@friggframework/core 2.0.0--canary.707.df80bfd.0 → 2.0.0--canary.680.d670696.0

package/queues/queue-message-auth.js

@@ -1,193 +0,0 @@
-/**
- * Queue message authentication for HTTP-delivered queues.
- *
- * An SQS-triggered Lambda is invoked by AWS itself, so its events are trusted
- * by the transport. An HTTP-delivered queue (a Netlify Background Function,
- * a QStash destination) is a public URL: anyone who can reach it can post a
- * message. These helpers let the sending adapter prove a message came from
- * Frigg and let the receiving adapter check that proof before anything runs.
- *
- * Scheme (Frigg-signed messages):
- *   timestamp = whole seconds since the epoch, as a decimal string
- *   signature = 'v1=' + hex(HMAC-SHA256(secret, `${timestamp}.${rawBody}`))
- * sent as the `x-frigg-queue-timestamp` and `x-frigg-queue-signature`
- * headers. The receiver recomputes the HMAC over the raw body it was given,
- * compares in constant time, and refuses a timestamp more than
- * MAX_MESSAGE_AGE_SECONDS away from its own clock (replay window).
- *
- * Fail closed: with no secret configured, a message is accepted unsigned only
- * when FRIGG_QUEUE_ALLOW_UNSIGNED=true AND the environment is not production
- * (isProductionEnvironment; a deployed function always is). Anything else is
- * refused.
- */
-const crypto = require('crypto');
-const { isDeployedRuntime } = require('../providers/runtime-detection');
-
-const SIGNING_SECRET_ENV = 'FRIGG_QUEUE_SIGNING_SECRET';
-const ALLOW_UNSIGNED_ENV = 'FRIGG_QUEUE_ALLOW_UNSIGNED';
-const SIGNATURE_HEADER = 'x-frigg-queue-signature';
-const TIMESTAMP_HEADER = 'x-frigg-queue-timestamp';
-const SIGNATURE_VERSION = 'v1';
-const MAX_MESSAGE_AGE_SECONDS = 5 * 60;
-
-// Stages core already treats as non-production (database/prisma.js bypasses
-// encryption for the same list).
-const NON_PRODUCTION_STAGES = ['dev', 'test', 'local'];
-const NON_PRODUCTION_NODE_ENVS = ['development', 'test'];
-
-/**
- * Production unless the environment says otherwise: an unset STAGE and
- * NODE_ENV count as production, so a missing setting never opens the door.
- * A deployed function (AWS Lambda, or the active provider's platform such as
- * a Netlify Function: providers/runtime-detection) is production whatever
- * STAGE says, so a deployed `dev` stage cannot opt out of signatures.
- *
- * @param {Object} [env=process.env]
- * @returns {boolean}
- */
-function isProductionEnvironment(env = process.env) {
-    if (isDeployedRuntime(env)) return true;
-    if (NON_PRODUCTION_STAGES.includes(env.STAGE)) return false;
-    if (NON_PRODUCTION_NODE_ENVS.includes(env.NODE_ENV)) return false;
-    if (env.NETLIFY_DEV === 'true') return false;
-    return true;
-}
-
-/**
- * Unsigned messages are allowed only by an explicit opt-in outside production.
- *
- * @param {Object} [env=process.env]
- * @returns {boolean}
- */
-function allowsUnsignedMessages(env = process.env) {
-    return env[ALLOW_UNSIGNED_ENV] === 'true' && !isProductionEnvironment(env);
-}
-
-/**
- * @param {Object} [env=process.env]
- * @returns {string|undefined} the configured signing secret, if non-empty
- */
-function readSigningSecret(env = process.env) {
-    const secret = env[SIGNING_SECRET_ENV];
-    return typeof secret === 'string' && secret.length > 0 ? secret : undefined;
-}
-
-function computeSignature(secret, timestamp, rawBody) {
-    const mac = crypto
-        .createHmac('sha256', secret)
-        .update(`${timestamp}.${rawBody}`)
-        .digest('hex');
-    return `${SIGNATURE_VERSION}=${mac}`;
-}
-
-/**
- * Sign a raw message body.
- *
- * @param {Object} params
- * @param {string} params.body - the exact string that will be sent
- * @param {string} params.secret
- * @param {number} [params.now] - milliseconds since the epoch (default Date.now())
- * @returns {{ [header: string]: string }} headers to add to the request
- */
-function signQueueMessage({ body, secret, now = Date.now() }) {
-    if (!secret) {
-        throw new Error('A signing secret is required to sign a queue message');
-    }
-    const timestamp = String(Math.floor(now / 1000));
-    return {
-        [TIMESTAMP_HEADER]: timestamp,
-        [SIGNATURE_HEADER]: computeSignature(secret, timestamp, body),
-    };
-}
-
-function constantTimeEqual(a, b) {
-    const left = Buffer.from(a, 'utf8');
-    const right = Buffer.from(b, 'utf8');
-    // timingSafeEqual throws on unequal lengths; the length of a v1 signature
-    // is fixed, so comparing lengths first leaks nothing secret.
-    if (left.length !== right.length) return false;
-    return crypto.timingSafeEqual(left, right);
-}
-
-/**
- * Verify a Frigg-signed message.
- *
- * @param {Object} params
- * @param {string|null|undefined} params.body - raw body as received
- * @param {string|undefined} params.timestamp - x-frigg-queue-timestamp
- * @param {string|undefined} params.signature - x-frigg-queue-signature
- * @param {string} params.secret
- * @param {number} [params.now] - milliseconds since the epoch
- * @param {number} [params.maxAgeSeconds]
- * @returns {{ ok: true } | { ok: false, reason: string }}
- */
-function verifyQueueMessage({
-    body,
-    timestamp,
-    signature,
-    secret,
-    now = Date.now(),
-    maxAgeSeconds = MAX_MESSAGE_AGE_SECONDS,
-}) {
-    if (!secret) return { ok: false, reason: 'signing_secret_not_configured' };
-    if (!signature || !timestamp) return { ok: false, reason: 'missing_signature' };
-    if (typeof body !== 'string') return { ok: false, reason: 'missing_body' };
-    if (!/^\d{1,15}$/.test(timestamp)) return { ok: false, reason: 'invalid_timestamp' };
-
-    const ageSeconds = Math.abs(Math.floor(now / 1000) - Number(timestamp));
-    if (ageSeconds > maxAgeSeconds) return { ok: false, reason: 'stale_timestamp' };
-
-    const expected = computeSignature(secret, timestamp, body);
-    if (!constantTimeEqual(expected, signature)) {
-        return { ok: false, reason: 'invalid_signature' };
-    }
-    return { ok: true };
-}
-
-/**
- * Case-insensitive header lookup over a Lambda/Netlify v1 event's headers.
- *
- * @param {Object} event
- * @param {string} name - lower-case header name
- * @returns {string|undefined}
- */
-function readHeader(event, name) {
-    const headers = event?.headers || {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (key.toLowerCase() === name) {
-            return Array.isArray(value) ? value[0] : value;
-        }
-    }
-    return undefined;
-}
-
-/**
- * The raw request body exactly as signed: a string body as is, a base64
- * body decoded to its UTF-8 text. An already-parsed object body cannot be
- * verified (its bytes are gone), so it reads as absent.
- *
- * @param {Object} event
- * @returns {string|null}
- */
-function readRawBody(event) {
-    if (typeof event?.body !== 'string') return null;
-    if (event.isBase64Encoded) {
-        return Buffer.from(event.body, 'base64').toString('utf8');
-    }
-    return event.body;
-}
-
-module.exports = {
-    SIGNING_SECRET_ENV,
-    ALLOW_UNSIGNED_ENV,
-    SIGNATURE_HEADER,
-    TIMESTAMP_HEADER,
-    MAX_MESSAGE_AGE_SECONDS,
-    isProductionEnvironment,
-    allowsUnsignedMessages,
-    readSigningSecret,
-    signQueueMessage,
-    verifyQueueMessage,
-    readHeader,
-    readRawBody,
-};

package/queues/queue-provider-factory.js

@@ -1,101 +0,0 @@
-/**
- * Queue Provider Factory
- *
- * Creates a QueueProvider (send / batchSend / parseEvent) for the active
- * platform. From friggframework/frigg#545, adapted: #545 resolved every
- * provider through resolveProvider(), so an AWS app had to install
- * @friggframework/provider-aws. In this stack the AWS SDK is a core
- * dependency, so the built-in queues are created here and only an unknown
- * name goes through the provider plugin system.
- *
- * Priority order for determining the provider:
- * 1. Explicit `provider` option
- * 2. `appDefinition.queue.provider`
- * 3. `QUEUE_PROVIDER` environment variable
- * 4. Default: SQS
- *
- * Built-in names:
- * - 'sqs' | 'aws'                     -> SqsQueueProvider
- * - 'netlify-background' | 'netlify'  -> NetlifyBackgroundProvider
- * - 'qstash'                          -> QStashQueueProvider
- * Any other name -> require('@friggframework/provider-<name>').QueueProvider
- */
-
-const QUEUE_PROVIDERS = {
-    SQS: 'sqs',
-    NETLIFY_BACKGROUND: 'netlify-background',
-    QSTASH: 'qstash',
-};
-
-// Platform provider names (appDefinition.provider) that map to a built-in queue.
-const PLATFORM_ALIASES = {
-    aws: QUEUE_PROVIDERS.SQS,
-    netlify: QUEUE_PROVIDERS.NETLIFY_BACKGROUND,
-};
-
-/**
- * Determine the queue provider from the config hierarchy.
- *
- * @param {Object} [options]
- * @param {string} [options.provider]
- * @param {Object} [options.appDefinition]
- * @returns {string|undefined}
- */
-function determineProvider(options = {}) {
-    if (options.provider) {
-        return options.provider;
-    }
-    if (options.appDefinition?.queue?.provider) {
-        return options.appDefinition.queue.provider;
-    }
-    if (process.env.QUEUE_PROVIDER) {
-        return process.env.QUEUE_PROVIDER;
-    }
-    return undefined;
-}
-
-/**
- * Create a queue provider instance.
- *
- * @param {Object} [options]
- * @param {string} [options.provider] - Queue provider name
- * @param {Object} [options.appDefinition] - reads `queue.provider`
- * @param {Object} [options.providerOptions] - passed to the provider constructor
- * @returns {import('./queue-provider').QueueProvider}
- */
-function createQueueProvider(options = {}) {
-    const explicit = determineProvider(options);
-    const name = PLATFORM_ALIASES[explicit] || explicit || QUEUE_PROVIDERS.SQS;
-    const providerOptions = options.providerOptions || {};
-
-    switch (name) {
-        case QUEUE_PROVIDERS.SQS: {
-            const { SqsQueueProvider } = require('./providers/sqs-queue-provider');
-            return new SqsQueueProvider(providerOptions);
-        }
-        case QUEUE_PROVIDERS.NETLIFY_BACKGROUND: {
-            const {
-                NetlifyBackgroundProvider,
-            } = require('./providers/netlify-background-provider');
-            return new NetlifyBackgroundProvider(providerOptions);
-        }
-        case QUEUE_PROVIDERS.QSTASH: {
-            const { QStashQueueProvider } = require('./providers/qstash-queue-provider');
-            return new QStashQueueProvider(providerOptions);
-        }
-        default: {
-            const { resolveProvider } = require('../providers/resolve-provider');
-            const provider = resolveProvider(null, { provider: name });
-            if (!provider.QueueProvider) {
-                throw new Error(`Provider '${provider.name || name}' does not export a QueueProvider`);
-            }
-            return new provider.QueueProvider(providerOptions);
-        }
-    }
-}
-
-module.exports = {
-    createQueueProvider,
-    determineProvider,
-    QUEUE_PROVIDERS,
-};

package/queues/queue-provider.js

@@ -1,65 +0,0 @@
-/**
- * Queue Provider Interface (Port)
- *
- * Defines the contract for queue message sending.
- * All queue adapters must extend this interface.
- *
- * Following Frigg's hexagonal architecture pattern:
- * - Port defines WHAT the service does (contract)
- * - Adapters implement HOW (AWS SQS, Netlify Background Functions, QStash, etc.)
- */
-class QueueProvider {
-    /**
-     * Send a single message to a queue
-     *
-     * @param {Object} message - Message payload (will be JSON-serialized)
-     * @param {string} queueId - Queue identifier (URL, name, or endpoint depending on provider)
-     * @returns {Promise<Object>} Provider-specific response
-     */
-    async send(message, queueId) {
-        throw new Error('Method send must be implemented by subclass');
-    }
-
-    /**
-     * Send a batch of messages to a queue
-     *
-     * @param {Object[]} entries - Array of message payloads
-     * @param {string} queueId - Queue identifier
-     * @returns {Promise<Object>} Provider-specific response
-     */
-    async batchSend(entries, queueId) {
-        throw new Error('Method batchSend must be implemented by subclass');
-    }
-
-    /**
-     * Parse an incoming event into an array of message payloads.
-     * Each provider has its own event shape (SQS Records, HTTP body, etc.)
-     *
-     * @param {Object} event - Raw event from the runtime (Lambda event, HTTP request, etc.)
-     * @returns {Object[]} Array of parsed message payloads
-     */
-    parseEvent(event) {
-        throw new Error('Method parseEvent must be implemented by subclass');
-    }
-
-    /**
-     * Prove an incoming event was sent by Frigg before anything is parsed or
-     * dispatched. HTTP-delivered queues (Netlify Background Functions,
-     * QStash) are public URLs, so their adapters check a signature here.
-     *
-     * The default refuses: an adapter that does not know how to verify its
-     * events must not have them run. An adapter whose transport already
-     * authenticates the caller (SQS triggering a Lambda) overrides this, and
-     * must not set `verifiesHttpDelivery`: an HTTP entry point (Netlify's
-     * worker-background) consults only adapters that set it to true, since
-     * a transport-trust answer says nothing about an HTTP caller.
-     *
-     * @param {Object} event - Raw event from the runtime
-     * @returns {Promise<{ ok: boolean, reason?: string, unsigned?: boolean }>}
-     */
-    async verifyEvent(event) {
-        return { ok: false, reason: 'verification_not_implemented' };
-    }
-}
-
-module.exports = { QueueProvider };

package/queues/sqs-queue-client.js

@@ -1,81 +0,0 @@
-/**
- * SQS Queue Client (Adapter)
- *
- * AWS SQS implementation of QueueClientInterface, used by Worker.
- *
- * In friggframework/frigg#545 this adapter moved to
- * @friggframework/provider-aws and Worker required it to be injected. In
- * this stack the AWS SDK stays a core dependency, so the adapter lives here,
- * Worker defaults to it, and provider-aws re-exports it. The SDK is
- * required on first use, not at module load.
- */
-const { QueueClientInterface } = require('./queue-client-interface');
-
-let sqsModule = null;
-function getSqsModule() {
-    if (!sqsModule) {
-        sqsModule = require('@aws-sdk/client-sqs');
-    }
-    return sqsModule;
-}
-
-/**
- * Client config #545's adapter used: IS_OFFLINE credentials, AWS_REGION and
- * AWS_ENDPOINT.
- */
-function defaultSqsClientConfig() {
-    const config = {};
-    if (process.env.IS_OFFLINE) {
-        config.credentials = {
-            accessKeyId: 'test-aws-key',
-            secretAccessKey: 'test-aws-secret',
-        };
-        config.region = 'us-east-1';
-    }
-    if (!config.region && process.env.AWS_REGION) {
-        config.region = process.env.AWS_REGION;
-    }
-    if (process.env.AWS_ENDPOINT) {
-        config.endpoint = process.env.AWS_ENDPOINT;
-    }
-    return config;
-}
-
-class SqsQueueClient extends QueueClientInterface {
-    /**
-     * @param {Object} [options]
-     * @param {Object} [options.clientConfig] - SQSClient config; defaults to
-     *   defaultSqsClientConfig().
-     */
-    constructor({ clientConfig } = {}) {
-        super();
-        this._clientConfig = clientConfig;
-        this._sqs = null;
-    }
-
-    _client() {
-        if (!this._sqs) {
-            const { SQSClient } = getSqsModule();
-            this._sqs = new SQSClient(this._clientConfig || defaultSqsClientConfig());
-        }
-        return this._sqs;
-    }
-
-    async sendMessage(params) {
-        const { SendMessageCommand } = getSqsModule();
-        return this._client().send(new SendMessageCommand(params));
-    }
-
-    async sendMessageBatch(params) {
-        const { SendMessageBatchCommand } = getSqsModule();
-        return this._client().send(new SendMessageBatchCommand(params));
-    }
-
-    async getQueueUrl(params) {
-        const { GetQueueUrlCommand } = getSqsModule();
-        const data = await this._client().send(new GetQueueUrlCommand(params));
-        return data.QueueUrl;
-    }
-}
-
-module.exports = { SqsQueueClient, defaultSqsClientConfig };

package/types/user/index.d.ts

@@ -1,134 +0,0 @@
-declare module "@friggframework/core/user" {
-  export type AdopterJwtAlgorithm =
-    | "ES256"
-    | "ES384"
-    | "RS256"
-    | "RS384"
-    | "RS512"
-    | "HS256"
-    | "HS384"
-    | "HS512";
-
-  /**
-   * Verification of tokens issued by the adopter's identity system
-   * (`authModes.adopterJwt`, ADR-056 §2). Set exactly one of `jwksUri` or `secret`.
-   */
-  export interface AdopterJwtConfig {
-    /** https URL of the issuer's JWKS (http only for localhost, 127.0.0.0/8, ::1). */
-    jwksUri?: string;
-    /** Shared HMAC secret for HS* tokens. */
-    secret?: string;
-    /** Required `iss`. With `jwksUri`, a startup warning is logged when unset. */
-    issuer?: string;
-    /** Accepted `aud`. Required with `jwksUri`. */
-    audience?: string | string[];
-    /** Allow-list. Default ES256 and RS256 with `jwksUri`, HS256 with `secret`. */
-    algorithms?: AdopterJwtAlgorithm[];
-    /** @deprecated Use `algorithms`. Setting both is an error. */
-    algorithm?: AdopterJwtAlgorithm;
-    /** Skew allowed on `exp` and `nbf`. Default 30. */
-    clockToleranceSec?: number;
-    /** Default `sub`. */
-    userIdClaim?: string;
-    /** Default `org_id`. */
-    orgIdClaim?: string;
-    /** Default `org_role`. Exposed as `User#getOrgRole()`; stored on a new membership. */
-    roleClaim?: string;
-  }
-
-  export interface UserAuthModes {
-    friggToken?: boolean;
-    sharedSecret?: boolean;
-    adopterJwt?: boolean;
-  }
-
-  /** The `user` block of the app definition. */
-  export interface UserConfig {
-    usePassword?: boolean;
-    primary?: "individual" | "organization";
-    individualUserRequired?: boolean;
-    organizationUserRequired?: boolean;
-    /**
-     * With `x-frigg` headers, refuse (400) to make a person a member of an
-     * organization that already existed: anyone not already a member, a
-     * brand-new `appUserId` included, is rejected. Naming an organization the
-     * request itself creates is still allowed. Default false (a non-member is
-     * added).
-     */
-    strictMembership?: boolean;
-    /**
-     * @deprecated Alias of `strictMembership`, with the same new meaning (it
-     * used to reject a mismatched individual/organization pair). Logs a warning
-     * at startup. `strictMembership` wins when both are set.
-     */
-    strictUserValidation?: boolean;
-    /**
-     * Roles that may manage organization-level things (ADR-056 §3). Default
-     * `['ADMIN']`. The role is the adopter token's role claim, else the stored
-     * membership `orgRole`, else `MEMBER` (never admin). A shared-secret
-     * (`x-frigg` header) caller needs no role, nor does a Frigg bearer token
-     * unless `orgAdminGateBearerTokens`. Compared case-insensitively.
-     * Validated at load.
-     */
-    orgAdminRoles?: string[];
-    /**
-     * Judge Frigg bearer-token callers by role like adopter-token callers.
-     * Default false: they keep their behaviour from before organization roles.
-     */
-    orgAdminGateBearerTokens?: boolean;
-    authModes?: UserAuthModes;
-    jwtConfig?: AdopterJwtConfig;
-  }
-
-  /**
-   * One person's membership of one organization (ADR-056 §3.6). `implicit` is
-   * true when it is only the legacy `IndividualUser.organizationId` pointer.
-   */
-  export interface OrganizationMembership {
-    id: string | null;
-    individualUserId: string;
-    organizationUserId: string;
-    /** Defaults to `MEMBER`. */
-    orgRole: string;
-    createdAt?: Date;
-    implicit: boolean;
-  }
-
-  export interface OrganizationMembershipRepository {
-    /** The stored row or null: the legacy `organizationId` pointer is not read here. */
-    findMembership(
-      individualUserId: string,
-      organizationUserId: string
-    ): Promise<OrganizationMembership | null>;
-    /** Idempotent: adds when absent, never changes an existing membership. */
-    addMembership(
-      individualUserId: string,
-      organizationUserId: string,
-      options?: { orgRole?: string | null }
-    ): Promise<OrganizationMembership>;
-    /** Stored rows only, oldest first; legacy-pointer people are not here. */
-    listMembershipsForOrganization(
-      organizationUserId: string
-    ): Promise<OrganizationMembership[]>;
-  }
-
-  export function createOrganizationMembershipRepository(): OrganizationMembershipRepository;
-
-  export class User {
-    /** The primary user's id; under `primary: 'organization'` the ACTIVE organization. */
-    getId(): string | undefined;
-    /** The organization this request acts in (token or `x-frigg-apporgid`), or null. */
-    getActiveOrganizationId(): string | null;
-    getAppUserId(): string | null;
-    getAppOrgId(): string | null;
-    getIndividualUser(): any;
-    getOrganizationUser(): any;
-    getPrimaryUser(): any;
-    /** The organization role from the adopter token for this request, or null. */
-    getOrgRole(): string | null;
-    setOrgRole(orgRole: string | null): void;
-    /** The stored `orgRole` of the membership of the active organization, or null. Used when the token carries no role. */
-    getMembershipRole(): string | null;
-    setMembershipRole(membershipRole: string | null): void;
-  }
-}