@friggframework/core 2.0.0-next.12 → 2.0.0-next.120

package/user/repositories/user-repository-documentdb.js

@@ -0,0 +1,426 @@
+const bcrypt = require('bcryptjs');
+const { prisma } = require('../../database/prisma');
+const {
+    toObjectId,
+    fromObjectId,
+    findOne,
+    findMany,
+    insertOne,
+    updateOne,
+    deleteOne,
+} = require('../../database/documentdb-utils');
+const {
+    createTokenRepository,
+} = require('../../token/repositories/token-repository-factory');
+const { UserRepositoryInterface } = require('./user-repository-interface');
+const { ClientSafeError } = require('../../errors');
+const {
+    DocumentDBEncryptionService,
+} = require('../../database/documentdb-encryption-service');
+const { getLogger } = require('../../logs');
+
+const log = getLogger('frigg.user');
+
+/**
+ * User repository for DocumentDB.
+ * Uses DocumentDBEncryptionService for field-level encryption.
+ *
+ * Encrypted fields: User.hashword
+ *
+ * @see DocumentDBEncryptionService
+ * @see encryption-schema-registry.js
+ */
+class UserRepositoryDocumentDB extends UserRepositoryInterface {
+    constructor() {
+        super();
+        this.prisma = prisma;
+        this.tokenRepository = createTokenRepository();
+        this.encryptionService = new DocumentDBEncryptionService();
+    }
+
+    async getSessionToken(token) {
+        const jsonToken =
+            this.tokenRepository.getJSONTokenFromBase64BufferToken(token);
+        const sessionToken = await this.tokenRepository.validateAndGetToken(
+            jsonToken
+        );
+        return sessionToken;
+    }
+
+    async findOrganizationUserById(userId) {
+        const doc = await findOne(this.prisma, 'User', {
+            _id: toObjectId(userId),
+            type: 'ORGANIZATION',
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findIndividualUserById(userId) {
+        const doc = await findOne(this.prisma, 'User', {
+            _id: toObjectId(userId),
+            type: 'INDIVIDUAL',
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findIndividualUsersByOrganizationId(organizationUserId) {
+        const docs = await findMany(this.prisma, 'User', {
+            organizationId: toObjectId(organizationUserId),
+            type: 'INDIVIDUAL',
+        });
+        return Promise.all(
+            docs.map(async (doc) => {
+                const decrypted = await this.encryptionService.decryptFields(
+                    'User',
+                    doc
+                );
+                return this._mapUser(decrypted);
+            })
+        );
+    }
+
+    async createToken(userId, rawToken, minutes = 120) {
+        const createdToken = await this.tokenRepository.createTokenWithExpire(
+            fromObjectId(toObjectId(userId)),
+            rawToken,
+            minutes
+        );
+        return this.tokenRepository.createBase64BufferToken(
+            createdToken,
+            rawToken
+        );
+    }
+
+    async createIndividualUser(params) {
+        const now = new Date();
+        const document = {
+            type: 'INDIVIDUAL',
+            email: params.email ?? null,
+            username: params.username ?? null,
+            appUserId: params.appUserId ?? null,
+            organizationId: params.organization
+                ? toObjectId(params.organization)
+                : params.organizationId
+                ? toObjectId(params.organizationId)
+                : null,
+            createdAt: now,
+            updatedAt: now,
+        };
+
+        if (
+            params.hashword !== undefined &&
+            params.hashword !== null &&
+            params.hashword !== ''
+        ) {
+            if (typeof params.hashword !== 'string') {
+                throw new ClientSafeError('Password must be a string', 400);
+            }
+
+            if (params.hashword.startsWith('$2')) {
+                throw new Error(
+                    'Password appears to be already hashed. Pass plain text password only.'
+                );
+            }
+
+            // Bcrypt hash the password
+            document.hashword = await bcrypt.hash(params.hashword, 10);
+        }
+
+        // Encrypt sensitive fields before insert
+        const encryptedDocument = await this.encryptionService.encryptFields(
+            'User',
+            document
+        );
+        const insertedId = await insertOne(
+            this.prisma,
+            'User',
+            encryptedDocument
+        );
+        const created = await findOne(this.prisma, 'User', { _id: insertedId });
+
+        // Defensive check: verify document was found after insert
+        if (!created) {
+            throw new Error(
+                `Failed to create individual user: Document not found after insert (insertedId ${fromObjectId(insertedId)}). ` +
+                    'This indicates a database consistency issue.'
+            );
+        }
+
+        // Decrypt sensitive fields after read
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            created
+        );
+
+        return this._mapUser(decrypted);
+    }
+
+    async createOrganizationUser(params) {
+        const now = new Date();
+        const document = {
+            type: 'ORGANIZATION',
+            appOrgId: params.appOrgId ?? null,
+            name: params.name ?? null,
+            createdAt: now,
+            updatedAt: now,
+        };
+
+        // Encrypt sensitive fields before insert (consistency with individual user)
+        const encryptedDocument = await this.encryptionService.encryptFields(
+            'User',
+            document
+        );
+        const insertedId = await insertOne(
+            this.prisma,
+            'User',
+            encryptedDocument
+        );
+        const created = await findOne(this.prisma, 'User', { _id: insertedId });
+
+        // Defensive check: verify document was found after insert
+        if (!created) {
+            throw new Error(
+                `Failed to create organization user: Document not found after insert (insertedId ${fromObjectId(insertedId)}). ` +
+                    'This indicates a database consistency issue.'
+            );
+        }
+
+        // Decrypt sensitive fields after read
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            created
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findIndividualUserByUsername(username) {
+        const doc = await findOne(this.prisma, 'User', {
+            type: 'INDIVIDUAL',
+            username,
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findIndividualUserByAppUserId(appUserId) {
+        const doc = await findOne(this.prisma, 'User', {
+            type: 'INDIVIDUAL',
+            appUserId,
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findOrganizationUserByAppOrgId(appOrgId) {
+        const doc = await findOne(this.prisma, 'User', {
+            type: 'ORGANIZATION',
+            appOrgId,
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async findIndividualUserByEmail(email) {
+        const doc = await findOne(this.prisma, 'User', {
+            type: 'INDIVIDUAL',
+            email,
+        });
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async updateIndividualUser(userId, updates) {
+        const objectId = toObjectId(userId);
+        if (!objectId) return null;
+
+        const payload = await this._prepareUpdatePayload(updates);
+        payload.updatedAt = new Date();
+
+        // Encrypt sensitive fields before update
+        const encryptedPayload = await this.encryptionService.encryptFields(
+            'User',
+            payload
+        );
+
+        await updateOne(
+            this.prisma,
+            'User',
+            { _id: objectId, type: 'INDIVIDUAL' },
+            { $set: encryptedPayload }
+        );
+
+        const updated = await findOne(this.prisma, 'User', { _id: objectId });
+
+        // Defensive check: verify document was found after update
+        if (!updated) {
+            throw new Error(
+                `Failed to update individual user: Document not found after update (userId ${userId}). ` +
+                    'This indicates a database consistency issue.'
+            );
+        }
+
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            updated
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async updateOrganizationUser(userId, updates) {
+        const objectId = toObjectId(userId);
+        if (!objectId) return null;
+
+        const payload = { ...updates, updatedAt: new Date() };
+
+        const encryptedPayload = await this.encryptionService.encryptFields(
+            'User',
+            payload
+        );
+
+        await updateOne(
+            this.prisma,
+            'User',
+            { _id: objectId, type: 'ORGANIZATION' },
+            { $set: encryptedPayload }
+        );
+
+        const updated = await findOne(this.prisma, 'User', { _id: objectId });
+
+        if (!updated) {
+            throw new Error(
+                `Failed to update organization user: Document not found after update (userId ${userId}). ` +
+                    'This indicates a database consistency issue.'
+            );
+        }
+
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            updated
+        );
+        return this._mapUser(decrypted);
+    }
+
+    async deleteUser(userId) {
+        const objectId = toObjectId(userId);
+        if (!objectId) return false;
+
+        const result = await deleteOne(this.prisma, 'User', { _id: objectId });
+        const deleted = result?.n ?? 0;
+        return deleted > 0;
+    }
+
+    _mapUser(doc) {
+        if (!doc) {
+            log.warn('_mapUser received a null document', {
+                eventName: 'frigg.user.map_user_null',
+            });
+            return null;
+        }
+
+        // Use optional chaining for robustness
+        return {
+            id: fromObjectId(doc?._id),
+            type: doc?.type ?? null,
+            email: doc?.email ?? null,
+            username: doc?.username ?? null,
+            hashword: doc?.hashword ?? null,
+            appUserId: doc?.appUserId ?? null,
+            organizationId: doc?.organizationId
+                ? fromObjectId(doc.organizationId)
+                : null,
+            appOrgId: doc?.appOrgId ?? null,
+            name: doc?.name ?? null,
+            createdAt: this._parseDate(doc?.createdAt),
+            updatedAt: this._parseDate(doc?.updatedAt),
+        };
+    }
+
+    async _prepareUpdatePayload(updates = {}) {
+        const payload = { ...updates };
+
+        if (
+            payload.hashword !== undefined &&
+            payload.hashword !== null &&
+            payload.hashword !== ''
+        ) {
+            if (typeof payload.hashword !== 'string') {
+                throw new ClientSafeError('Password must be a string', 400);
+            }
+
+            if (payload.hashword.startsWith('$2')) {
+                throw new Error(
+                    'Password appears to be already hashed. Pass plain text password only.'
+                );
+            }
+
+            payload.hashword = await bcrypt.hash(payload.hashword, 10);
+        }
+
+        if (payload.organization !== undefined) {
+            payload.organizationId = toObjectId(payload.organization);
+            delete payload.organization;
+        }
+
+        if (payload.organizationId !== undefined) {
+            payload.organizationId = payload.organizationId
+                ? toObjectId(payload.organizationId)
+                : null;
+        }
+
+        return payload;
+    }
+
+    /**
+     * Parse date value safely, returning undefined for invalid dates
+     * @private
+     * @param {*} value - Date value from database
+     * @returns {Date|undefined} Valid Date object or undefined
+     */
+    _parseDate(value) {
+        if (!value) return undefined;
+        const date = new Date(value);
+        return isNaN(date.getTime()) ? undefined : date;
+    }
+
+    /**
+     * Link an individual user to an organization user
+     * @param {string} individualUserId - Individual user ID (MongoDB ObjectId string)
+     * @param {string} organizationUserId - Organization user ID (MongoDB ObjectId string)
+     * @returns {Promise<Object>} Updated individual user object
+     */
+    async linkIndividualToOrganization(individualUserId, organizationUserId) {
+        const doc = await updateOne(
+            this.prisma,
+            'User',
+            { _id: toObjectId(individualUserId), type: 'INDIVIDUAL' },
+            { $set: { organizationId: toObjectId(organizationUserId) } }
+        );
+        const decrypted = await this.encryptionService.decryptFields(
+            'User',
+            doc
+        );
+        return this._mapUser(decrypted);
+    }
+}
+
+module.exports = { UserRepositoryDocumentDB };

package/user/repositories/user-repository-factory.js

@@ -0,0 +1,52 @@
+const { UserRepositoryMongo } = require('./user-repository-mongo');
+const { UserRepositoryPostgres } = require('./user-repository-postgres');
+const { UserRepositoryDocumentDB } = require('./user-repository-documentdb');
+const databaseConfig = require('../../database/config');
+
+/**
+ * User Repository Factory
+ * Creates the appropriate repository adapter based on database type
+ *
+ * Database-specific implementations:
+ * - MongoDB: Uses String IDs (ObjectId), no conversion needed
+ * - PostgreSQL: Uses Int IDs, converts String ↔ Int
+ *
+ * All repository methods return String IDs regardless of database type,
+ * ensuring application layer consistency.
+ *
+ * Usage:
+ * ```javascript
+ * const repository = createUserRepository();
+ * const user = await repository.findIndividualUserById(id); // ID is string
+ * const orgUser = await repository.findOrganizationUserById(id); // ID is string
+ * ```
+ *
+ * @returns {UserRepositoryInterface} Configured repository adapter
+ */
+function createUserRepository() {
+    const dbType = databaseConfig.DB_TYPE;
+
+    switch (dbType) {
+        case 'mongodb':
+            return new UserRepositoryMongo();
+
+        case 'postgresql':
+            return new UserRepositoryPostgres();
+
+        case 'documentdb':
+            return new UserRepositoryDocumentDB();
+
+        default:
+            throw new Error(
+                `Unsupported DB_TYPE: ${dbType}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+            );
+    }
+}
+
+module.exports = {
+    createUserRepository,
+    // Export adapters for direct testing
+    UserRepositoryMongo,
+    UserRepositoryPostgres,
+    UserRepositoryDocumentDB,
+};

package/user/repositories/user-repository-interface.js

@@ -0,0 +1,214 @@
+/**
+ * User Repository Interface
+ * Abstract base class defining the contract for user persistence adapters
+ *
+ * This follows the Port in Hexagonal Architecture:
+ * - Domain layer depends on this abstraction
+ * - Concrete adapters implement this interface
+ * - Use cases receive repositories via dependency injection
+ *
+ * Note: Currently, User model has identical structure across MongoDB and PostgreSQL,
+ * so UserRepository serves both. This interface exists for consistency and
+ * future-proofing if database-specific implementations become needed.
+ *
+ * @abstract
+ */
+class UserRepositoryInterface {
+    /**
+     * Get session token from base64 buffer token
+     *
+     * @param {string} token - Base64 buffer token
+     * @returns {Promise<Object>} Session token object
+     * @abstract
+     */
+    async getSessionToken(token) {
+        throw new Error(
+            'Method getSessionToken must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find organization user by ID
+     *
+     * @param {string|number} userId - User ID
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findOrganizationUserById(userId) {
+        throw new Error(
+            'Method findOrganizationUserById must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find individual user by ID
+     *
+     * @param {string|number} userId - User ID
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findIndividualUserById(userId) {
+        throw new Error(
+            'Method findIndividualUserById must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find all individual users linked to an organization user
+     *
+     * @param {string|number} organizationUserId - Organization user ID
+     * @returns {Promise<Object[]>} Array of individual user objects (empty if none)
+     * @abstract
+     */
+    async findIndividualUsersByOrganizationId(organizationUserId) {
+        throw new Error(
+            'Method findIndividualUsersByOrganizationId must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Create token with expiration
+     *
+     * @param {string|number} userId - User ID
+     * @param {string} rawToken - Raw unhashed token
+     * @param {number} minutes - Minutes until expiration (default 120)
+     * @returns {Promise<string>} Base64 buffer token
+     * @abstract
+     */
+    async createToken(userId, rawToken, minutes = 120) {
+        throw new Error('Method createToken must be implemented by subclass');
+    }
+
+    /**
+     * Create individual user
+     *
+     * @param {Object} params - User creation parameters
+     * @returns {Promise<Object>} Created user object
+     * @abstract
+     */
+    async createIndividualUser(params) {
+        throw new Error(
+            'Method createIndividualUser must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Create organization user
+     *
+     * @param {Object} params - Organization creation parameters
+     * @returns {Promise<Object>} Created organization object
+     * @abstract
+     */
+    async createOrganizationUser(params) {
+        throw new Error(
+            'Method createOrganizationUser must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find individual user by username
+     *
+     * @param {string} username - Username to search for
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findIndividualUserByUsername(username) {
+        throw new Error(
+            'Method findIndividualUserByUsername must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find individual user by app user ID
+     *
+     * @param {string} appUserId - App user ID to search for
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findIndividualUserByAppUserId(appUserId) {
+        throw new Error(
+            'Method findIndividualUserByAppUserId must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find organization user by app org ID
+     *
+     * @param {string} appOrgId - App organization ID to search for
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findOrganizationUserByAppOrgId(appOrgId) {
+        throw new Error(
+            'Method findOrganizationUserByAppOrgId must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Find individual user by email
+     *
+     * @param {string} email - Email to search for
+     * @returns {Promise<Object|null>} User object or null
+     * @abstract
+     */
+    async findIndividualUserByEmail(email) {
+        throw new Error(
+            'Method findIndividualUserByEmail must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Update individual user
+     *
+     * @param {string|number} userId - User ID
+     * @param {Object} updates - Fields to update
+     * @returns {Promise<Object>} Updated user object
+     * @abstract
+     */
+    async updateIndividualUser(userId, updates) {
+        throw new Error(
+            'Method updateIndividualUser must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Update organization user
+     *
+     * @param {string|number} userId - User ID
+     * @param {Object} updates - Fields to update
+     * @returns {Promise<Object>} Updated user object
+     * @abstract
+     */
+    async updateOrganizationUser(userId, updates) {
+        throw new Error(
+            'Method updateOrganizationUser must be implemented by subclass'
+        );
+    }
+
+    /**
+     * Delete user by ID
+     *
+     * @param {string|number} userId - User ID to delete
+     * @returns {Promise<boolean>} True if deleted successfully
+     * @abstract
+     */
+    async deleteUser(userId) {
+        throw new Error('Method deleteUser must be implemented by subclass');
+    }
+
+    /**
+     * Link an individual user to an organization user
+     *
+     * @param {string|number} individualUserId - Individual user ID
+     * @param {string|number} organizationUserId - Organization user ID
+     * @returns {Promise<Object>} Updated individual user object
+     * @abstract
+     */
+    async linkIndividualToOrganization(individualUserId, organizationUserId) {
+        throw new Error(
+            'Method linkIndividualToOrganization must be implemented by subclass'
+        );
+    }
+}
+
+module.exports = { UserRepositoryInterface };