@friggframework/devtools 2.0.0--canary.606.7d3473f.0 → 2.0.0--canary.608.ba60ba6.0

package/infrastructure/domains/integration/integration-builder.test.js

@@ -1,6 +1,6 @@
 /**
  * Tests for Integration Builder
- * 
+ *
  * Tests integration-specific Lambda functions and SQS queues
  */
 
@@ -17,9 +17,7 @@ describe('IntegrationBuilder', () => {
     describe('shouldExecute()', () => {
         it('should return true when integrations array has items', () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             expect(integrationBuilder.shouldExecute(appDefinition)).toBe(true);
@@ -85,9 +83,7 @@ describe('IntegrationBuilder', () => {
 
         it('should error when integration is missing Definition', () => {
             const appDefinition = {
-                integrations: [
-                    { someOtherField: 'value' },
-                ],
+                integrations: [{ someOtherField: 'value' }],
             };
 
             const result = integrationBuilder.validate(appDefinition);
@@ -100,9 +96,7 @@ describe('IntegrationBuilder', () => {
 
         it('should error when integration Definition is missing name', () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: {} },
-                ],
+                integrations: [{ Definition: {} }],
             };
 
             const result = integrationBuilder.validate(appDefinition);
@@ -132,9 +126,7 @@ describe('IntegrationBuilder', () => {
     describe('build()', () => {
         it('should create HTTP handler for integration', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'hubspot' } },
-                ],
+                integrations: [{ Definition: { name: 'hubspot' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -147,9 +139,7 @@ describe('IntegrationBuilder', () => {
 
         it('should configure HTTP API event for integration', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'salesforce' } },
-                ],
+                integrations: [{ Definition: { name: 'salesforce' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -166,9 +156,7 @@ describe('IntegrationBuilder', () => {
 
         it('should create SQS queue for integration', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'slack' } },
-                ],
+                integrations: [{ Definition: { name: 'slack' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -179,39 +167,39 @@ describe('IntegrationBuilder', () => {
 
         it('should configure queue with correct retention and visibility timeout', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
-            expect(result.resources.TestQueue.Properties.MessageRetentionPeriod).toBe(345600);
-            expect(result.resources.TestQueue.Properties.VisibilityTimeout).toBe(1800);
+            expect(
+                result.resources.TestQueue.Properties.MessageRetentionPeriod
+            ).toBe(345600);
+            expect(
+                result.resources.TestQueue.Properties.VisibilityTimeout
+            ).toBe(1800);
         });
 
         it('should configure redrive policy to internal error queue', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
-            expect(result.resources.TestQueue.Properties.RedrivePolicy).toEqual({
-                maxReceiveCount: 3,
-                deadLetterTargetArn: {
-                    'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
-                },
-            });
+            expect(result.resources.TestQueue.Properties.RedrivePolicy).toEqual(
+                {
+                    maxReceiveCount: 3,
+                    deadLetterTargetArn: {
+                        'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                    },
+                }
+            );
         });
 
         it('should create queue worker function', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'hubspot' } },
-                ],
+                integrations: [{ Definition: { name: 'hubspot' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -221,9 +209,7 @@ describe('IntegrationBuilder', () => {
 
         it('should configure queue worker with SQS event', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -241,9 +227,7 @@ describe('IntegrationBuilder', () => {
 
         it('should set queue worker timeout to 600 seconds', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -253,21 +237,19 @@ describe('IntegrationBuilder', () => {
 
         it('should set queue worker reserved concurrency', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'test' } },
-                ],
+                integrations: [{ Definition: { name: 'test' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
-            expect(result.functions.testQueueWorker.reservedConcurrency).toBe(20);
+            expect(result.functions.testQueueWorker.reservedConcurrency).toBe(
+                20
+            );
         });
 
         it('should add queue URL to environment variables', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'slack' } },
-                ],
+                integrations: [{ Definition: { name: 'slack' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -279,14 +261,14 @@ describe('IntegrationBuilder', () => {
 
         it('should add queue name to custom variables', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'stripe' } },
-                ],
+                integrations: [{ Definition: { name: 'stripe' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
-            expect(result.custom.StripeQueue).toBe('${self:service}--${self:provider.stage}-StripeQueue');
+            expect(result.custom.StripeQueue).toBe(
+                '${self:service}--${self:provider.stage}-StripeQueue'
+            );
         });
 
         it('should handle multiple integrations', async () => {
@@ -321,9 +303,7 @@ describe('IntegrationBuilder', () => {
 
         it('should capitalize integration name for queue reference', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'myIntegration' } },
-                ],
+                integrations: [{ Definition: { name: 'myIntegration' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -334,9 +314,7 @@ describe('IntegrationBuilder', () => {
 
         it('should handle integration names with hyphens', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'my-integration' } },
-                ],
+                integrations: [{ Definition: { name: 'my-integration' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
@@ -361,7 +339,8 @@ describe('IntegrationBuilder', () => {
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
-            const retention = result.resources.TestQueue.Properties.MessageRetentionPeriod;
+            const retention =
+                result.resources.TestQueue.Properties.MessageRetentionPeriod;
 
             // The max SQS DelaySeconds is 900. Retention must comfortably
             // exceed this to ensure delayed messages are never silently lost.
@@ -377,7 +356,9 @@ describe('IntegrationBuilder', () => {
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
-            const maxReceiveCount = result.resources.TestQueue.Properties.RedrivePolicy.maxReceiveCount;
+            const maxReceiveCount =
+                result.resources.TestQueue.Properties.RedrivePolicy
+                    .maxReceiveCount;
 
             // Should allow at least 2 retries (maxReceiveCount >= 3)
             expect(maxReceiveCount).toBeGreaterThanOrEqual(3);
@@ -393,7 +374,9 @@ describe('IntegrationBuilder', () => {
             const result = await integrationBuilder.build(appDefinition, {});
             const sqsEvent = result.functions.testQueueWorker.events[0].sqs;
 
-            expect(sqsEvent.functionResponseType).toBe('ReportBatchItemFailures');
+            expect(sqsEvent.functionResponseType).toBe(
+                'ReportBatchItemFailures'
+            );
         });
     });
 
@@ -406,10 +389,18 @@ describe('IntegrationBuilder', () => {
             const result = await integrationBuilder.build(appDefinition, {});
 
             expect(result.resources.DLQMessageAlarm).toBeDefined();
-            expect(result.resources.DLQMessageAlarm.Type).toBe('AWS::CloudWatch::Alarm');
-            expect(result.resources.DLQMessageAlarm.Properties.MetricName).toBe('ApproximateNumberOfMessagesVisible');
-            expect(result.resources.DLQMessageAlarm.Properties.ComparisonOperator).toBe('GreaterThanThreshold');
-            expect(result.resources.DLQMessageAlarm.Properties.Threshold).toBe(500);
+            expect(result.resources.DLQMessageAlarm.Type).toBe(
+                'AWS::CloudWatch::Alarm'
+            );
+            expect(result.resources.DLQMessageAlarm.Properties.MetricName).toBe(
+                'ApproximateNumberOfMessagesVisible'
+            );
+            expect(
+                result.resources.DLQMessageAlarm.Properties.ComparisonOperator
+            ).toBe('GreaterThanThreshold');
+            expect(result.resources.DLQMessageAlarm.Properties.Threshold).toBe(
+                500
+            );
         });
 
         it('should wire alarm to InternalErrorBridgeTopic for notifications', async () => {
@@ -419,9 +410,9 @@ describe('IntegrationBuilder', () => {
 
             const result = await integrationBuilder.build(appDefinition, {});
 
-            expect(result.resources.DLQMessageAlarm.Properties.AlarmActions).toEqual([
-                { Ref: 'InternalErrorBridgeTopic' },
-            ]);
+            expect(
+                result.resources.DLQMessageAlarm.Properties.AlarmActions
+            ).toEqual([{ Ref: 'InternalErrorBridgeTopic' }]);
         });
 
         it('should create a DLQ processor Lambda triggered by InternalErrorQueue', async () => {
@@ -435,7 +426,9 @@ describe('IntegrationBuilder', () => {
             expect(result.functions.dlqProcessor.events[0].sqs.arn).toEqual({
                 'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
             });
-            expect(result.functions.dlqProcessor.events[0].sqs.functionResponseType).toBe('ReportBatchItemFailures');
+            expect(
+                result.functions.dlqProcessor.events[0].sqs.functionResponseType
+            ).toBe('ReportBatchItemFailures');
         });
 
         it('DLQ processor should have skipEsbuild, short timeout, and low concurrency', async () => {
@@ -447,7 +440,9 @@ describe('IntegrationBuilder', () => {
 
             expect(result.functions.dlqProcessor.skipEsbuild).toBe(true);
             expect(result.functions.dlqProcessor.package).toBeDefined();
-            expect(result.functions.dlqProcessor.timeout).toBeLessThanOrEqual(60);
+            expect(result.functions.dlqProcessor.timeout).toBeLessThanOrEqual(
+                60
+            );
             expect(result.functions.dlqProcessor.reservedConcurrency).toBe(1);
         });
     });
@@ -474,7 +469,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'hubspot',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -494,7 +489,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'salesforce',
                             webhooks: { enabled: true },
-                        }
+                        },
                     },
                 ],
             };
@@ -511,7 +506,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'slack',
                             webhooks: false,
-                        }
+                        },
                     },
                 ],
             };
@@ -528,7 +523,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'test',
                             webhooks: { enabled: false },
-                        }
+                        },
                     },
                 ],
             };
@@ -545,7 +540,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'stripe',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -716,7 +711,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'asana',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -742,7 +737,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'test',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -751,9 +746,12 @@ describe('IntegrationBuilder', () => {
 
             const functionKeys = Object.keys(result.functions);
 
-            // Expected order: dlqProcessor (from InternalErrorQueue), webhook, integration, queueWorker
+            // Expected order: dlqProcessor + userActionQueueWorker (both
+            // app-level, created before the integration loop), then webhook,
+            // integration, queueWorker.
             expect(functionKeys).toEqual([
                 'dlqProcessor',
+                'userActionQueueWorker',
                 'testWebhook',
                 'test',
                 'testQueueWorker',
@@ -767,19 +765,19 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'hubspot',
                             webhooks: true,
-                        }
+                        },
                     },
                     {
                         Definition: {
                             name: 'salesforce',
                             webhooks: false,
-                        }
+                        },
                     },
                     {
                         Definition: {
                             name: 'slack',
                             webhooks: { enabled: true },
-                        }
+                        },
                     },
                 ],
             };
@@ -809,7 +807,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'test',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -826,7 +824,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'test',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -834,24 +832,26 @@ describe('IntegrationBuilder', () => {
             const result = await integrationBuilder.build(appDefinition, {});
 
             expect(result.functions.testWebhook.package).toBeDefined();
-            expect(result.functions.testWebhook.package.exclude).toContain('node_modules/aws-sdk/**');
-            expect(result.functions.testWebhook.package.exclude).toContain('node_modules/@prisma/**');
+            expect(result.functions.testWebhook.package.exclude).toContain(
+                'node_modules/aws-sdk/**'
+            );
+            expect(result.functions.testWebhook.package.exclude).toContain(
+                'node_modules/@prisma/**'
+            );
         });
     });
 
     describe('Prisma Layer Configuration', () => {
         it('should attach Prisma Lambda layer to queue worker functions', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'hubspot' } },
-                ],
+                integrations: [{ Definition: { name: 'hubspot' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
             // Queue workers need Prisma layer for database operations
             expect(result.functions.hubspotQueueWorker.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
         });
 
@@ -867,28 +867,26 @@ describe('IntegrationBuilder', () => {
             const result = await integrationBuilder.build(appDefinition, {});
 
             expect(result.functions.hubspotQueueWorker.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
             expect(result.functions.salesforceQueueWorker.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
             expect(result.functions.slackQueueWorker.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
         });
 
         it('should attach Prisma layer to HTTP handlers for database access', async () => {
             const appDefinition = {
-                integrations: [
-                    { Definition: { name: 'stripe' } },
-                ],
+                integrations: [{ Definition: { name: 'stripe' } }],
             };
 
             const result = await integrationBuilder.build(appDefinition, {});
 
             // HTTP handlers also need Prisma for integration queries
             expect(result.functions.stripe.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
         });
 
@@ -899,7 +897,7 @@ describe('IntegrationBuilder', () => {
                         Definition: {
                             name: 'hubspot',
                             webhooks: true,
-                        }
+                        },
                     },
                 ],
             };
@@ -908,7 +906,7 @@ describe('IntegrationBuilder', () => {
 
             // Webhook handlers need Prisma for credential lookups
             expect(result.functions.hubspotWebhook.layers).toEqual([
-                { Ref: 'PrismaLambdaLayer' }
+                { Ref: 'PrismaLambdaLayer' },
             ]);
         });
 
@@ -935,5 +933,124 @@ describe('IntegrationBuilder', () => {
             );
         });
     });
-});
 
+    describe('User-Action FIFO queue', () => {
+        const appDefinition = {
+            integrations: [{ Definition: { name: 'test' } }],
+        };
+
+        it('creates a FIFO queue without ContentBasedDeduplication', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            const q = result.resources.FriggUserActionQueue;
+            expect(q).toBeDefined();
+            expect(q.Type).toBe('AWS::SQS::Queue');
+            expect(q.Properties.FifoQueue).toBe(true);
+            expect(q.Properties.ContentBasedDeduplication).toBeUndefined();
+            expect(q.Properties.VisibilityTimeout).toBe(1800);
+            expect(q.Properties.MessageRetentionPeriod).toBe(345600);
+        });
+
+        it('redrives to the FIFO DLQ with maxReceiveCount 2', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            expect(
+                result.resources.FriggUserActionQueue.Properties.RedrivePolicy
+            ).toEqual({
+                maxReceiveCount: 2,
+                deadLetterTargetArn: {
+                    'Fn::GetAtt': ['FriggUserActionDLQ', 'Arn'],
+                },
+            });
+        });
+
+        it('creates a FIFO DLQ with 14-day retention', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            const dlq = result.resources.FriggUserActionDLQ;
+            expect(dlq).toBeDefined();
+            expect(dlq.Properties.FifoQueue).toBe(true);
+            expect(dlq.Properties.MessageRetentionPeriod).toBe(1209600);
+        });
+
+        it('creates the worker bound to the FIFO queue ARN with no reservedConcurrency', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            const worker = result.functions.userActionQueueWorker;
+            expect(worker).toBeDefined();
+            expect(worker.handler).toBe(
+                'node_modules/@friggframework/core/handlers/workers/user-action-worker.userActionQueueWorker'
+            );
+            expect(worker.timeout).toBe(900);
+            expect(worker.reservedConcurrency).toBeUndefined();
+            expect(worker.events).toEqual([
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['FriggUserActionQueue', 'Arn'] },
+                        batchSize: 1,
+                        functionResponseType: 'ReportBatchItemFailures',
+                    },
+                },
+            ]);
+        });
+
+        it('exposes USER_ACTION_QUEUE_URL to all Lambdas', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            expect(result.environment.USER_ACTION_QUEUE_URL).toEqual({
+                Ref: 'FriggUserActionQueue',
+            });
+        });
+
+        it('alarms on the FIFO DLQ via the InternalErrorBridgeTopic', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            const alarm = result.resources.FriggUserActionDLQAlarm;
+            expect(alarm).toBeDefined();
+            expect(alarm.Properties.AlarmActions).toEqual([
+                { Ref: 'InternalErrorBridgeTopic' },
+            ]);
+        });
+
+        it('creates exactly one FIFO queue + worker regardless of integration count', async () => {
+            const result = await integrationBuilder.build(
+                {
+                    integrations: [
+                        { Definition: { name: 'hubspot' } },
+                        { Definition: { name: 'salesforce' } },
+                        { Definition: { name: 'slack' } },
+                    ],
+                },
+                {}
+            );
+
+            const fifoQueues = Object.keys(result.resources).filter(
+                (k) => k === 'FriggUserActionQueue'
+            );
+            expect(fifoQueues).toHaveLength(1);
+            expect(result.functions.userActionQueueWorker).toBeDefined();
+        });
+
+        it('does not make per-integration queues FIFO', async () => {
+            const result = await integrationBuilder.build(appDefinition, {});
+
+            expect(
+                result.resources.TestQueue.Properties.FifoQueue
+            ).toBeUndefined();
+        });
+
+        it('omits the Prisma layer on the worker when usePrismaLambdaLayer=false', async () => {
+            const result = await integrationBuilder.build(
+                {
+                    usePrismaLambdaLayer: false,
+                    integrations: [{ Definition: { name: 'test' } }],
+                },
+                {}
+            );
+
+            expect(
+                result.functions.userActionQueueWorker.layers
+            ).toBeUndefined();
+        });
+    });
+});

package/infrastructure/domains/security/iam-generator.js

@@ -14,7 +14,7 @@ function generateIAMCloudFormation(options = {}) {
         appName = 'Frigg',
         features = {},
         userPrefix = 'frigg-deployment-user',
-        stackName = 'frigg-deployment-iam'
+        stackName = 'frigg-deployment-iam',
     } = options;
 
     const deploymentUserName = userPrefix;
@@ -426,6 +426,10 @@ function generateIAMCloudFormation(options = {}) {
             ],
             Resource: [
                 { 'Fn::Sub': 'arn:aws:sqs:*:${AWS::AccountId}:*frigg*' },
+                // IAM wildcard matching is case-sensitive; the app-level FIFO
+                // queue is named "...-FriggUserActionQueue.fifo", which the
+                // lowercase "*frigg*" glob would not match.
+                { 'Fn::Sub': 'arn:aws:sqs:*:${AWS::AccountId}:*Frigg*' },
                 {
                     'Fn::Sub':
                         'arn:aws:sqs:*:${AWS::AccountId}:internal-error-queue-*',
@@ -761,8 +765,7 @@ function getFeatureSummary(appDefinition) {
     const features = {
         core: true, // Always enabled
         vpc: appDefinition.vpc?.enable === true,
-        kms:
-            appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
+        kms: appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
         ssm: appDefinition.ssm?.enable === true,
         websockets: appDefinition.websockets?.enable === true,
     };
@@ -781,7 +784,10 @@ function getFeatureSummary(appDefinition) {
  * @returns {Object} Basic IAM policy document
  */
 function generateBasicIAMPolicy() {
-    const basicPolicyPath = path.join(__dirname, 'templates/iam-policy-basic.json');
+    const basicPolicyPath = path.join(
+        __dirname,
+        'templates/iam-policy-basic.json'
+    );
     return require(basicPolicyPath);
 }
 
@@ -790,7 +796,10 @@ function generateBasicIAMPolicy() {
  * @returns {Object} Full IAM policy document
  */
 function generateFullIAMPolicy() {
-    const fullPolicyPath = path.join(__dirname, 'templates/iam-policy-full.json');
+    const fullPolicyPath = path.join(
+        __dirname,
+        'templates/iam-policy-full.json'
+    );
     return require(fullPolicyPath);
 }