@friggframework/core 2.0.0-next.12 → 2.0.0-next.121

package/handlers/database-migration-handler.js

@@ -0,0 +1,236 @@
+/**
+ * Database Migration Handler for AWS Lambda
+ * 
+ * Executes Prisma migrations in a Lambda environment.
+ * Based on AWS best practices for running migrations in serverless environments.
+ * 
+ * Supported Commands:
+ * - deploy: Apply pending migrations to the database (production-safe)
+ * - reset: Reset database and apply all migrations (DANGEROUS - dev only)
+ * 
+ * Usage:
+ *   // Via Lambda invoke
+ *   {
+ *     "command": "deploy"  // or "reset"
+ *   }
+ * 
+ * Requirements:
+ * - Prisma CLI must be included in deployment or Lambda layer
+ * - DATABASE_URL environment variable must be set
+ * - VPC configuration for Aurora access
+ * 
+ * Reference: https://www.prisma.io/docs/guides/deployment/deployment-guides/deploying-to-aws-lambda
+ */
+
+const { execFile } = require('child_process');
+const path = require('path');
+const { getLogger } = require('../logs');
+
+const log = getLogger('frigg.database.migration');
+
+/**
+ * Execute Prisma migration command
+ * 
+ * @param {string} command - Migration command ('deploy' or 'reset')
+ * @param {string} schemaPath - Path to Prisma schema file
+ * @returns {Promise<number>} Exit code
+ */
+async function executePrismaMigration(command, schemaPath) {
+    console.log(`Executing Prisma migration: ${command}`);
+    console.log(`Schema path: ${schemaPath}`);
+    console.log(`Database URL: ${process.env.DATABASE_URL ? '[SET]' : '[NOT SET]'}`);
+
+    return new Promise((resolve, reject) => {
+        // Build command arguments
+        const args = ['migrate', command];
+        
+        // Add command-specific options
+        if (command === 'reset') {
+            args.push('--force');           // Skip confirmation prompt
+            args.push('--skip-generate');   // Skip client generation (already done in layer)
+        }
+
+        // Add schema path if provided
+        if (schemaPath) {
+            args.push('--schema', schemaPath);
+        }
+
+        console.log(`Running: prisma ${args.join(' ')}`);
+        
+        // Execute Prisma CLI
+        execFile(
+            path.resolve('./node_modules/prisma/build/index.js'),
+            args,
+            {
+                env: {
+                    ...process.env,
+                    // Ensure Prisma uses the correct binary target
+                    PRISMA_CLI_BINARY_TARGETS: 'rhel-openssl-3.0.x',
+                }
+            },
+            (error, stdout, stderr) => {
+                // Log all output
+                if (stdout) {
+                    console.log('STDOUT:', stdout);
+                }
+                if (stderr) {
+                    console.error('STDERR:', stderr);
+                }
+
+                if (error) {
+                    console.error(`Migration ${command} exited with error:`, error.message);
+                    console.error(`Exit code: ${error.code || 1}`);
+                    resolve(error.code || 1);
+                } else {
+                    console.log(`Migration ${command} completed successfully`);
+                    resolve(0);
+                }
+            }
+        );
+    });
+}
+
+/**
+ * Validate migration command
+ */
+function validateCommand(command) {
+    const validCommands = ['deploy', 'reset'];
+    
+    if (!validCommands.includes(command)) {
+        throw new Error(
+            `Invalid migration command: "${command}". ` +
+            `Valid commands are: ${validCommands.join(', ')}`
+        );
+    }
+
+    // Extra validation for dangerous commands
+    if (command === 'reset') {
+        const stage = process.env.STAGE || process.env.NODE_ENV;
+        if (stage === 'production' || stage === 'prod') {
+            throw new Error(
+                'BLOCKED: "reset" command is not allowed in production environment. ' +
+                'This command would delete all data. Use "deploy" instead.'
+            );
+        }
+        console.warn('⚠️  WARNING: "reset" will DELETE all data and reset the database!');
+    }
+}
+
+/**
+ * Determine which Prisma schema to use based on database type
+ */
+function getSchemaPath() {
+    // In Lambda, schemas are in @friggframework/core/generated/
+    const baseSchemaPath = './node_modules/@friggframework/core/generated';
+    
+    // Check if Postgres is enabled
+    if (process.env.DATABASE_URL?.includes('postgresql') || process.env.DATABASE_URL?.includes('postgres')) {
+        const schemaPath = `${baseSchemaPath}/prisma-postgresql/schema.prisma`;
+        console.log(`Using PostgreSQL schema: ${schemaPath}`);
+        return schemaPath;
+    }
+    
+    // Check if MongoDB is enabled
+    if (process.env.DATABASE_URL?.includes('mongodb')) {
+        const schemaPath = `${baseSchemaPath}/prisma-mongodb/schema.prisma`;
+        console.log(`Using MongoDB schema: ${schemaPath}`);
+        return schemaPath;
+    }
+
+    // Default to PostgreSQL
+    console.log('DATABASE_URL not set or database type unknown, defaulting to PostgreSQL');
+    return `${baseSchemaPath}/prisma-postgresql/schema.prisma`;
+}
+
+/**
+ * Lambda handler for database migrations
+ * 
+ * @param {Object} event - Lambda event
+ * @param {string} event.command - Migration command ('deploy' or 'reset')
+ * @param {Object} context - Lambda context
+ * @returns {Promise<Object>} Migration result
+ */
+exports.handler = async (event, context) => {
+    const startTime = Date.now();
+    
+    console.log('='.repeat(60));
+    console.log('Database Migration Handler');
+    console.log('='.repeat(60));
+    log.info('Database migration invoked', {
+        eventName: 'frigg.database.migration.invoked',
+        migrationId: event.migrationId,
+        dbType: process.env.DB_TYPE,
+        targetStage: process.env.STAGE,
+        action: event.command || 'deploy',
+    });
+    console.log('Context:', JSON.stringify({
+        functionName: context.functionName,
+        functionVersion: context.functionVersion,
+        memoryLimitInMB: context.memoryLimitInMB,
+        logGroupName: context.logGroupName,
+    }, null, 2));
+    
+    try {
+        // Get migration command (default to 'deploy')
+        const command = event.command || 'deploy';
+        
+        // Validate command
+        validateCommand(command);
+        
+        // Check required environment variables
+        if (!process.env.DATABASE_URL) {
+            throw new Error(
+                'DATABASE_URL environment variable is not set. ' +
+                'Cannot connect to database for migrations.'
+            );
+        }
+        
+        // Determine schema path
+        const schemaPath = getSchemaPath();
+        
+        // Execute migration
+        const exitCode = await executePrismaMigration(command, schemaPath);
+        
+        const duration = Date.now() - startTime;
+        
+        if (exitCode === 0) {
+            const result = {
+                success: true,
+                command,
+                message: `Migration ${command} completed successfully`,
+                duration: `${duration}ms`,
+                timestamp: new Date().toISOString(),
+            };
+            
+            console.log('='.repeat(60));
+            console.log('Migration completed successfully');
+            console.log(JSON.stringify(result, null, 2));
+            console.log('='.repeat(60));
+            
+            return result;
+        } else {
+            throw new Error(`Migration ${command} failed with exit code ${exitCode}`);
+        }
+        
+    } catch (error) {
+        const duration = Date.now() - startTime;
+        
+        console.error('='.repeat(60));
+        console.error('Migration failed');
+        console.error('Error:', error.message);
+        console.error('Stack:', error.stack);
+        console.error('='.repeat(60));
+        
+        const errorResult = {
+            success: false,
+            command: event.command || 'unknown',
+            error: error.message,
+            duration: `${duration}ms`,
+            timestamp: new Date().toISOString(),
+        };
+        
+        // Return error (don't throw) so Lambda doesn't retry
+        return errorResult;
+    }
+};
+

package/handlers/integration-event-dispatcher.js

@@ -0,0 +1,68 @@
+const { instrumentHandler } = require('../telemetry/instrument-handler');
+
+/**
+ * Lightweight dispatcher that executes integration event handlers.
+ * @param {import('../integrations/integration-base')} integrationInstance Pre-instantiated integration.
+ */
+class IntegrationEventDispatcher {
+    constructor(integrationInstance) {
+        if (!integrationInstance) {
+            throw new Error('Integration instance is required');
+        }
+        this.integrationInstance = integrationInstance;
+    }
+
+    async dispatchHttp({ event, req, res, next }) {
+        return this._dispatch(event, (instance, handler) =>
+            handler.call(instance, { req, res, next })
+        );
+    }
+
+    async dispatchJob({ event, data, context, delivery }) {
+        return this._dispatch(event, (instance, handler) =>
+            handler.call(instance, { data, context, delivery })
+        );
+    }
+
+    /**
+     * Resolve + invoke a handler, auto-instrumented. This
+     * is the seam for queue/webhook/defined-route dispatch; the `this.on` path
+     * (user actions, lifecycle) is instrumented in IntegrationBase.send().
+     */
+    async _dispatch(event, invoke) {
+        const instance = this.integrationInstance;
+        const handler = this.findEventHandler(instance, event);
+
+        if (!handler) {
+            const name =
+                instance.constructor?.Definition?.name || 'integration';
+            throw new Error(`Event ${event} not registered for ${name}`);
+        }
+
+        const eventDef = this.findEventDef(instance, event);
+
+        return instrumentHandler(
+            instance.telemetry,
+            { event, eventType: eventDef?.type },
+            () => invoke(instance, handler)
+        );
+    }
+
+    findEventHandler(integration, event) {
+        return this.findEventDef(integration, event)?.handler || null;
+    }
+
+    findEventDef(integration, event) {
+        if (integration.events && integration.events[event]) {
+            return integration.events[event];
+        }
+
+        if (integration.defaultEvents && integration.defaultEvents[event]) {
+            return integration.defaultEvents[event];
+        }
+
+        return null;
+    }
+}
+
+module.exports = { IntegrationEventDispatcher };

package/handlers/middleware/admin-auth.js

@@ -0,0 +1,73 @@
+const crypto = require('node:crypto');
+
+/**
+ * Admin Auth Middleware
+ *
+ * Shared authentication middleware for all admin endpoints:
+ * - /admin/db-migrate/*
+ * - /admin/scripts/*
+ *
+ * Uses simple ENV-based API key validation.
+ * Expects: x-frigg-admin-api-key header
+ */
+
+/**
+ * Constant-time comparison of two secrets. Hashing both to a fixed-length
+ * digest first means timingSafeEqual never throws on length mismatch and the
+ * comparison leaks neither the key nor its length.
+ * @private
+ */
+function secretsMatch(provided, expected) {
+    const providedHash = crypto
+        .createHash('sha256')
+        .update(String(provided))
+        .digest();
+    const expectedHash = crypto
+        .createHash('sha256')
+        .update(String(expected))
+        .digest();
+    return crypto.timingSafeEqual(providedHash, expectedHash);
+}
+
+/**
+ * Validate admin API key from request header
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+function validateAdminApiKey(req, res, next) {
+    const expectedKey = process.env.ADMIN_API_KEY;
+
+    // Check if admin API key is configured
+    if (!expectedKey) {
+        console.error('ADMIN_API_KEY environment variable not configured');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Admin API key not configured',
+        });
+    }
+
+    const apiKey = req.headers['x-frigg-admin-api-key'];
+
+    // Check if header is present
+    if (!apiKey) {
+        console.error('Missing x-frigg-admin-api-key header');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'x-frigg-admin-api-key header required',
+        });
+    }
+
+    // Validate key using a constant-time comparison
+    if (!secretsMatch(apiKey, expectedKey)) {
+        console.error('Invalid admin API key provided');
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Invalid admin API key',
+        });
+    }
+
+    next();
+}
+
+module.exports = { validateAdminApiKey };