@friggframework/core 2.0.0-next.12 → 2.0.0-next.120

package/database/encryption/integration-mapping-encryption.js

@@ -0,0 +1,97 @@
+const { getEncryptionConfig } = require('../prisma');
+const { Cryptor } = require('../../encrypt/Cryptor');
+const {
+    getFieldsToDecryptOnRead,
+    getFieldsToEncryptOnWrite,
+    loadCustomEncryptionSchema,
+} = require('./encryption-schema-registry');
+const {
+    createFieldEncryptionService,
+} = require('./prisma-encryption-extension');
+
+let plainMappingEncryption = null;
+
+/**
+ * The `IntegrationMapping` fields, `mapping` itself or a nested `mapping.*`
+ * path, that field-level encryption encrypts on write. An empty result is
+ * kept for the life of the process.
+ *
+ * @returns {string[]} Empty when every mapping path is written as plain JSON
+ */
+function getMappingFieldsEncryptedOnWrite() {
+    return mappingEncryption().encryptedOnWrite;
+}
+
+/**
+ * @throws {Error} When field-level encryption still encrypts `mapping`, or a
+ *   nested `mapping.*` path, on write, naming the opt-out that lifts it
+ */
+function assertMappingWrittenUnencrypted() {
+    const fields = getMappingFieldsEncryptedOnWrite();
+    if (fields.length === 0) return;
+
+    const encrypted = fields
+        .map((field) => `IntegrationMapping.${field}`)
+        .join(', ');
+    const optOut = fields.map((field) => `'${field}'`).join(', ');
+    throw new Error(
+        `queryMappings: field-level encryption still encrypts ${encrypted} on write, so it cannot be queried. Opt out by adding ${optOut} to appDefinition.encryption.disable.IntegrationMapping.`
+    );
+}
+
+/**
+ * Decrypts rows that `queryMappings` read around the Prisma encryption
+ * extension, the way reads through the extension do: every
+ * `IntegrationMapping` field the schema lists, opted-out paths included, so a
+ * path written encrypted before its opt-out comes back plain.
+ *
+ * @param {Object[]} rows - Rows whose `mapping` is a JSON object
+ * @returns {Promise<Object[]>} `rows` itself when encryption is off or the
+ *   schema lists no field besides `mapping`
+ */
+async function decryptQueriedMappings(rows) {
+    const { decryptor } = mappingEncryption();
+    if (!decryptor) return rows;
+    return decryptor.decryptFieldsInBulk('IntegrationMapping', rows);
+}
+
+function mappingEncryption() {
+    if (plainMappingEncryption) return plainMappingEncryption;
+
+    const encryption = currentMappingEncryption();
+    if (encryption.encryptedOnWrite.length === 0) {
+        plainMappingEncryption = encryption;
+    }
+    return encryption;
+}
+
+function currentMappingEncryption() {
+    const config = getEncryptionConfig();
+    if (!config.enabled) return { encryptedOnWrite: [], decryptor: null };
+
+    loadCustomEncryptionSchema();
+    const encryptedOnWrite = getFieldsToEncryptOnWrite(
+        'IntegrationMapping'
+    ).filter((field) => field === 'mapping' || field.startsWith('mapping.'));
+    const decryptsBesidesMapping = getFieldsToDecryptOnRead(
+        'IntegrationMapping'
+    ).some((field) => field !== 'mapping');
+    const decryptor = decryptsBesidesMapping
+        ? createFieldEncryptionService(
+              new Cryptor({ shouldUseAws: config.method === 'kms' })
+          )
+        : null;
+    return { encryptedOnWrite, decryptor };
+}
+
+/** Test helper: forget a kept result. */
+function resetMappingEncryptionCheck() {
+    plainMappingEncryption = null;
+}
+
+module.exports = {
+    assertMappingWrittenUnencrypted,
+    decryptQueriedMappings,
+    getMappingFieldsEncryptedOnWrite,
+    resetMappingEncryptionCheck,
+};

package/database/encryption/logger.js

@@ -0,0 +1,82 @@
+/**
+ * Encryption Logger
+ *
+ * Centralized logging for encryption operations.
+ * Prevents sensitive data leakage in production logs.
+ */
+
+const LOG_LEVELS = {
+    DEBUG: 0,
+    INFO: 1,
+    WARN: 2,
+    ERROR: 3,
+};
+
+class EncryptionLogger {
+    constructor() {
+        this.minLevel = this._getMinLevel();
+    }
+
+    // FRIGG_LOG_LEVEL also takes TRACE and FATAL (ADR-048); this logger has
+    // no such levels, so they map to its nearest ones.
+    _getMinLevel() {
+        const level = (process.env.FRIGG_LOG_LEVEL || 'INFO').trim().toUpperCase();
+        const mapped = { TRACE: 'DEBUG', FATAL: 'ERROR' }[level] ?? level;
+        return LOG_LEVELS[mapped] ?? LOG_LEVELS.INFO;
+    }
+
+    _shouldLog(level) {
+        return LOG_LEVELS[level] >= this.minLevel;
+    }
+
+    _sanitize(message) {
+        // Remove potential key material or encrypted data from logs
+        if (typeof message === 'string') {
+            // Truncate long base64 strings that might be keys or encrypted data
+            return message.replace(/([A-Za-z0-9+/=]{50,})/g, (match) =>
+                `${match.substring(0, 10)}...[${match.length} chars]`
+            );
+        }
+        return message;
+    }
+
+    debug(message, ...args) {
+        if (this._shouldLog('DEBUG')) {
+            console.log(`[Frigg Debug]`, this._sanitize(message), ...args);
+        }
+    }
+
+    info(message, ...args) {
+        if (this._shouldLog('INFO')) {
+            console.log(`[Frigg]`, this._sanitize(message), ...args);
+        }
+    }
+
+    warn(message, ...args) {
+        if (this._shouldLog('WARN')) {
+            console.warn(`[Frigg]`, this._sanitize(message), ...args);
+        }
+    }
+
+    error(message, error) {
+        if (this._shouldLog('ERROR')) {
+            const sanitizedMessage = this._sanitize(message);
+
+            // In production, don't log stack traces with sensitive paths
+            const isProduction = process.env.STAGE === 'production';
+
+            if (error && !isProduction) {
+                console.error(`[Frigg]`, sanitizedMessage, error);
+            } else if (error) {
+                console.error(`[Frigg]`, sanitizedMessage, error.message);
+            } else {
+                console.error(`[Frigg]`, sanitizedMessage);
+            }
+        }
+    }
+}
+
+// Singleton instance
+const logger = new EncryptionLogger();
+
+module.exports = { logger };

package/database/encryption/prisma-encryption-extension.js

@@ -0,0 +1,241 @@
+/**
+ * Prisma Client Extension for transparent field-level encryption.
+ * Intercepts Prisma queries to encrypt on write and decrypt on read.
+ */
+
+const {
+    getEncryptedFields,
+    getFieldsToEncryptOnWrite,
+    getFieldsToDecryptOnRead,
+} = require('./encryption-schema-registry');
+const { FieldEncryptionService } = require('./field-encryption-service');
+
+/**
+ * The FieldEncryptionService the extension runs, with field paths from the
+ * encryption schema registry.
+ *
+ * @param {import('../../encrypt/Cryptor').Cryptor} cryptor
+ * @returns {FieldEncryptionService}
+ */
+function createFieldEncryptionService(cryptor) {
+    return new FieldEncryptionService({
+        cryptor,
+        schema: {
+            getEncryptedFields,
+            getFieldsToEncryptOnWrite,
+            getFieldsToDecryptOnRead,
+        },
+    });
+}
+
+function createEncryptionExtension({ cryptor, enabled = true }) {
+    if (!enabled) {
+        return (client) => client;
+    }
+
+    if (!cryptor) {
+        throw new Error(
+            'Cryptor instance required for encryption extension'
+        );
+    }
+
+    const encryptionService = createFieldEncryptionService(cryptor);
+
+    return {
+        name: 'frigg-field-encryption',
+        query: {
+            $allModels: {
+                async create({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async createMany({ model, args, query }) {
+                    if (args.data && Array.isArray(args.data)) {
+                        args.data =
+                            await encryptionService.encryptFieldsInBulk(
+                                model,
+                                args.data
+                            );
+                    } else if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async update({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async updateMany({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async upsert({ model, args, query }) {
+                    if (args.create) {
+                        args.create = await encryptionService.encryptFields(
+                            model,
+                            args.create
+                        );
+                    }
+
+                    if (args.update) {
+                        args.update = await encryptionService.encryptFields(
+                            model,
+                            args.update
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUnique({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findFirst({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findMany({ model, args, query }) {
+                    const results = await query(args);
+
+                    if (results && Array.isArray(results)) {
+                        return await encryptionService.decryptFieldsInBulk(
+                            model,
+                            results
+                        );
+                    }
+
+                    return results;
+                },
+
+                async delete({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async deleteMany({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async count({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async aggregate({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async groupBy({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async findFirstOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUniqueOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+            },
+        },
+    };
+}
+
+module.exports = { createEncryptionExtension, createFieldEncryptionService };

package/database/index.js

@@ -1,25 +1,25 @@
-const { mongoose } = require('./mongoose');
+/**
+ * Database Module Index
+ * Exports Prisma client, connection utilities, and repositories
+ *
+ * Note: Frigg uses the Repository pattern for data access.
+ * Use repositories for data operations:
+ * - SyncRepository (syncs/sync-repository.js)
+ * - IntegrationRepository (integrations/integration-repository.js)
+ * - CredentialRepository (credential/credential-repository.js)
+ * etc.
+ */
+
+const { prisma, connectPrisma, disconnectPrisma } = require('./prisma');
+const { TokenRepository } = require('../token/repositories/token-repository');
 const {
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-} = require('./mongo');
-const { IndividualUser } = require('./models/IndividualUser');
-const { OrganizationUser } = require('./models/OrganizationUser');
-const { State } = require('./models/State');
-const { Token } = require('./models/Token');
-const { UserModel } = require('./models/UserModel');
-const { WebsocketConnection } = require('./models/WebsocketConnection');
+    WebsocketConnectionRepository,
+} = require('../websocket/repositories/websocket-connection-repository');
 
 module.exports = {
-    mongoose,
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-    IndividualUser,
-    OrganizationUser,
-    State,
-    Token,
-    UserModel,
-    WebsocketConnection,
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    TokenRepository,
+    WebsocketConnectionRepository,
 };

package/database/prisma.js

@@ -0,0 +1,182 @@
+const {
+    createEncryptionExtension,
+} = require('./encryption/prisma-encryption-extension');
+const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const { logger } = require('./encryption/logger');
+const { Cryptor } = require('../encrypt/Cryptor');
+const config = require('./config');
+
+/**
+ * Ensures DATABASE_URL is set for MongoDB connections
+ * Falls back to MONGO_URI if DATABASE_URL is not set
+ * Infrastructure layer concern - maps legacy MONGO_URI to Prisma's expected DATABASE_URL
+ * 
+ * Note: This should only be called when DB_TYPE is 'mongodb' or 'documentdb'
+ */
+function ensureMongoDbUrl() {
+    // If DATABASE_URL is already set, use it
+    if (process.env.DATABASE_URL && process.env.DATABASE_URL.trim()) {
+        return;
+    }
+
+    // Fallback to MONGO_URI for backwards compatibility with DocumentDB deployments
+    if (process.env.MONGO_URI && process.env.MONGO_URI.trim()) {
+        process.env.DATABASE_URL = process.env.MONGO_URI;
+        logger.debug('Using MONGO_URI as DATABASE_URL for Mongo-compatible connection');
+        return;
+    }
+
+    // Neither is set - error
+    throw new Error(
+        'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB/DocumentDB'
+    );
+}
+
+function getEncryptionConfig() {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS =
+        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+    const hasAES =
+        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
+const prismaClientSingleton = () => {
+    let PrismaClient;
+
+    // Helper to try loading Prisma client from multiple locations
+    const loadPrismaClient = (dbType) => {
+        const paths = [
+            // Lambda layer location (when using Prisma Lambda layer)
+            `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
+            // Local development location (relative to core package)
+            `../generated/prisma-${dbType}`,
+        ];
+
+        for (const path of paths) {
+            try {
+                return require(path).PrismaClient;
+            } catch (err) {
+                // Continue to next path
+            }
+        }
+
+        throw new Error(
+            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(', ')}`
+        );
+    };
+
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        // Ensure DATABASE_URL is set (fallback to MONGO_URI if needed)
+        ensureMongoDbUrl();
+        PrismaClient = loadPrismaClient('mongodb');
+    } else if (config.DB_TYPE === 'postgresql') {
+        PrismaClient = loadPrismaClient('postgresql');
+    } else {
+        throw new Error(
+            `Unsupported database type: ${config.DB_TYPE}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+        );
+    }
+
+    let client = new PrismaClient({
+        log: process.env.PRISMA_LOG_LEVEL
+            ? process.env.PRISMA_LOG_LEVEL.split(',')
+            : ['error', 'warn'],
+        errorFormat: 'pretty',
+    });
+
+    const encryptionConfig = getEncryptionConfig();
+
+    if (encryptionConfig.enabled) {
+        try {
+            // Load custom encryption schema from appDefinition before creating extension
+            loadCustomEncryptionSchema();
+
+            const cryptor = new Cryptor({
+                shouldUseAws: encryptionConfig.method === 'kms',
+            });
+
+            client = client.$extends(
+                createEncryptionExtension({
+                    cryptor,
+                    enabled: true,
+                })
+            );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+            );
+        } catch (error) {
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
+        }
+    } else {
+        logger.info('Field-level encryption disabled');
+    }
+
+    return client;
+};
+
+const globalForPrisma = global;
+
+// Lazy initialization - only create singleton when first accessed
+function getPrismaClient() {
+    if (!globalForPrisma._prismaInstance) {
+        globalForPrisma._prismaInstance = prismaClientSingleton();
+    }
+    return globalForPrisma._prismaInstance;
+}
+
+// Export a getter for lazy initialization
+const prisma = new Proxy({}, {
+    get(target, prop) {
+        return getPrismaClient()[prop];
+    }
+});
+
+async function disconnectPrisma() {
+    await getPrismaClient().$disconnect();
+}
+
+async function connectPrisma() {
+    await getPrismaClient().$connect();
+
+    // Initialize MongoDB schema - ensure all collections exist
+    // Only run for MongoDB/DocumentDB (not PostgreSQL)
+    // This prevents "Cannot create namespace in multi-document transaction" errors
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        const { initializeMongoDBSchema } = require('./utils/mongodb-schema-init');
+        await initializeMongoDBSchema();
+    }
+
+    return getPrismaClient();
+}
+
+module.exports = {
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    getEncryptionConfig,
+    ensureMongoDbUrl, // Exported for testing
+};