@friggframework/core 2.0.0--canary.707.df80bfd.0 → 2.0.0--canary.680.d670696.0

package/database/config.js

@@ -3,39 +3,6 @@
  * Manages configuration for Prisma ORM operations
  */
 
-/**
- * Maps an app definition's `database` block to a Prisma database type.
- *
- * @param {Object|undefined} database - `Definition.database`
- * @param {string} where - where the definition lives, for the error message
- * @returns {'mongodb'|'postgresql'|'documentdb'}
- */
-function databaseTypeFromConfig(database, where) {
-    if (!database) {
-        throw new Error(
-            '[Frigg] App definition missing database configuration. ' +
-            `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${where}`
-        );
-    }
-
-    // Determine database type from enabled database
-    // Priority order: postgres > mongoDB > documentDB
-    if (database.postgres?.enable === true) {
-        return 'postgresql';
-    }
-    if (database.mongoDB?.enable === true) {
-        return 'mongodb';
-    }
-    if (database.documentDB?.enable === true) {
-        return 'documentdb';
-    }
-
-    throw new Error(
-        '[Frigg] No database enabled in app definition. ' +
-        'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
-    );
-}
-
 /**
  * Determines database type from environment or app definition
  * 
@@ -54,20 +21,6 @@ function getDatabaseType() {
 
     // Fallback: Load app definition
     try {
-        // A definition preset with setAppDefinition() (provider-netlify's
-        // function preamble) wins: on Netlify process.cwd() is the function
-        // root at runtime, so discovery cannot find the backend.
-        const {
-            getPresetAppDefinition,
-        } = require('../handlers/app-definition-loader');
-        const preset = getPresetAppDefinition();
-        if (preset) {
-            return databaseTypeFromConfig(
-                preset.database,
-                'your backend/index.js'
-            );
-        }
-
         const path = require('node:path');
         const fs = require('node:fs');
         const { findNearestBackendPackageJson } = require('../utils');
@@ -123,7 +76,30 @@ function getDatabaseType() {
         }
 
         database = backendModule?.Definition?.database;
-        return databaseTypeFromConfig(database, backendIndexPath);
+
+        if (!database) {
+            throw new Error(
+                '[Frigg] App definition missing database configuration. ' +
+                `Add database: { postgres: { enable: true } } (or mongoDB/documentDB) to ${backendIndexPath}`
+            );
+        }
+
+        // Determine database type from enabled database
+        // Priority order: postgres > mongoDB > documentDB
+        if (database.postgres?.enable === true) {
+            return 'postgresql';
+        }
+        if (database.mongoDB?.enable === true) {
+            return 'mongodb';
+        }
+        if (database.documentDB?.enable === true) {
+            return 'documentdb';
+        }
+
+        throw new Error(
+            '[Frigg] No database enabled in app definition. ' +
+            'Set one of: database.postgres.enable, database.mongoDB.enable, or database.documentDB.enable to true'
+        );
     } catch (error) {
         // Re-throw with context if it's our error
         if (error.message.includes('[Frigg]')) {

package/database/documentdb-encryption-service.js

@@ -251,7 +251,6 @@ class DocumentDBEncryptionService {
             const errorContext = {
                 modelName,
                 fieldPath,
-                encryptedValuePrefix: encryptedValue.substring(0, 20),
                 errorMessage: error.message
             };
 

package/database/documentdb-utils.js

@@ -58,12 +58,7 @@ async function insertOne(client, collection, document) {
 
         // Provide helpful context for common errors
         if (error.code === 11000) {
-            // `code` lets callers recognise a lost race without parsing text
-            // (see database/unique-violation.js).
-            throw Object.assign(
-                new Error(`${errorMsg} - Duplicate key violation`),
-                { code: 11000 }
-            );
+            throw new Error(`${errorMsg} - Duplicate key violation`);
         }
         throw new Error(errorMsg);
     }

package/database/encryption/encryption-config.js

@@ -18,9 +18,6 @@
  */
 
 const { logger } = require('./logger');
-const {
-    isDeployedRuntime: isDeployedProviderRuntime,
-} = require('../../providers/runtime-detection');
 
 const LOCAL_BYPASS_STAGES = ['dev', 'test', 'local'];
 const OPT_OUT_VAR = 'FRIGG_ENCRYPTION_DISABLED';
@@ -43,18 +40,42 @@ function isTrue(value) {
 }
 
 /**
- * True when the process runs as a deployed function, on AWS Lambda or on the
- * active provider's platform (provider-netlify: FRIGG_PROVIDER=netlify, set by
- * its generated entry points), and not under a local emulator or test runner.
- * One rule for encryption and queue authentication: core/providers/
- * runtime-detection asks the provider's detect(), and fails closed when a
- * named non-AWS provider cannot be loaded.
+ * True when the process runs as a deployed function, on AWS Lambda or on
+ * another provider's platform.
+ *
+ * - AWS Lambda sets AWS_LAMBDA_FUNCTION_NAME, LAMBDA_TASK_ROOT and
+ *   AWS_EXECUTION_ENV (AWS_Lambda_<runtime>). Other AWS hosts (CloudShell,
+ *   CodeBuild, ECS) set AWS_EXECUTION_ENV to other values and count as local:
+ *   CLI commands run from CI must not trip the deployed-stage check.
+ * - Other providers: FRIGG_PROVIDER names a non-AWS provider. Frigg's
+ *   generated function entry points for that provider set it (provider-netlify
+ *   sets 'netlify'), so it is present in every deployed function. Netlify
+ *   exposes SITE_ID, CONTEXT and NETLIFY at build time only, so they cannot
+ *   tell a running function from a laptop.
+ *
+ * A local run is never deployed: serverless-offline and `serverless invoke
+ * local` (which set the Lambda variables themselves) mark IS_OFFLINE /
+ * IS_LOCAL, `netlify dev` marks NETLIFY_DEV, and Jest marks JEST_WORKER_ID.
  *
  * @param {Object} [env=process.env]
  * @returns {boolean}
  */
 function isDeployedRuntime(env = process.env) {
-    return isDeployedProviderRuntime(env);
+    const localRun =
+        isTrue(env.IS_OFFLINE) ||
+        isTrue(env.IS_LOCAL) ||
+        isTrue(env.NETLIFY_DEV) ||
+        isSet(env.JEST_WORKER_ID);
+    if (localRun) return false;
+
+    const onAwsRuntime =
+        isSet(env.AWS_LAMBDA_FUNCTION_NAME) ||
+        isSet(env.LAMBDA_TASK_ROOT) ||
+        String(env.AWS_EXECUTION_ENV ?? '').startsWith('AWS_Lambda_');
+    if (onAwsRuntime) return true;
+
+    const provider = String(env.FRIGG_PROVIDER ?? '').trim().toLowerCase();
+    return provider !== '' && provider !== 'aws';
 }
 
 function missingKeyMessage(stage) {
@@ -100,6 +121,10 @@ function resolveEncryptionConfig(env = process.env) {
     const runtime = isDeployedRuntime(env) ? 'deployed' : 'local';
     const hasKMS = isSet(env.KMS_KEY_ARN);
     const hasAES = isSet(env.AES_KEY_ID);
+    // AES needs the key as well as its id, locally too: a cryptor built from
+    // the id alone cannot encrypt, and a local run reads failed decrypts as
+    // stored values, so an incomplete pair would hand back blobs as tokens.
+    const hasCompleteAES = hasAES && isSet(env.AES_KEY);
     const optOutRequested = isTrue(env[OPT_OUT_VAR]);
 
     const base = {
@@ -120,14 +145,13 @@ function resolveEncryptionConfig(env = process.env) {
         if (LOCAL_BYPASS_STAGES.includes(String(stage).toLowerCase())) {
             return { ...base, bypassed: true };
         }
-        if (hasKMS || hasAES) {
+        if (hasKMS || hasCompleteAES) {
             const method = hasKMS ? 'kms' : 'aes';
             return { ...base, enabled: true, method, mode: method };
         }
         return base;
     }
 
-    const hasCompleteAES = hasAES && isSet(env.AES_KEY);
     if (hasKMS || hasCompleteAES) {
         const method = hasKMS ? 'kms' : 'aes';
         return {
@@ -191,7 +215,14 @@ function getEncryptionConfig(env = process.env) {
         );
     }
 
-    if (config.runtime === 'local' && !config.enabled && !config.bypassed) {
+    if (config.runtime === 'local' && !config.enabled && !config.bypassed && config.hasAES) {
+        warnOnce(
+            'local-incomplete-aes',
+            `AES_KEY_ID is set but AES_KEY is not for local stage "${config.stage}". ` +
+                'Field-level encryption disabled for this local run; set both to encrypt. ' +
+                'A deployed stage refuses to start without both.'
+        );
+    } else if (config.runtime === 'local' && !config.enabled && !config.bypassed) {
         warnOnce(
             'local-no-keys',
             `No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID) for local stage "${config.stage}". ` +

package/database/encryption/encryption-schema-registry.js

@@ -9,6 +9,7 @@
  */
 
 const { logger } = require('./logger');
+const { isDeployedRuntime } = require('./encryption-config');
 const { registerDeniedKeys } = require('../../logs/denied-keys');
 const {
     getEntityTypeRegistry,
@@ -229,85 +230,35 @@ function loadModuleEncryptionSchemas(integrations, entities) {
  *
  * Used by both Prisma (MongoDB/PostgreSQL) and DocumentDB encryption services.
  */
-/**
- * Registers encryption schemas declared by app-level extensions
- * (`appDefinition.coreExtensions[].encryption`), e.g. the db-credentials
- * extension's `OAuthAppCredential.clientSecret`.
- *
- * @param {Array<Object>} extensions - Normalized extensions (extension-loader)
- */
-function loadExtensionEncryptionSchemas(extensions) {
-    if (!extensions || !Array.isArray(extensions) || extensions.length === 0) {
-        return;
-    }
-
-    for (const ext of extensions) {
-        if (!ext.encryption || typeof ext.encryption !== 'object') {
-            continue;
-        }
+function loadCustomEncryptionSchema() {
+    let appDefinition;
+    try {
+        // Lazy require to avoid circular dependency issues
+        const path = require('node:path');
+        const { findNearestBackendPackageJson } = require('../../utils');
 
-        const schema = {};
-        for (const [modelName, config] of Object.entries(ext.encryption)) {
-            if (config && Array.isArray(config.fields) && config.fields.length > 0) {
-                schema[modelName] = { fields: config.fields };
-            }
+        const backendPackagePath = findNearestBackendPackageJson();
+        if (!backendPackagePath) {
+            return; // No backend found, skip custom schema
         }
 
-        if (Object.keys(schema).length > 0) {
-            logger.info(
-                `Registering encryption schema from extension "${ext.name}" for models: ${Object.keys(schema).join(', ')}`
-            );
-            // registerCustomSchema replaces the registered schema, so merge:
-            // an extension adds its models to the app's encryption.schema
-            // rather than dropping it.
-            const merged = { ...customSchema };
-            for (const [modelName, config] of Object.entries(schema)) {
-                const existing = merged[modelName]?.fields || [];
-                merged[modelName] = {
-                    ...merged[modelName],
-                    fields: [...new Set([...existing, ...config.fields])],
-                };
-            }
-            registerCustomSchema(merged);
-        }
-    }
-}
+        const backendDir = path.dirname(backendPackagePath);
+        const backendIndexPath = path.join(backendDir, 'index.js');
 
-function readAppDefinitionForEncryption() {
-    // Lazy require to avoid circular dependency issues
-    const {
-        getPresetAppDefinition,
-    } = require('../../handlers/app-definition-loader');
-    // A definition preset with setAppDefinition() (provider-netlify's
-    // preamble) wins: on Netlify process.cwd() cannot find the backend.
-    const preset = getPresetAppDefinition();
-    if (preset) {
-        return preset;
+        const backendModule = require(backendIndexPath);
+        appDefinition = backendModule?.Definition;
+    } catch (error) {
+        // No app definition to read (tests, standalone usage): there is
+        // nothing to register, so nothing is lost by carrying on.
+        logger.debug('Could not load custom encryption schema:', error.message);
+        return;
     }
 
-    const path = require('node:path');
-    const { findNearestBackendPackageJson } = require('../../utils');
-
-    const backendPackagePath = findNearestBackendPackageJson();
-    if (!backendPackagePath) {
-        return null; // No backend found, skip custom schema
+    if (!appDefinition) {
+        return; // No app definition found
     }
 
-    const backendDir = path.dirname(backendPackagePath);
-    const backendIndexPath = path.join(backendDir, 'index.js');
-
-    const backendModule = require(backendIndexPath);
-    return backendModule?.Definition || null;
-}
-
-function loadCustomEncryptionSchema() {
     try {
-        const appDefinition = readAppDefinitionForEncryption();
-
-        if (!appDefinition) {
-            return; // No app definition found
-        }
-
         // Load app-level custom schema
         const customSchema = appDefinition.encryption?.schema;
         if (customSchema && Object.keys(customSchema).length > 0) {
@@ -322,15 +273,6 @@ function loadCustomEncryptionSchema() {
             registerEncryptionOptOut(disable);
         }
 
-        // Load app-level extension encryption schemas. Before the module
-        // schemas: loadModuleEncryptionSchemas currently throws (see the
-        // NOTE inside it) and the throw would skip anything after it.
-        const { loadExtensions } = require('../../extensions/extension-loader');
-        const extensions = loadExtensions(appDefinition);
-        if (extensions.length > 0) {
-            loadExtensionEncryptionSchemas(extensions);
-        }
-
         // Load module-level encryption schemas from integrations
         const integrations = appDefinition.integrations;
         if (Array.isArray(integrations) || appDefinition.entities) {
@@ -340,14 +282,16 @@ function loadCustomEncryptionSchema() {
             );
         }
     } catch (error) {
-        // A bad entity registry is a configuration error, not "no custom schema".
-        if (error instanceof EntityRegistryError) throw error;
-        // Silently ignore errors - custom schema is optional
-        // This handles cases like:
-        // - Backend package.json not found (tests, standalone usage)
-        // - No appDefinition defined
-        // - No custom encryption schema specified
-        logger.debug('Could not load custom encryption schema:', error.message);
+        // The app declared fields to encrypt and they could not be registered:
+        // carrying on would store them in plaintext. A bad entity registry is a
+        // configuration error anywhere; a deployed function refuses to start
+        // for any registration failure, and a local run says so loudly.
+        if (error instanceof EntityRegistryError || isDeployedRuntime()) {
+            throw error;
+        }
+        logger.warn(
+            `Encryption schema from the app definition could not be registered; those fields stay plaintext in this local run: ${error.message}`
+        );
     }
 }
 
@@ -492,7 +436,6 @@ module.exports = {
     registerEncryptionOptOut,
     loadCustomEncryptionSchema,
     loadModuleEncryptionSchemas,
-    loadExtensionEncryptionSchemas,
     extractCredentialFieldsFromModules,
     validateCustomSchema,
     validateOptOut,

package/database/prisma.js

@@ -41,15 +41,13 @@ const prismaClientSingleton = () => {
         const paths = [
             // Lambda layer location (when using Prisma Lambda layer)
             `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
-            // __dirname-based absolute path (Netlify functions and bundlers)
-            require('node:path').resolve(__dirname, `../generated/prisma-${dbType}`),
             // Local development location (relative to core package)
             `../generated/prisma-${dbType}`,
         ];
 
-        for (const candidate of paths) {
+        for (const path of paths) {
             try {
-                return require(candidate).PrismaClient;
+                return require(path).PrismaClient;
             } catch (err) {
                 // Continue to next path
             }