@friggframework/core 2.0.0-next.114 → 2.0.0-next.115

package/modules/use-cases/process-authorization-callback.js

@@ -1,5 +1,8 @@
 const { Module } = require('../module');
 const { ModuleConstants } = require('../ModuleConstants');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.modules.authorization_callback');
 
 // Statuses considered "broken" for an integration whose credentials have just
 // been successfully re-authorized. Both ERROR (system-driven auth failure) and
@@ -28,10 +31,12 @@ class ProcessAuthorizationCallback {
     }
 
     async execute(userId, entityType, params) {
-        const hasCode = Boolean(params && params.code);
-        console.log(
-            `[Frigg] processAuthorizationCallback start userId=${userId} entityType=${entityType} hasCode=${hasCode}`
-        );
+        log.debug('Authorization callback started', {
+            eventName: `${log.name}.started`,
+            userId,
+            entityType,
+            hasCode: Boolean(params && params.code),
+        });
 
         const moduleDefinition = this.moduleDefinitions.find((def) => {
             return entityType === def.moduleName;
@@ -58,9 +63,11 @@ class ProcessAuthorizationCallback {
                 : null;
 
         if (existingEntity) {
-            console.log(
-                `[Frigg] processAuthorizationCallback found existing entity id=${existingEntity.id} credentialId=${existingEntity.credential?.id}`
-            );
+            log.debug('Existing entity found', {
+                eventName: `${log.name}.existing_entity_found`,
+                entityId: existingEntity.id,
+                credentialId: existingEntity.credential?.id,
+            });
         }
 
         const module = new Module({
@@ -69,15 +76,26 @@ class ProcessAuthorizationCallback {
             definition: moduleDefinition,
         });
 
+        const authType = module.apiClass.requesterType;
+        log.debug('Module created', {
+            eventName: `${log.name}.module_created`,
+            moduleName: module.getName(),
+            authType,
+        });
+
         let tokenResponse;
-        if (module.apiClass.requesterType === ModuleConstants.authType.oauth2) {
+        if (authType === ModuleConstants.authType.oauth2) {
+            log.debug('Exchanging authorization code for token', {
+                eventName: `${log.name}.token_exchanging`,
+            });
             tokenResponse = await moduleDefinition.requiredAuthMethods.getToken(
                 module.api,
                 params
             );
-            console.log(
-                `[Frigg] processAuthorizationCallback OAuth getToken complete userId=${userId} entityType=${entityType}`
-            );
+            log.debug('Token exchange completed', {
+                eventName: `${log.name}.token_exchanged`,
+                tokenKeys: Object.keys(tokenResponse || {}),
+            });
             // Belt-and-suspenders: persist tokens explicitly here rather than
             // relying solely on the DLGT_TOKEN_UPDATE notification chain
             // inside setTokens. The notification path remains in place but
@@ -86,6 +104,9 @@ class ProcessAuthorizationCallback {
             // OAuth flow appears to succeed.
             await this.onTokenUpdate(module, moduleDefinition, userId);
         } else {
+            log.debug('Setting auth params', {
+                eventName: `${log.name}.auth_params_setting`,
+            });
             tokenResponse =
                 await moduleDefinition.requiredAuthMethods.setAuthParams(
                     module.api,
@@ -94,15 +115,24 @@ class ProcessAuthorizationCallback {
             await this.onTokenUpdate(module, moduleDefinition, userId);
         }
 
-        console.log(
-            `[Frigg] processAuthorizationCallback credential persisted credentialId=${module.credential?.id} authIsValid=${module.credential?.authIsValid}`
-        );
+        log.debug('Credential persisted', {
+            eventName: `${log.name}.credential_persisted`,
+            credentialId: module.credential?.id,
+            authIsValid: module.credential?.authIsValid,
+        });
 
+        log.debug('Testing auth', { eventName: `${log.name}.auth_testing` });
         const authRes = await module.testAuth();
         if (!authRes) {
             throw new Error('Authorization failed');
         }
+        log.debug('Auth test passed', {
+            eventName: `${log.name}.auth_test_passed`,
+        });
 
+        log.debug('Fetching entity details', {
+            eventName: `${log.name}.entity_details_fetching`,
+        });
         const entityDetails =
             await moduleDefinition.requiredAuthMethods.getEntityDetails(
                 module.api,
@@ -110,17 +140,29 @@ class ProcessAuthorizationCallback {
                 tokenResponse,
                 userId
             );
+        log.debug('Entity details received', {
+            eventName: `${log.name}.entity_details_received`,
+            externalId: entityDetails.identifiers?.externalId,
+        });
 
         Object.assign(
             entityDetails.details,
             module.apiParamsFromEntity(module.api)
         );
 
+        log.debug('Finding or creating entity', {
+            eventName: `${log.name}.entity_resolving`,
+        });
         const persistedEntity = await this.findOrCreateEntity(
             entityDetails,
             entityType,
             module.credential.id
         );
+        log.debug('Authorization callback completed', {
+            eventName: `${log.name}.completed`,
+            entityId: persistedEntity.id,
+            credentialId: module.credential.id,
+        });
 
         // Best-effort: a hiccup here must not fail a successful re-auth whose
         // credential + entity are already persisted. Operators can recover
@@ -129,14 +171,17 @@ class ProcessAuthorizationCallback {
             const restoredCount = await this.restoreIntegrationsForEntity(
                 persistedEntity.id
             );
-            console.log(
-                `[Frigg] processAuthorizationCallback restored ${restoredCount} integration(s) for entityId=${persistedEntity.id}`
-            );
+            log.debug('Integrations restored', {
+                eventName: `${log.name}.integrations_restored`,
+                entityId: persistedEntity.id,
+                restoredCount,
+            });
         } catch (err) {
-            console.error(
-                `[Frigg] Failed to restore integrations for entity ${persistedEntity.id} after successful re-auth — manual intervention may be needed`,
-                err
-            );
+            log.error('Failed to restore integrations after re-auth', {
+                eventName: `${log.name}.integrations_restore_failed`,
+                entityId: persistedEntity.id,
+                error: err,
+            });
         }
 
         return {
@@ -155,9 +200,12 @@ class ProcessAuthorizationCallback {
         let restored = 0;
         for (const integration of integrations) {
             if (STATUSES_RESET_ON_REAUTH.includes(integration.status)) {
-                console.log(
-                    `[Frigg] Restoring integration ${integration.id} from ${integration.status} to ENABLED after successful re-auth (entityId=${entityId})`
-                );
+                log.info('Integration restored to ENABLED after re-auth', {
+                    eventName: `${log.name}.integration_restored`,
+                    integrationId: integration.id,
+                    previousStatus: integration.status,
+                    entityId,
+                });
                 await this.integrationRepository.updateIntegrationStatus(
                     integration.id,
                     'ENABLED'
@@ -219,9 +267,12 @@ class ProcessAuthorizationCallback {
                 credentialId &&
                 String(existingCredentialId) !== String(credentialId)
             ) {
-                console.log(
-                    `[Frigg] Repointing entity ${existingEntity.id} credentialId ${existingCredentialId} -> ${credentialId} after re-auth`
-                );
+                log.info('Entity credential repointed after re-auth', {
+                    eventName: `${log.name}.entity_credential_repointed`,
+                    entityId: existingEntity.id,
+                    previousCredentialId: existingCredentialId,
+                    credentialId,
+                });
                 const updated = await this.moduleRepository.updateEntity(
                     existingEntity.id,
                     { credential: credentialId }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0-next.114",
+    "version": "2.0.0-next.115",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0-next.114",
-        "@friggframework/prettier-config": "2.0.0-next.114",
-        "@friggframework/test": "2.0.0-next.114",
+        "@friggframework/eslint-config": "2.0.0-next.115",
+        "@friggframework/prettier-config": "2.0.0-next.115",
+        "@friggframework/test": "2.0.0-next.115",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "5e56fb857cb3cc0ccf9e033690ecb37cf3e6730c"
+    "gitHead": "a90dfe5e48de5524e61f8919731b323afff5d852"
 }

package/user/use-cases/authenticate-user.js

@@ -1,13 +1,16 @@
 const Boom = require('@hapi/boom');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.user.authentication');
 
 /**
  * Use case for authenticating a user using multiple authentication strategies.
- * 
+ *
  * Supports three authentication modes in priority order:
  * 1. Shared Secret (backend-to-backend with x-frigg-api-key + x-frigg headers)
  * 2. Adopter JWT (custom JWT authentication)
  * 3. Frigg Native Token (bearer token from /user/login)
- * 
+ *
  * x-frigg-appUserId and x-frigg-appOrgId headers are automatically supported
  * for user identification with any auth mode. When present with JWT or Frigg
  * tokens, they are validated to match the authenticated user.
@@ -50,12 +53,18 @@ class AuthenticateUser {
         const authModes = this.userConfig.authModes || { friggToken: true };
         const appUserId = req.headers['x-frigg-appuserid'];
         const appOrgId = req.headers['x-frigg-apporgid'];
-        let user = null;
+        log.debug('Request headers received', {
+            eventName: `${log.name}.headers_received`,
+            headerNames: Object.keys(req.headers),
+        });
 
         // Priority 1: Shared Secret (backend-to-backend with API key)
         if (authModes.sharedSecret !== false) {
             const apiKey = req.headers['x-frigg-api-key'];
             if (apiKey) {
+                log.debug('Attempting shared secret authentication', {
+                    eventName: `${log.name}.shared_secret_attempted`,
+                });
                 // Validate the API key (authentication)
                 await this.authenticateWithSharedSecret.execute(apiKey);
                 // Get user from x-frigg headers (authorization)
@@ -64,6 +73,9 @@ class AuthenticateUser {
                     appOrgId
                 );
             }
+            log.debug('No x-frigg-api-key header, skipping shared secret', {
+                eventName: `${log.name}.shared_secret_skipped`,
+            });
         }
 
         // Priority 2: Adopter JWT (if enabled)
@@ -71,10 +83,13 @@ class AuthenticateUser {
             authModes.adopterJwt === true &&
             req.headers.authorization?.startsWith('Bearer ')
         ) {
+            log.debug('Attempting adopter JWT authentication', {
+                eventName: `${log.name}.adopter_jwt_attempted`,
+            });
             const token = req.headers.authorization.split(' ')[1];
             // Detect JWT format (3 parts separated by dots)
             if (token && token.split('.').length === 3) {
-                user = await this.getUserFromAdopterJwt.execute(token);
+                const user = await this.getUserFromAdopterJwt.execute(token);
                 // Validate x-frigg headers match JWT claims if present
                 if (appUserId || appOrgId) {
                     this.validateUserMatch(user, appUserId, appOrgId);
@@ -85,7 +100,10 @@ class AuthenticateUser {
 
         // Priority 3: Frigg native token (default)
         if (authModes.friggToken !== false && req.headers.authorization) {
-            user = await this.getUserFromBearerToken.execute(
+            log.debug('Attempting Frigg native token authentication', {
+                eventName: `${log.name}.frigg_token_attempted`,
+            });
+            const user = await this.getUserFromBearerToken.execute(
                 req.headers.authorization
             );
             // Validate x-frigg headers match token user if present
@@ -123,5 +141,3 @@ class AuthenticateUser {
 }
 
 module.exports = { AuthenticateUser };
-
-