@friggframework/core 2.0.0-next.105 → 2.0.0-next.107

package/integrations/integration-base.js

@@ -383,10 +383,7 @@ class IntegrationBase {
                     this.id,
                     'errors',
                     'Authentication Error',
-                    `There was an error with your ${this[
-                        module
-                    ].getName()} Entity.
-                Please reconnect/re-authenticate, or reach out to Support for assistance.`,
+                    this._authErrorMessage(this[module].getName()),
                     Date.now()
                 );
             }
@@ -395,6 +392,16 @@ class IntegrationBase {
         return didAuthPass;
     }
 
+    /**
+     * @param {string} [moduleName] - The module whose credentials failed.
+     * @param {number} [statusCode] - HTTP status the module rejected us with.
+     * @returns {string} A user-facing message.
+     */
+    _authErrorMessage(moduleName, statusCode) {
+        const status = statusCode ? ` (HTTP ${statusCode})` : '';
+        return `There was an error with your ${moduleName} Entity${status}. Please reconnect/re-authenticate, or reach out to Support for assistance.`;
+    }
+
     /**
      * Reconcile the auth-health axis (ERROR ↔ ENABLED) from a testAuth result.
      * On success it never clears DISABLED — a user pause is not an auth-health
@@ -848,6 +855,9 @@ class IntegrationBase {
         if (!this.id) return;
 
         if (delegateString === 'CREDENTIAL_INVALIDATED') {
+            if (this.status === 'ERROR') return;
+
+            const moduleName = notifier?.name;
             const detail =
                 object?.reason || object?.statusCode
                     ? ` (status ${object?.statusCode ?? '?'}: ${
@@ -856,11 +866,15 @@ class IntegrationBase {
                     : '';
             console.log(
                 `[Frigg] Module ${
-                    notifier?.name || '?'
+                    moduleName || '?'
                 } reported invalid credentials for integration ${
                     this.id
                 } — marking ERROR${detail}`
             );
+            await this._recordCredentialRejection(
+                moduleName,
+                object?.statusCode
+            );
             await this.persistStatus('ERROR');
             return;
         }
@@ -877,6 +891,30 @@ class IntegrationBase {
             await this.persistStatus('ENABLED');
         }
     }
+
+    /**
+     * Takes no `reason`: the delegate's is a FetchError message echoing the
+     * request, Authorization header included outside prod, and this is shown to
+     * end users. Best-effort so it cannot block the caller's status flip.
+     * @param {string} [moduleName] - The module that reported the rejection.
+     * @param {number} [statusCode] - HTTP status the module rejected us with.
+     */
+    async _recordCredentialRejection(moduleName, statusCode) {
+        try {
+            await this.updateIntegrationMessages.execute(
+                this.id,
+                'errors',
+                'Authentication Error',
+                this._authErrorMessage(moduleName, statusCode),
+                Date.now()
+            );
+        } catch (error) {
+            console.error(
+                `[Frigg] Failed to record credential rejection for integration ${this.id}:`,
+                error
+            );
+        }
+    }
 }
 
 module.exports = { IntegrationBase };

package/integrations/use-cases/update-process-metrics.js

@@ -16,11 +16,13 @@
  *
  *   2. Derived-fields phase — duration, recordsPerSecond,
  *      estimatedCompletion. Computed from the post-atomic snapshot and
- *      written via the legacy (non-atomic) `update()` method.
- *      Intentionally best-effort: under concurrent writers they reflect
- *      "whichever handler wrote last" — the same semantics they had
- *      before and all they've ever guaranteed. Preserved for backward
- *      compatibility with consumers (UI, WebSocket listeners).
+ *      written through the same atomic primitive, scoped to only those
+ *      three paths. The values themselves stay best-effort (under
+ *      concurrent writers they reflect "whichever handler wrote last"),
+ *      but the write can no longer clobber another caller's counters.
+ *      Writing the full context/results blob here — as the legacy
+ *      `update()` path did — replayed phase 1's snapshot over the row and
+ *      permanently discarded increments landed in between.
  *
  * Optionally broadcasts progress via WebSocket service if provided.
  *
@@ -124,44 +126,48 @@ class UpdateProcessMetrics {
             throw processNotFound(`Process not found: ${processId}`);
         }
 
-        // Phase 2: derived metrics (non-atomic, best-effort). Preserved
-        // for backward compatibility — these were always stale under
-        // concurrent writers even before this refactor.
+        // Phase 2: derived metrics. Written through the SAME atomic path
+        // as phase 1, touching ONLY the paths this phase owns. Writing the
+        // whole context/results blob here (as the legacy `update()` did)
+        // replayed phase 1's snapshot over the row and silently discarded
+        // any increment a concurrent caller had landed in between.
         const context = updatedProcess.context || {};
-        const results = updatedProcess.results || { aggregateData: {} };
-        if (!results.aggregateData) results.aggregateData = {};
 
         if (context.processedRecords > 0 || context.totalRecords > 0) {
             const startTime = new Date(
                 context.startTime || updatedProcess.createdAt
             );
             const elapsed = Date.now() - startTime.getTime();
-            results.aggregateData.duration = elapsed;
 
-            if (elapsed > 0 && context.processedRecords > 0) {
-                results.aggregateData.recordsPerSecond =
-                    context.processedRecords / (elapsed / 1000);
-            } else {
-                results.aggregateData.recordsPerSecond = 0;
-            }
+            const recordsPerSecond =
+                elapsed > 0 && context.processedRecords > 0
+                    ? context.processedRecords / (elapsed / 1000)
+                    : 0;
+
+            const set = {
+                'results.aggregateData.duration': elapsed,
+                'results.aggregateData.recordsPerSecond': recordsPerSecond,
+            };
 
-            if (context.totalRecords > 0 && context.processedRecords > 0) {
+            if (
+                context.totalRecords > 0 &&
+                context.processedRecords > 0 &&
+                recordsPerSecond > 0
+            ) {
                 const remaining =
                     context.totalRecords - context.processedRecords;
-                if (results.aggregateData.recordsPerSecond > 0) {
-                    const etaMs =
-                        (remaining / results.aggregateData.recordsPerSecond) *
-                        1000;
-                    const eta = new Date(Date.now() + etaMs);
-                    context.estimatedCompletion = eta.toISOString();
-                }
+                const etaMs = (remaining / recordsPerSecond) * 1000;
+                set['context.estimatedCompletion'] = new Date(
+                    Date.now() + etaMs
+                ).toISOString();
             }
 
             try {
-                updatedProcess = await this.processRepository.update(
-                    processId,
-                    { context, results }
-                );
+                const withDerived =
+                    await this.processRepository.applyProcessUpdate(processId, {
+                        set,
+                    });
+                if (withDerived) updatedProcess = withDerived;
             } catch (error) {
                 // Derived-field write failures are NON-FATAL — atomic
                 // counters from phase 1 already landed. Log and return the

package/modules/requester/oauth-2.js

@@ -322,6 +322,11 @@ class OAuth2Requester extends Requester {
                 response_status: error?.response?.status,
                 response_data: error?.response?.data,
             });
+            // Status only: the refresh body carries client_secret, and
+            // FetchError embeds the body in its message outside prod.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
             return false;
         }
     }
@@ -353,8 +358,13 @@ class OAuth2Requester extends Requester {
 
             await this.setTokens(tokenRes);
             return tokenRes;
-        } catch {
-            await this.notify(this.DLGT_INVALID_AUTH);
+        } catch (error) {
+            // Status only. This request's body holds the password or client
+            // secret, and FetchError embeds the body in its message outside
+            // prod, so forwarding the error itself would log the credential.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
         }
     }
 
@@ -387,8 +397,13 @@ class OAuth2Requester extends Requester {
 
             await this.setTokens(tokenRes);
             return tokenRes;
-        } catch {
-            await this.notify(this.DLGT_INVALID_AUTH);
+        } catch (error) {
+            // Status only. This request's body holds the password or client
+            // secret, and FetchError embeds the body in its message outside
+            // prod, so forwarding the error itself would log the credential.
+            await this.notify(this.DLGT_INVALID_AUTH, {
+                statusCode: error?.statusCode,
+            });
         }
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0-next.105",
+    "version": "2.0.0-next.107",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0-next.105",
-        "@friggframework/prettier-config": "2.0.0-next.105",
-        "@friggframework/test": "2.0.0-next.105",
+        "@friggframework/eslint-config": "2.0.0-next.107",
+        "@friggframework/prettier-config": "2.0.0-next.107",
+        "@friggframework/test": "2.0.0-next.107",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "d200bd6b1385a33736b67f48e3aa5ac3f5e167c8"
+    "gitHead": "27ac136ac4fc2da4c9d9806ee548a8f8c49eaa15"
 }