@friggframework/core 2.0.0-next.12 → 2.0.0-next.121

package/integrations/utils/assert-entity-ids-input.js

@@ -0,0 +1,42 @@
+/**
+ * Throws INVALID_INTEGRATION_DATA unless an integration id and a non-empty
+ * list of entity ids are given.
+ * @param {string} integrationId
+ * @param {string[]} entityIds
+ */
+function assertEntityIdsInput(integrationId, entityIds) {
+    if (!integrationId || !Array.isArray(entityIds) || entityIds.length === 0) {
+        const error = new Error(
+            'integrationId and a non-empty entityIds array are required'
+        );
+        error.code = 'INVALID_INTEGRATION_DATA';
+        throw error;
+    }
+}
+
+function integrationNotFound(integrationId) {
+    const error = new Error(`Integration ${integrationId} not found`);
+    error.code = 'INTEGRATION_NOT_FOUND';
+    return error;
+}
+
+/**
+ * Loads an integration, mapping the repositories' "not found" error to
+ * INTEGRATION_NOT_FOUND. Any other failure (connection, invalid id) is
+ * rethrown unchanged.
+ * @param {Object} integrationRepository
+ * @param {string} integrationId
+ * @returns {Promise<Object>} The integration record.
+ */
+async function loadIntegration(integrationRepository, integrationId) {
+    try {
+        return await integrationRepository.findIntegrationById(integrationId);
+    } catch (error) {
+        if (/^Integration with id .* not found$/.test(error?.message)) {
+            throw integrationNotFound(integrationId);
+        }
+        throw error;
+    }
+}
+
+module.exports = { assertEntityIdsInput, integrationNotFound, loadIntegration };

package/integrations/utils/map-integration-dto.js

@@ -0,0 +1,37 @@
+/**
+ * @param {import('../integration').Integration} integration
+ * Convert an Integration domain instance to a plain DTO suitable for JSON responses.
+ * Can also accept a plain object with an 'options' property to avoid unnecessary instantiation.
+ */
+function mapIntegrationClassToIntegrationDTO(integration) {
+    if (!integration) return null;
+
+    return {
+        id: integration.id,
+        userId: integration.userId,
+        entities: integration.entities,
+        config: integration.config,
+        status: integration.status,
+        version: integration.version,
+        messages: integration.messages,
+        userActions: integration.userActions,
+        options: integration.options || (typeof integration.getOptionDetails === 'function' ? integration.getOptionDetails() : null),
+    };
+}
+
+
+const getModulesDefinitionFromIntegrationClasses = (integrationClasses) => {
+    return [
+        ...new Set(
+            integrationClasses
+                .map((integration) =>
+                    Object.values(integration.Definition.modules).map(
+                        (module) => module.definition
+                    )
+                )
+                .flat()
+        ),
+    ];
+};
+
+module.exports = { mapIntegrationClassToIntegrationDTO, getModulesDefinitionFromIntegrationClasses }; 

package/jest-global-setup-noop.js

@@ -0,0 +1,3 @@
+module.exports = async function noopGlobalSetup() {
+    // No global setup required for unit tests.
+};

package/jest-global-teardown-noop.js

@@ -0,0 +1,3 @@
+module.exports = async function noopGlobalTeardown() {
+    // No global teardown required for unit tests.
+};

package/jest.config.js

@@ -18,4 +18,6 @@ module.exports = {
 
     // A path to a module which exports an async function that is triggered once after all test suites
     globalTeardown: './jest-teardown.js',
+
+    setupFilesAfterEnv: ['./logs/jest-logger-setup.js'],
 };

package/logs/.eslintrc.json

@@ -1,3 +1,28 @@
 {
-    "extends": "@friggframework/eslint-config"
+    "extends": "@friggframework/eslint-config",
+    "rules": {
+        "no-console": "error",
+        "no-restricted-syntax": [
+            "error",
+            {
+                "selector": "CallExpression[callee.object.object.name='process'][callee.object.property.name=/^(stdout|stderr)$/][callee.property.name='write']",
+                "message": "Write through the logger; only logs/sinks.js writes to fd 1"
+            }
+        ]
+    },
+    "overrides": [
+        {
+            "files": ["*.test.js", "__fixtures__/**", "jest-logger-setup.js"],
+            "rules": {
+                "no-console": "off",
+                "no-restricted-syntax": "off"
+            }
+        },
+        {
+            "files": ["sinks.js"],
+            "rules": {
+                "no-restricted-syntax": "off"
+            }
+        }
+    ]
 }

package/logs/__fixtures__/events.js

@@ -0,0 +1,82 @@
+const { SECRETS } = require('./secrets');
+
+function httpApiV2Event() {
+    return {
+        version: '2.0',
+        routeKey: 'GET /api/authorize',
+        rawPath: '/api/authorize',
+        rawQueryString: `code=${SECRETS.oauthCode}&state=abc123&api_key=${SECRETS.apiKeyQuery}`,
+        cookies: [`session=${SECRETS.cookie}`],
+        headers: {
+            'x-frigg-api-key': SECRETS.friggApiKey,
+            authorization: `Bearer ${SECRETS.bearer}`,
+            cookie: `session=${SECRETS.cookie}`,
+            'content-type': 'application/json',
+        },
+        queryStringParameters: {
+            code: SECRETS.oauthCode,
+            state: 'abc123',
+            api_key: SECRETS.apiKeyQuery,
+        },
+        requestContext: {
+            http: { method: 'GET', path: '/api/authorize', sourceIp: '203.0.113.9' },
+            requestId: 'req-v2-1',
+        },
+        body: JSON.stringify({
+            code: SECRETS.oauthCode,
+            code_verifier: SECRETS.codeVerifier,
+            client_secret: SECRETS.clientSecret,
+        }),
+        isBase64Encoded: false,
+    };
+}
+
+function restV1Event() {
+    return {
+        resource: '/api/{proxy+}',
+        path: '/api/integrations',
+        httpMethod: 'POST',
+        headers: {
+            Authorization: `Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`,
+            'X-Frigg-Api-Key': SECRETS.friggApiKey,
+            Cookie: `session=${SECRETS.cookie}`,
+        },
+        multiValueHeaders: {
+            Authorization: [`Basic ${Buffer.from(`user:${SECRETS.password}`).toString('base64')}`],
+            'Set-Cookie': [`session=${SECRETS.cookie}`],
+        },
+        queryStringParameters: { access_token: SECRETS.accessToken },
+        multiValueQueryStringParameters: { access_token: [SECRETS.accessToken] },
+        requestContext: { requestId: 'req-v1-1', stage: 'dev' },
+        body: JSON.stringify({ password: SECRETS.password, refresh_token: SECRETS.refreshToken }),
+        isBase64Encoded: false,
+    };
+}
+
+function sqsEvent() {
+    return {
+        Records: [
+            {
+                messageId: 'msg-1',
+                receiptHandle: 'receipt-1',
+                attributes: { ApproximateReceiveCount: '1' },
+                body: JSON.stringify({
+                    event: 'PROCESS_BATCH',
+                    data: {
+                        processId: 'proc-1',
+                        integrationId: 'int-1',
+                        access_token: SECRETS.accessToken,
+                        credentials: { client_secret: SECRETS.clientSecret },
+                    },
+                }),
+            },
+            {
+                messageId: 'msg-2',
+                attributes: { ApproximateReceiveCount: '3' },
+                body: `not json Authorization: Bearer ${SECRETS.bearer}`,
+            },
+        ],
+    };
+}
+
+module.exports = { httpApiV2Event, restV1Event, sqsEvent };

package/logs/__fixtures__/matchers.js

@@ -0,0 +1,45 @@
+const WINDOW = 8;
+
+function forms(secret) {
+    return [
+        secret,
+        encodeURIComponent(secret),
+        Buffer.from(secret).toString('base64'),
+    ];
+}
+
+function windows(value) {
+    if (value.length <= WINDOW) return [value];
+    const result = [];
+    for (let i = 0; i + WINDOW <= value.length; i += 1) {
+        result.push(value.slice(i, i + WINDOW));
+    }
+    return result;
+}
+
+function findSecretWindow(received, secrets) {
+    const haystack =
+        typeof received === 'string' ? received : JSON.stringify(received);
+    for (const secret of secrets) {
+        for (const form of forms(secret)) {
+            for (const w of windows(form)) {
+                if (haystack.includes(w)) return { secret, window: w };
+            }
+        }
+    }
+    return null;
+}
+
+function toContainNoSecretWindow(received, secrets) {
+    const list = Array.isArray(secrets) ? secrets : Object.values(secrets);
+    const hit = findSecretWindow(received, list);
+    return {
+        pass: hit === null,
+        message: () =>
+            hit
+                ? `expected no ${WINDOW}-char window of a secret, found "${hit.window}" (from a secret of length ${hit.secret.length})`
+                : 'expected a secret window, found none',
+    };
+}
+
+module.exports = { toContainNoSecretWindow, findSecretWindow, WINDOW };

package/logs/__fixtures__/secrets.js

@@ -0,0 +1,59 @@
+// Fake values, generated at load time so secret scanners find no literal in
+// the source. A fixed seed per name keeps every run identical.
+const MIXED = 'BCDFGHJKLMNPQRSTVWXZbcdfghjkmnpqrstvwxz23456789';
+const HEX = '0123456789abcdef';
+
+function seededRandom(name) {
+    let seed = [...name].reduce(
+        (h, c) => Math.imul(h ^ c.charCodeAt(0), 16777619),
+        2166136261
+    );
+    return () => {
+        seed = (seed + 0x6d2b79f5) | 0;
+        let t = Math.imul(seed ^ (seed >>> 15), seed | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+
+function draw(name, alphabet, length) {
+    const next = seededRandom(name);
+    let out = '';
+    for (let i = 0; i < length; i += 1) {
+        out += alphabet[Math.floor(next() * alphabet.length)];
+    }
+    return out;
+}
+
+// The fixed 'Zq' + 'B7k' start puts upper case, lower case and a digit in every token.
+function fakeToken(name, length = 28) {
+    return `ZqB7k${draw(name, MIXED, length - 5)}`;
+}
+
+const base64url = (value) => Buffer.from(value).toString('base64url');
+
+const SECRETS = Object.freeze({
+    bearer: fakeToken('bearer'),
+    apiKeyQuery: fakeToken('apiKeyQuery'),
+    friggApiKey: fakeToken('friggApiKey'),
+    cookie: fakeToken('cookie'),
+    oauthCode: fakeToken('oauthCode'),
+    codeVerifier: fakeToken('codeVerifier'),
+    password: fakeToken('password'),
+    clientSecret: fakeToken('clientSecret'),
+    accessToken: fakeToken('accessToken'),
+    refreshToken: fakeToken('refreshToken'),
+    idToken: fakeToken('idToken'),
+    hashword: fakeToken('hashword'),
+    dbPassword: fakeToken('dbPassword'),
+    signature: fakeToken('signature'),
+    jwt: [
+        base64url(JSON.stringify({ alg: 'HS256' })),
+        base64url(JSON.stringify({ sub: `fake-${draw('jwtSub', MIXED, 8)}` })),
+        base64url(draw('jwtSig', MIXED, 24)),
+    ].join('.'),
+    hexToken: draw('hexToken', HEX, 40),
+    base64Run: Buffer.from(draw('base64Run', MIXED, 42)).toString('base64'),
+});
+
+module.exports = { SECRETS, fakeToken };

package/logs/__fixtures__/vectors.js

@@ -0,0 +1,329 @@
+// ADR-048 §14 redaction vectors. Each vector is one log call that carries
+// secrets; the suite asserts that no 8-char window of them reaches a record.
+const { SECRETS: S, fakeToken } = require('./secrets');
+const { httpApiV2Event, restV1Event, sqsEvent } = require('./events');
+const { summarizeLambdaEvent } = require('../summarize-event');
+
+const secretUrl = `https://api.example.com/v1/items?api_key=${S.apiKeyQuery}`;
+const SIGNATURE_VALUE = fakeToken('signatureValue', 27);
+
+// Built by concatenation so push protection does not match the prefixes.
+const TOKEN_TAIL = fakeToken('prefixTail', 25);
+const PREFIXED_TOKENS = [
+    'sk_' + 'live_' + TOKEN_TAIL,
+    'whsec' + '_' + TOKEN_TAIL,
+    'xox' + 'b-' + TOKEN_TAIL,
+    'gh' + 'p_' + TOKEN_TAIL,
+    'AK' + 'IA' + 'ZQPR3FIXTAIL8HN2',
+];
+
+function errorWithMessage(message, name = 'Error') {
+    const error = new Error(message);
+    error.name = name;
+    return error;
+}
+
+function nodeFetchError() {
+    const { FetchError } = require('node-fetch');
+    return new FetchError(
+        `request to ${secretUrl} failed, reason: connect ECONNREFUSED Authorization: Bearer ${S.bearer}`,
+        'system',
+        { code: 'ECONNREFUSED' }
+    );
+}
+
+function causeChain() {
+    const deepest = errorWithMessage(`token refresh failed: refresh_token=${S.refreshToken}`);
+    const third = new Error('third', { cause: deepest });
+    const second = new Error('second', { cause: third });
+    return new Error('top', { cause: second });
+}
+
+function cyclicObject() {
+    const node = { name: 'node', access_token: S.accessToken };
+    node.self = node;
+    node.list = [node, { password: S.password }];
+    return node;
+}
+
+function aggregateError() {
+    return new AggregateError(
+        [
+            errorWithMessage(`GET ${secretUrl} 401`),
+            errorWithMessage(`Authorization: Basic ${Buffer.from(`u:${S.password}`).toString('base64')}`),
+        ],
+        'batch failed'
+    );
+}
+
+function prismaValidationError() {
+    const error = errorWithMessage(
+        [
+            'Invalid `prisma.credential.create()` invocation:',
+            '',
+            `{ data: { access_token: "${S.accessToken}", refresh_token: "${S.refreshToken}" } }`,
+            '',
+            'Argument `userId` is missing.',
+        ].join('\n'),
+        'PrismaClientValidationError'
+    );
+    error.clientVersion = '6.19.3';
+    return error;
+}
+
+function vectors() {
+    return [
+        {
+            name: 'HTTP API v2 event through summarizeLambdaEvent',
+            level: 'info',
+            fields: () => ({ invocation: summarizeLambdaEvent(httpApiV2Event()) }),
+            secrets: [S.friggApiKey, S.cookie, S.oauthCode, S.bearer, S.apiKeyQuery, S.codeVerifier, S.clientSecret],
+            expectSanitized: (record) => {
+                expect(record.invocation.headerNames).toEqual(
+                    expect.arrayContaining(['x-frigg-api-key', 'cookie', 'authorization'])
+                );
+                expect(record.invocation.queryKeys).toEqual(expect.arrayContaining(['code', 'api_key']));
+            },
+        },
+        {
+            name: 'HTTP API v2 event as a raw field',
+            level: 'debug',
+            fields: () => ({ event: httpApiV2Event() }),
+            secrets: [S.friggApiKey, S.cookie, S.oauthCode, S.bearer, S.apiKeyQuery, S.codeVerifier, S.clientSecret],
+            expectSanitized: (record) => {
+                expect(record.event.headers).toEqual(
+                    expect.arrayContaining(['x-frigg-api-key', 'cookie'])
+                );
+            },
+        },
+        {
+            name: 'REST v1 event as a raw field',
+            level: 'debug',
+            fields: () => ({ event: restV1Event() }),
+            secrets: [S.friggApiKey, S.cookie, S.password, S.accessToken, S.refreshToken],
+            expectSanitized: (record) => {
+                expect(record.event.httpMethod).toBe('POST');
+            },
+        },
+        {
+            name: 'SQS event as a raw field',
+            level: 'debug',
+            fields: () => ({ event: sqsEvent() }),
+            secrets: [S.accessToken, S.clientSecret, S.bearer],
+            expectSanitized: (record) => {
+                expect(record.event.Records[0].messageId).toBe('msg-1');
+            },
+        },
+        {
+            name: 'node-fetch FetchError',
+            level: 'error',
+            fields: () => ({ error: nodeFetchError() }),
+            secrets: [S.apiKeyQuery, S.bearer],
+            expectSanitized: (record) => {
+                expect(record.error.message).toContain('api_key=REDACTED');
+            },
+        },
+        {
+            name: 'Error as the message',
+            level: 'error',
+            message: () => errorWithMessage(`GET ${secretUrl} Authorization: Bearer ${S.bearer}`),
+            secrets: [S.apiKeyQuery, S.bearer],
+            expectSanitized: (record) => {
+                expect(record.message).toContain('api_key=REDACTED');
+            },
+        },
+        {
+            name: 'cause chain with a secret at depth 3',
+            level: 'error',
+            fields: () => ({ error: causeChain() }),
+            secrets: [S.refreshToken],
+            expectSanitized: (record) => {
+                expect(record.error.cause.cause.message).toBe('third');
+            },
+        },
+        {
+            name: 'cyclic object',
+            level: 'warn',
+            fields: () => ({ node: cyclicObject() }),
+            secrets: [S.accessToken, S.password],
+            expectSanitized: (record) => {
+                expect(JSON.stringify(record)).toContain('[Circular]');
+            },
+        },
+        {
+            name: 'AggregateError',
+            level: 'error',
+            fields: () => ({ error: aggregateError() }),
+            secrets: [S.apiKeyQuery, S.password],
+            expectSanitized: (record) => {
+                expect(record.error.type).toBe('AggregateError');
+            },
+        },
+        {
+            name: 'Prisma validation error',
+            level: 'error',
+            fields: () => ({ error: prismaValidationError() }),
+            secrets: [S.accessToken, S.refreshToken],
+            expectSanitized: (record) => {
+                expect(record.error.message).toContain('Argument `userId` is missing.');
+            },
+        },
+        {
+            name: 'connection strings',
+            level: 'warn',
+            message: () =>
+                `connect failed postgresql://frigg:${S.dbPassword}@db.internal:5432/app and mongodb+srv://frigg:${S.dbPassword}@cluster0.example.net/app`,
+            secrets: [S.dbPassword],
+            expectSanitized: (record) => {
+                expect(record.message).toContain('db.internal');
+            },
+        },
+        {
+            name: 'JWT',
+            level: 'info',
+            fields: () => ({ note: `id token ${S.jwt} received` }),
+            secrets: [S.jwt],
+        },
+        {
+            name: 'Bearer and Basic credentials',
+            level: 'info',
+            fields: () => ({
+                note: `Authorization: Bearer ${S.bearer}; Authorization: Basic ${Buffer.from(`u:${S.password}`).toString('base64')}`,
+            }),
+            secrets: [S.bearer, S.password],
+        },
+        {
+            name: 'base64 run',
+            level: 'info',
+            fields: () => ({ note: `blob ${S.base64Run} end` }),
+            secrets: [S.base64Run],
+        },
+        {
+            name: 'provider token prefixes',
+            level: 'warn',
+            message: () => `provider rejected ${PREFIXED_TOKENS.join(' and ')}`,
+            fields: () => ({ note: PREFIXED_TOKENS.join(',') }),
+            secrets: PREFIXED_TOKENS,
+        },
+        {
+            name: '40-hex token',
+            level: 'error',
+            message: () => `lookup failed for key ${S.hexToken}`,
+            secrets: [S.hexToken],
+        },
+        {
+            name: 'client_secret, signature and code pairs',
+            level: 'info',
+            fields: () => ({
+                note: `client_secret=${S.clientSecret} signature=${SIGNATURE_VALUE} code=${S.oauthCode}`,
+            }),
+            secrets: [S.clientSecret, SIGNATURE_VALUE, S.oauthCode],
+        },
+        {
+            name: 'JSON string',
+            level: 'info',
+            fields: () => ({ note: JSON.stringify({ token: S.accessToken, id: 7 }) }),
+            secrets: [S.accessToken],
+        },
+        {
+            name: 'k=v& string',
+            level: 'info',
+            fields: () => ({ note: `user=alice&password=${S.password}&next=/home` }),
+            secrets: [S.password],
+        },
+        {
+            name: 'URLSearchParams body',
+            level: 'debug',
+            fields: () => ({
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code: S.oauthCode,
+                    code_verifier: S.codeVerifier,
+                    client_secret: S.clientSecret,
+                }),
+            }),
+            secrets: [S.oauthCode, S.codeVerifier, S.clientSecret],
+            expectSanitized: (record) => {
+                expect(JSON.stringify(record.body)).toContain('grant_type');
+            },
+        },
+        {
+            name: 'Headers, URL and Buffer',
+            level: 'debug',
+            fields: () => ({
+                headers: new Headers({ authorization: `Bearer ${S.bearer}`, 'x-frigg-api-key': S.friggApiKey }),
+                url: new URL(`https://user:${S.password}@api.example.com/x?access_token=${S.accessToken}`),
+                raw: Buffer.from(`secret=${S.clientSecret}`),
+            }),
+            secrets: [S.bearer, S.friggApiKey, S.password, S.accessToken, S.clientSecret],
+            expectSanitized: (record) => {
+                expect(JSON.stringify(record.url)).toContain('api.example.com');
+            },
+        },
+        {
+            name: 'OAuth callback params',
+            level: 'debug',
+            fields: () => ({ params: { code: S.oauthCode, state: 'abc123', code_verifier: S.codeVerifier } }),
+            secrets: [S.oauthCode, S.codeVerifier],
+            expectSanitized: (record) => {
+                expect(Object.keys(record.params)).toEqual(
+                    expect.arrayContaining(['code', 'state'])
+                );
+            },
+        },
+        {
+            name: 'hashword',
+            level: 'info',
+            fields: () => ({ user: { username: 'alice', hashword: S.hashword } }),
+            secrets: [S.hashword],
+            expectSanitized: (record) => {
+                expect(record.user.username).toBe('alice');
+            },
+        },
+        {
+            name: 'denied keys as bindings and top-level fields',
+            level: 'info',
+            bindings: () => ({ apiKey: S.friggApiKey }),
+            fields: () => ({ access_token: S.accessToken, id_token: S.idToken, cookies: [S.cookie] }),
+            secrets: [S.friggApiKey, S.accessToken, S.idToken, S.cookie],
+        },
+    ];
+}
+
+// A real Requester call that fails with 401. The URL carries a query key and
+// the request an Authorization header.
+async function requesterFetchError() {
+    const { Requester } = require('../../modules/requester/requester');
+    class TestRequester extends Requester {
+        async addAuthHeaders(headers) {
+            return { ...headers, Authorization: `Bearer ${S.bearer}` };
+        }
+    }
+    const response = {
+        status: 401,
+        ok: false,
+        bodyUsed: false,
+        headers: {
+            get: () => 'application/json',
+            raw: () => ({ 'content-type': ['application/json'] }),
+            [Symbol.iterator]: function* () {
+                yield ['content-type', 'application/json'];
+            },
+        },
+        json: async () => ({ access_token: S.accessToken }),
+        text: async () => `{"access_token":"${S.accessToken}"}`,
+    };
+    const requester = new TestRequester({
+        backOff: [],
+        requestTimeoutMs: 0,
+        fetch: async () => response,
+    });
+    return requester._get({ url: secretUrl }).then(
+        () => {
+            throw new Error('expected the request to fail');
+        },
+        (error) => error
+    );
+}
+
+module.exports = { vectors, requesterFetchError, secretUrl };

package/logs/__fixtures__/with-env.js

@@ -0,0 +1,45 @@
+const { createMemorySink } = require('../sinks');
+const { resetLoggerForTests } = require('../logger-runtime');
+
+function applyEnv(vars) {
+    const saved = {};
+    for (const [key, value] of Object.entries(vars)) {
+        saved[key] = Object.prototype.hasOwnProperty.call(process.env, key)
+            ? process.env[key]
+            : undefined;
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+    }
+    return () => {
+        for (const [key, value] of Object.entries(saved)) {
+            if (value === undefined) delete process.env[key];
+            else process.env[key] = value;
+        }
+    };
+}
+
+// Sets env keys (undefined deletes), resets the logger to read them, and
+// passes a fresh memory sink to fn. Restores env and the test logger after.
+function withEnv(vars, fn) {
+    const restore = applyEnv(vars);
+    const sink = createMemorySink({ install: false });
+    resetLoggerForTests({ sinks: [sink] });
+    const done = () => {
+        restore();
+        resetLoggerForTests({ level: 'TRACE', sinks: [createMemorySink({ install: false })] });
+    };
+    let result;
+    try {
+        result = fn(sink);
+    } catch (error) {
+        done();
+        throw error;
+    }
+    if (result && typeof result.then === 'function') {
+        return result.finally(done);
+    }
+    done();
+    return result;
+}
+
+module.exports = { withEnv, applyEnv };