@friggframework/core 2.0.0--canary.704.79d9a63.0 → 2.0.0--canary.686.e94de4d.0

package/core/Worker.js

@@ -1,4 +1,3 @@
-const { SQSClient, GetQueueUrlCommand, SendMessageCommand } = require('@aws-sdk/client-sqs');
 const _ = require('lodash');
 const { RequiredPropertyError } = require('../errors');
 const { get } = require('../assertions');
@@ -6,18 +5,44 @@ const { readQueueDelivery } = require('../queues/queue-delivery');
 const { runMessageScope } = require('./invocation-scope');
 const { getLogger } = require('../logs');
 
-const sqs = new SQSClient({ region: process.env.AWS_REGION });
 const log = getLogger('frigg.worker');
 
+/**
+ * Worker - queue message producer/consumer base class.
+ *
+ * Subclass and override _run(). The queue transport is behind
+ * QueueClientInterface and can be injected (friggframework/frigg#545):
+ * `new MyWorker({ queueClient })`. Unlike #545 it is not required: without
+ * one the worker uses an SqsQueueClient configured exactly as before
+ * (AWS_REGION), created on first use rather than at module load, so
+ * requiring core constructs no AWS client and a Netlify/QStash worker that
+ * only calls _run() never touches SQS.
+ */
 class Worker {
+    /**
+     * @param {Object} [options]
+     * @param {import('../queues/queue-client-interface').QueueClientInterface} [options.queueClient]
+     */
+    constructor(options = {}) {
+        this._queueClient = options.queueClient || null;
+    }
+
+    _getQueueClient() {
+        if (!this._queueClient) {
+            const { SqsQueueClient } = require('../queues/sqs-queue-client');
+            this._queueClient = new SqsQueueClient({
+                clientConfig: { region: process.env.AWS_REGION },
+            });
+        }
+        return this._queueClient;
+    }
+
     async getQueueURL(params) {
         // Passing params in because there will be multiple QueueNames
         // let params = {
         //     QueueName:  process.env.QueueName
         // };
-        const command = new GetQueueUrlCommand(params);
-        const data = await sqs.send(command);
-        return data.QueueUrl;
+        return this._getQueueClient().getQueueUrl(params);
     }
 
     async run(params, context = {}) {
@@ -91,8 +116,7 @@ class Worker {
     }
 
     async sendAsyncSQSMessage(params) {
-        const command = new SendMessageCommand(params);
-        const data = await sqs.send(command);
+        const data = await this._getQueueClient().sendMessage(params);
         return data.MessageId;
     }
 

package/core/create-handler.js

@@ -81,6 +81,15 @@ const createHandler = (optionByName = {}) => {
                     if (shouldUseDatabase) {
                         const { connectPrisma } = require('../database/prisma');
                         await connectPrisma();
+
+                        // Extension bootstraps (e.g. db-credentials swapping a
+                        // module's env for its DB loader) run once per
+                        // process, after the connect and before any request
+                        // builds a module. AWS and Netlify both reach here.
+                        const {
+                            initializeApp,
+                        } = require('../extensions/initialize-app');
+                        await initializeApp();
                     }
 
                     // Helps reuse the database connection.  Lowers response times.

package/credential/repositories/credential-repository-documentdb.js

@@ -186,6 +186,40 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        const userObjectId = toObjectId(userId);
+        if (!userObjectId) return [];
+        const docs = await findManyDrained(
+            this.prisma,
+            'Credential',
+            { userId: userObjectId },
+            { sort: { createdAt: -1 } }
+        );
+        const credentials = [];
+        for (const doc of docs) {
+            const decrypted = await this.encryptionService.decryptFields(
+                'Credential',
+                doc
+            );
+            credentials.push({
+                ...this._mapCredential(decrypted),
+                id: fromObjectId(doc._id),
+                userId: fromObjectId(doc.userId) ?? doc.userId,
+                externalId: doc.externalId ?? null,
+                authIsValid: doc.authIsValid ?? null,
+                createdAt: doc.createdAt ?? null,
+                updatedAt: doc.updatedAt ?? null,
+            });
+        }
+        return credentials;
+    }
+
     async updateCredential(credentialId, updates) {
         const objectId = toObjectId(credentialId);
         if (!objectId) return null;

package/credential/repositories/credential-repository-interface.js

@@ -80,6 +80,21 @@ class CredentialRepositoryInterface {
         );
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string|number} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs, `createdAt`
+     *   and `updatedAt`, and the (decrypted) data fields spread in, as
+     *   findCredentialById returns them. Empty when the user has none.
+     * @abstract
+     */
+    async findCredentialsByUserId(userId) {
+        throw new Error(
+            'Method findCredentialsByUserId must be implemented by subclass'
+        );
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/repositories/credential-repository-mongo.js

@@ -188,6 +188,29 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        if (!userId) return [];
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: String(userId) },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id,
+            userId: credential.userId,
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })

package/credential/repositories/credential-repository-postgres.js

@@ -205,6 +205,34 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        let intUserId;
+        try {
+            intUserId = this._convertId(userId);
+        } catch {
+            return [];
+        }
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: intUserId },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id.toString(),
+            userId: credential.userId?.toString(),
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/use-cases/credential-operations-for-user.js

@@ -0,0 +1,202 @@
+const Boom = require('@hapi/boom');
+const {
+    createScopePolicy,
+    describeRecord,
+    visibilityClauses,
+    matchesListFilters,
+    SCOPES,
+} = require('../../modules/entity-scope');
+const { assertCanManage } = require('../../modules/use-cases/manage-access');
+
+/**
+ * Management API v2 credential operations (ADR-056 §3.4, §3.6). A credential
+ * has no module name and no organization of its own:
+ *
+ * - its `type` and `entityIds` come from the entities that use it that the
+ *   caller may see, so the same person's account connected in two
+ *   organizations (one credential, two entities) lists in each organization
+ *   with that organization's entity only;
+ * - who it belongs to is its OWNER (`credential.userId`), never the entities:
+ *   a credential an individual entity and an organization entity both point at
+ *   (possible only through legacy data) is described by whoever owns the
+ *   credential, so the answer cannot change with the order the entities load;
+ * - a credential whose entities are all out of sight (another organization's)
+ *   is a 404, and one with no entities at all (its entity was deleted) is
+ *   visible to its owner only, as it was before scoping.
+ */
+
+const credentialIdOf = (entity) => {
+    const ref = entity.credential ?? entity.credentialId;
+    if (ref === undefined || ref === null) return null;
+    if (typeof ref === 'object') {
+        const id = ref.id ?? ref._id;
+        return id === undefined || id === null ? null : String(id);
+    }
+    return String(ref);
+};
+
+/** Adds `type` and `entityIds` from the user's entities to each credential. */
+function withEntityUsage(credentials, entities) {
+    const usage = new Map();
+    for (const entity of entities || []) {
+        const credentialId = credentialIdOf(entity);
+        if (!credentialId) continue;
+        const entry = usage.get(credentialId) || { type: null, entityIds: [] };
+        entry.type = entry.type || entity.moduleName || null;
+        entry.entityIds.push(String(entity.id));
+        usage.set(credentialId, entry);
+    }
+    return credentials.map((credential) => {
+        const entry = usage.get(String(credential.id)) || {
+            type: null,
+            entityIds: [],
+        };
+        return { ...credential, type: entry.type, entityIds: entry.entityIds };
+    });
+}
+
+/**
+ * `{scope, owner, organizationId, access}` of a credential for this caller, or
+ * null when its owner is neither the caller nor the active organization. Built
+ * by `describeRecord` over the row a connection by this owner has: the
+ * organization of a visible entity, else the one a new entity would get.
+ */
+function credentialTenancy(credential, visibleEntities, ctx) {
+    const entityOrg = visibleEntities.find(
+        (entity) => entity.organizationId !== undefined && entity.organizationId !== null
+    )?.organizationId;
+    const organizationId =
+        entityOrg ?? (ctx.individualAcross === 'all' ? null : ctx.activeOrgId);
+    return describeRecord({ userId: credential.userId, organizationId }, ctx, 'entity');
+}
+
+/** The entities of `entities` the caller may see, each with its `tenancy`. */
+function visibleOf(entities, ctx) {
+    const visible = [];
+    for (const entity of entities || []) {
+        const tenancy = describeRecord(entity, ctx, 'entity');
+        if (tenancy) visible.push({ ...entity, tenancy });
+    }
+    return visible;
+}
+
+/**
+ * The caller's credentials with their type, the entities of them they may see
+ * and `tenancy`. Credentials with no entity at all are listed too, for the
+ * person and the active organization that own them.
+ */
+class ListCredentialsForUser {
+    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+        this.scopePolicy = scopePolicy || createScopePolicy();
+    }
+
+    /** @param {{scope?: string, owner?: string}} [filters] */
+    async execute(user, filters = {}) {
+        const ctx = this.scopePolicy.accessContext(user);
+        const owners = [...new Set([ctx.callerId, ctx.activeOrgId].filter(Boolean))];
+        const [found, perOwner, owned] = await Promise.all([
+            this.moduleRepository.findEntitiesByOwnership(visibilityClauses(ctx, 'entity')),
+            Promise.all(owners.map((id) => this.credentialRepository.findCredentialsByUserId(id))),
+            // Every entity of those owners, in any organization: only to tell a credential
+            // with no entity at all from one used elsewhere.
+            Promise.all(owners.map((id) => this.moduleRepository.findEntitiesByUserId(id))),
+        ]);
+        const visible = visibleOf(found, ctx);
+        const usedAnywhere = new Set(owned.flat().map(credentialIdOf).filter(Boolean));
+        const listed = [];
+        for (const credential of perOwner.flat().filter(Boolean)) {
+            const id = String(credential.id);
+            const referencing = visible.filter((entity) => credentialIdOf(entity) === id);
+            if (referencing.length === 0 && usedAnywhere.has(id)) continue;
+            const tenancy = credentialTenancy(credential, referencing, ctx);
+            if (!tenancy || !matchesListFilters(tenancy, filters)) continue;
+            listed.push({ ...withEntityUsage([credential], referencing)[0], tenancy });
+        }
+        return listed;
+    }
+}
+
+/** One credential the caller may see: see the header. 404 otherwise. */
+class GetCredentialForUserV2 {
+    constructor({ credentialRepository, moduleRepository, scopePolicy }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+        this.scopePolicy = scopePolicy || createScopePolicy();
+    }
+
+    async execute(credentialId, user) {
+        const notFound = () =>
+            Boom.notFound(`Credential ${credentialId} not found`, {
+                code: 'CREDENTIAL_NOT_FOUND',
+            });
+        let credential = null;
+        try {
+            credential = await this.credentialRepository.findCredentialById(
+                credentialId
+            );
+        } catch (error) {
+            if (!/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
+                throw error;
+            }
+        }
+        if (!credential) throw notFound();
+        const ctx = this.scopePolicy.accessContext(user);
+
+        const referencing =
+            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
+        const visible = visibleOf(referencing, ctx);
+        if (referencing.length > 0 && visible.length === 0) throw notFound();
+        const tenancy = credentialTenancy(credential, visible, ctx);
+        if (!tenancy) throw notFound();
+        return { ...withEntityUsage([credential], visible)[0], tenancy };
+    }
+}
+
+/**
+ * Deletes a credential the caller may manage. The entities that used it stay,
+ * with their credential unset, so they show as needing re-authorization rather
+ * than disappearing from integrations.
+ *
+ * Refuses with 409 `CREDENTIAL_SHARED` while an entity the caller cannot see
+ * still uses it: one credential row serves the same provider account in every
+ * organization, and deleting it from one would break the other. The message
+ * says nothing about the other connections (not even how many): remove the
+ * entities that use it, and it goes with the last one.
+ */
+class DeleteCredentialForUser {
+    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+        this.getCredentialForUser = getCredentialForUser;
+    }
+
+    async execute(credentialId, user) {
+        const credential = await this.getCredentialForUser.execute(
+            credentialId,
+            user
+        );
+        assertCanManage(credential.tenancy.access, `credential ${credential.id}`);
+        const usedBy =
+            (await this.moduleRepository.findEntities({ credentialId: credential.id })) || [];
+        if (usedBy.length > credential.entityIds.length) {
+            throw Boom.conflict(
+                `Credential ${credential.id} is still in use by other connections and cannot be deleted from here`,
+                { code: 'CREDENTIAL_SHARED' }
+            );
+        }
+        for (const entityId of credential.entityIds) {
+            await this.moduleRepository.unsetCredential(entityId);
+        }
+        await this.credentialRepository.deleteCredentialById(credential.id);
+        return { id: String(credential.id), entityIds: credential.entityIds };
+    }
+}
+
+module.exports = {
+    ListCredentialsForUser,
+    GetCredentialForUserV2,
+    DeleteCredentialForUser,
+    withEntityUsage,
+};

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -0,0 +1,73 @@
+const Boom = require('@hapi/boom');
+const { assertCanManage } = require('../../modules/use-cases/manage-access');
+
+/**
+ * Re-authorization of a credential the caller owns (Management API v2). It
+ * runs the same flow as /api/v2/authorize for the credential's entity type,
+ * with the session bound to the credential so it cannot be reused for
+ * anything else.
+ */
+async function credentialEntityType(getCredentialForUser, credentialId, user) {
+    const credential = await getCredentialForUser.execute(credentialId, user);
+    if (!credential.type) {
+        throw Boom.conflict(
+            `Credential ${credentialId} is not used by any entity, so its type is unknown; authorize a new connection instead`,
+            { code: 'CREDENTIAL_TYPE_UNKNOWN' }
+        );
+    }
+    return {
+        entityType: credential.type,
+        credentialId: String(credential.id),
+        // A re-authorization keeps the scope the connection already has.
+        fixedScope: credential.tenancy?.scope,
+        access: credential.tenancy?.access,
+    };
+}
+
+/** GET /api/v2/credentials/:credentialId/reauthorize */
+class GetCredentialReauthorization {
+    constructor({ getCredentialForUser, getAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.getAuthorizationStep = getAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
+        const { entityType, credentialId: boundCredentialId } =
+            await credentialEntityType(this.getCredentialForUser, credentialId, user);
+        return this.getAuthorizationStep.execute({
+            user,
+            entityType,
+            credentialId: boundCredentialId,
+            step,
+            sessionId,
+            state,
+        });
+    }
+}
+
+/** POST /api/v2/credentials/:credentialId/reauthorize */
+class ReauthorizeCredentialForUser {
+    constructor({ getCredentialForUser, submitAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.submitAuthorizationStep = submitAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
+        const { access, ...binding } = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
+        // A credential an organization owns: the organization's admins only.
+        assertCanManage(access, `credential ${credentialId}`);
+        return this.submitAuthorizationStep.execute({
+            user,
+            ...binding,
+            data,
+            step,
+            sessionId,
+        });
+    }
+}
+
+module.exports = { GetCredentialReauthorization, ReauthorizeCredentialForUser };

package/database/config.js

@@ -3,6 +3,39 @@
  * Manages configuration for Prisma ORM operations
  */
 
+/**
+ * Maps an app definition's `database` block to a Prisma database type.
+ *
+ * @param {Object|undefined} database - `Definition.database`
+ * @param {string} where - where the definition lives, for the error message
+ * @returns {'mongodb'|'postgresql'|'documentdb'}
+ */
+function databaseTypeFromConfig(database, where) {
+    if (!database) {
+        throw new Error(
+            '[Frigg] App definition missing database configuration. ' +
+            `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${where}`
+        );
+    }
+
+    // Determine database type from enabled database
+    // Priority order: postgres > mongoDB > documentDB
+    if (database.postgres?.enable === true) {
+        return 'postgresql';
+    }
+    if (database.mongoDB?.enable === true) {
+        return 'mongodb';
+    }
+    if (database.documentDB?.enable === true) {
+        return 'documentdb';
+    }
+
+    throw new Error(
+        '[Frigg] No database enabled in app definition. ' +
+        'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
+    );
+}
+
 /**
  * Determines database type from environment or app definition
  * 
@@ -21,6 +54,20 @@ function getDatabaseType() {
 
     // Fallback: Load app definition
     try {
+        // A definition preset with setAppDefinition() (provider-netlify's
+        // function preamble) wins: on Netlify process.cwd() is the function
+        // root at runtime, so discovery cannot find the backend.
+        const {
+            getPresetAppDefinition,
+        } = require('../handlers/app-definition-loader');
+        const preset = getPresetAppDefinition();
+        if (preset) {
+            return databaseTypeFromConfig(
+                preset.database,
+                'your backend/index.js'
+            );
+        }
+
         const path = require('node:path');
         const fs = require('node:fs');
         const { findNearestBackendPackageJson } = require('../utils');
@@ -76,30 +123,7 @@ function getDatabaseType() {
         }
 
         database = backendModule?.Definition?.database;
-
-        if (!database) {
-            throw new Error(
-                '[Frigg] App definition missing database configuration. ' +
-                `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${backendIndexPath}`
-            );
-        }
-
-        // Determine database type from enabled database
-        // Priority order: postgres > mongoDB > documentDB
-        if (database.postgres?.enable === true) {
-            return 'postgresql';
-        }
-        if (database.mongoDB?.enable === true) {
-            return 'mongodb';
-        }
-        if (database.documentDB?.enable === true) {
-            return 'documentdb';
-        }
-
-        throw new Error(
-            '[Frigg] No database enabled in app definition. ' +
-            'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
-        );
+        return databaseTypeFromConfig(database, backendIndexPath);
     } catch (error) {
         // Re-throw with context if it's our error
         if (error.message.includes('[Frigg]')) {

package/database/documentdb-encryption-service.js

@@ -4,6 +4,7 @@ const {
     getFieldsToEncryptOnWrite,
     loadCustomEncryptionSchema,
 } = require('./encryption/encryption-schema-registry');
+const { getEncryptionConfig } = require('./encryption/encryption-config');
 
 /**
  * Encryption service specifically for DocumentDB repositories
@@ -41,43 +42,29 @@ class DocumentDBEncryptionService {
     }
 
     /**
-     * Initialize Cryptor with environment-based configuration.
-     * Matches the logic from @friggframework/core/database/prisma.js
+     * Initialize Cryptor with environment-based configuration, using the
+     * same rule as the Prisma client (see encryption/encryption-config.js).
      *
-     * Encryption is bypassed in dev/test/local stages.
-     * Production uses AWS KMS (if available) or AES encryption.
+     * Local runs skip encryption on the dev, test and local stages. A
+     * deployed runtime with no key throws instead of writing plaintext.
      *
      * @private
+     * @throws {EncryptionConfigurationError} deployed with no usable key
      */
     _initializeCryptor() {
         // Load custom encryption schema from app definition BEFORE checking configuration
         // This ensures custom fields (like User.username) are registered before any encryption operations
         loadCustomEncryptionSchema();
 
-        // Match logic from packages/core/database/prisma.js
-        const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
-        const bypassEncryption = ['dev', 'test', 'local'].includes(stage.toLowerCase());
+        const config = getEncryptionConfig();
 
-        if (bypassEncryption) {
+        if (!config.enabled) {
             this.cryptor = null;
             this.enabled = false;
             return;
         }
 
-        // Determine encryption method (ensure boolean values)
-        const hasKMS = !!(process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '');
-        const hasAES = !!(process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '');
-
-        if (!hasKMS && !hasAES) {
-            console.warn('[DocumentDBEncryptionService] No encryption keys configured. Encryption disabled.');
-            this.cryptor = null;
-            this.enabled = false;
-            return;
-        }
-
-        // KMS takes precedence over AES
-        const shouldUseAws = hasKMS;
-        this.cryptor = new Cryptor({ shouldUseAws });
+        this.cryptor = new Cryptor({ shouldUseAws: config.method === 'kms' });
         this.enabled = true;
     }
 

package/database/documentdb-utils.js

@@ -58,6 +58,8 @@ async function insertOne(client, collection, document) {
 
         // Provide helpful context for common errors
         if (error.code === 11000) {
+            // `code` lets callers recognise a lost race without parsing text
+            // (see database/unique-violation.js).
             throw Object.assign(
                 new Error(`${errorMsg} - Duplicate key violation`),
                 { code: 11000 }