@friggframework/core 2.0.0-next.9 → 2.0.0-next.90

package/database/encryption/logger.js

@@ -0,0 +1,79 @@
+/**
+ * Encryption Logger
+ *
+ * Centralized logging for encryption operations.
+ * Prevents sensitive data leakage in production logs.
+ */
+
+const LOG_LEVELS = {
+    DEBUG: 0,
+    INFO: 1,
+    WARN: 2,
+    ERROR: 3,
+};
+
+class EncryptionLogger {
+    constructor() {
+        this.minLevel = this._getMinLevel();
+    }
+
+    _getMinLevel() {
+        const level = process.env.FRIGG_LOG_LEVEL || 'INFO';
+        return LOG_LEVELS[level.toUpperCase()] ?? LOG_LEVELS.INFO;
+    }
+
+    _shouldLog(level) {
+        return LOG_LEVELS[level] >= this.minLevel;
+    }
+
+    _sanitize(message) {
+        // Remove potential key material or encrypted data from logs
+        if (typeof message === 'string') {
+            // Truncate long base64 strings that might be keys or encrypted data
+            return message.replace(/([A-Za-z0-9+/=]{50,})/g, (match) =>
+                `${match.substring(0, 10)}...[${match.length} chars]`
+            );
+        }
+        return message;
+    }
+
+    debug(message, ...args) {
+        if (this._shouldLog('DEBUG')) {
+            console.log(`[Frigg Debug]`, this._sanitize(message), ...args);
+        }
+    }
+
+    info(message, ...args) {
+        if (this._shouldLog('INFO')) {
+            console.log(`[Frigg]`, this._sanitize(message), ...args);
+        }
+    }
+
+    warn(message, ...args) {
+        if (this._shouldLog('WARN')) {
+            console.warn(`[Frigg]`, this._sanitize(message), ...args);
+        }
+    }
+
+    error(message, error) {
+        if (this._shouldLog('ERROR')) {
+            const sanitizedMessage = this._sanitize(message);
+
+            // In production, don't log stack traces with sensitive paths
+            const isProduction = process.env.STAGE === 'production';
+
+            if (error && !isProduction) {
+                console.error(`[Frigg]`, sanitizedMessage, error);
+            } else if (error) {
+                console.error(`[Frigg]`, sanitizedMessage, error.message);
+            } else {
+                console.error(`[Frigg]`, sanitizedMessage);
+            }
+        }
+    }
+}
+
+// Singleton instance
+const logger = new EncryptionLogger();
+
+module.exports = { logger };

package/database/encryption/prisma-encryption-extension.js

@@ -0,0 +1,230 @@
+/**
+ * Prisma Client Extension for transparent field-level encryption.
+ * Intercepts Prisma queries to encrypt on write and decrypt on read.
+ */
+
+const {
+    getEncryptedFields,
+    getFieldsToEncryptOnWrite,
+    getFieldsToDecryptOnRead,
+} = require('./encryption-schema-registry');
+const { FieldEncryptionService } = require('./field-encryption-service');
+
+function createEncryptionExtension({ cryptor, enabled = true }) {
+    if (!enabled) {
+        return (client) => client;
+    }
+
+    if (!cryptor) {
+        throw new Error(
+            'Cryptor instance required for encryption extension'
+        );
+    }
+
+    const encryptionService = new FieldEncryptionService({
+        cryptor,
+        schema: {
+            getEncryptedFields,
+            getFieldsToEncryptOnWrite,
+            getFieldsToDecryptOnRead,
+        },
+    });
+
+    return {
+        name: 'frigg-field-encryption',
+        query: {
+            $allModels: {
+                async create({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async createMany({ model, args, query }) {
+                    if (args.data && Array.isArray(args.data)) {
+                        args.data =
+                            await encryptionService.encryptFieldsInBulk(
+                                model,
+                                args.data
+                            );
+                    } else if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async update({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async updateMany({ model, args, query }) {
+                    if (args.data) {
+                        args.data = await encryptionService.encryptFields(
+                            model,
+                            args.data
+                        );
+                    }
+
+                    return await query(args);
+                },
+
+                async upsert({ model, args, query }) {
+                    if (args.create) {
+                        args.create = await encryptionService.encryptFields(
+                            model,
+                            args.create
+                        );
+                    }
+
+                    if (args.update) {
+                        args.update = await encryptionService.encryptFields(
+                            model,
+                            args.update
+                        );
+                    }
+
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUnique({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findFirst({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findMany({ model, args, query }) {
+                    const results = await query(args);
+
+                    if (results && Array.isArray(results)) {
+                        return await encryptionService.decryptFieldsInBulk(
+                            model,
+                            results
+                        );
+                    }
+
+                    return results;
+                },
+
+                async delete({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async deleteMany({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async count({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async aggregate({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async groupBy({ model, args, query }) {
+                    return await query(args);
+                },
+
+                async findFirstOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+
+                async findUniqueOrThrow({ model, args, query }) {
+                    const result = await query(args);
+
+                    if (result) {
+                        return await encryptionService.decryptFields(
+                            model,
+                            result
+                        );
+                    }
+
+                    return result;
+                },
+            },
+        },
+    };
+}
+
+module.exports = { createEncryptionExtension };

package/database/index.js

@@ -1,25 +1,25 @@
-const { mongoose } = require('./mongoose');
+/**
+ * Database Module Index
+ * Exports Prisma client, connection utilities, and repositories
+ *
+ * Note: Frigg uses the Repository pattern for data access.
+ * Use repositories for data operations:
+ * - SyncRepository (syncs/sync-repository.js)
+ * - IntegrationRepository (integrations/integration-repository.js)
+ * - CredentialRepository (credential/credential-repository.js)
+ * etc.
+ */
+
+const { prisma, connectPrisma, disconnectPrisma } = require('./prisma');
+const { TokenRepository } = require('../token/repositories/token-repository');
 const {
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-} = require('./mongo');
-const { IndividualUser } = require('./models/IndividualUser');
-const { OrganizationUser } = require('./models/OrganizationUser');
-const { State } = require('./models/State');
-const { Token } = require('./models/Token');
-const { UserModel } = require('./models/UserModel');
-const { WebsocketConnection } = require('./models/WebsocketConnection');
+    WebsocketConnectionRepository,
+} = require('../websocket/repositories/websocket-connection-repository');
 
 module.exports = {
-    mongoose,
-    connectToDatabase,
-    disconnectFromDatabase,
-    createObjectId,
-    IndividualUser,
-    OrganizationUser,
-    State,
-    Token,
-    UserModel,
-    WebsocketConnection,
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    TokenRepository,
+    WebsocketConnectionRepository,
 };

package/database/prisma.js

@@ -0,0 +1,182 @@
+const {
+    createEncryptionExtension,
+} = require('./encryption/prisma-encryption-extension');
+const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const { logger } = require('./encryption/logger');
+const { Cryptor } = require('../encrypt/Cryptor');
+const config = require('./config');
+
+/**
+ * Ensures DATABASE_URL is set for MongoDB connections
+ * Falls back to MONGO_URI if DATABASE_URL is not set
+ * Infrastructure layer concern - maps legacy MONGO_URI to Prisma's expected DATABASE_URL
+ * 
+ * Note: This should only be called when DB_TYPE is 'mongodb' or 'documentdb'
+ */
+function ensureMongoDbUrl() {
+    // If DATABASE_URL is already set, use it
+    if (process.env.DATABASE_URL && process.env.DATABASE_URL.trim()) {
+        return;
+    }
+
+    // Fallback to MONGO_URI for backwards compatibility with DocumentDB deployments
+    if (process.env.MONGO_URI && process.env.MONGO_URI.trim()) {
+        process.env.DATABASE_URL = process.env.MONGO_URI;
+        logger.debug('Using MONGO_URI as DATABASE_URL for Mongo-compatible connection');
+        return;
+    }
+
+    // Neither is set - error
+    throw new Error(
+        'DATABASE_URL or MONGO_URI environment variable must be set for MongoDB/DocumentDB'
+    );
+}
+
+function getEncryptionConfig() {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS =
+        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+    const hasAES =
+        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
+const prismaClientSingleton = () => {
+    let PrismaClient;
+
+    // Helper to try loading Prisma client from multiple locations
+    const loadPrismaClient = (dbType) => {
+        const paths = [
+            // Lambda layer location (when using Prisma Lambda layer)
+            `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
+            // Local development location (relative to core package)
+            `../generated/prisma-${dbType}`,
+        ];
+
+        for (const path of paths) {
+            try {
+                return require(path).PrismaClient;
+            } catch (err) {
+                // Continue to next path
+            }
+        }
+
+        throw new Error(
+            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(', ')}`
+        );
+    };
+
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        // Ensure DATABASE_URL is set (fallback to MONGO_URI if needed)
+        ensureMongoDbUrl();
+        PrismaClient = loadPrismaClient('mongodb');
+    } else if (config.DB_TYPE === 'postgresql') {
+        PrismaClient = loadPrismaClient('postgresql');
+    } else {
+        throw new Error(
+            `Unsupported database type: ${config.DB_TYPE}. Supported values: 'mongodb', 'documentdb', 'postgresql'`
+        );
+    }
+
+    let client = new PrismaClient({
+        log: process.env.PRISMA_LOG_LEVEL
+            ? process.env.PRISMA_LOG_LEVEL.split(',')
+            : ['error', 'warn'],
+        errorFormat: 'pretty',
+    });
+
+    const encryptionConfig = getEncryptionConfig();
+
+    if (encryptionConfig.enabled) {
+        try {
+            // Load custom encryption schema from appDefinition before creating extension
+            loadCustomEncryptionSchema();
+
+            const cryptor = new Cryptor({
+                shouldUseAws: encryptionConfig.method === 'kms',
+            });
+
+            client = client.$extends(
+                createEncryptionExtension({
+                    cryptor,
+                    enabled: true,
+                })
+            );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+            );
+        } catch (error) {
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
+        }
+    } else {
+        logger.info('Field-level encryption disabled');
+    }
+
+    return client;
+};
+
+const globalForPrisma = global;
+
+// Lazy initialization - only create singleton when first accessed
+function getPrismaClient() {
+    if (!globalForPrisma._prismaInstance) {
+        globalForPrisma._prismaInstance = prismaClientSingleton();
+    }
+    return globalForPrisma._prismaInstance;
+}
+
+// Export a getter for lazy initialization
+const prisma = new Proxy({}, {
+    get(target, prop) {
+        return getPrismaClient()[prop];
+    }
+});
+
+async function disconnectPrisma() {
+    await getPrismaClient().$disconnect();
+}
+
+async function connectPrisma() {
+    await getPrismaClient().$connect();
+
+    // Initialize MongoDB schema - ensure all collections exist
+    // Only run for MongoDB/DocumentDB (not PostgreSQL)
+    // This prevents "Cannot create namespace in multi-document transaction" errors
+    if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
+        const { initializeMongoDBSchema } = require('./utils/mongodb-schema-init');
+        await initializeMongoDBSchema();
+    }
+
+    return getPrismaClient();
+}
+
+module.exports = {
+    prisma,
+    connectPrisma,
+    disconnectPrisma,
+    getEncryptionConfig,
+    ensureMongoDbUrl, // Exported for testing
+};

package/database/repositories/health-check-repository-documentdb.js

@@ -0,0 +1,138 @@
+const {
+    HealthCheckRepositoryInterface,
+} = require('./health-check-repository-interface');
+const {
+    toObjectId,
+    fromObjectId,
+    findOne,
+    insertOne,
+    deleteOne,
+} = require('../documentdb-utils');
+const { DocumentDBEncryptionService } = require('../documentdb-encryption-service');
+
+class HealthCheckRepositoryDocumentDB extends HealthCheckRepositoryInterface {
+    /**
+     * @param {Object} params
+     * @param {Object} params.prismaClient - Prisma client instance
+     */
+    constructor({ prismaClient }) {
+        super();
+        this.prisma = prismaClient;
+        this.encryptionService = new DocumentDBEncryptionService();
+    }
+
+    /**
+     * @returns {Promise<{readyState: number, stateName: string, isConnected: boolean}>}
+     */
+    async getDatabaseConnectionState() {
+        let isConnected = false;
+        let stateName = 'unknown';
+
+        try {
+            await this.prisma.$runCommandRaw({ ping: 1 });
+            isConnected = true;
+            stateName = 'connected';
+        } catch (error) {
+            stateName = 'disconnected';
+        }
+
+        return {
+            readyState: isConnected ? 1 : 0,
+            stateName,
+            isConnected,
+        };
+    }
+
+    /**
+     * @param {number} maxTimeMS
+     * @returns {Promise<number>} Response time in milliseconds
+     */
+    async pingDatabase(maxTimeMS = 2000) {
+        const pingStart = Date.now();
+        let timeoutId;
+
+        const timeoutPromise = new Promise((_, reject) => {
+            timeoutId = setTimeout(() => reject(new Error('Database ping timeout')), maxTimeMS);
+        });
+
+        try {
+            await Promise.race([
+                this.prisma.$runCommandRaw({ ping: 1 }),
+                timeoutPromise,
+            ]);
+            return Date.now() - pingStart;
+        } finally {
+            clearTimeout(timeoutId);
+        }
+    }
+
+    async createCredential(credentialData) {
+        const now = new Date();
+        const document = {
+            ...credentialData,
+            createdAt: now,
+            updatedAt: now,
+        };
+
+        // Encrypt sensitive fields before insert
+        const encryptedDocument = await this.encryptionService.encryptFields(
+            'Credential',
+            document
+        );
+        const insertedId = await insertOne(this.prisma, 'Credential', encryptedDocument);
+        const created = await findOne(this.prisma, 'Credential', { _id: insertedId });
+
+        // Decrypt after read
+        const decrypted = await this.encryptionService.decryptFields(
+            'Credential',
+            created
+        );
+
+        return {
+            id: fromObjectId(decrypted._id),
+            ...decrypted,
+        };
+    }
+
+    async findCredentialById(id) {
+        const doc = await findOne(this.prisma, 'Credential', {
+            _id: toObjectId(id),
+        });
+
+        if (!doc) return null;
+
+        // Decrypt sensitive fields
+        const decrypted = await this.encryptionService.decryptFields('Credential', doc);
+
+        return {
+            id: fromObjectId(decrypted._id),
+            ...decrypted,
+        };
+    }
+
+    async getRawCredentialById(id) {
+        const objectId = toObjectId(id);
+        if (!objectId) return null;
+
+        const result = await this.prisma.$runCommandRaw({
+            find: 'Credential',
+            filter: { _id: objectId },
+        });
+
+        // Return raw document WITHOUT decryption
+        // This allows the test to verify that fields are actually encrypted in the database
+        return result?.cursor?.firstBatch?.[0] ?? null;
+    }
+
+    async deleteCredential(id) {
+        const objectId = toObjectId(id);
+        if (!objectId) return false;
+
+        const result = await deleteOne(this.prisma, 'Credential', { _id: objectId });
+        const deleted = result?.n ?? 0;
+        return deleted > 0;
+    }
+}
+
+module.exports = { HealthCheckRepositoryDocumentDB };
+