@friggframework/core 2.0.0--canary.710.7cfcf12.0 → 2.0.0--canary.682.451c957.0

package/credential/repositories/credential-repository-mongo.js

@@ -188,6 +188,29 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        if (!userId) return [];
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: String(userId) },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id,
+            userId: credential.userId,
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })

package/credential/repositories/credential-repository-postgres.js

@@ -205,6 +205,34 @@ class CredentialRepositoryPostgres extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        let intUserId;
+        try {
+            intUserId = this._convertId(userId);
+        } catch {
+            return [];
+        }
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: intUserId },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id.toString(),
+            userId: credential.userId?.toString(),
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/use-cases/credential-operations-for-user.js

@@ -0,0 +1,117 @@
+const Boom = require('@hapi/boom');
+const { userOwns } = require('../../modules/use-cases/get-entity-module-for-user');
+
+/**
+ * Management API v2 credential operations. A credential has no module name
+ * of its own; its `type` and the entities that use it come from the
+ * caller's entities. A missing or foreign credential is a 404.
+ */
+
+const credentialIdOf = (entity) => {
+    const ref = entity.credential ?? entity.credentialId;
+    if (ref === undefined || ref === null) return null;
+    if (typeof ref === 'object') {
+        const id = ref.id ?? ref._id;
+        return id === undefined || id === null ? null : String(id);
+    }
+    return String(ref);
+};
+
+/** Adds `type` and `entityIds` from the user's entities to each credential. */
+function withEntityUsage(credentials, entities) {
+    const usage = new Map();
+    for (const entity of entities || []) {
+        const credentialId = credentialIdOf(entity);
+        if (!credentialId) continue;
+        const entry = usage.get(credentialId) || { type: null, entityIds: [] };
+        entry.type = entry.type || entity.moduleName || null;
+        entry.entityIds.push(String(entity.id));
+        usage.set(credentialId, entry);
+    }
+    return credentials.map((credential) => {
+        const entry = usage.get(String(credential.id)) || {
+            type: null,
+            entityIds: [],
+        };
+        return { ...credential, type: entry.type, entityIds: entry.entityIds };
+    });
+}
+
+/** The caller's credentials with their type and entity usage. */
+class ListCredentialsForUser {
+    constructor({ credentialRepository, moduleRepository }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+    }
+
+    async execute(user) {
+        const userId = user.getId();
+        const [credentials, entities] = await Promise.all([
+            this.credentialRepository.findCredentialsByUserId(userId),
+            this.moduleRepository.findEntitiesByUserId(userId),
+        ]);
+        return withEntityUsage(credentials || [], entities);
+    }
+}
+
+/** One credential the caller owns, with its type and entity usage. */
+class GetCredentialForUserV2 {
+    constructor({ credentialRepository, moduleRepository }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+    }
+
+    async execute(credentialId, user) {
+        let credential = null;
+        try {
+            credential = await this.credentialRepository.findCredentialById(
+                credentialId
+            );
+        } catch (error) {
+            if (!/Invalid ID|ObjectId|Malformed/i.test(error?.message || '')) {
+                throw error;
+            }
+        }
+        if (!credential || !userOwns(user, credential.userId)) {
+            throw Boom.notFound(`Credential ${credentialId} not found`, {
+                code: 'CREDENTIAL_NOT_FOUND',
+            });
+        }
+        const entities = await this.moduleRepository.findEntitiesByUserId(
+            credential.userId
+        );
+        return withEntityUsage([credential], entities)[0];
+    }
+}
+
+/**
+ * Deletes a credential the caller owns. The entities that used it stay, with
+ * their credential unset, so they show as needing re-authorization rather
+ * than disappearing from integrations.
+ */
+class DeleteCredentialForUser {
+    constructor({ credentialRepository, moduleRepository, getCredentialForUser }) {
+        this.credentialRepository = credentialRepository;
+        this.moduleRepository = moduleRepository;
+        this.getCredentialForUser = getCredentialForUser;
+    }
+
+    async execute(credentialId, user) {
+        const credential = await this.getCredentialForUser.execute(
+            credentialId,
+            user
+        );
+        for (const entityId of credential.entityIds) {
+            await this.moduleRepository.unsetCredential(entityId);
+        }
+        await this.credentialRepository.deleteCredentialById(credential.id);
+        return { id: String(credential.id), entityIds: credential.entityIds };
+    }
+}
+
+module.exports = {
+    ListCredentialsForUser,
+    GetCredentialForUserV2,
+    DeleteCredentialForUser,
+    withEntityUsage,
+};

package/credential/use-cases/reauthorize-credential-for-user.js

@@ -0,0 +1,66 @@
+const Boom = require('@hapi/boom');
+
+/**
+ * Re-authorization of a credential the caller owns (Management API v2). It
+ * runs the same flow as /api/v2/authorize for the credential's entity type,
+ * with the session bound to the credential so it cannot be reused for
+ * anything else.
+ */
+async function credentialEntityType(getCredentialForUser, credentialId, user) {
+    const credential = await getCredentialForUser.execute(credentialId, user);
+    if (!credential.type) {
+        throw Boom.conflict(
+            `Credential ${credentialId} is not used by any entity, so its type is unknown; authorize a new connection instead`,
+            { code: 'CREDENTIAL_TYPE_UNKNOWN' }
+        );
+    }
+    return { entityType: credential.type, credentialId: String(credential.id) };
+}
+
+/** GET /api/v2/credentials/:credentialId/reauthorize */
+class GetCredentialReauthorization {
+    constructor({ getCredentialForUser, getAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.getAuthorizationStep = getAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { step = 1, sessionId, state } = {}) {
+        const binding = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
+        return this.getAuthorizationStep.execute({
+            user,
+            ...binding,
+            step,
+            sessionId,
+            state,
+        });
+    }
+}
+
+/** POST /api/v2/credentials/:credentialId/reauthorize */
+class ReauthorizeCredentialForUser {
+    constructor({ getCredentialForUser, submitAuthorizationStep }) {
+        this.getCredentialForUser = getCredentialForUser;
+        this.submitAuthorizationStep = submitAuthorizationStep;
+    }
+
+    async execute(credentialId, user, { data, step = 1, sessionId } = {}) {
+        const binding = await credentialEntityType(
+            this.getCredentialForUser,
+            credentialId,
+            user
+        );
+        return this.submitAuthorizationStep.execute({
+            user,
+            ...binding,
+            data,
+            step,
+            sessionId,
+        });
+    }
+}
+
+module.exports = { GetCredentialReauthorization, ReauthorizeCredentialForUser };

package/database/documentdb-encryption-service.js

@@ -1,5 +1,4 @@
 const { Cryptor } = require('../encrypt/Cryptor');
-const { isEncryptedEnvelope } = require('./encryption/ciphertext-format');
 const {
     getEncryptedFields,
     getFieldsToEncryptOnWrite,
@@ -296,7 +295,39 @@ class DocumentDBEncryptionService {
      * _isEncryptedValue({})  // false
      */
     _isEncryptedValue(value) {
-        return isEncryptedEnvelope(value);
+        // Must be string
+        if (typeof value !== 'string') {
+            return false;
+        }
+
+        // Must have exactly 4 colon-separated parts
+        const parts = value.split(':');
+        if (parts.length !== 4) {
+            return false;
+        }
+
+        // Enhanced validation: check for base64 pattern
+        // This prevents false positives on URLs, connection strings, etc.
+        const base64Pattern = /^[A-Za-z0-9+/=]+$/;
+
+        // All parts should be base64-encoded
+        if (!parts.every(part => base64Pattern.test(part))) {
+            return false;
+        }
+
+        // Encrypted values should be sufficiently long to be valid
+        // Real encrypted values from Cryptor are always >50 chars due to envelope encryption format:
+        // - keyId (base64): ~12 chars minimum
+        // - iv (base64): ~24 chars for 16-byte IV
+        // - ciphertext (base64): varies, minimum ~16 chars for small values
+        // - encryptedKey (base64): ~44 chars for 32-byte data key
+        // Total minimum: ~96 chars, so 50 is a safe lower bound
+        // This prevents false positives on non-encrypted strings that happen to have 4 colons
+        if (value.length < 50) {
+            return false;
+        }
+
+        return true;
     }
 }
 

package/database/documentdb-utils.js

@@ -58,6 +58,8 @@ async function insertOne(client, collection, document) {
 
         // Provide helpful context for common errors
         if (error.code === 11000) {
+            // `code` lets callers recognise a lost race without parsing text
+            // (see database/unique-violation.js).
             throw Object.assign(
                 new Error(`${errorMsg} - Duplicate key violation`),
                 { code: 11000 }

package/database/encryption/README.md

@@ -508,9 +508,9 @@ return entities.map((e) => ({
 
 **Verified:**
 
--   ✅ `postgres-relation-decryption.db.test.js` - Proves the bug exists
--   ✅ `postgres-decryption-fix-verification.db.test.js` - Verifies separate queries work
--   ✅ `mongo-decryption-fix-verification.db.test.js` - Verifies fix for MongoDB
+-   ✅ `postgres-relation-decryption.test.js` - Proves the bug exists
+-   ✅ `postgres-decryption-fix-verification.test.js` - Verifies separate queries work
+-   ✅ `mongo-decryption-fix-verification.test.js` - Verifies fix for MongoDB
 
 **Implementation Examples:**
 

package/database/encryption/encryption-schema-registry.js

@@ -39,6 +39,12 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
+
+    // Multi-step authorization (Management API v2): earlier steps can collect
+    // emails, usernames or one-time codes.
+    AuthorizationSession: {
+        fields: ['stepData'],
+    },
 };
 
 let customSchema = {};
@@ -146,16 +152,6 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
 
         for (const field of credentialFields) {
-            // Validate entry by entry: one bad entry must not drop the
-            // module's (or any other module's) valid fields.
-            if (typeof field !== 'string' || field.trim() === '') {
-                logger.warn(
-                    `Ignoring invalid encryption.credentialFields entry ${JSON.stringify(field)} ` +
-                        `in module "${moduleDef.moduleName || moduleDef.name || 'unknown'}" ` +
-                        '(expected a non-empty string)'
-                );
-                continue;
-            }
             const prefixedField = field.startsWith('data.') ? field : `data.${field}`;
             fields.push(prefixedField);
         }
@@ -184,46 +180,33 @@ function loadModuleEncryptionSchemas(integrations) {
         return;
     }
 
-    const { getModulesDefinitionFromIntegrationClasses } = require('../../integrations/utils/map-integration-dto');
+    // NOTE: this path does not exist ('../integrations' resolves to
+    // database/integrations), so today this function throws MODULE_NOT_FOUND,
+    // loadCustomEncryptionSchema swallows it, and module credentialFields are
+    // effectively NOT registered. Fixing it changes which fields are encrypted
+    // and needs a decrypt that tolerates plaintext, so it ships separately:
+    // branch claude/internal-mcp-03b-module-credential-encryption. Left as is
+    // here on purpose (ADR-059 must not change what gets encrypted).
+    const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
 
-    // Integrations without modules contribute no credential fields.
-    const integrationsWithModules = integrations.filter(
-        (integration) => integration?.Definition?.modules
-    );
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(
-        integrationsWithModules
-    );
-
-    // Fields the core schema already encrypts (e.g. data.api_key) are
-    // covered; registering them again would fail validation and drop every
-    // other module field with them.
-    const coreCredentialFields = CORE_ENCRYPTION_SCHEMA.Credential.fields;
-    const credentialFields = extractCredentialFieldsFromModules(
-        moduleDefinitions
-    ).filter((field) => !coreCredentialFields.includes(field));
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);
+    const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
 
     if (credentialFields.length === 0) {
         return;
     }
 
-    // Merge with whatever custom schema the app already registered rather
-    // than replacing it (registerCustomSchema overwrites).
-    const existingCredentialFields = customSchema.Credential?.fields || [];
-    const mergedSchema = {
-        ...customSchema,
+    const moduleSchema = {
         Credential: {
-            ...customSchema.Credential,
-            fields: [
-                ...new Set([...existingCredentialFields, ...credentialFields]),
-            ],
-        },
+            fields: credentialFields
+        }
     };
 
     logger.info(
         `Registering module-level encryption for ${credentialFields.length} credential fields`
     );
 
-    registerCustomSchema(mergedSchema);
+    registerCustomSchema(moduleSchema);
 }
 
 /**
@@ -235,40 +218,7 @@ function loadModuleEncryptionSchemas(integrations) {
  *
  * Used by both Prisma (MongoDB/PostgreSQL) and DocumentDB encryption services.
  */
-/**
- * Raised when an app's encryption configuration is invalid. In deployed
- * stages this fails startup instead of silently writing plaintext.
- */
-class EncryptionSchemaError extends Error {
-    constructor(message, { cause } = {}) {
-        super(message, { cause });
-        this.name = 'EncryptionSchemaError';
-    }
-}
-
-/** Stages where field-level encryption is bypassed (see prisma.js). */
-function isLocalStage() {
-    const stage = process.env.STAGE || process.env.NODE_ENV || 'development';
-    return ['dev', 'test', 'local'].includes(stage.toLowerCase());
-}
-
-/**
- * An app definition was found but part of its encryption configuration
- * could not be applied. Deployed stages fail closed; local stages warn and
- * carry on so development isn't blocked.
- */
-function reportInvalidEncryptionConfig(what, error) {
-    const message = `Invalid ${what}: ${error.message}`;
-    if (isLocalStage()) {
-        logger.warn(`${message} (ignored in local stage)`);
-        return;
-    }
-    logger.error(message);
-    throw new EncryptionSchemaError(message, { cause: error });
-}
-
 function loadCustomEncryptionSchema() {
-    let appDefinition;
     try {
         // Lazy require to avoid circular dependency issues
         const path = require('node:path');
@@ -283,54 +233,38 @@ function loadCustomEncryptionSchema() {
         const backendIndexPath = path.join(backendDir, 'index.js');
 
         const backendModule = require(backendIndexPath);
-        appDefinition = backendModule?.Definition;
-    } catch (error) {
-        // No loadable backend (tests, standalone usage): custom schema is
-        // optional, so this stays at debug level.
-        logger.debug('Could not load custom encryption schema:', error.message);
-        return;
-    }
+        const appDefinition = backendModule?.Definition;
 
-    if (!appDefinition) {
-        return; // No app definition found
-    }
-
-    // From here an app definition exists, so failures are configuration
-    // errors and must be visible.
+        if (!appDefinition) {
+            return; // No app definition found
+        }
 
-    // Load app-level custom schema
-    const customSchema = appDefinition.encryption?.schema;
-    if (customSchema && Object.keys(customSchema).length > 0) {
-        try {
+        // Load app-level custom schema
+        const customSchema = appDefinition.encryption?.schema;
+        if (customSchema && Object.keys(customSchema).length > 0) {
             registerCustomSchema(customSchema);
-        } catch (error) {
-            reportInvalidEncryptionConfig('app encryption.schema', error);
         }
-    }
 
-    // Load app-level encryption opt-out — apps can declare fields they
-    // don't want encrypted on write (decryption on read still works,
-    // so legacy data remains readable).
-    const disable = appDefinition.encryption?.disable;
-    if (disable && Object.keys(disable).length > 0) {
-        try {
+        // Load app-level encryption opt-out — apps can declare fields they
+        // don't want encrypted on write (decryption on read still works,
+        // so legacy data remains readable).
+        const disable = appDefinition.encryption?.disable;
+        if (disable && Object.keys(disable).length > 0) {
             registerEncryptionOptOut(disable);
-        } catch (error) {
-            reportInvalidEncryptionConfig('app encryption.disable', error);
         }
-    }
 
-    // Load module-level encryption schemas from integrations
-    const integrations = appDefinition.integrations;
-    if (integrations && Array.isArray(integrations)) {
-        try {
+        // Load module-level encryption schemas from integrations
+        const integrations = appDefinition.integrations;
+        if (integrations && Array.isArray(integrations)) {
             loadModuleEncryptionSchemas(integrations);
-        } catch (error) {
-            reportInvalidEncryptionConfig(
-                'module encryption.credentialFields',
-                error
-            );
         }
+    } catch (error) {
+        // Silently ignore errors - custom schema is optional
+        // This handles cases like:
+        // - Backend package.json not found (tests, standalone usage)
+        // - No appDefinition defined
+        // - No custom encryption schema specified
+        logger.debug('Could not load custom encryption schema:', error.message);
     }
 }
 
@@ -465,7 +399,6 @@ function resetCustomSchema() {
 }
 
 module.exports = {
-    EncryptionSchemaError,
     CORE_ENCRYPTION_SCHEMA,
     getEncryptedFields,
     getFieldsToEncryptOnWrite,

package/database/encryption/field-encryption-service.js

@@ -1,5 +1,3 @@
-const { isEncryptedEnvelope } = require('./ciphertext-format');
-
 /**
  * Field Encryption Service
  *
@@ -149,7 +147,12 @@ class FieldEncryptionService {
     }
 
     _isEncrypted(value) {
-        return isEncryptedEnvelope(value);
+        if (typeof value !== 'string') {
+            return false;
+        }
+
+        const parts = value.split(':');
+        return parts.length >= 4;
     }
 
     _getNestedValue(obj, path) {
@@ -215,22 +218,22 @@ class FieldEncryptionService {
     }
 
     /**
-     * Serialize a value for encryption.
-     * Every value is JSON-encoded, strings included, so the type survives
-     * the round trip: '123456' is stored as "\"123456\"" and reads back as a
-     * string, 1234 reads back as a number.
+     * Serialize a value for encryption
+     * Objects/arrays are JSON stringified, primitives are converted to strings
      * @private
      */
     _serializeForEncryption(value) {
-        return JSON.stringify(value);
+        if (typeof value === 'object' && value !== null) {
+            // JSON.stringify for objects and arrays
+            return JSON.stringify(value);
+        }
+        // For primitives (string, number, boolean), convert to string
+        return String(value);
     }
 
     /**
-     * Deserialize a value after decryption.
-     * Parses the JSON written by _serializeForEncryption. Values encrypted by
-     * earlier versions stored strings raw: those that aren't valid JSON come
-     * back unchanged; a raw legacy string that is also valid JSON (e.g.
-     * '123456') still parses as it always did.
+     * Deserialize a value after decryption
+     * Attempts to parse as JSON, returns string if parsing fails
      * @private
      */
     _deserializeAfterDecryption(value) {

package/database/organization-where.js

@@ -0,0 +1,18 @@
+/**
+ * The Prisma `where` fragment for an `organizationId` on MongoDB (ADR-056
+ * §3.6), shared by the entity and integration adapters.
+ *
+ * Prisma on MongoDB: `null` matches only an explicit null and `isSet: false`
+ * only a missing field. A row written before the column existed is the common
+ * "no organization" case, so `null` here means both.
+ */
+function organizationWhere(organizationId) {
+    if (organizationId === null) {
+        return {
+            OR: [{ organizationId: null }, { organizationId: { isSet: false } }],
+        };
+    }
+    return { organizationId };
+}
+
+module.exports = { organizationWhere };

package/database/prisma.js

@@ -1,10 +1,7 @@
 const {
     createEncryptionExtension,
 } = require('./encryption/prisma-encryption-extension');
-const {
-    loadCustomEncryptionSchema,
-    EncryptionSchemaError,
-} = require('./encryption/encryption-schema-registry');
+const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
 const { logger } = require('./encryption/logger');
 const { Cryptor } = require('../encrypt/Cryptor');
 const config = require('./config');
@@ -128,12 +125,6 @@ const prismaClientSingleton = () => {
                 `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
             );
         } catch (error) {
-            // An invalid encryption configuration must fail startup: carrying
-            // on without the extension would write encrypted fields in
-            // plaintext.
-            if (error instanceof EncryptionSchemaError) {
-                throw error;
-            }
             logger.error(
                 'Failed to initialize encryption extension:',
                 error

package/database/unique-violation.js

@@ -0,0 +1,25 @@
+/** Mongo/DocumentDB duplicate-key error code. */
+const DUPLICATE_KEY_CODE = 11000;
+/** Prisma's unique-constraint error code (PostgreSQL and MongoDB). */
+const PRISMA_UNIQUE_CODE = 'P2002';
+
+/**
+ * Whether `error` is a unique-constraint violation, however the database
+ * layer raised it: a Prisma `P2002`, or a duplicate-key `11000`
+ * (`documentdb-utils` `insertOne` sets `code` on the error it throws).
+ * Matches on the code only, never on message text.
+ *
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+function isUniqueViolation(error) {
+    return (
+        error?.code === PRISMA_UNIQUE_CODE || error?.code === DUPLICATE_KEY_CODE
+    );
+}
+
+module.exports = {
+    isUniqueViolation,
+    DUPLICATE_KEY_CODE,
+    PRISMA_UNIQUE_CODE,
+};

package/errors/index.js

@@ -6,9 +6,6 @@ const {
     ParameterTypeError,
 } = require('./validation-errors');
 const { ClientSafeError } = require('./client-safe-error');
-const {
-    MappingAlreadyExistsError,
-} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -17,5 +14,4 @@ module.exports = {
     RequiredPropertyError,
     ParameterTypeError,
     ClientSafeError,
-    MappingAlreadyExistsError,
 };