@friggframework/core 2.0.0-next.105 → 2.0.0-next.106

package/integrations/integration-base.js

@@ -383,10 +383,7 @@ class IntegrationBase {
                     this.id,
                     'errors',
                     'Authentication Error',
-                    `There was an error with your ${this[
-                        module
-                    ].getName()} Entity.
-                Please reconnect/re-authenticate, or reach out to Support for assistance.`,
+                    this._authErrorMessage(this[module].getName()),
                     Date.now()
                 );
             }
@@ -395,6 +392,16 @@ class IntegrationBase {
         return didAuthPass;
     }
 
+    /**
+     * @param {string} [moduleName] - The module whose credentials failed.
+     * @param {number} [statusCode] - HTTP status the module rejected us with.
+     * @returns {string} A user-facing message.
+     */
+    _authErrorMessage(moduleName, statusCode) {
+        const status = statusCode ? ` (HTTP ${statusCode})` : '';
+        return `There was an error with your ${moduleName} Entity${status}. Please reconnect/re-authenticate, or reach out to Support for assistance.`;
+    }
+
     /**
      * Reconcile the auth-health axis (ERROR ↔ ENABLED) from a testAuth result.
      * On success it never clears DISABLED — a user pause is not an auth-health
@@ -848,6 +855,9 @@ class IntegrationBase {
         if (!this.id) return;
 
         if (delegateString === 'CREDENTIAL_INVALIDATED') {
+            if (this.status === 'ERROR') return;
+
+            const moduleName = notifier?.name;
             const detail =
                 object?.reason || object?.statusCode
                     ? ` (status ${object?.statusCode ?? '?'}: ${
@@ -856,11 +866,15 @@ class IntegrationBase {
                     : '';
             console.log(
                 `[Frigg] Module ${
-                    notifier?.name || '?'
+                    moduleName || '?'
                 } reported invalid credentials for integration ${
                     this.id
                 } — marking ERROR${detail}`
             );
+            await this._recordCredentialRejection(
+                moduleName,
+                object?.statusCode
+            );
             await this.persistStatus('ERROR');
             return;
         }
@@ -877,6 +891,30 @@ class IntegrationBase {
             await this.persistStatus('ENABLED');
         }
     }
+
+    /**
+     * Takes no `reason`: the delegate's is a FetchError message echoing the
+     * request, Authorization header included outside prod, and this is shown to
+     * end users. Best-effort so it cannot block the caller's status flip.
+     * @param {string} [moduleName] - The module that reported the rejection.
+     * @param {number} [statusCode] - HTTP status the module rejected us with.
+     */
+    async _recordCredentialRejection(moduleName, statusCode) {
+        try {
+            await this.updateIntegrationMessages.execute(
+                this.id,
+                'errors',
+                'Authentication Error',
+                this._authErrorMessage(moduleName, statusCode),
+                Date.now()
+            );
+        } catch (error) {
+            console.error(
+                `[Frigg] Failed to record credential rejection for integration ${this.id}:`,
+                error
+            );
+        }
+    }
 }
 
 module.exports = { IntegrationBase };

package/modules/requester/oauth-2.js

@@ -322,6 +322,11 @@ class OAuth2Requester extends Requester {
                 response_status: error?.response?.status,
                 response_data: error?.response?.data,
             });
+            // Status only: the refresh body carries client_secret, and
+            // FetchError embeds the body in its message outside prod.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
             return false;
         }
     }
@@ -353,8 +358,13 @@ class OAuth2Requester extends Requester {
 
             await this.setTokens(tokenRes);
             return tokenRes;
-        } catch {
-            await this.notify(this.DLGT_INVALID_AUTH);
+        } catch (error) {
+            // Status only. This request's body holds the password or client
+            // secret, and FetchError embeds the body in its message outside
+            // prod, so forwarding the error itself would log the credential.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
         }
     }
 
@@ -387,8 +397,13 @@ class OAuth2Requester extends Requester {
 
             await this.setTokens(tokenRes);
             return tokenRes;
-        } catch {
-            await this.notify(this.DLGT_INVALID_AUTH);
+        } catch (error) {
+            // Status only. This request's body holds the password or client
+            // secret, and FetchError embeds the body in its message outside
+            // prod, so forwarding the error itself would log the credential.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
         }
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0-next.105",
+    "version": "2.0.0-next.106",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0-next.105",
-        "@friggframework/prettier-config": "2.0.0-next.105",
-        "@friggframework/test": "2.0.0-next.105",
+        "@friggframework/eslint-config": "2.0.0-next.106",
+        "@friggframework/prettier-config": "2.0.0-next.106",
+        "@friggframework/test": "2.0.0-next.106",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "d200bd6b1385a33736b67f48e3aa5ac3f5e167c8"
+    "gitHead": "979c1a62fe226206ec3801d1d7aacbfe2a8fac78"
 }