getEncryptionConfig();
 
     if (encryptionConfig.enabled) {
-        // Fail closed: if the extension cannot be installed, do not hand out
-        // a client that would write plaintext.
         try {
             // Load custom encryption schema from appDefinition before creating extension
             loadCustomEncryptionSchema();
@@ -100,14 +120,17 @@ const prismaClientSingleton = () => {
                     enabled: true,
                 })
             );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+            );
         } catch (error) {
-            logger.error('Failed to initialize encryption extension:', error);
-            throw error;
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
         }
-
-        logger.info(
-            `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
-        );
     } else {
         logger.info('Field-level encryption disabled');
     }

package/database/use-cases/check-encryption-health-use-case.js

@@ -1,12 +1,3 @@
-const {
-    resolveEncryptionConfig,
-    OPT_OUT_VAR,
-} = require('../encryption/encryption-config');
-
-/**
- * Reports whether field-level encryption is on and working, using the same
- * rule the Prisma client applies at startup (encryption/encryption-config.js).
- */
 class CheckEncryptionHealthUseCase {
     constructor({ testEncryptionUseCase }) {
         this.testEncryptionUseCase = testEncryptionUseCase;
@@ -14,60 +5,78 @@ class CheckEncryptionHealthUseCase {
 
     async execute() {
         const config = this._getEncryptionConfiguration();
-        const summary = {
-            mode: config.mode,
-            bypassed: config.bypassed,
-            optedOut: config.optedOut,
-            runtime: config.runtime,
-            stage: config.stage,
-            debug: {
-                hasKMS: config.hasKMS,
-                hasAES: config.hasAES,
-            },
-        };
 
-        if (config.error) {
-            return {
-                status: 'unhealthy',
-                ...summary,
-                testResult: config.error,
-                encryptionWorks: false,
-            };
-        }
+        if (config.isBypassed || config.mode === 'none') {
+            const testResult = config.isBypassed
+                ? 'Encryption bypassed for this stage'
+                : 'No encryption keys configured';
 
-        if (!config.enabled) {
             return {
                 status: 'disabled',
-                ...summary,
-                testResult: this._disabledReason(config),
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
+                testResult,
                 encryptionWorks: false,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
             };
         }
 
         try {
             const testResults = await this.testEncryptionUseCase.execute();
-            return { ...testResults, ...summary };
+
+            return {
+                ...testResults,
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
+            };
         } catch (error) {
             return {
                 status: 'unhealthy',
-                ...summary,
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
                 testResult: `Encryption test failed: ${error.message}`,
                 encryptionWorks: false,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
             };
         }
     }
 
-    _disabledReason(config) {
-        if (config.bypassed) return 'Encryption bypassed for this stage';
-        if (config.optedOut) {
-            return `Encryption explicitly disabled (${OPT_OUT_VAR}=true); sensitive fields are stored in plaintext`;
-        }
-        return 'No encryption keys configured';
-    }
-
     _getEncryptionConfiguration() {
-        const config = resolveEncryptionConfig(process.env);
-        return { ...config, stage: process.env.STAGE || null };
+        const { STAGE, BYPASS_ENCRYPTION_STAGE, KMS_KEY_ARN, AES_KEY_ID } =
+            process.env;
+
+        const defaultBypassStages = ['dev', 'test', 'local'];
+        const useEnv = BYPASS_ENCRYPTION_STAGE !== undefined;
+        const bypassStages = useEnv
+            ? BYPASS_ENCRYPTION_STAGE.split(',').map((s) => s.trim())
+            : defaultBypassStages;
+
+        const isBypassed = bypassStages.includes(STAGE);
+        const hasAES = AES_KEY_ID && AES_KEY_ID.trim() !== '';
+        const hasKMS = KMS_KEY_ARN && KMS_KEY_ARN.trim() !== '';
+        // Prefer KMS over AES when both are configured (KMS is more secure)
+        const mode = hasKMS ? 'kms' : hasAES ? 'aes' : 'none';
+
+        return {
+            stage: STAGE || null,
+            isBypassed,
+            hasAES,
+            hasKMS,
+            mode,
+        };
     }
 }
 

package/errors/index.js

@@ -6,6 +6,9 @@ const {
     ParameterTypeError,
 } = require('./validation-errors');
 const { ClientSafeError } = require('./client-safe-error');
+const {
+    MappingAlreadyExistsError,
+} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -14,4 +17,5 @@ module.exports = {
     RequiredPropertyError,
     ParameterTypeError,
     ClientSafeError,
+    MappingAlreadyExistsError,
 };

package/errors/mapping-already-exists-error.js

@@ -0,0 +1,14 @@
+const { BaseError } = require('./base-error');
+
+class MappingAlreadyExistsError extends BaseError {
+    constructor(integrationId, sourceId, ...errorOptions) {
+        super(
+            `Mapping already exists for integration ${integrationId} and sourceId ${sourceId}`,
+            ...errorOptions
+        );
+        this.integrationId = integrationId;
+        this.sourceId = sourceId;
+    }
+}
+
+module.exports = { MappingAlreadyExistsError };