@friggframework/core 2.0.0--canary.704.79d9a63.0 → 2.0.0--canary.680.daae24e.0

package/database/encryption/field-encryption-service.js

@@ -4,8 +4,41 @@
  * Infrastructure layer service that orchestrates field-level encryption/decryption.
  * Handles nested JSON paths (e.g., 'data.access_token') and bulk operations.
  */
+const { logger } = require('./logger');
+const { isDeployedRuntime } = require('./encryption-config');
+
+/**
+ * Thrown when a value that looks like ciphertext cannot be decrypted in a
+ * deployed runtime (a wrong, rotated or missing key). Returning the stored
+ * ciphertext would hand it to API modules as if it were a token.
+ */
+class FieldDecryptionError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'FieldDecryptionError';
+    }
+}
+
+// Cryptor.encrypt() returns `${keyId}:${iv}:${ciphertext}:${encryptedKey}`:
+// keyId and encryptedKey are base64, iv is 16 bytes of hex, ciphertext is hex.
+// Plaintext with three colons (`https://user:pw@host:443`, `a:b:c:d`) must not
+// be mistaken for it.
+const BASE64_PART = /^[A-Za-z0-9+/]+={0,2}$/;
+const IV_PART = /^[0-9a-f]{32}$/i;
+const CIPHERTEXT_PART = /^(?:[0-9a-f]{2})+$/i;
+
 class FieldEncryptionService {
-    constructor({ cryptor, schema }) {
+    /**
+     * @param {Object} params
+     * @param {Object} params.cryptor
+     * @param {Object} params.schema
+     * @param {() => boolean} [params.failClosedOnDecryptError] - whether a
+     *   ciphertext-shaped value that fails to decrypt throws. Defaults to
+     *   "running deployed" (encryption-config's isDeployedRuntime), read on
+     *   each failure. Locally such a value is returned as stored, with a
+     *   warning.
+     */
+    constructor({ cryptor, schema, failClosedOnDecryptError }) {
         if (!cryptor) {
             throw new Error('Cryptor instance required');
         }
@@ -15,6 +48,10 @@ class FieldEncryptionService {
 
         this.cryptor = cryptor;
         this.schema = schema;
+        this.failClosedOnDecryptError =
+            typeof failClosedOnDecryptError === 'function'
+                ? failClosedOnDecryptError
+                : () => isDeployedRuntime();
     }
 
     /**
@@ -97,12 +134,33 @@ class FieldEncryptionService {
         const decryptionPromises = fields.map(async (fieldPath) => {
             const value = this._getNestedValue(decrypted, fieldPath);
 
-            if (this._isEncrypted(value)) {
+            if (!this._isEncrypted(value)) {
+                return null;
+            }
+            try {
                 const decryptedValue = await this.cryptor.decrypt(value);
                 const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
+            } catch (error) {
+                // Deployed: a ciphertext-shaped value under a wrong, rotated or
+                // missing key fails the read rather than reaching an API
+                // module as a token. Legacy plaintext never gets here: it does
+                // not look like ciphertext (_isEncrypted).
+                if (this.failClosedOnDecryptError()) {
+                    throw new FieldDecryptionError(
+                        `Could not decrypt ${modelName}.${fieldPath}`,
+                        { cause: error }
+                    );
+                }
+                // Local: a value that looks like ciphertext but is not is read
+                // as it is stored. One such field must not fail the whole
+                // read, findMany included.
+                logger.warn(
+                    `Could not decrypt ${modelName}.${fieldPath}; returning the stored value`,
+                    { errorName: error?.name }
+                );
+                return null;
             }
-            return null;
         });
 
         const results = await Promise.all(decryptionPromises);
@@ -152,7 +210,13 @@ class FieldEncryptionService {
         }
 
         const parts = value.split(':');
-        return parts.length >= 4;
+        return (
+            parts.length === 4 &&
+            BASE64_PART.test(parts[0]) &&
+            IV_PART.test(parts[1]) &&
+            CIPHERTEXT_PART.test(parts[2]) &&
+            BASE64_PART.test(parts[3])
+        );
     }
 
     _getNestedValue(obj, path) {
@@ -251,4 +315,4 @@ class FieldEncryptionService {
     }
 }
 
-module.exports = { FieldEncryptionService };
+module.exports = { FieldEncryptionService, FieldDecryptionError };

package/database/encryption/integration-mapping-encryption.js

@@ -1,4 +1,4 @@
-const { getEncryptionConfig } = require('../prisma');
+const { getEncryptionConfig } = require('./encryption-config');
 const { Cryptor } = require('../../encrypt/Cryptor');
 const {
     getFieldsToDecryptOnRead,

package/database/encryption/test-support/fake-ciphertext.js

@@ -0,0 +1,15 @@
+/**
+ * Test double for Cryptor output. Same shape as the real thing
+ * (`keyId:iv:ciphertext:encryptedKey`: base64, 16-byte hex, hex, base64) so
+ * FieldEncryptionService._isEncrypted accepts it, with the plaintext
+ * recoverable for the fake decrypt.
+ */
+const fakeCiphertext = (plain) =>
+    `a2V5SWQ=:${'0'.repeat(32)}:${Buffer.from(String(plain)).toString(
+        'hex'
+    )}:ZW5jS2V5`;
+
+const fakePlaintext = (ciphertext) =>
+    Buffer.from(String(ciphertext).split(':')[2], 'hex').toString();
+
+module.exports = { fakeCiphertext, fakePlaintext };

package/database/prisma.js

@@ -4,6 +4,7 @@ const {
 const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
 const { logger } = require('./encryption/logger');
 const { Cryptor } = require('../encrypt/Cryptor');
+const { getEncryptionConfig } = require('./encryption/encryption-config');
 const config = require('./config');
 
 /**
@@ -32,33 +33,6 @@ function ensureMongoDbUrl() {
     );
 }
 
-function getEncryptionConfig() {
-    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
-    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
-
-    if (shouldBypassEncryption) {
-        return { enabled: false };
-    }
-
-    const hasKMS =
-        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
-    const hasAES =
-        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
-
-    if (!hasKMS && !hasAES) {
-        logger.warn(
-            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
-            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
-        );
-        return { enabled: false };
-    }
-
-    return {
-        enabled: true,
-        method: hasKMS ? 'kms' : 'aes',
-    };
-}
-
 const prismaClientSingleton = () => {
     let PrismaClient;
 
@@ -103,9 +77,13 @@ const prismaClientSingleton = () => {
         errorFormat: 'pretty',
     });
 
+    // Throws when a deployed runtime has no encryption key: the app must not
+    // start and write sensitive fields in plaintext.
     const encryptionConfig = getEncryptionConfig();
 
     if (encryptionConfig.enabled) {
+        // Fail closed: if the extension cannot be installed, do not hand out
+        // a client that would write plaintext.
         try {
             // Load custom encryption schema from appDefinition before creating extension
             loadCustomEncryptionSchema();
@@ -120,17 +98,14 @@ const prismaClientSingleton = () => {
                     enabled: true,
                 })
             );
-
-            logger.info(
-                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
-            );
         } catch (error) {
-            logger.error(
-                'Failed to initialize encryption extension:',
-                error
-            );
-            logger.warn('Continuing without encryption...');
+            logger.error('Failed to initialize encryption extension:', error);
+            throw error;
         }
+
+        logger.info(
+            `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+        );
     } else {
         logger.info('Field-level encryption disabled');
     }

package/database/use-cases/check-encryption-health-use-case.js

@@ -1,3 +1,12 @@
+const {
+    resolveEncryptionConfig,
+    OPT_OUT_VAR,
+} = require('../encryption/encryption-config');
+
+/**
+ * Reports whether field-level encryption is on and working, using the same
+ * rule the Prisma client applies at startup (encryption/encryption-config.js).
+ */
 class CheckEncryptionHealthUseCase {
     constructor({ testEncryptionUseCase }) {
         this.testEncryptionUseCase = testEncryptionUseCase;
@@ -5,78 +14,60 @@ class CheckEncryptionHealthUseCase {
 
     async execute() {
         const config = this._getEncryptionConfiguration();
+        const summary = {
+            mode: config.mode,
+            bypassed: config.bypassed,
+            optedOut: config.optedOut,
+            runtime: config.runtime,
+            stage: config.stage,
+            debug: {
+                hasKMS: config.hasKMS,
+                hasAES: config.hasAES,
+            },
+        };
 
-        if (config.isBypassed || config.mode === 'none') {
-            const testResult = config.isBypassed
-                ? 'Encryption bypassed for this stage'
-                : 'No encryption keys configured';
+        if (config.error) {
+            return {
+                status: 'unhealthy',
+                ...summary,
+                testResult: config.error,
+                encryptionWorks: false,
+            };
+        }
 
+        if (!config.enabled) {
             return {
                 status: 'disabled',
-                mode: config.mode,
-                bypassed: config.isBypassed,
-                stage: config.stage,
-                testResult,
+                ...summary,
+                testResult: this._disabledReason(config),
                 encryptionWorks: false,
-                debug: {
-                    hasKMS: config.hasKMS,
-                    hasAES: config.hasAES,
-                },
             };
         }
 
         try {
             const testResults = await this.testEncryptionUseCase.execute();
-
-            return {
-                ...testResults,
-                mode: config.mode,
-                bypassed: config.isBypassed,
-                stage: config.stage,
-                debug: {
-                    hasKMS: config.hasKMS,
-                    hasAES: config.hasAES,
-                },
-            };
+            return { ...testResults, ...summary };
         } catch (error) {
             return {
                 status: 'unhealthy',
-                mode: config.mode,
-                bypassed: config.isBypassed,
-                stage: config.stage,
+                ...summary,
                 testResult: `Encryption test failed: ${error.message}`,
                 encryptionWorks: false,
-                debug: {
-                    hasKMS: config.hasKMS,
-                    hasAES: config.hasAES,
-                },
             };
         }
     }
 
-    _getEncryptionConfiguration() {
-        const { STAGE, BYPASS_ENCRYPTION_STAGE, KMS_KEY_ARN, AES_KEY_ID } =
-            process.env;
-
-        const defaultBypassStages = ['dev', 'test', 'local'];
-        const useEnv = BYPASS_ENCRYPTION_STAGE !== undefined;
-        const bypassStages = useEnv
-            ? BYPASS_ENCRYPTION_STAGE.split(',').map((s) => s.trim())
-            : defaultBypassStages;
-
-        const isBypassed = bypassStages.includes(STAGE);
-        const hasAES = AES_KEY_ID && AES_KEY_ID.trim() !== '';
-        const hasKMS = KMS_KEY_ARN && KMS_KEY_ARN.trim() !== '';
-        // Prefer KMS over AES when both are configured (KMS is more secure)
-        const mode = hasKMS ? 'kms' : hasAES ? 'aes' : 'none';
+    _disabledReason(config) {
+        if (config.bypassed) return 'Encryption bypassed for this stage';
+        if (config.optedOut) {
+            return `Encryption explicitly disabled (${OPT_OUT_VAR}=true); sensitive fields are stored in plaintext`;
+        }
+        return 'No encryption keys configured';
+    }
 
-        return {
-            stage: STAGE || null,
-            isBypassed,
-            hasAES,
-            hasKMS,
-            mode,
-        };
+    _getEncryptionConfiguration() {
+        const config = resolveEncryptionConfig(process.env);
+        return { ...config, stage: process.env.STAGE || null };
     }
 }
 

package/errors/index.js

@@ -6,9 +6,6 @@ const {
     ParameterTypeError,
 } = require('./validation-errors');
 const { ClientSafeError } = require('./client-safe-error');
-const {
-    MappingAlreadyExistsError,
-} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -17,5 +14,4 @@ module.exports = {
     RequiredPropertyError,
     ParameterTypeError,
     ClientSafeError,
-    MappingAlreadyExistsError,
 };