@friggframework/core 2.0.0-next.6 → 2.0.0-next.60

package/database/encryption/prisma-encryption-extension.js

@@ -0,0 +1,222 @@
+/**
+ * Prisma Client Extension for transparent field-level encryption.
+ * Intercepts Prisma queries to encrypt on write and decrypt on read.
+ */
+
+const { getEncryptedFields } = require('./encryption-schema-registry');
+const { FieldEncryptionService } = require('./field-encryption-service');
+
+function createEncryptionExtension({ cryptor, enabled = true }) {
+    if (!enabled) {
+        return (client) => client;
+    }
+
+    if (!cryptor) {
+        throw new Error(
+            'Cryptor instance required for encryption extension'
+        );
+    }
+
+    const encryptionService = new FieldEncryptionService({
+        cryptor,
+        schema: { getEncryptedFields },
+    });
+
+    return {
+        name: 'frigg-field-encryption',
+        query: {
+            $allModels: {
+                async create({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async createMany({ model, args, query }) {
+                    if (args.data && Array.isArray(args.data)) {
+                        args.data =
+                            await encryptionService.encryptFieldsInBulk(
+                                model,
+                                args.data
+                            );
+                    } else if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async update({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async updateMany({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async upsert({ model, args, query }) {
+                    if (args.create) {
+                        args.create = await encryptionService.encryptFields(
+                            model,
+                            args.create
+                        );
+                    }
+
+                    if (args.update) {
+                        args.update = await encryptionService.encryptFields(
+                            model,
+                            args.update
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUnique({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findFirst({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findMany({ model, args, query }) {
+                    const results = await query(args);
+
+                    if (results && Array.isArray(results)) {
+                        return await encryptionService.decryptFieldsInBulk(
+                            model,
+                            results
+                        );
+                    }
+
+                    return results;
+                },
+
+                async delete({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async deleteMany({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async count({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async aggregate({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async groupBy({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async findFirstOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUniqueOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+            },
+        },
+    };
+}
+
+module.exports = { createEncryptionExtension };

package/database/index.js

@@ -1,25 +1,65 @@
-const { mongoose } = require('./mongoose');
+//todo: probably most of this file content can be removed
+
+/**
+ * Database Module Index
+ * Exports Mongoose models and connection utilities
+ *
+ * Note: Frigg uses the Repository pattern for data access.
+ * Models are not meant to be used directly - use repositories instead:
+ * - SyncRepository (syncs/sync-repository.js)
+ * - IntegrationRepository (integrations/integration-repository.js)
+ * - CredentialRepository (credential/credential-repository.js)
+ * etc.
+ */
+
+// Lazy-load mongoose to avoid importing mongodb when using PostgreSQL only
+let _mongoose = null;
+let _IndividualUser = null;
+let _OrganizationUser = null;
+let _UserModel = null;
+let _WebsocketConnection = null;
+
+// Prisma exports (always available)
+const { prisma } = require('./prisma');
+const { TokenRepository } = require('../token/repositories/token-repository');
 const {
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-} = require('./mongo');
-const { IndividualUser } = require('./models/IndividualUser');
-const { OrganizationUser } = require('./models/OrganizationUser');
-const { State } = require('./models/State');
-const { Token } = require('./models/Token');
-const { UserModel } = require('./models/UserModel');
-const { WebsocketConnection } = require('./models/WebsocketConnection');
+    WebsocketConnectionRepository,
+} = require('../websocket/repositories/websocket-connection-repository');
 
 module.exports = {
-    mongoose,
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-    IndividualUser,
-    OrganizationUser,
-    State,
-    Token,
-    UserModel,
-    WebsocketConnection,
+    // Lazy-loaded mongoose exports (only load when accessed)
+    get mongoose() {
+        if (!_mongoose) {
+            _mongoose = require('./mongoose').mongoose;
+        }
+        return _mongoose;
+    },
+    get IndividualUser() {
+        if (!_IndividualUser) {
+            _IndividualUser = require('./models/IndividualUser').IndividualUser;
+        }
+        return _IndividualUser;
+    },
+    get OrganizationUser() {
+        if (!_OrganizationUser) {
+            _OrganizationUser = require('./models/OrganizationUser').OrganizationUser;
+        }
+        return _OrganizationUser;
+    },
+    get UserModel() {
+        if (!_UserModel) {
+            _UserModel = require('./models/UserModel').UserModel;
+        }
+        return _UserModel;
+    },
+    get WebsocketConnection() {
+        if (!_WebsocketConnection) {
+            _WebsocketConnection = require('./models/WebsocketConnection').WebsocketConnection;
+        }
+        return _WebsocketConnection;
+    },
+    // Prisma (always available)
+    prisma,
+    TokenRepository,
+    WebsocketConnectionRepository,
 };

package/database/models/WebsocketConnection.js

@@ -1,5 +1,8 @@
 const { mongoose } = require('../mongoose');
-const AWS = require('aws-sdk');
+const {
+    ApiGatewayManagementApiClient,
+    PostToConnectionCommand,
+} = require('@aws-sdk/client-apigatewaymanagementapi');
 
 const schema = new mongoose.Schema({
     connectionId: { type: mongoose.Schema.Types.String },
@@ -8,24 +11,27 @@ const schema = new mongoose.Schema({
 // Add a static method to get active connections
 schema.statics.getActiveConnections = async function () {
     try {
+        // Return empty array if websockets are not configured
+        if (!process.env.WEBSOCKET_API_ENDPOINT) {
+            return [];
+        }
+
         const connections = await this.find({}, 'connectionId');
         return connections.map((conn) => ({
             connectionId: conn.connectionId,
             send: async (data) => {
-                const apigwManagementApi = new AWS.ApiGatewayManagementApi({
-                    apiVersion: '2018-11-29',
+                const apigwManagementApi = new ApiGatewayManagementApiClient({
                     endpoint: process.env.WEBSOCKET_API_ENDPOINT,
                 });
 
                 try {
-                    await apigwManagementApi
-                        .postToConnection({
-                            ConnectionId: conn.connectionId,
-                            Data: JSON.stringify(data),
-                        })
-                        .promise();
+                    const command = new PostToConnectionCommand({
+                        ConnectionId: conn.connectionId,
+                        Data: JSON.stringify(data),
+                    });
+                    await apigwManagementApi.send(command);
                 } catch (error) {
-                    if (error.statusCode === 410) {
+                    if (error.statusCode === 410 || error.$metadata?.httpStatusCode === 410) {
                         console.log(`Stale connection ${conn.connectionId}`);
                         await this.deleteOne({
                             connectionId: conn.connectionId,

package/database/models/readme.md

@@ -0,0 +1 @@
+// todo: we need to get rid of this entire models folder

package/database/prisma.js

@@ -0,0 +1,182 @@
+const {
+    createEncryptionExtension,
+} = require('./encryption/prisma-encryption-extension');
+const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const { logger } = require('./encryption/logger');
+const { Cryptor } = require('../encrypt/Cryptor');
+const config = require('./config');
+
+/**
+ * Ensures DATABASE_URL is set for MongoDB connections
+ * Falls back to MONGO_URI if DATABASE_URL is not set
+ * Infrastructure layer concern - maps legacy MONGO_URI to Prisma's expected DATABASE_URL
+ * 
+ * Note: This should only be called when DB_TYPE is 'mongodb' or 'documentdb'
+ */
+function ensureMongoDbUrl() {
+    // If DATABASE_URL is already set, use it
+    if (process.env.DATABASE_URL && process.env.DATABASE_URL.trim()) {
+        return;
+    }
+
+    // Fallback to MONGO_URI for backwards compatibility with DocumentDB deployments
+    if (process.env.MONGO_URI && process.env.MONGO_URI.trim()) {
+        process.env.DATABASE_URL = process.env.MONGO_URI;
+        logger.debug('Using MONGO_URI as DATABASE_URL for Mongo-compatible connection');
+        return;
+    }
+
+    // Neither is set - error
+    throw new Error(
+        'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB/DocumentDB'
+    );
+}
+
+function getEncryptionConfig() {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS =
+        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+    const hasAES =
+        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
+const prismaClientSingleton = () => {
+    let PrismaClient;
+
+    // Helper to try loading Prisma client from multiple locations
+    const loadPrismaClient = (dbType) => {
+        const paths = [
+            // Lambda layer location (when using Prisma Lambda layer)
+            `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
+            // Local development location (relative to core package)
+            `../generated/prisma-${dbType}`,
+        ];
+
+        for (const path of paths) {
+            try {
+                return require(path).PrismaClient;
+            } catch (err) {
+                // Continue to next path
+            }
+        }
+
+        throw new Error(
+            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(', ')}`
+        );
+    };
+
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        // Ensure DATABASE_URL is set (fallback to MONGO_URI if needed)
+        ensureMongoDbUrl();
+        PrismaClient = loadPrismaClient('mongodb');
+    } else if (config.DB_TYPE === 'postgresql') {
+        PrismaClient = loadPrismaClient('postgresql');
+    } else {
+        throw new Error(
+            `Unsupported database type: ${config.DB_TYPE}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+        );
+    }
+
+    let client = new PrismaClient({
+        log: process.env.PRISMA_LOG_LEVEL
+            ? process.env.PRISMA_LOG_LEVEL.split(',')
+            : ['error', 'warn'],
+        errorFormat: 'pretty',
+    });
+
+    const encryptionConfig = getEncryptionConfig();
+
+    if (encryptionConfig.enabled) {
+        try {
+            // Load custom encryption schema from appDefinition before creating extension
+            loadCustomEncryptionSchema();
+
+            const cryptor = new Cryptor({
+                shouldUseAws: encryptionConfig.method === 'kms',
+            });
+
+            client = client.$extends(
+                createEncryptionExtension({
+                    cryptor,
+                    enabled: true,
+                })
+            );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+            );
+        } catch (error) {
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
+        }
+    } else {
+        logger.info('Field-level encryption disabled');
+    }
+
+    return client;
+};
+
+const globalForPrisma = global;
+
+// Lazy initialization - only create singleton when first accessed
+function getPrismaClient() {
+    if (!globalForPrisma._prismaInstance) {
+        globalForPrisma._prismaInstance = prismaClientSingleton();
+    }
+    return globalForPrisma._prismaInstance;
+}
+
+// Export a getter for lazy initialization
+const prisma = new Proxy({}, {
+    get(target, prop) {
+        return getPrismaClient()[prop];
+    }
+});
+
+async function disconnectPrisma() {
+    await getPrismaClient().$disconnect();
+}
+
+async function connectPrisma() {
+    await getPrismaClient().$connect();
+
+    // Initialize MongoDB schema - ensure all collections exist
+    // Only run for MongoDB/DocumentDB (not PostgreSQL)
+    // This prevents "Cannot create namespace in multi-document transaction" errors
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        const { initializeMongoDBSchema } = require('./utils/mongodb-schema-init');
+        await initializeMongoDBSchema();
+    }
+
+    return getPrismaClient();
+}
+
+module.exports = {
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    getEncryptionConfig,
+    ensureMongoDbUrl, // Exported for testing
+};

package/database/repositories/health-check-repository-documentdb.js

@@ -0,0 +1,134 @@
+const {
+    HealthCheckRepositoryInterface,
+} = require('./health-check-repository-interface');
+const {
+    toObjectId,
+    fromObjectId,
+    findOne,
+    insertOne,
+    deleteOne,
+} = require('../documentdb-utils');
+const { DocumentDBEncryptionService } = require('../documentdb-encryption-service');
+
+class HealthCheckRepositoryDocumentDB extends HealthCheckRepositoryInterface {
+    /**
+     * @param {Object} params
+     * @param {Object} params.prismaClient - Prisma client instance
+     */
+    constructor({ prismaClient }) {
+        super();
+        this.prisma = prismaClient;
+        this.encryptionService = new DocumentDBEncryptionService();
+    }
+
+    /**
+     * @returns {Promise<{readyState: number, stateName: string, isConnected: boolean}>}
+     */
+    async getDatabaseConnectionState() {
+        let isConnected = false;
+        let stateName = 'unknown';
+
+        try {
+            await this.prisma.$runCommandRaw({ ping: 1 });
+            isConnected = true;
+            stateName = 'connected';
+        } catch (error) {
+            stateName = 'disconnected';
+        }
+
+        return {
+            readyState: isConnected ? 1 : 0,
+            stateName,
+            isConnected,
+        };
+    }
+
+    /**
+     * @param {number} maxTimeMS
+     * @returns {Promise<number>} Response time in milliseconds
+     */
+    async pingDatabase(maxTimeMS = 2000) {
+        const pingStart = Date.now();
+
+        const timeoutPromise = new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('Database ping timeout')), maxTimeMS)
+        );
+
+        await Promise.race([
+            this.prisma.$runCommandRaw({ ping: 1 }),
+            timeoutPromise,
+        ]);
+
+        return Date.now() - pingStart;
+    }
+
+    async createCredential(credentialData) {
+        const now = new Date();
+        const document = {
+            ...credentialData,
+            createdAt: now,
+            updatedAt: now,
+        };
+
+        // Encrypt sensitive fields before insert
+        const encryptedDocument = await this.encryptionService.encryptFields(
+            'Credential',
+            document
+        );
+        const insertedId = await insertOne(this.prisma, 'Credential', encryptedDocument);
+        const created = await findOne(this.prisma, 'Credential', { _id: insertedId });
+
+        // Decrypt after read
+        const decrypted = await this.encryptionService.decryptFields(
+            'Credential',
+            created
+        );
+
+        return {
+            id: fromObjectId(decrypted._id),
+            ...decrypted,
+        };
+    }
+
+    async findCredentialById(id) {
+        const doc = await findOne(this.prisma, 'Credential', {
+            _id: toObjectId(id),
+        });
+
+        if (!doc) return null;
+
+        // Decrypt sensitive fields
+        const decrypted = await this.encryptionService.decryptFields('Credential', doc);
+
+        return {
+            id: fromObjectId(decrypted._id),
+            ...decrypted,
+        };
+    }
+
+    async getRawCredentialById(id) {
+        const objectId = toObjectId(id);
+        if (!objectId) return null;
+
+        const result = await this.prisma.$runCommandRaw({
+            find: 'Credential',
+            filter: { _id: objectId },
+        });
+
+        // Return raw document WITHOUT decryption
+        // This allows the test to verify that fields are actually encrypted in the database
+        return result?.cursor?.firstBatch?.[0] ?? null;
+    }
+
+    async deleteCredential(id) {
+        const objectId = toObjectId(id);
+        if (!objectId) return false;
+
+        const result = await deleteOne(this.prisma, 'Credential', { _id: objectId });
+        const deleted = result?.n ?? 0;
+        return deleted > 0;
+    }
+}
+
+module.exports = { HealthCheckRepositoryDocumentDB };
+