@friggframework/core 2.0.0-next.124 → 2.0.0-next.126

package/handlers/app-handler-helpers.js

@@ -9,6 +9,17 @@ const serverlessHttp = require('serverless-http');
 
 const log = getLogger('frigg.http');
 
+const isHttpErrorStatus = (statusCode) =>
+    Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599;
+
+const toBoom = (err) => {
+    if (err.isBoom) return err;
+    if (err.isClientSafe === true && isHttpErrorStatus(err.statusCode)) {
+        return Boom.boomify(err, { statusCode: err.statusCode });
+    }
+    return Boom.boomify(err);
+};
+
 const createApp = (applyMiddleware) => {
     const app = express();
 
@@ -27,7 +38,7 @@ const createApp = (applyMiddleware) => {
 
     // The express boundary: send the error response and log it one time.
     app.use((err, req, res, next) => {
-        const boomError = err.isBoom ? err : Boom.boomify(err);
+        const boomError = toBoom(err);
         const {
             output: { statusCode = 500 },
         } = boomError;

package/integrations/integration-base.js

@@ -557,17 +557,30 @@ class IntegrationBase {
                 }
             }
         }
-        const dynamicUserActions = await this.loadDynamicUserActions();
-        const filteredDynamicActions = actionType
-            ? Object.fromEntries(
-                  Object.entries(dynamicUserActions).filter(
-                      ([_, event]) => event.userActionType === actionType
-                  )
-              )
-            : dynamicUserActions;
+        const dynamicUserActions = await this._loadDynamicUserActionEvents();
+        const filteredDynamicActions = Object.fromEntries(
+            Object.entries(dynamicUserActions).filter(
+                ([_, event]) =>
+                    event.type === constantsToBeMigrated.types.USER_ACTION &&
+                    (!actionType || event.userActionType === actionType)
+            )
+        );
         return { ...userActions, ...filteredDynamicActions };
     }
 
+    async _loadDynamicUserActionEvents() {
+        const dynamicUserActions = await this.loadDynamicUserActions();
+        return Object.fromEntries(
+            Object.entries(dynamicUserActions).map(([key, event]) => [
+                key,
+                {
+                    ...event,
+                    type: event.type ?? constantsToBeMigrated.types.USER_ACTION,
+                },
+            ])
+        );
+    }
+
     async getActionOptions(actionId, data) {
         const options = {
             jsonSchema: {},
@@ -847,7 +860,8 @@ class IntegrationBase {
 
     async initialize() {
         try {
-            const additionalUserActions = await this.loadDynamicUserActions();
+            const additionalUserActions =
+                await this._loadDynamicUserActionEvents();
             this.events = { ...this.events, ...additionalUserActions };
         } catch (e) {
             this.addError(e);

package/integrations/integration-router.js

@@ -257,6 +257,15 @@ function checkRequiredParams(params, requiredKeys) {
     return returnDict;
 }
 
+function assertUserAction(integration, actionId) {
+    if (
+        !Object.hasOwn(integration.events, actionId) ||
+        integration.events[actionId].type !== 'USER_ACTION'
+    ) {
+        throw Boom.notFound(`User action ${actionId} does not exist`);
+    }
+}
+
 /**
  * Sets up integration-related routes on the provided Express router
  * @param {express.Router} router - Express router instance to add routes to
@@ -393,6 +402,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                     params.integrationId,
                     user.getId()
                 );
+                assertUserAction(integration, params.actionId);
 
                 res.json(
                     await integration.send('GET_USER_ACTION_OPTIONS', {
@@ -418,6 +428,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                     params.integrationId,
                     user.getId()
                 );
+                assertUserAction(integration, params.actionId);
 
                 res.json(
                     await integration.send('REFRESH_USER_ACTION_OPTIONS', {
@@ -439,6 +450,7 @@ function setIntegrationRoutes(router, authenticateUser, useCases) {
                 params.integrationId,
                 user.getId()
             );
+            assertUserAction(integration, params.actionId);
             res.json(await integration.send(params.actionId, req.body));
         })
     );

package/integrations/use-cases/delete-integration-for-user.js

@@ -31,14 +31,17 @@ class DeleteIntegrationForUser {
      * @param {string} integrationId - ID of the integration to delete.
      * @param {string} userId - ID of the user requesting the deletion.
      * @returns {Promise<void>} Resolves when the integration is successfully deleted.
-     * @throws {Boom.notFound} When integration with the specified ID does not exist.
-     * @throws {Error} When the integration doesn't belong to the specified user.
+     * @throws {Boom.notFound} When integration does not exist or doesn't belong to the specified user.
      */
     async execute(integrationId, userId) {
-        const integrationRecord =
-            await this.integrationRepository.findIntegrationById(integrationId);
+        const integrationRecord = await this.integrationRepository
+            .findIntegrationById(integrationId)
+            .catch((error) => {
+                if (error.message?.includes('not found')) return null;
+                throw error;
+            });
 
-        if (!integrationRecord) {
+        if (!integrationRecord || integrationRecord.userId !== userId) {
             throw Boom.notFound(
                 `Integration with id of ${integrationId} does not exist`
             );
@@ -50,12 +53,6 @@ class DeleteIntegrationForUser {
                 integrationRecord.config.type
         );
 
-        if (integrationRecord.userId !== userId) {
-            throw new Error(
-                `Integration ${integrationId} does not belong to User ${userId}`
-            );
-        }
-
         // Load modules with API clients for webhook deletion
         const modules = [];
         const failedModuleLoads = [];

package/integrations/use-cases/get-integration-instance.js

@@ -1,3 +1,4 @@
+const Boom = require('@hapi/boom');
 // Removed Integration wrapper - using IntegrationBase directly
 
 /**
@@ -24,15 +25,20 @@ class GetIntegrationInstance {
      * @param {string} integrationId - ID of the integration to retrieve.
      * @param {string} userId - ID of the user requesting the integration.
      * @returns {Promise<Integration>} The fully initialized integration instance.
-     * @throws {Error} When integration is not found, doesn't belong to user, or integration class is not found.
+     * @throws {Boom.notFound} When integration is not found or doesn't belong to user.
+     * @throws {Error} When integration class is not found.
      */
     async execute(integrationId, userId) {
-        const integrationRecord =
-            await this.integrationRepository.findIntegrationById(integrationId);
+        const integrationRecord = await this.integrationRepository
+            .findIntegrationById(integrationId)
+            .catch((error) => {
+                if (error.message?.includes('not found')) return null;
+                throw error;
+            });
 
-        if (!integrationRecord) {
-            throw new Error(
-                `No integration found by the ID of ${integrationId}`
+        if (!integrationRecord || integrationRecord.userId !== userId) {
+            throw Boom.notFound(
+                `Integration with id of ${integrationId} does not exist`
             );
         }
 
@@ -48,12 +54,6 @@ class GetIntegrationInstance {
             );
         }
 
-        if (integrationRecord.userId !== userId) {
-            throw new Error(
-                `Integration ${integrationId} does not belong to User ${userId}`
-            );
-        }
-
         const modules = [];
         for (const entityId of integrationRecord.entitiesIds) {
             const moduleInstance = await this.moduleFactory.getModuleInstance(

package/integrations/use-cases/update-integration.js

@@ -1,3 +1,4 @@
+const Boom = require('@hapi/boom');
 const {
     mapIntegrationClassToIntegrationDTO,
 } = require('../utils/map-integration-dto');
@@ -27,16 +28,21 @@ class UpdateIntegration {
      * @param {string} userId - ID of the user requesting the update.
      * @param {Object} config - New configuration object for the integration.
      * @returns {Promise<Object>} The updated integration DTO.
-     * @throws {Error} When integration is not found, doesn't belong to user, or integration class is not found.
+     * @throws {Boom.notFound} When integration is not found or doesn't belong to user.
+     * @throws {Error} When integration class is not found.
      */
     async execute(integrationId, userId, config) {
         // 1. Get integration record from repository
-        const integrationRecord =
-            await this.integrationRepository.findIntegrationById(integrationId);
+        const integrationRecord = await this.integrationRepository
+            .findIntegrationById(integrationId)
+            .catch((error) => {
+                if (error.message?.includes('not found')) return null;
+                throw error;
+            });
 
-        if (!integrationRecord) {
-            throw new Error(
-                `No integration found by the ID of ${integrationId}`
+        if (!integrationRecord || integrationRecord.userId !== userId) {
+            throw Boom.notFound(
+                `Integration with id of ${integrationId} does not exist`
             );
         }
 
@@ -53,12 +59,6 @@ class UpdateIntegration {
             );
         }
 
-        if (integrationRecord.userId !== userId) {
-            throw new Error(
-                `Integration ${integrationId} does not belong to User ${userId}`
-            );
-        }
-
         // 3. Load modules based on entity references
         const modules = [];
         for (const entityId of integrationRecord.entitiesIds) {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0-next.124",
+    "version": "2.0.0-next.126",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -11,7 +11,7 @@
         "@aws-sdk/client-sqs": "^3.588.0",
         "@aws-sdk/client-ssm": "^3.588.0",
         "@aws-sdk/s3-request-presigner": "^3.588.0",
-        "@friggframework/schemas": "2.0.0-next.124",
+        "@friggframework/schemas": "2.0.0-next.126",
         "@hapi/boom": "^10.0.1",
         "@opentelemetry/api": "^1.9.1",
         "@opentelemetry/context-async-hooks": "^2.9.0",
@@ -49,9 +49,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0-next.124",
-        "@friggframework/prettier-config": "2.0.0-next.124",
-        "@friggframework/test": "2.0.0-next.124",
+        "@friggframework/eslint-config": "2.0.0-next.126",
+        "@friggframework/prettier-config": "2.0.0-next.126",
+        "@friggframework/test": "2.0.0-next.126",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -92,5 +92,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "679a3f0f550136151563c34f9a8c7680b88b6984"
+    "gitHead": "be8690d56e4e772fc744f414a7e3bed7363ad9b5"
 }

package/token/repositories/token-repository-documentdb.js

@@ -119,7 +119,19 @@ class TokenRepositoryDocumentDB extends TokenRepositoryInterface {
 
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 
     _mapToken(record) {

package/token/repositories/token-repository-mongo.js

@@ -212,7 +212,19 @@ class TokenRepositoryMongo extends TokenRepositoryInterface {
      */
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 }
 

package/token/repositories/token-repository-postgres.js

@@ -257,7 +257,19 @@ class TokenRepositoryPostgres extends TokenRepositoryInterface {
      */
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 }