@aifabrix/builder 2.44.6 → 2.45.5

package/lib/identity/identity-apply-phases.js

@@ -0,0 +1,244 @@
+/**
+ * @fileoverview Phased execution for identity apply
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getGroup, createGroup } = require('../api/groups.api');
+const { createUser } = require('../api/users.api');
+const { addUserToGroup } = require('../api/user-groups.api');
+const { clearAuthCache } = require('../api/auth-cache.api');
+const { fullSyncToDataplane } = require('../api/dataplane-sync.api');
+const {
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage,
+  findExistingUser
+} = require('./identity-apply-core');
+
+/**
+ * @param {string} msg
+ * @returns {boolean}
+ */
+function isAlreadyMemberError(msg) {
+  return /already a member|409|Conflict/i.test(String(msg || ''));
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {{ name: string, displayName: string }} spec
+ * @param {boolean} dryRun
+ * @returns {Promise<{ id: string, created: boolean }>}
+ */
+async function ensureGroup(controllerUrl, authConfig, spec, dryRun) {
+  const name = spec.name;
+  const existingRes = await getGroup(controllerUrl, authConfig, name);
+  const existing = unwrapControllerData(existingRes);
+  if (existing && existing.id) {
+    return { id: existing.id, created: false };
+  }
+  if (dryRun) {
+    return { id: `(dry-run:${name})`, created: true };
+  }
+  const createdRes = await createGroup(controllerUrl, authConfig, {
+    name,
+    displayName: spec.displayName || name
+  });
+  throwIfApiFailed(createdRes);
+  const created = unwrapControllerData(createdRes);
+  return { id: created.id, created: true };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} userSpec
+ * @param {boolean} dryRun
+ * @returns {Promise<{ id: string, created: boolean }>}
+ */
+async function ensureUser(controllerUrl, authConfig, userSpec, dryRun) {
+  const existing = await findExistingUser(controllerUrl, authConfig, userSpec);
+  if (existing && existing.id) {
+    return { id: existing.id, created: false };
+  }
+  if (dryRun) {
+    return { id: `(dry-run:${userSpec.email})`, created: true };
+  }
+  const body = {
+    email: userSpec.email,
+    firstName: userSpec.firstName,
+    lastName: userSpec.lastName,
+    displayName: userSpec.displayName,
+    username: userSpec.username,
+    status: 'active'
+  };
+  Object.keys(body).forEach((k) => {
+    if (body[k] === undefined || body[k] === '') {
+      delete body[k];
+    }
+  });
+  const createdRes = await createUser(controllerUrl, authConfig, body);
+  throwIfApiFailed(createdRes);
+  const created = unwrapControllerData(createdRes);
+  return { id: created.id, created: true };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Map} groups
+ * @param {boolean} dryRun
+ * @returns {Promise<{ map: Map<string, string>, created: number, processed: number }>}
+ */
+async function applyGroupsPhase(controllerUrl, authConfig, groups, dryRun) {
+  const map = new Map();
+  let created = 0;
+  let processed = 0;
+  for (const spec of groups.values()) {
+    const out = await ensureGroup(controllerUrl, authConfig, spec, dryRun);
+    map.set(spec.name, out.id);
+    processed += 1;
+    if (out.created) {
+      created += 1;
+    }
+  }
+  return { map, created, processed };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Map} users
+ * @param {boolean} dryRun
+ * @returns {Promise<{ map: Map<string, string>, created: number, processed: number }>}
+ */
+async function applyUsersPhase(controllerUrl, authConfig, users, dryRun) {
+  const map = new Map();
+  let created = 0;
+  let processed = 0;
+  for (const [userKey, userSpec] of users.entries()) {
+    const out = await ensureUser(controllerUrl, authConfig, userSpec, dryRun);
+    map.set(userKey, out.id);
+    processed += 1;
+    if (out.created) {
+      created += 1;
+    }
+  }
+  return { map, created, processed };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object[]} memberships
+ * @param {Map<string, string>} userIdByKey
+ * @param {Map<string, string>} groupIdByName
+ * @param {boolean} dryRun
+ * @returns {Promise<{ created: number, processed: number, skipped: number }>}
+ */
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} m
+ * @param {Map<string, string>} userIdByKey
+ * @param {Map<string, string>} groupIdByName
+ * @param {boolean} dryRun
+ * @returns {Promise<'created'|'skipped'|'dry'>}
+ */
+async function applyOneMembership(controllerUrl, authConfig, m, userIdByKey, groupIdByName, dryRun) {
+  const userId = userIdByKey.get(m.userKey);
+  const groupId = groupIdByName.get(m.groupName);
+  if (!userId || !groupId) {
+    return 'skipped';
+  }
+  if (dryRun) {
+    return 'dry';
+  }
+  const res = await addUserToGroup(controllerUrl, authConfig, userId, groupId, {});
+  if (res && res.success !== false) {
+    return 'created';
+  }
+  if (isAlreadyMemberError(apiErrorMessage(res))) {
+    return 'skipped';
+  }
+  throw new Error(apiErrorMessage(res));
+}
+
+async function applyMembershipsPhase(
+  controllerUrl,
+  authConfig,
+  memberships,
+  userIdByKey,
+  groupIdByName,
+  dryRun
+) {
+  let created = 0;
+  let processed = 0;
+  let skipped = 0;
+  for (const m of memberships) {
+    const userId = userIdByKey.get(m.userKey);
+    const groupId = groupIdByName.get(m.groupName);
+    if (!userId || !groupId) {
+      continue;
+    }
+    processed += 1;
+    const outcome = await applyOneMembership(
+      controllerUrl,
+      authConfig,
+      m,
+      userIdByKey,
+      groupIdByName,
+      dryRun
+    );
+    if (outcome === 'created' || outcome === 'dry') {
+      created += 1;
+    } else if (outcome === 'skipped') {
+      skipped += 1;
+    }
+  }
+  return { created, processed, skipped };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} opts
+ * @returns {Promise<Object|null>}
+ */
+async function maybePurgeAndSync(controllerUrl, authConfig, opts) {
+  if (opts.dryRun) {
+    return null;
+  }
+  if (opts.purgeCache) {
+    const cacheRes = await clearAuthCache(controllerUrl, authConfig);
+    throwIfApiFailed(cacheRes);
+  }
+  if (!opts.sync || !opts.envKey) {
+    return null;
+  }
+  const syncRes = await fullSyncToDataplane(controllerUrl, authConfig, opts.envKey);
+  throwIfApiFailed(syncRes);
+  const stats = unwrapControllerData(syncRes);
+  assertSyncStatsOk(stats, { allowEmptySync: opts.allowEmptySync });
+  return stats;
+}
+
+module.exports = {
+  ensureGroup,
+  ensureUser,
+  applyGroupsPhase,
+  applyUsersPhase,
+  applyMembershipsPhase,
+  maybePurgeAndSync
+};

package/lib/identity/identity-apply-service.js

@@ -0,0 +1,77 @@
+/**
+ * @fileoverview Bulk identity apply (CSV) against miso-controller
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { parseUsersCsvFile, buildApplyPlanFromRows } = require('./identity-csv-parser');
+const {
+  applyGroupsPhase,
+  applyUsersPhase,
+  applyMembershipsPhase,
+  maybePurgeAndSync
+} = require('./identity-apply-phases');
+
+const {
+  unwrapControllerData,
+  apiErrorMessage,
+  throwIfApiFailed,
+  findExistingUser
+} = require('./identity-apply-core');
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runIdentityApply(controllerUrl, authConfig, options) {
+  const { rows } = parseUsersCsvFile(options.filePath, options.filterPrefix);
+  if (!rows.length) {
+    throw new Error('No data rows to apply after parsing CSV');
+  }
+  const plan = buildApplyPlanFromRows(rows);
+  const dryRun = Boolean(options.dryRun);
+
+  const groupPhase = await applyGroupsPhase(controllerUrl, authConfig, plan.groups, dryRun);
+  const userPhase = await applyUsersPhase(controllerUrl, authConfig, plan.users, dryRun);
+  const memPhase = await applyMembershipsPhase(
+    controllerUrl,
+    authConfig,
+    plan.memberships,
+    userPhase.map,
+    groupPhase.map,
+    dryRun
+  );
+
+  const syncStats = await maybePurgeAndSync(controllerUrl, authConfig, {
+    dryRun,
+    purgeCache: Boolean(options.purgeCache),
+    sync: Boolean(options.sync),
+    envKey: options.envKey,
+    allowEmptySync: Boolean(options.allowEmptySync)
+  });
+
+  return {
+    groupsProcessed: groupPhase.processed,
+    groupsCreated: groupPhase.created,
+    usersProcessed: userPhase.processed,
+    usersCreated: userPhase.created,
+    membershipsProcessed: memPhase.processed,
+    membershipsCreated: memPhase.created,
+    membershipsSkipped: memPhase.skipped,
+    dryRun,
+    syncStats
+  };
+}
+
+module.exports = {
+  unwrapControllerData,
+  apiErrorMessage,
+  throwIfApiFailed,
+  runIdentityApply,
+  findExistingUser
+};

package/lib/identity/identity-csv-parser.js

@@ -0,0 +1,114 @@
+/**
+ * @fileoverview Parse controller users.csv-style files for identity apply
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { readFileSync } = require('../internal/fs-real-sync');
+
+/**
+ * Parse one CSV line respecting double-quoted fields.
+ * @param {string} line
+ * @returns {string[]}
+ */
+function parseCsvLine(line) {
+  const out = [];
+  let cur = '';
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    if (ch === '"') {
+      if (inQuotes && line[i + 1] === '"') {
+        cur += '"';
+        i += 1;
+      } else {
+        inQuotes = !inQuotes;
+      }
+    } else if (ch === ',' && !inQuotes) {
+      out.push(cur.trim());
+      cur = '';
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur.trim());
+  return out;
+}
+
+/**
+ * @param {string} filePath
+ * @param {string} [filterPrefix]
+ * @returns {{ headers: string[], rows: Object[] }}
+ */
+function parseUsersCsvFile(filePath, filterPrefix = '') {
+  const raw = readFileSync(filePath, 'utf8');
+  const lines = raw.split(/\r?\n/).filter((l) => l.trim().length > 0);
+  if (lines.length < 2) {
+    throw new Error('CSV must include a header row and at least one data row');
+  }
+  const headers = parseCsvLine(lines[0]);
+  const prefix = String(filterPrefix || '').trim();
+  const rows = [];
+  for (let i = 1; i < lines.length; i += 1) {
+    const cells = parseCsvLine(lines[i]);
+    const row = {};
+    headers.forEach((h, idx) => {
+      row[h] = cells[idx] !== undefined ? cells[idx] : '';
+    });
+    const id = String(row.Id || row.id || '').trim();
+    if (prefix && id && !id.startsWith(prefix)) {
+      continue;
+    }
+    rows.push(row);
+  }
+  return { headers, rows };
+}
+
+/**
+ * Build unique entities from CSV rows (users.csv shape).
+ * @param {Object[]} rows
+ * @returns {{ groups: Map<string, { name: string, displayName: string }>, users: Map<string, Object>, memberships: { userKey: string, groupName: string }[] }}
+ */
+// eslint-disable-next-line complexity -- row shape varies; logic is linear per field
+function buildApplyPlanFromRows(rows) {
+  const groups = new Map();
+  const users = new Map();
+  const memberships = [];
+
+  for (const row of rows) {
+    const csvId = String(row.Id || row.id || '').trim();
+    const email = String(row.Email || row.email || '').trim();
+    if (!email) {
+      continue;
+    }
+    const userKey = csvId || email;
+    const groupName = String(row.GroupId || row.groupId || '').trim();
+    const groupDisplay = String(row.GroupName || row.groupName || groupName).trim();
+    if (groupName) {
+      if (!groups.has(groupName)) {
+        groups.set(groupName, { name: groupName, displayName: groupDisplay || groupName });
+      }
+      memberships.push({ userKey, groupName });
+    }
+    if (!users.has(userKey)) {
+      users.set(userKey, {
+        csvId,
+        email,
+        firstName: String(row.FirstName || row.firstName || '').trim() || undefined,
+        lastName: String(row.LastName || row.lastName || '').trim() || undefined,
+        displayName: String(row.DisplayName || row.displayName || '').trim() || undefined,
+        username: String(row.UserPrincipalName || row.userPrincipalName || row.username || '').trim() || undefined
+      });
+    }
+  }
+
+  return { groups, users, memberships };
+}
+
+module.exports = {
+  parseCsvLine,
+  parseUsersCsvFile,
+  buildApplyPlanFromRows
+};

package/lib/internal/fs-real-sync.js

@@ -93,6 +93,31 @@ function readdirSync(p, opts) {
   return delegate('readdirSync', opts !== undefined ? [p, opts] : [p]);
 }
 
+/**
+ * @param {string} prefix
+ * @returns {string}
+ */
+function mkdtempSync(prefix) {
+  return delegate('mkdtempSync', [prefix]);
+}
+
+/**
+ * @param {string} p
+ * @param {import('node:fs').RmOptions} [opts]
+ * @returns {void}
+ */
+function rmSync(p, opts) {
+  return delegate('rmSync', opts !== undefined ? [p, opts] : [p]);
+}
+
+/**
+ * @param {string} p
+ * @returns {void}
+ */
+function unlinkSync(p) {
+  return delegate('unlinkSync', [p]);
+}
+
 module.exports = {
   existsSync,
   readFileSync,
@@ -100,5 +125,8 @@ module.exports = {
   writeFileSync,
   mkdirSync,
   statSync,
-  readdirSync
+  readdirSync,
+  mkdtempSync,
+  rmSync,
+  unlinkSync
 };

package/lib/internal/node-fs.js

@@ -72,6 +72,7 @@ function buildBoundFs() {
       mkdirSync: snap.mkdirSync,
       readdirSync: snap.readdirSync,
       statSync: snap.statSync,
+      renameSync: snap.renameSync,
       watch: (...args) => live.watch(...args),
       promises: boundPromises
     };
@@ -83,6 +84,7 @@ function buildBoundFs() {
     mkdirSync: bindSync(rf, 'mkdirSync'),
     readdirSync: bindSync(rf, 'readdirSync'),
     statSync: bindSync(rf, 'statSync'),
+    renameSync: bindSync(rf, 'renameSync'),
     watch: (...args) => live.watch(...args),
     promises: boundPromises
   };

package/lib/protection/auth-context.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Dataplane auth/url resolution for protection commands.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveEnvironment } = require('../core/config');
+const { getDeviceOnlyAuth, getDeploymentAuth } = require('../utils/token-manager');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
+
+/**
+ * @param {Object} [options]
+ * @param {string} [options.env]
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
+ */
+async function resolveProtectionDataplaneContext(options = {}) {
+  const environment = options.env || (await resolveEnvironment());
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+
+  let authConfig;
+  try {
+    authConfig = await getDeviceOnlyAuth(controllerUrl);
+  } catch {
+    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane');
+  }
+
+  if (!authConfig?.token) {
+    throw new Error(
+      'Authentication required. Run "aifabrix login" and try again.'
+    );
+  }
+
+  const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
+  return { environment, controllerUrl, dataplaneUrl, authConfig };
+}
+
+module.exports = {
+  resolveProtectionDataplaneContext
+};

package/lib/protection/convert-batch.js

@@ -0,0 +1,90 @@
+/**
+ * @fileoverview Convert all protection manifests in `.protection/` between JSON and YAML.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, unlinkSync } = require('../internal/fs-real-sync');
+const { getProtectionRoot } = require('./paths');
+const { listProtectionManifestPaths } = require('./resolve');
+const { promptConfirm, targetFileName, convertOneFile } = require('../commands/convert');
+
+/**
+ * @param {string} root
+ * @param {string} format
+ * @returns {string[]}
+ */
+function listFilesNeedingConvert(root, format) {
+  const targetExt = format === 'json' ? '.json' : '.yaml';
+  return listProtectionManifestPaths(root).filter((p) => {
+    return path.extname(p).toLowerCase() !== targetExt;
+  });
+}
+
+/**
+ * @param {string[]} toConvert
+ * @param {string} format
+ * @param {boolean} force
+ * @returns {Promise<void>}
+ */
+async function confirmProtectionConvert(toConvert, format, force) {
+  if (force) {
+    return;
+  }
+  const lines = toConvert.map((p) => `  • ${path.basename(p)} → ${targetFileName(p, format)}`);
+  const confirmed = await promptConfirm(
+    `Convert all protection manifests to ${format}?\n${lines.join('\n')}\nAre you sure? (y/N) `
+  );
+  if (!confirmed) {
+    throw new Error('Convert cancelled.');
+  }
+}
+
+/**
+ * @param {string} root
+ * @param {string[]} toConvert
+ * @param {string} format
+ * @returns {{ converted: string[], deleted: string[] }}
+ */
+function convertProtectionFiles(root, toConvert, format) {
+  const converted = [];
+  const deleted = [];
+  for (const sourcePath of toConvert) {
+    const targetPath = path.join(root, targetFileName(sourcePath, format));
+    convertOneFile(sourcePath, targetPath, format);
+    converted.push(targetPath);
+    if (path.normalize(sourcePath) !== path.normalize(targetPath)) {
+      unlinkSync(sourcePath);
+      deleted.push(sourcePath);
+    }
+  }
+  return { converted, deleted };
+}
+
+/**
+ * @param {string} format - `yaml` | `json`
+ * @param {Object} opts
+ * @returns {Promise<{ converted: string[], deleted: string[] }>}
+ */
+async function runConvertProtectionBatch(format, opts = {}) {
+  const root = opts.root || getProtectionRoot();
+  if (!existsSync(root)) {
+    throw new Error(`Protection folder not found: ${root}`);
+  }
+  const toConvert = listFilesNeedingConvert(root, format);
+  if (!toConvert.length) {
+    return { converted: [], deleted: [] };
+  }
+  await confirmProtectionConvert(toConvert, format, opts.force === true);
+  return convertProtectionFiles(root, toConvert, format);
+}
+
+module.exports = {
+  runConvertProtectionBatch,
+  listFilesNeedingConvert,
+  confirmProtectionConvert,
+  convertProtectionFiles
+};

package/lib/protection/load.js

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Load protection manifest YAML files (v1).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
+const { yamlToJson } = require('../utils/config-format');
+
+/**
+ * @param {string} manifestPath - Absolute path to `.yaml` manifest
+ * @returns {Object} Parsed manifest object
+ */
+function loadProtectionManifest(manifestPath) {
+  const p = path.resolve(String(manifestPath || '').trim());
+  if (!p) {
+    throw new Error('Protection manifest path is required');
+  }
+  if (!existsSync(p)) {
+    throw new Error(`Protection manifest not found: ${p}`);
+  }
+  const ext = path.extname(p).toLowerCase();
+  if (ext !== '.yaml' && ext !== '.yml' && ext !== '.json') {
+    throw new Error(
+      `Protection manifest must be .yaml, .yml, or .json (got ${ext || '(none)'}).`
+    );
+  }
+  const content = readFileSync(p, 'utf8');
+  if (ext === '.json') {
+    const parsed = JSON.parse(content);
+    return parsed === undefined || parsed === null ? {} : parsed;
+  }
+  return yamlToJson(content);
+}
+
+module.exports = {
+  loadProtectionManifest
+};