@friggframework/core 2.0.0-next.12 → 2.0.0-next.121

package/encrypt/Cryptor.js

@@ -1,36 +1,41 @@
+/**
+ * Cryptor - Encryption Service Adapter
+ *
+ * Infrastructure Layer adapter for AWS KMS and local AES encryption.
+ * Provides envelope encryption pattern for field-level encryption.
+ *
+ * Envelope Encryption Pattern:
+ * 1. Generate Data Encryption Key (DEK) via KMS or locally
+ * 2. Encrypt field value with DEK using AES-256-CTR
+ * 3. Encrypt DEK with Master Key (KMS CMK or AES_KEY)
+ * 4. Return format: "keyId:encryptedText:encryptedKey"
+ *
+ * Benefits:
+ * - Reduces KMS API calls (unique DEK per operation)
+ * - Master key never leaves KMS
+ * - Enables key rotation without re-encrypting data
+ */
+
 const crypto = require('crypto');
-const AWS = require('aws-sdk');
-const { get, set } = require('lodash');
+const { KMSClient, GenerateDataKeyCommand, DecryptCommand } = require('@aws-sdk/client-kms');
 const aes = require('./aes');
 
-const hasValue = (a) => a !== undefined && a !== null && a !== '';
-
 class Cryptor {
-    constructor({ fields, shouldUseAws }) {
+    constructor({ shouldUseAws }) {
         this.shouldUseAws = shouldUseAws;
-        this.fields = fields;
-
-        this.permutationsByField = {};
-
-        for (const field of fields) {
-            this.permutationsByField[field] = this.calculatePermutations(
-                field.split('.')
-            );
-        }
     }
 
     async generateDataKey() {
         if (this.shouldUseAws) {
-            const kmsClient = new AWS.KMS();
-            const dataKey = await kmsClient
-                .generateDataKey({
-                    KeyId: process.env.KMS_KEY_ARN,
-                    KeySpec: 'AES_256',
-                })
-                .promise();
+            const kmsClient = new KMSClient({});
+            const command = new GenerateDataKeyCommand({
+                KeyId: process.env.KMS_KEY_ARN,
+                KeySpec: 'AES_256',
+            });
+            const dataKey = await kmsClient.send(command);
 
             const keyId = Buffer.from(dataKey.KeyId).toString('base64');
-            const encryptedKey = dataKey.CiphertextBlob.toString('base64');
+            const encryptedKey = Buffer.from(dataKey.CiphertextBlob).toString('base64');
             const plaintext = dataKey.Plaintext;
             return { keyId, encryptedKey, plaintext };
         }
@@ -56,7 +61,7 @@ class Cryptor {
         const key = availableKeys[keyId];
 
         if (!key) {
-            throw new Error(`No encryption key found with ID "${keyId}"`);
+            throw new Error('Encryption key not found');
         }
 
         return key;
@@ -64,13 +69,12 @@ class Cryptor {
 
     async decryptDataKey(keyId, encryptedKey) {
         if (this.shouldUseAws) {
-            const kmsClient = new AWS.KMS();
-            const dataKey = await kmsClient
-                .decrypt({
-                    KeyId: keyId,
-                    CiphertextBlob: encryptedKey,
-                })
-                .promise();
+            const kmsClient = new KMSClient({});
+            const command = new DecryptCommand({
+                KeyId: keyId,
+                CiphertextBlob: encryptedKey,
+            });
+            const dataKey = await kmsClient.send(command);
 
             return dataKey.Plaintext;
         }
@@ -79,146 +83,9 @@ class Cryptor {
         return aes.decrypt(encryptedKey, key);
     }
 
-    // If the field has a value in the document, apply async function f to that field.
-    async setInDocument(doc, f) {
-        // Use the Mongoose document get/set when available (not for insertMany)
-        if (doc.get) {
-            for (const field of this.fields) {
-                const value = doc.get(field);
-                if (hasValue(value)) {
-                    doc.set(field, await f(value));
-                }
-            }
-            return;
-        }
-
-        // Otherwise use permutations.
-        for (const field of this.fields) {
-            const updatedDoc = await this.applyAll(doc, field, f);
-            Object.assign(doc, updatedDoc);
-        }
-    }
-
-    // Calculate all possible permutations for a nested field.  For example a
-    // field "deeply.nested.field" might be referred to in a Mongo query as
-    // { deeply: { 'nested.field': {} } } or { 'deeply.nested.field': {} }
-    // etc.  For a given path, this gives all path parts to check in a format
-    // that lodash understands when using get and set with an array of path
-    // parts e.g. get(o, ['deeply', 'nested.parts'])
-    calculatePermutations = (parts) => {
-        if (!parts.length) return [];
-        if (parts.length === 1) return [parts];
-
-        const combos = [];
-
-        for (let i = 0; i < parts.length; i += 1) {
-            const frontPath = parts.slice(0, i + 1).join('.');
-            const rest = parts.slice(i + 1);
-
-            if (rest.length) {
-                combos.push(
-                    ...this.calculatePermutations(rest).map((child) => [
-                        frontPath,
-                        ...child,
-                    ])
-                );
-            } else {
-                combos.push([frontPath]);
-            }
-        }
-
-        return combos;
-    };
-
-    // Encrypt all possible permutations of a field (possibly nested), if there
-    // is a value at that path permutation.
-    async applyAll(o, field, f) {
-        const clone = { ...o };
-        const permutations = this.permutationsByField[field];
-
-        for (const path of permutations) {
-            const value = get(o, path);
-            if (hasValue(value)) {
-                set(clone, path, await f(value));
-            }
-        }
-
-        return clone;
-    }
-
-    async processFieldsInDocuments(docs, f) {
-        const promises = docs
-            .filter(Boolean)
-            .flatMap((doc) => this.setInDocument(doc, f));
-
-        return Promise.all(promises);
-    }
-
-    async encryptFieldsInDocuments(docs) {
-        await this.processFieldsInDocuments(docs, this.encrypt.bind(this));
-    }
-
-    async decryptFieldsInDocuments(docs) {
-        await this.processFieldsInDocuments(docs, this.decrypt.bind(this));
-    }
-
-    async encryptFieldsInQuery(query) {
-        for (const field of this.fields) {
-            const originalUpdate = query.getUpdate();
-            const updatedUpdate = await this.applyAll(
-                originalUpdate,
-                field,
-                this.encrypt.bind(this)
-            );
-
-            if (originalUpdate.$set) {
-                const updatedSetUpdate = await this.applyAll(
-                    originalUpdate.$set,
-                    field,
-                    this.encrypt.bind(this)
-                );
-                updatedUpdate.$set = { ...updatedSetUpdate };
-            }
-
-            if (originalUpdate.$setOnInsert) {
-                const updatedSetOnInsertUpdate = await this.applyAll(
-                    originalUpdate.$setOnInsert,
-                    field,
-                    this.encrypt.bind(this)
-                );
-                updatedUpdate.$setOnInsert = { ...updatedSetOnInsertUpdate };
-            }
-
-            query.setUpdate(updatedUpdate);
-        }
-    }
-
-    expectNotToUpdateManyEncrypted(update) {
-        for (const field of this.fields) {
-            if (update.$set && hasValue(update.$set[field])) {
-                throw new Error(
-                    'Attempted to update encrypted field of multiple documents'
-                );
-            }
-
-            if (update.$setOnInsert && hasValue(update.$setOnInsert[field])) {
-                throw new Error(
-                    'Attempted to update encrypted field of multiple documents'
-                );
-            }
-
-            if (hasValue(update[field])) {
-                throw new Error(
-                    'Attempted to update encrypted field of multiple documents'
-                );
-            }
-        }
-    }
-
     async encrypt(text) {
         const { keyId, encryptedKey, plaintext } = await this.generateDataKey();
         const encryptedText = aes.encrypt(text, plaintext);
-
         return `${keyId}:${encryptedText}:${encryptedKey}`;
     }
 
@@ -228,7 +95,6 @@ class Cryptor {
         const encryptedText = `${split[1]}:${split[2]}`;
         const encryptedKey = Buffer.from(split[3], 'base64');
         const plaintext = await this.decryptDataKey(keyId, encryptedKey);
-
         return aes.decrypt(encryptedText, plaintext);
     }
 }

package/encrypt/index.js

@@ -1,4 +1,3 @@
-const { Encrypt } = require('./encrypt');
 const { Cryptor } = require('./Cryptor');
 
-module.exports = { Encrypt, Cryptor };
+module.exports = { Cryptor };

package/errors/client-safe-error.js

@@ -0,0 +1,26 @@
+const { BaseError } = require('./base-error');
+
+/**
+ * ClientSafeError - An error that is safe to expose to end users
+ *
+ * Use this error class when the error message does not contain sensitive
+ * implementation details and can be safely shown to users.
+ *
+ * Examples:
+ * - "Invalid Token: Token is expired"
+ * - "User not found"
+ * - "Invalid credentials"
+ *
+ * @param {string} message - The user-safe error message
+ * @param {number} statusCode - HTTP status code (default: 400)
+ * @param {object} options - Additional error options (cause, etc.)
+ */
+class ClientSafeError extends BaseError {
+    constructor(message, statusCode = 400, options) {
+        super(message, options);
+        this.statusCode = statusCode;
+        this.isClientSafe = true;
+    }
+}
+
+module.exports = { ClientSafeError };

package/errors/fetch-error.js

@@ -1,74 +1,76 @@
 const { BaseError } = require('./base-error');
-const { stripIndent } = require('common-tags');
-
-// TODO hide header values
+const { redactUrl, scrubString } = require('../logs/redact');
 
 // Parameters names here are based on fetch.  See:
 // https://developer.mozilla.org/en-US/docs/Web/API/fetch
 
-class FetchError extends BaseError {
-    response = null;
-
-    constructor(options = {}) {
-        const { resource, init, response, responseBody } = options;
-        const method = init?.method ?? 'GET';
-        const initText = init
-            ? init.body instanceof URLSearchParams
-                ? (() => {
-                      init.body = init.body.toString();
-                      return JSON.stringify({ init }, null, 2);
-                  })()
-                : JSON.stringify({ init }, null, 2)
-            : '';        
+function resourceUrl(resource) {
+    if (resource === undefined || resource === null) return '';
+    if (typeof resource === 'object' && typeof resource.url === 'string') {
+        return redactUrl(resource.url);
+    }
+    return redactUrl(resource);
+}
 
-        let responseBodyText = '<response body is unavailable>';
-        if (typeof responseBody === 'string') {
-            responseBodyText = responseBody;
-        } else if (responseBody) {
-            responseBodyText = JSON.stringify(responseBody, null, 2);
-        }
+// node-fetch messages can contain part of the response body.
+// Use a fixed phrase instead of the original message.
+const NODE_FETCH_TYPE_PHRASES = {
+    'invalid-json': 'invalid json response body',
+};
 
-        const responseHeaders = {};
-        if (response?.headers) {
-            for (const [key, value] of response.headers) {
-                responseHeaders[key] = value;
-            }
-        }
+function causeLabel(cause) {
+    if (!cause || typeof cause !== 'object') return '';
+    const label = cause.code ?? cause.name;
+    const scrubbedLabel =
+        label === undefined || label === null ? '' : scrubString(String(label));
+    const phrase = Object.hasOwn(NODE_FETCH_TYPE_PHRASES, cause.type)
+        ? NODE_FETCH_TYPE_PHRASES[cause.type]
+        : '';
+    return [scrubbedLabel, phrase].filter(Boolean).join(': ');
+}
 
-        const responseHeaderText = response
-            ? JSON.stringify({ headers: responseHeaders }, null, 2)
-            : '';
+function buildMessage({ method, url, response, cause }) {
+    const outcome = response
+        ? response.status === undefined || response.status === null
+            ? ''
+            : String(response.status)
+        : causeLabel(cause);
+    return [method, url, outcome].filter(Boolean).join(' ');
+}
 
-        const messageParts = [
-            stripIndent`
-                -----------------------------------------------------
-                An error ocurred while fetching an external resource.
-                -----------------------------------------------------
-                >>> Request Details >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
-                ${method} ${resource}
-            `,
-            initText,
-            stripIndent`
-                <<< Response Details <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
-                ${response?.status} ${response?.statusText}
-            `,
-            responseHeaderText,
-            responseBodyText,
-            stripIndent`
-                -----------------------------------------------------
-                Stack Trace:
-            `,
-        ];
+class FetchError extends BaseError {
+    constructor({ resource, init, response, cause, responseBody, body } = {}) {
+        const method = String(init?.method ?? 'GET').toUpperCase();
+        const url = resourceUrl(resource);
+        super(
+            buildMessage({ method, url, response, cause }),
+            cause ? { cause } : undefined
+        );
 
-        super(messageParts.filter(Boolean).join('\n'));
-        
-        this.response = response;
+        this.statusCode = response?.status;
+        this.method = method;
+        this.url = url;
+        Object.defineProperty(this, 'response', {
+            value: response ?? null,
+            enumerable: false,
+            writable: true,
+            configurable: true,
+        });
+        Object.defineProperty(this, 'body', {
+            value: responseBody ?? body,
+            enumerable: false,
+            writable: true,
+            configurable: true,
+        });
     }
 
     static async create(options = {}) {
         const { response } = options;
-        let responseBody = response?.bodyUsed ? null : await response?.text();
-        if (!responseBody && options.body) responseBody = options.body;
+        let responseBody =
+            response && !response.bodyUsed && typeof response.text === 'function'
+                ? await response.text()
+                : null;
+        if (!responseBody) responseBody = options.responseBody ?? options.body;
         return new FetchError({ ...options, responseBody });
     }
 }

package/errors/index.js

@@ -5,6 +5,10 @@ const {
     RequiredPropertyError,
     ParameterTypeError,
 } = require('./validation-errors');
+const { ClientSafeError } = require('./client-safe-error');
+const {
+    MappingAlreadyExistsError,
+} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -12,4 +16,6 @@ module.exports = {
     HaltError,
     RequiredPropertyError,
     ParameterTypeError,
+    ClientSafeError,
+    MappingAlreadyExistsError,
 };

package/errors/mapping-already-exists-error.js

@@ -0,0 +1,14 @@
+const { BaseError } = require('./base-error');
+
+class MappingAlreadyExistsError extends BaseError {
+    constructor(integrationId, sourceId, ...errorOptions) {
+        super(
+            `Mapping already exists for integration ${integrationId} and sourceId ${sourceId}`,
+            ...errorOptions
+        );
+        this.integrationId = integrationId;
+        this.sourceId = sourceId;
+    }
+}
+
+module.exports = { MappingAlreadyExistsError };

package/generated/prisma-mongodb/client.d.ts

@@ -0,0 +1 @@
+export * from "./index"

package/generated/prisma-mongodb/client.js

@@ -0,0 +1,5 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!!
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+module.exports = { ...require('.') }

package/generated/prisma-mongodb/default.d.ts

@@ -0,0 +1 @@
+export * from "./index"

package/generated/prisma-mongodb/default.js

@@ -0,0 +1,5 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!!
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+module.exports = { ...require('#main-entry-point') }

package/generated/prisma-mongodb/edge.d.ts

@@ -0,0 +1 @@
+export * from "./default"