@aifabrix/builder 2.44.6 → 2.45.0

package/lib/utils/system-builder-root.js

@@ -17,6 +17,10 @@ const path = require('path');
  * `builder/`) beside `config.yaml` (e.g. `$HOME/.aifabrix/builder` when `AIFABRIX_HOME=$HOME`).
  * When `aifabrix-home` relocates home outside the config tree, materialize under that home instead.
  *
+ * Uses a resolved-path prefix check (not `path.relative`) so "nested under home" is stable across
+ * platforms (e.g. sibling paths like `/var/aifabrix` vs `/var/aifabrix-config` must not be treated
+ * as nested).
+ *
  * @param {string} systemDir - Absolute config/state directory (same as `getAifabrixSystemDir()`).
  * @param {string} homeDir - Absolute AI Fabrix home (`getAifabrixHome()`).
  * @returns {string} Absolute directory whose `builder/` subdir is used
@@ -24,8 +28,12 @@ const path = require('path');
 function resolveSystemBuilderParentDir(systemDir, homeDir) {
   const s = path.resolve(systemDir);
   const h = path.resolve(homeDir);
-  const rel = path.relative(h, s);
-  const configUnderHome = rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+  if (s === h) {
+    return s;
+  }
+  const sep = path.sep;
+  const homePrefix = h.endsWith(sep) ? h : `${h}${sep}`;
+  const configUnderHome = s.startsWith(homePrefix);
   return configUnderHome ? s : h;
 }
 

package/lib/utils/url-declarative-public-base.js

@@ -11,6 +11,26 @@
 const { expandFrontDoorHostPlaceholders } = require('./compose-generator');
 const { publishedHostPort, localHostPort } = require('./declarative-url-ports');
 
+/**
+ * Public URL authorities that must use `http://` (browsers hit loopback without TLS in practice).
+ *
+ * @param {string} hostname - Parsed URL hostname
+ * @returns {boolean}
+ */
+function isLocalhostPublicSchemeHostname(hostname) {
+  const h = String(hostname || '').trim().toLowerCase();
+  if (!h) {
+    return false;
+  }
+  if (h === 'localhost') {
+    return true;
+  }
+  if (h === '127.0.0.1') {
+    return true;
+  }
+  return h === '::1';
+}
+
 /**
  * Expand frontDoorRouting.host placeholders for url:// (same rules as Traefik labels in compose-generator).
  *
@@ -31,6 +51,17 @@ function hostPortForProfile(profile, listenPort, developerIdNum) {
     : localHostPort(listenPort, developerIdNum);
 }
 
+/**
+ * Scheme for `declarativePublicUrlsUseLocalhost` bases: always **http** for loopback reachability
+ * (ignore `tlsEnabled` / `remote-server` https — localhost URLs are not served with TLS in dev).
+ * @param {Object} opts - Kept for call-site compatibility (same shape as {@link computePublicUrlBaseString})
+ * @returns {'http'}
+ */
+function schemeForDeclarativeLocalhostPublicBase(opts) {
+  void opts;
+  return 'http';
+}
+
 /**
  * Local profile: workstation `+10` applies only to the app being resolved (`currentAppKey`).
  * Cross-app tokens (e.g. `url://keycloak-public` from miso-controller) use `publishedHostPort`
@@ -62,10 +93,10 @@ function resolveHostPortForDeclarativePublic(opts) {
 }
 
 /**
- * Without Traefik, `remote-server` is the dev machine host. Apps bind published host ports, not 443 + path.
- * If the URL already has an explicit port, keep host:port but **scheme follows `infraTlsEnabled`**, not the
- * literal `https://` in `remote-server` when TLS is off (`up-infra` without `--tls`).
- * If `remote-server` omits a port, append the profile-specific published/listen-derived port.
+ * Public authority from `remote-server` when expansion opts in (Traefik on, or per-app `proxy: true` ⇒
+ * `declarativePublicUrlsUseLocalhost === false`). If the URL already has an explicit port, keep host:port but
+ * **scheme follows `infraTlsEnabled`**, not the literal `https://` in `remote-server` when TLS is off
+ * (`up-infra` without `--tls`). If `remote-server` omits a port, append the profile-specific published/listen-derived port.
  *
  * @param {string} rawRemote
  * @param {'docker'|'local'} profile
@@ -85,7 +116,10 @@ function remotePublicBaseWithoutTraefik(
   const raw = String(rawRemote || '').trim().replace(/\/+$/, '');
   const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : (infraTlsEnabled ? `https://${raw}` : `http://${raw}`);
   const u = new URL(withScheme);
-  const scheme = infraTlsEnabled ? 'https' : 'http';
+  let scheme = infraTlsEnabled ? 'https' : 'http';
+  if (isLocalhostPublicSchemeHostname(u.hostname)) {
+    scheme = 'http';
+  }
 
   if (u.port !== '') {
     return `${scheme}://${u.host}`;
@@ -105,17 +139,31 @@ function remotePublicBaseWithoutTraefik(
   return `${scheme}://${u.hostname}:${hostPort}`;
 }
 
+/**
+ * True when `frontDoorRouting.host` depends on `remote-server` for expansion (`${REMOTE_HOST}`).
+ * Without a remote, expansion yields a bare `devNN` label (no DNS) — public `url://` bases must fall back to localhost.
+ *
+ * @param {string|null|undefined} hostTemplate
+ * @returns {boolean}
+ */
+function templateUsesRemoteHostPlaceholder(hostTemplate) {
+  return /\$\{REMOTE_HOST\}/.test(String(hostTemplate || ''));
+}
+
 /**
  * @param {Object} opts - same shape as computePublicUrlBaseString
  * @returns {string|null}
  */
 function buildTraefikPublicBaseIfApplicable(opts) {
-  const { traefik, pathActive, hostTemplate, tls, developerIdRaw, remoteServer, infraTlsEnabled } =
+  const { traefik, pathActive, hostTemplate, developerIdRaw, remoteServer, infraTlsEnabled } =
     opts;
   // Plan 124: Traefik host authority only when pathActive (traefik ∧ frontDoorRouting.enabled)
   if (!traefik || !pathActive || !hostTemplate || !String(hostTemplate).trim()) {
     return null;
   }
+  if (templateUsesRemoteHostPlaceholder(hostTemplate) && !String(remoteServer || '').trim()) {
+    return null;
+  }
   const expanded = expandFrontDoorHostTemplateForUrls(hostTemplate, {
     developerIdRaw,
     remoteServer
@@ -123,8 +171,12 @@ function buildTraefikPublicBaseIfApplicable(opts) {
   if (!expanded) {
     return null;
   }
-  const useHttps = Boolean(infraTlsEnabled) || tls !== false;
-  const scheme = useHttps ? 'https' : 'http';
+  // Scheme follows global `tlsEnabled` (`up-infra --tls`) only — not `frontDoorRouting.tls` when infra TLS is off.
+  const useHttps = Boolean(infraTlsEnabled);
+  let scheme = useHttps ? 'https' : 'http';
+  if (isLocalhostPublicSchemeHostname(expanded)) {
+    scheme = 'http';
+  }
   return `${scheme}://${expanded}`.replace(/\/+$/, '');
 }
 
@@ -140,8 +192,9 @@ function buildTraefikPublicBaseIfApplicable(opts) {
  * @param {'docker'|'local'} opts.profile
  * @param {number} opts.listenPort
  * @param {number} opts.developerIdNum
- * @param {boolean} [opts.infraTlsEnabled] - `tlsEnabled` from ~/.aifabrix/config.yaml (`up-infra --tls`); when true, Traefik front-door public URLs use https even if application.yaml has `frontDoorRouting.tls: false`
+ * @param {boolean} [opts.infraTlsEnabled] - `tlsEnabled` from ~/.aifabrix/config.yaml (`up-infra --tls`); Traefik front-door public bases use **`https`** only when this is **true** (even if `frontDoorRouting.tls` is **false**). When **false**, front-door bases use **`http`** regardless of `frontDoorRouting.tls`. Loopback hostnames stay **http** always.
  * @param {boolean} [opts.pathActive] - traefik ∧ frontDoorRouting.enabled; required for Traefik host branch (plan 124)
+ * @param {boolean|undefined} [opts.declarativePublicUrlsUseLocalhost] - **`true`**: force localhost authority (+ port rules below). **`false`**: allow `remote-server` as authority when Traefik is on, or when global `traefik` is not `false` and per-app `proxy` opts in without Traefik. **`undefined`**: default — omit `remote-server` when Traefik is off so published services use `http://localhost:<port>` (e.g. `af setup` / device login URLs). When user config has **`traefik: false`**, expansion forces localhost for public bases regardless of per-app `proxy`.
  * @returns {string}
  */
 function computePublicUrlBaseString(opts) {
@@ -159,7 +212,23 @@ function computePublicUrlBaseString(opts) {
     return traefikBase;
   }
 
-  if (remoteServer && String(remoteServer).trim()) {
+  if (opts.declarativePublicUrlsUseLocalhost) {
+    const hostPort = resolveHostPortForDeclarativePublic({
+      profile,
+      listenPort,
+      developerIdNum,
+      declarativeTargetAppKey: declarativePortOpts.declarativeTargetAppKey,
+      declarativeCurrentAppKey: declarativePortOpts.declarativeCurrentAppKey
+    });
+    const scheme = schemeForDeclarativeLocalhostPublicBase(opts);
+    return `${scheme}://localhost:${hostPort}`;
+  }
+
+  const remoteTrimmed = remoteServer && String(remoteServer).trim();
+  const useRemotePublicAuthority =
+    Boolean(remoteTrimmed) &&
+    (Boolean(opts.traefik) || opts.declarativePublicUrlsUseLocalhost === false);
+  if (useRemotePublicAuthority) {
     return remotePublicBaseWithoutTraefik(
       remoteServer,
       profile,
@@ -177,8 +246,7 @@ function computePublicUrlBaseString(opts) {
     declarativeTargetAppKey: declarativePortOpts.declarativeTargetAppKey,
     declarativeCurrentAppKey: declarativePortOpts.declarativeCurrentAppKey
   });
-  const scheme = infraTlsEnabled ? 'https' : 'http';
-  return `${scheme}://localhost:${hostPort}`;
+  return `http://localhost:${hostPort}`;
 }
 
 module.exports = {

package/lib/utils/url-declarative-resolve-build-urls.js

@@ -0,0 +1,238 @@
+/**
+ * Public/internal URL string builders for declarative url:// (join + build*).
+ *
+ * @fileoverview Split from url-declarative-resolve-build.js for ESLint max-lines
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  computePublicUrlBaseString,
+  resolveHostPortForDeclarativePublic
+} = require('./url-declarative-public-base');
+
+/**
+ * Join base URL origin with path segments (no duplicate slashes).
+ * @param {string} originOrBase - https://host or https://host:port
+ * @param {string} suffixPath - /dev/data
+ * @returns {string}
+ */
+function joinUrlPath(originOrBase, suffixPath) {
+  const base = String(originOrBase || '').replace(/\/+$/, '');
+  let suf = suffixPath || '';
+  if (!suf.startsWith('/')) {
+    suf = `/${suf}`;
+  }
+  return `${base}${suf}`.replace(/([^:]\/)\/+/g, '$1');
+}
+
+/**
+ * @param {Object} opts
+ * @returns {string}
+ */
+function buildPublicUrlString(opts) {
+  const {
+    profile,
+    listenPort,
+    developerIdNum,
+    remoteServer,
+    pathPrefix,
+    patternPath,
+    traefik,
+    hostTemplate,
+    tls,
+    developerIdRaw,
+    infraTlsEnabled,
+    frontDoorIngressActive,
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  } = opts;
+  const base = computePublicUrlBaseString({
+    traefik: Boolean(traefik),
+    pathActive: Boolean(frontDoorIngressActive),
+    hostTemplate: hostTemplate || null,
+    tls: tls !== false,
+    developerIdRaw,
+    remoteServer,
+    profile,
+    listenPort,
+    developerIdNum,
+    infraTlsEnabled: Boolean(infraTlsEnabled),
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  });
+  const patternSegment =
+    frontDoorIngressActive === false
+      ? ''
+      : patternPath === '/' || patternPath === ''
+        ? ''
+        : patternPath;
+  const rawSuffix = `${pathPrefix}${patternSegment}`.replace(/\/{2,}/g, '/');
+  if (!rawSuffix || rawSuffix === '/') {
+    return String(base).replace(/\/+$/, '');
+  }
+  const normalizedSuffix = rawSuffix.startsWith('/') ? rawSuffix : `/${rawSuffix}`;
+  return joinUrlPath(base, normalizedSuffix);
+}
+
+/**
+ * Public reachability origin only (no env path prefix, no front-door pattern path).
+ * @param {Object} opts
+ * @returns {string}
+ */
+function buildPublicHostOriginString(opts) {
+  const {
+    profile,
+    listenPort,
+    developerIdNum,
+    remoteServer,
+    traefik,
+    hostTemplate,
+    tls,
+    developerIdRaw,
+    infraTlsEnabled,
+    frontDoorIngressActive,
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  } = opts;
+  const base = computePublicUrlBaseString({
+    traefik: Boolean(traefik),
+    pathActive: Boolean(frontDoorIngressActive),
+    hostTemplate: hostTemplate || null,
+    tls: tls !== false,
+    developerIdRaw,
+    remoteServer,
+    profile,
+    listenPort,
+    developerIdNum,
+    infraTlsEnabled: Boolean(infraTlsEnabled),
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  });
+  try {
+    return new URL(base).origin;
+  } catch {
+    const hostPort = resolveHostPortForDeclarativePublic({
+      profile,
+      listenPort,
+      developerIdNum,
+      declarativeTargetAppKey,
+      declarativeCurrentAppKey
+    });
+    return `http://localhost:${hostPort}`;
+  }
+}
+
+/**
+ * Internal service origin only (scheme + host + port), no path suffix.
+ * @param {Object} opts
+ * @returns {string}
+ */
+function buildInternalHostOriginString(opts) {
+  const {
+    profile,
+    listenPort,
+    targetAppKey,
+    remoteServer,
+    pathPrefix,
+    patternPath,
+    developerIdNum,
+    traefik,
+    hostTemplate,
+    tls,
+    developerIdRaw,
+    infraTlsEnabled,
+    frontDoorIngressActive,
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  } = opts;
+  if (profile === 'docker') {
+    return `http://${targetAppKey}:${listenPort}`;
+  }
+  if (remoteServer && String(remoteServer).trim()) {
+    const pub = buildPublicUrlString({
+      profile: 'local',
+      listenPort,
+      developerIdNum,
+      remoteServer,
+      pathPrefix,
+      patternPath,
+      traefik,
+      hostTemplate,
+      tls,
+      developerIdRaw,
+      infraTlsEnabled,
+      frontDoorIngressActive,
+      declarativeTargetAppKey: declarativeTargetAppKey || targetAppKey,
+      declarativeCurrentAppKey: declarativeCurrentAppKey,
+      declarativePublicUrlsUseLocalhost
+    });
+    try {
+      return new URL(pub).origin;
+    } catch {
+      return `http://${targetAppKey}:${listenPort}`;
+    }
+  }
+  return `http://${targetAppKey}:${listenPort}`;
+}
+
+function buildInternalUrlString(opts) {
+  const {
+    profile,
+    listenPort,
+    targetAppKey,
+    runtimeBasePath,
+    remoteServer,
+    pathPrefix,
+    patternPath,
+    developerIdNum,
+    traefik,
+    hostTemplate,
+    tls,
+    developerIdRaw,
+    infraTlsEnabled,
+    frontDoorIngressActive,
+    declarativeTargetAppKey,
+    declarativeCurrentAppKey,
+    declarativePublicUrlsUseLocalhost
+  } = opts;
+  if (profile === 'docker') {
+    const origin = `http://${targetAppKey}:${listenPort}`;
+    return runtimeBasePath ? joinUrlPath(origin, runtimeBasePath) : origin;
+  }
+  if (remoteServer && String(remoteServer).trim()) {
+    return buildPublicUrlString({
+      profile: 'local',
+      listenPort,
+      developerIdNum,
+      remoteServer,
+      pathPrefix,
+      patternPath,
+      traefik,
+      hostTemplate,
+      tls,
+      developerIdRaw,
+      infraTlsEnabled,
+      frontDoorIngressActive,
+      declarativeTargetAppKey: declarativeTargetAppKey || targetAppKey,
+      declarativeCurrentAppKey: declarativeCurrentAppKey,
+      declarativePublicUrlsUseLocalhost
+    });
+  }
+  return `http://${targetAppKey}:${listenPort}`;
+}
+
+module.exports = {
+  joinUrlPath,
+  buildPublicUrlString,
+  buildPublicHostOriginString,
+  buildInternalUrlString,
+  buildInternalHostOriginString
+};