@friggframework/core 2.0.0-next.112 → 2.0.0-next.113

package/integrations/integration-base.js

@@ -21,6 +21,7 @@ const { validateExtensionBinding } = require('./extension');
 const { getTelemetry } = require('../telemetry/telemetry-runtime');
 const { instrumentHandler } = require('../telemetry/instrument-handler');
 const { bindTelemetryContext } = require('../telemetry/bind-telemetry-context');
+const { getLogger } = require('../logs');
 
 const constantsToBeMigrated = {
     defaultEvents: {
@@ -64,6 +65,10 @@ class IntegrationBase {
         this.getTelemetryContext()
     );
 
+    logger = getLogger(
+        `integration.${this.constructor.Definition?.name ?? 'unknown'}`
+    ).child(() => this.getLoggerBindings());
+
     static getOptionDetails() {
         const options = new Options({
             module: Object.values(this.Definition.modules)[0], // This is a placeholder until we revamp the frontend
@@ -254,6 +259,14 @@ class IntegrationBase {
         };
     }
 
+    // Stage and appName are record resource fields; binding them would
+    // only land in droppedKeys.
+    getLoggerBindings() {
+        const { integrationId, integrationType, userId, version } =
+            this.getTelemetryContext();
+        return { integrationId, integrationType, userId, version };
+    }
+
     assertHydrated(message = 'Integration instance is not hydrated') {
         if (!this.isHydrated) {
             throw new Error(message);
@@ -411,15 +424,15 @@ class IntegrationBase {
      */
     async reconcileAuthStatus(authPassed) {
         if (!authPassed) {
-            console.log(
-                `[Frigg] Integration ${this.id} failed to authenticate`
-            );
+            this.logger.warn('Integration failed to authenticate', {
+                eventName: `${this.logger.name}.auth_failed`,
+            });
             await this.persistStatus('ERROR');
         }
         if (authPassed && this.status === 'ERROR') {
-            console.log(
-                `[Frigg] auth confirmed for integration ${this.id} — clearing ERROR → ENABLED`
-            );
+            this.logger.info('Auth confirmed, clearing ERROR', {
+                eventName: `${this.logger.name}.auth_confirmed`,
+            });
             await this.persistStatus('ENABLED');
         }
     }
@@ -615,12 +628,22 @@ class IntegrationBase {
         this[key] = module;
     }
 
+    // The raw error can echo a request with its credentials, and messages
+    // reach end users, so only a fixed text is stored.
     addError(error) {
         if (!this.messages.errors) {
             this.messages.errors = [];
         }
-        this.messages.errors.push(error);
+        this.messages.errors.push({
+            title: 'Integration Error',
+            message: `Integration ${this.id} hit an error. Contact support.`,
+            timestamp: Date.now(),
+        });
         this.status = 'ERROR';
+        this.logger.error('Integration error recorded', {
+            eventName: `${this.logger.name}.error_recorded`,
+            error,
+        });
     }
 
     addWarning(warning) {
@@ -639,9 +662,10 @@ class IntegrationBase {
     async persistStatus(status) {
         await this.updateIntegrationStatus.execute(this.id, status);
         this.status = status;
-        console.log(
-            `[Frigg] Integration ${this.id} status changed to ${status}`
-        );
+        this.logger.info('Integration status changed', {
+            eventName: `${this.logger.name}.status_changed`,
+            integrationStatus: status,
+        });
     }
 
     /**
@@ -753,10 +777,14 @@ class IntegrationBase {
                 // it wins. Warn if the binding tried to wire an override that's now ignored.
                 if (this.events[eventName]) {
                     if (typeof handlers[eventName] === 'string') {
-                        console.warn(
-                            `[Frigg] Integration "${integrationName}" binding "${bindingName}": ` +
-                                `handler "${handlers[eventName]}" for event "${eventName}" is ignored because ` +
-                                `this.events["${eventName}"] was already set (subclass constructor or earlier merge)`
+                        this.logger.warn(
+                            'Binding handler is ignored: the event is already set',
+                            {
+                                eventName: `${this.logger.name}.extension_handler_shadowed`,
+                                bindingName,
+                                handler: handlers[eventName],
+                                event: eventName,
+                            }
                         );
                     }
                     continue;
@@ -858,19 +886,12 @@ class IntegrationBase {
             if (this.status === 'ERROR') return;
 
             const moduleName = notifier?.name;
-            const detail =
-                object?.reason || object?.statusCode
-                    ? ` (status ${object?.statusCode ?? '?'}: ${
-                          object?.reason ?? 'no reason given'
-                      })`
-                    : '';
-            console.log(
-                `[Frigg] Module ${
-                    moduleName || '?'
-                } reported invalid credentials for integration ${
-                    this.id
-                } — marking ERROR${detail}`
-            );
+            this.logger.warn('Module reported invalid credentials, marking ERROR', {
+                eventName: `${this.logger.name}.credentials_invalidated`,
+                moduleName,
+                statusCode: object?.statusCode,
+                reason: object?.reason,
+            });
             await this._recordCredentialRejection(
                 moduleName,
                 object?.statusCode
@@ -881,13 +902,10 @@ class IntegrationBase {
 
         if (delegateString === 'CREDENTIAL_VALIDATED') {
             if (this.status !== 'ERROR') return;
-            console.log(
-                `[Frigg] Module ${
-                    notifier?.name || '?'
-                } reported valid credentials for integration ${
-                    this.id
-                } — clearing ERROR → ENABLED`
-            );
+            this.logger.info('Module reported valid credentials, clearing ERROR', {
+                eventName: `${this.logger.name}.credentials_validated`,
+                moduleName: notifier?.name,
+            });
             await this.persistStatus('ENABLED');
         }
     }
@@ -909,10 +927,10 @@ class IntegrationBase {
                 Date.now()
             );
         } catch (error) {
-            console.error(
-                `[Frigg] Failed to record credential rejection for integration ${this.id}:`,
-                error
-            );
+            this.logger.error('Failed to record credential rejection', {
+                eventName: `${this.logger.name}.credential_rejection_record_failed`,
+                error,
+            });
         }
     }
 }

package/integrations/integration-router.js

@@ -2,6 +2,7 @@ const express = require('express');
 const { get } = require('../assertions');
 const Boom = require('@hapi/boom');
 const catchAsyncError = require('express-async-handler');
+const { getLogger } = require('../logs');
 const {
     createIntegrationRepository,
 } = require('./repositories/integration-repository-factory');
@@ -70,6 +71,8 @@ const {
     ProcessAuthorizationCallback,
 } = require('../modules/use-cases/process-authorization-callback');
 
+const log = getLogger('frigg.integrations');
+
 function createIntegrationRouter() {
     const { integrations: integrationClasses, userConfig } =
         loadAppDefinition();
@@ -536,29 +539,27 @@ function setEntityRoutes(router, authenticateUser, useCases) {
                 params.data && typeof params.data === 'object'
                     ? Object.keys(params.data)
                     : [];
-            console.log(
-                `[Frigg] POST /api/authorize userId=${userId} entityType=${params.entityType} dataKeys=${JSON.stringify(dataKeys)}`
-            );
+            log.debug('Authorize requested', {
+                userId,
+                entityType: params.entityType,
+                dataKeys,
+            });
 
-            try {
-                const entityDetails =
-                    await processAuthorizationCallback.execute(
-                        userId,
-                        params.entityType,
-                        params.data
-                    );
+            const entityDetails = await processAuthorizationCallback.execute(
+                userId,
+                params.entityType,
+                params.data
+            );
 
-                console.log(
-                    `[Frigg] POST /api/authorize success userId=${userId} entityType=${params.entityType} credentialId=${entityDetails?.credential_id} entityId=${entityDetails?.entity_id}`
-                );
+            log.info('Entity authorized', {
+                eventName: 'frigg.integrations.authorized',
+                userId,
+                entityType: params.entityType,
+                credentialId: entityDetails?.credential_id,
+                entityId: entityDetails?.entity_id,
+            });
 
-                res.json(entityDetails);
-            } catch (err) {
-                console.error(
-                    `[Frigg] POST /api/authorize failed userId=${userId} entityType=${params.entityType} error=${err?.message || err}`
-                );
-                throw err;
-            }
+            res.json(entityDetails);
         })
     );
 

package/integrations/use-cases/delete-integration-for-user.js

@@ -1,4 +1,7 @@
 const Boom = require('@hapi/boom');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.integrations');
 // Removed Integration wrapper - using IntegrationBase directly
 
 /**
@@ -65,17 +68,25 @@ class DeleteIntegrationForUser {
                 );
                 modules.push(moduleInstance);
             } catch (error) {
-                console.error(
-                    `[Integration Deletion] Failed to load module for entity ${entityId}:`,
-                    error.message
-                );
+                log.warn('Failed to load module for deletion', {
+                    eventName: 'frigg.integrations.delete_module_load_failed',
+                    integrationId,
+                    entityId,
+                    error,
+                });
                 failedModuleLoads.push({ entityId, error: error.message });
             }
         }
 
         if (failedModuleLoads.length > 0) {
-            console.warn(
-                `[Integration Deletion] ${failedModuleLoads.length}/${integrationRecord.entitiesIds.length} module(s) failed to load. Webhooks for these modules may require manual cleanup.`
+            log.warn(
+                'Some modules failed to load. Webhooks for these modules may require manual cleanup.',
+                {
+                    eventName: 'frigg.integrations.delete_modules_incomplete',
+                    integrationId,
+                    failedCount: failedModuleLoads.length,
+                    totalCount: integrationRecord.entitiesIds.length,
+                }
             );
         }
 
@@ -97,19 +108,19 @@ class DeleteIntegrationForUser {
         try {
             await integrationInstance.send('ON_DELETE');
         } catch (error) {
-            const reason = error?.message ?? String(error);
-            console.error(
-                `[Integration Deletion] onDelete failed for integration ${integrationId}, leaving it IN_DELETION:`,
-                reason
-            );
+            // The error text can echo a request with its credentials and
+            // messages reach end users; the boundary logs the cause once.
             await integrationInstance.updateIntegrationMessages.execute(
                 integrationId,
                 'errors',
                 'Integration Deletion Error',
-                `Deletion did not complete: ${reason}`,
+                'Deletion did not complete. Contact support.',
                 Date.now()
             );
-            throw error;
+            throw new Error(
+                `Integration ${integrationId} deletion did not complete`,
+                { cause: error }
+            );
         }
 
         await this.integrationRepository.deleteIntegrationById(integrationId);

package/jest.config.js

@@ -18,4 +18,6 @@ module.exports = {
 
     // A path to a module which exports an async function that is triggered once after all test suites
     globalTeardown: './jest-teardown.js',
+
+    setupFilesAfterEnv: ['./logs/jest-logger-setup.js'],
 };

package/logs/.eslintrc.json

@@ -1,3 +1,28 @@
 {
-    "extends": "@friggframework/eslint-config"
+    "extends": "@friggframework/eslint-config",
+    "rules": {
+        "no-console": "error",
+        "no-restricted-syntax": [
+            "error",
+            {
+                "selector": "CallExpression[callee.object.object.name='process'][callee.object.property.name=/^(stdout|stderr)$/][callee.property.name='write']",
+                "message": "Write through the logger; only logs/sinks.js writes to fd 1"
+            }
+        ]
+    },
+    "overrides": [
+        {
+            "files": ["*.test.js", "__fixtures__/**", "jest-logger-setup.js"],
+            "rules": {
+                "no-console": "off",
+                "no-restricted-syntax": "off"
+            }
+        },
+        {
+            "files": ["sinks.js"],
+            "rules": {
+                "no-restricted-syntax": "off"
+            }
+        }
+    ]
 }

package/logs/__fixtures__/events.js

@@ -0,0 +1,82 @@
+const { SECRETS } = require('./secrets');
+
+function httpApiV2Event() {
+    return {
+        version: '2.0',
+        routeKey: 'GET /api/authorize',
+        rawPath: '/api/authorize',
+        rawQueryString: `code=${SECRETS.oauthCode}&state=abc123&api_key=${SECRETS.apiKeyQuery}`,
+        cookies: [`session=${SECRETS.cookie}`],
+        headers: {
+            'x-frigg-api-key': SECRETS.friggApiKey,
+            authorization: `Bearer ${SECRETS.bearer}`,
+            cookie: `session=${SECRETS.cookie}`,
+            'content-type': 'application/json',
+        },
+        queryStringParameters: {
+            code: SECRETS.oauthCode,
+            state: 'abc123',
+            api_key: SECRETS.apiKeyQuery,
+        },
+        requestContext: {
+            http: { method: 'GET', path: '/api/authorize', sourceIp: '203.0.113.9' },
+            requestId: 'req-v2-1',
+        },
+        body: JSON.stringify({
+            code: SECRETS.oauthCode,
+            code_verifier: SECRETS.codeVerifier,
+            client_secret: SECRETS.clientSecret,
+        }),
+        isBase64Encoded: false,
+    };
+}
+
+function restV1Event() {
+    return {
+        resource: '/api/{proxy+}',
+        path: '/api/integrations',
+        httpMethod: 'POST',
+        headers: {
+            Authorization: `Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`,
+            'X-Frigg-Api-Key': SECRETS.friggApiKey,
+            Cookie: `session=${SECRETS.cookie}`,
+        },
+        multiValueHeaders: {
+            Authorization: [`Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`],
+            'Set-Cookie': [`session=${SECRETS.cookie}`],
+        },
+        queryStringParameters: { access_token: SECRETS.accessToken },
+        multiValueQueryStringParameters: { access_token: [SECRETS.accessToken] },
+        requestContext: { requestId: 'req-v1-1', stage: 'dev' },
+        body: JSON.stringify({ password: SECRETS.password, refresh_token: SECRETS.refreshToken }),
+        isBase64Encoded: false,
+    };
+}
+
+function sqsEvent() {
+    return {
+        Records: [
+            {
+                messageId: 'msg-1',
+                receiptHandle: 'receipt-1',
+                attributes: { ApproximateReceiveCount: '1' },
+                body: JSON.stringify({
+                    event: 'PROCESS_BATCH',
+                    data: {
+                        processId: 'proc-1',
+                        integrationId: 'int-1',
+                        access_token: SECRETS.accessToken,
+                        credentials: { client_secret: SECRETS.clientSecret },
+                    },
+                }),
+            },
+            {
+                messageId: 'msg-2',
+                attributes: { ApproximateReceiveCount: '3' },
+                body: `not json Authorization: Bearer ${SECRETS.bearer}`,
+            },
+        ],
+    };
+}
+
+module.exports = { httpApiV2Event, restV1Event, sqsEvent };

package/logs/__fixtures__/matchers.js

@@ -0,0 +1,45 @@
+const WINDOW = 8;
+
+function forms(secret) {
+    return [
+        secret,
+        encodeURIComponent(secret),
+        Buffer.from(secret).toString('base64'),
+    ];
+}
+
+function windows(value) {
+    if (value.length <= WINDOW) return [value];
+    const result = [];
+    for (let i = 0; i + WINDOW <= value.length; i += 1) {
+        result.push(value.slice(i, i + WINDOW));
+    }
+    return result;
+}
+
+function findSecretWindow(received, secrets) {
+    const haystack =
+        typeof received === 'string' ? received : JSON.stringify(received);
+    for (const secret of secrets) {
+        for (const form of forms(secret)) {
+            for (const w of windows(form)) {
+                if (haystack.includes(w)) return { secret, window: w };
+            }
+        }
+    }
+    return null;
+}
+
+function toContainNoSecretWindow(received, secrets) {
+    const list = Array.isArray(secrets) ? secrets : Object.values(secrets);
+    const hit = findSecretWindow(received, list);
+    return {
+        pass: hit === null,
+        message: () =>
+            hit
+                ? `expected no ${WINDOW}-char window of a secret, found "${hit.window}" (from a secret of length ${hit.secret.length})`
+                : 'expected a secret window, found none',
+    };
+}
+
+module.exports = { toContainNoSecretWindow, findSecretWindow, WINDOW };

package/logs/__fixtures__/secrets.js

@@ -0,0 +1,59 @@
+// Fake values, generated at load time so secret scanners find no literal in
+// the source. A fixed seed per name keeps every run identical.
+const MIXED = 'BCDFGHJKLMNPQRSTVWXZbcdfghjkmnpqrstvwxz23456789';
+const HEX = '0123456789abcdef';
+
+function seededRandom(name) {
+    let seed = [...name].reduce(
+        (h, c) => Math.imul(h ^ c.charCodeAt(0), 16777619),
+        2166136261
+    );
+    return () => {
+        seed = (seed + 0x6d2b79f5) | 0;
+        let t = Math.imul(seed ^ (seed >>> 15), seed | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+
+function draw(name, alphabet, length) {
+    const next = seededRandom(name);
+    let out = '';
+    for (let i = 0; i < length; i += 1) {
+        out += alphabet[Math.floor(next() * alphabet.length)];
+    }
+    return out;
+}
+
+// The fixed 'Zq' + 'B7k' start puts upper case, lower case and a digit in every token.
+function fakeToken(name, length = 28) {
+    return `ZqB7k${draw(name, MIXED, length - 5)}`;
+}
+
+const base64url = (value) => Buffer.from(value).toString('base64url');
+
+const SECRETS = Object.freeze({
+    bearer: fakeToken('bearer'),
+    apiKeyQuery: fakeToken('apiKeyQuery'),
+    friggApiKey: fakeToken('friggApiKey'),
+    cookie: fakeToken('cookie'),
+    oauthCode: fakeToken('oauthCode'),
+    codeVerifier: fakeToken('codeVerifier'),
+    password: fakeToken('password'),
+    clientSecret: fakeToken('clientSecret'),
+    accessToken: fakeToken('accessToken'),
+    refreshToken: fakeToken('refreshToken'),
+    idToken: fakeToken('idToken'),
+    hashword: fakeToken('hashword'),
+    dbPassword: fakeToken('dbPassword'),
+    signature: fakeToken('signature'),
+    jwt: [
+        base64url(JSON.stringify({ alg: 'HS256' })),
+        base64url(JSON.stringify({ sub: `fake-${draw('jwtSub', MIXED, 8)}` })),
+        base64url(draw('jwtSig', MIXED, 24)),
+    ].join('.'),
+    hexToken: draw('hexToken', HEX, 40),
+    base64Run: Buffer.from(draw('base64Run', MIXED, 42)).toString('base64'),
+});
+
+module.exports = { SECRETS, fakeToken };