@friggframework/core 2.0.0-next.41 → 2.0.0-next.43

package/database/encryption/postgres-decryption-fix-verification.test.js

@@ -0,0 +1,371 @@
+/**
+ * Verification Test: Repository Fix for PostgreSQL Decryption Bug
+ *
+ * This test verifies that the fix in ModuleRepositoryPostgres successfully
+ * decrypts credentials when fetching entities (after removing `include`).
+ *
+ * Expected Behavior After Fix:
+ * - All repository methods should return decrypted credentials
+ * - No encrypted tokens should leak through to the application layer
+ */
+
+// Set up test environment for PostgreSQL with encryption
+process.env.DB_TYPE = 'postgresql';
+process.env.DATABASE_URL = process.env.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/frigg?schema=public';
+process.env.STAGE = 'integration-test';
+process.env.AES_KEY_ID = 'test-key-id';
+process.env.AES_KEY = 'test-aes-key-32-characters-long!';
+
+// Mock config to return postgresql
+jest.mock('../config', () => ({
+    DB_TYPE: 'postgresql',
+    getDatabaseType: jest.fn(() => 'postgresql'),
+    PRISMA_LOG_LEVEL: 'error,warn',
+    PRISMA_QUERY_LOGGING: false,
+}));
+
+const { prisma, connectPrisma, disconnectPrisma } = require('../prisma');
+const { ModuleRepositoryPostgres } = require('../../modules/repositories/module-repository-postgres');
+
+describe('Repository Fix Verification - PostgreSQL Decryption', () => {
+    let repository;
+    let testCredentialId;
+    let testEntityId;
+    let testUserId;
+    const TEST_TOKEN = 'my-secret-access-token-12345';
+    const TEST_REFRESH_TOKEN = 'my-secret-refresh-token-67890';
+    const TEST_DOMAIN = 'example-test.com';
+
+    beforeAll(async () => {
+        await connectPrisma();
+        repository = new ModuleRepositoryPostgres();
+    });
+
+    afterAll(async () => {
+        // Cleanup test data
+        if (testEntityId) {
+            await prisma.entity.deleteMany({
+                where: { id: parseInt(testEntityId, 10) }
+            }).catch(() => {});
+        }
+        if (testCredentialId) {
+            await prisma.credential.deleteMany({
+                where: { id: testCredentialId }
+            }).catch(() => {});
+        }
+        if (testUserId) {
+            await prisma.user.deleteMany({
+                where: { id: testUserId }
+            }).catch(() => {});
+        }
+
+        await disconnectPrisma();
+    });
+
+    afterEach(async () => {
+        // Clean up after each test
+        if (testEntityId) {
+            await prisma.entity.deleteMany({
+                where: { id: parseInt(testEntityId, 10) }
+            }).catch(() => {});
+            testEntityId = null;
+        }
+        if (testCredentialId) {
+            await prisma.credential.deleteMany({
+                where: { id: testCredentialId }
+            }).catch(() => {});
+            testCredentialId = null;
+        }
+        if (testUserId) {
+            await prisma.user.deleteMany({
+                where: { id: testUserId }
+            }).catch(() => {});
+            testUserId = null;
+        }
+    });
+
+    test('✅ FIX VERIFICATION: findEntityById returns decrypted credential', async () => {
+        // Setup: Create user, credential, and entity
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-findEntityById',
+                data: {
+                    access_token: TEST_TOKEN,
+                    refresh_token: TEST_REFRESH_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                userId: testUserId,
+                credentialId: testCredentialId,
+                moduleName: 'test-module',
+                externalId: 'test-entity-findById',
+            },
+        });
+        testEntityId = entity.id.toString();
+
+        // Test: Fetch via repository
+        const result = await repository.findEntityById(testEntityId);
+
+        // Verify: Credential is decrypted
+        expect(result).toBeDefined();
+        expect(result.credential).toBeDefined();
+        expect(result.credential.data.access_token).toBe(TEST_TOKEN);
+        expect(result.credential.data.refresh_token).toBe(TEST_REFRESH_TOKEN);
+        expect(result.credential.data.domain).toBe(TEST_DOMAIN);
+
+        // Verify: No encrypted format (shouldn't contain ':' pattern)
+        expect(result.credential.data.access_token).not.toContain(':');
+
+        console.log('✅ findEntityById: Credential successfully decrypted!');
+    });
+
+    test('✅ FIX VERIFICATION: findEntitiesByUserId returns decrypted credentials', async () => {
+        // Setup
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-findByUserId',
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                userId: testUserId,
+                credentialId: testCredentialId,
+                moduleName: 'test-module',
+                externalId: 'test-entity-findByUserId',
+            },
+        });
+        testEntityId = entity.id.toString();
+
+        // Test
+        const results = await repository.findEntitiesByUserId(testUserId.toString());
+
+        // Verify
+        expect(results).toBeDefined();
+        expect(results.length).toBeGreaterThan(0);
+        const firstEntity = results[0];
+        expect(firstEntity.credential).toBeDefined();
+        expect(firstEntity.credential.data.access_token).toBe(TEST_TOKEN);
+        expect(firstEntity.credential.data.access_token).not.toContain(':');
+
+        console.log('✅ findEntitiesByUserId: Credentials successfully decrypted!');
+    });
+
+    test('✅ FIX VERIFICATION: findEntitiesByIds returns decrypted credentials', async () => {
+        // Setup
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-findByIds',
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                userId: testUserId,
+                credentialId: testCredentialId,
+                moduleName: 'test-module',
+                externalId: 'test-entity-findByIds',
+            },
+        });
+        testEntityId = entity.id.toString();
+
+        // Test
+        const results = await repository.findEntitiesByIds([testEntityId]);
+
+        // Verify
+        expect(results).toBeDefined();
+        expect(results.length).toBe(1);
+        expect(results[0].credential).toBeDefined();
+        expect(results[0].credential.data.access_token).toBe(TEST_TOKEN);
+        expect(results[0].credential.data.access_token).not.toContain(':');
+
+        console.log('✅ findEntitiesByIds: Credentials successfully decrypted!');
+    });
+
+    test('✅ FIX VERIFICATION: createEntity returns decrypted credential', async () => {
+        // Setup
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-create',
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        // Test: Create entity via repository
+        const entity = await repository.createEntity({
+            userId: testUserId.toString(),
+            credentialId: testCredentialId.toString(),
+            moduleName: 'test-module',
+            externalId: 'test-entity-create',
+        });
+
+        testEntityId = entity.id;
+
+        // Verify
+        expect(entity).toBeDefined();
+        expect(entity.credential).toBeDefined();
+        expect(entity.credential.data.access_token).toBe(TEST_TOKEN);
+        expect(entity.credential.data.access_token).not.toContain(':');
+
+        console.log('✅ createEntity: Credential successfully decrypted!');
+    });
+
+    test('✅ FIX VERIFICATION: updateEntity returns decrypted credential', async () => {
+        // Setup
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-update',
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                userId: testUserId,
+                credentialId: testCredentialId,
+                moduleName: 'test-module',
+                externalId: 'test-entity-update',
+            },
+        });
+        testEntityId = entity.id.toString();
+
+        // Test: Update entity via repository
+        const updated = await repository.updateEntity(testEntityId, {
+            name: 'Updated Name',
+        });
+
+        // Verify
+        expect(updated).toBeDefined();
+        expect(updated.name).toBe('Updated Name');
+        expect(updated.credential).toBeDefined();
+        expect(updated.credential.data.access_token).toBe(TEST_TOKEN);
+        expect(updated.credential.data.access_token).not.toContain(':');
+
+        console.log('✅ updateEntity: Credential successfully decrypted!');
+    });
+
+    test('📊 COMPARISON: Verify tokens are encrypted in database but decrypted in repository', async () => {
+        // Setup
+        const user = await prisma.user.create({
+            data: {
+                type: 'INDIVIDUAL',
+                hashword: 'test-hash'
+            }
+        });
+        testUserId = user.id;
+
+        const credential = await prisma.credential.create({
+            data: {
+                userId: testUserId,
+                externalId: 'test-cred-comparison',
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: TEST_DOMAIN,
+                },
+            },
+        });
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                userId: testUserId,
+                credentialId: testCredentialId,
+                moduleName: 'test-module',
+                externalId: 'test-entity-comparison',
+            },
+        });
+        testEntityId = entity.id.toString();
+
+        // 1. Check raw database (should be encrypted)
+        const rawCred = await prisma.$queryRaw`
+            SELECT data FROM "Credential" WHERE id = ${testCredentialId}
+        `;
+        const rawToken = rawCred[0].data.access_token;
+
+        // 2. Check via repository (should be decrypted)
+        const repoEntity = await repository.findEntityById(testEntityId);
+        const repoToken = repoEntity.credential.data.access_token;
+
+        console.log('\n📊 COMPARISON RESULTS:');
+        console.log('Raw DB token (encrypted):', rawToken.substring(0, 50) + '...');
+        console.log('Repository token (decrypted):', repoToken);
+
+        // Verify database has encrypted version
+        expect(rawToken).toContain(':');
+        expect(rawToken.split(':')).toHaveLength(4);
+
+        // Verify repository returns decrypted version
+        expect(repoToken).toBe(TEST_TOKEN);
+        expect(repoToken).not.toContain(':');
+
+        console.log('✅ Database stores encrypted, repository returns decrypted - FIX WORKS!');
+    });
+});

package/database/encryption/postgres-relation-decryption.test.js

@@ -0,0 +1,245 @@
+/**
+ * PostgreSQL Relation Decryption Bug Test
+ *
+ * This test proves that credentials fetched via Prisma `include` relations
+ * are NOT being decrypted by the encryption extension, while credentials
+ * fetched directly ARE being decrypted.
+ *
+ * Expected Behavior:
+ * - Direct credential fetch: SHOULD decrypt ✅
+ * - Credential via Entity include: SHOULD decrypt but DOESN'T ❌
+ * - Raw database query: SHOULD be encrypted ✅
+ */
+
+// Set up test environment for PostgreSQL with encryption
+process.env.DB_TYPE = 'postgresql';
+process.env.DATABASE_URL = process.env.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/frigg?schema=public';
+process.env.STAGE = 'integration-test';
+process.env.AES_KEY_ID = 'test-key-id';
+process.env.AES_KEY = 'test-aes-key-32-characters-long!';
+
+// Mock config to return postgresql
+jest.mock('../config', () => ({
+    DB_TYPE: 'postgresql',
+    getDatabaseType: jest.fn(() => 'postgresql'),
+    PRISMA_LOG_LEVEL: 'error,warn',
+    PRISMA_QUERY_LOGGING: false,
+}));
+
+const { prisma, connectPrisma, disconnectPrisma } = require('../prisma');
+
+describe('PostgreSQL Relation Decryption Bug', () => {
+    let testCredentialId;
+    let testEntityId;
+    const TEST_TOKEN = 'secret-token-should-be-encrypted';
+    const TEST_EXTERNAL_ID = 'test-relation-bug-credential';
+
+    beforeAll(async () => {
+        await connectPrisma();
+    });
+
+    afterAll(async () => {
+        // Cleanup test data
+        if (testEntityId) {
+            await prisma.entity.deleteMany({
+                where: { id: testEntityId }
+            }).catch(() => {});
+        }
+        if (testCredentialId) {
+            await prisma.credential.deleteMany({
+                where: { id: testCredentialId }
+            }).catch(() => {});
+        }
+
+        await disconnectPrisma();
+    });
+
+    afterEach(async () => {
+        // Clean up after each test
+        if (testEntityId) {
+            await prisma.entity.deleteMany({
+                where: { id: testEntityId }
+            }).catch(() => {});
+            testEntityId = null;
+        }
+        if (testCredentialId) {
+            await prisma.credential.deleteMany({
+                where: { id: testCredentialId }
+            }).catch(() => {});
+            testCredentialId = null;
+        }
+    });
+
+    test('PROOF 1: Direct credential fetch DOES decrypt (extension works)', async () => {
+        // 1. Create credential with sensitive data
+        const created = await prisma.credential.create({
+            data: {
+                externalId: TEST_EXTERNAL_ID,
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: 'example.com',
+                },
+            },
+        });
+
+        testCredentialId = created.id;
+
+        // Verify creation returns decrypted data
+        expect(created.data.access_token).toBe(TEST_TOKEN);
+
+        // 2. Fetch directly via Credential model (simulating direct query)
+        const directFetch = await prisma.credential.findUnique({
+            where: { id: testCredentialId },
+        });
+
+        // ✅ EXPECT: Should be decrypted by extension
+        expect(directFetch).toBeDefined();
+        expect(directFetch.data.access_token).toBe(TEST_TOKEN);
+
+        // Should NOT contain colon pattern (not encrypted format)
+        expect(directFetch.data.access_token).not.toContain(':');
+    });
+
+    test('BUG PROOF: Credential via Entity include DOES NOT decrypt', async () => {
+        // 1. Create credential first
+        const credential = await prisma.credential.create({
+            data: {
+                externalId: TEST_EXTERNAL_ID,
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: 'example.com',
+                },
+            },
+        });
+
+        testCredentialId = credential.id;
+
+        // 2. Create entity that references the credential
+        const entity = await prisma.entity.create({
+            data: {
+                moduleName: 'test-module',
+                externalId: 'test-entity-for-bug-proof',
+                credentialId: testCredentialId,
+            },
+        });
+
+        testEntityId = entity.id;
+
+        // 3. Fetch entity with credential included (like ModuleRepository does)
+        const entityWithCredential = await prisma.entity.findUnique({
+            where: { id: testEntityId },
+            include: { credential: true },
+        });
+
+        // ❌ BUG: Credential data is STILL ENCRYPTED when fetched via include
+        expect(entityWithCredential).toBeDefined();
+        expect(entityWithCredential.credential).toBeDefined();
+
+        console.log('\n🔍 DEBUG: Credential data from include:', entityWithCredential.credential.data);
+        console.log('🔍 DEBUG: access_token value:', entityWithCredential.credential.data.access_token);
+
+        // The bug: Token should be decrypted but it's still in encrypted format
+        const tokenValue = entityWithCredential.credential.data.access_token;
+        const hasColonPattern = tokenValue.includes(':');
+        const isEncryptedFormat = tokenValue.split(':').length === 4;
+
+        if (hasColonPattern && isEncryptedFormat) {
+            console.log('❌ BUG CONFIRMED: Token is still encrypted!');
+            console.log(`   Expected: "${TEST_TOKEN}"`);
+            console.log(`   Got: "${tokenValue}"`);
+        }
+
+        // This assertion SHOULD fail if the bug exists
+        // Comment it out initially to see the actual behavior
+        // expect(tokenValue).toBe(TEST_TOKEN);
+
+        // Instead, let's prove the bug by showing it's encrypted
+        expect(tokenValue).toContain(':'); // Still has encrypted format
+        expect(tokenValue).not.toBe(TEST_TOKEN); // Not the plain text
+    });
+
+    test('PROOF 2: Raw database has encrypted data (encryption works at storage)', async () => {
+        // 1. Create credential
+        const created = await prisma.credential.create({
+            data: {
+                externalId: TEST_EXTERNAL_ID,
+                data: {
+                    access_token: TEST_TOKEN,
+                    domain: 'example.com',
+                },
+            },
+        });
+
+        testCredentialId = created.id;
+
+        // 2. Query raw database to see actual stored value
+        const raw = await prisma.$queryRaw`
+            SELECT data FROM "Credential" WHERE id = ${testCredentialId}
+        `;
+
+        expect(raw).toBeDefined();
+        expect(raw.length).toBe(1);
+
+        const rawToken = raw[0].data.access_token;
+        console.log('\n🔍 DEBUG: Raw database token:', rawToken);
+
+        // ✅ VERIFY: Database stores encrypted data
+        expect(rawToken).toContain(':'); // Has encrypted format
+
+        const parts = rawToken.split(':');
+        expect(parts.length).toBe(4); // keyId:iv:ciphertext:encryptedKey
+
+        console.log('✅ CONFIRMED: Data is encrypted at rest in database');
+    });
+
+    test('COMPARISON: Direct fetch vs Include fetch behavior', async () => {
+        // Create credential and entity
+        const credential = await prisma.credential.create({
+            data: {
+                externalId: TEST_EXTERNAL_ID,
+                data: {
+                    access_token: TEST_TOKEN,
+                    refresh_token: 'refresh-token-test',
+                    domain: 'comparison.com',
+                },
+            },
+        });
+
+        testCredentialId = credential.id;
+
+        const entity = await prisma.entity.create({
+            data: {
+                moduleName: 'comparison-module',
+                externalId: 'comparison-entity',
+                credentialId: testCredentialId,
+            },
+        });
+
+        testEntityId = entity.id;
+
+        // Fetch 1: Direct credential query
+        const directCredential = await prisma.credential.findUnique({
+            where: { id: testCredentialId },
+        });
+
+        // Fetch 2: Credential via entity include
+        const entityWithCredential = await prisma.entity.findUnique({
+            where: { id: testEntityId },
+            include: { credential: true },
+        });
+
+        console.log('\n📊 COMPARISON RESULTS:');
+        console.log('Direct fetch access_token:', directCredential.data.access_token);
+        console.log('Include fetch access_token:', entityWithCredential.credential.data.access_token);
+
+        const directIsDecrypted = directCredential.data.access_token === TEST_TOKEN;
+        const includeIsDecrypted = entityWithCredential.credential.data.access_token === TEST_TOKEN;
+
+        console.log(`\nDirect fetch decrypted: ${directIsDecrypted ? '✅ YES' : '❌ NO'}`);
+        console.log(`Include fetch decrypted: ${includeIsDecrypted ? '✅ YES' : '❌ NO'}`);
+
+        // Prove they're different
+        expect(directIsDecrypted).toBe(true);
+        expect(includeIsDecrypted).toBe(false); // BUG: This should be true but it's false
+    });
+});