@aifabrix/builder 2.45.0 → 2.45.5

package/lib/commands/identity-membership-role-cache.js

@@ -0,0 +1,175 @@
+/**
+ * @fileoverview Identity membership, role, and cache subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  parseGroupsList,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const { addUserToGroup, removeUserFromGroup } = require('../api/user-groups.api');
+const { listEnvironmentRoles, updateRoleGroups } = require('../api/environments.api');
+const { clearAuthCache, invalidateAuthCache } = require('../api/auth-cache.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+/**
+ * @param {import('commander').Command} memCmd
+ */
+function setupIdentityMembershipCommands(memCmd) {
+  memCmd
+    .command('add <userId> <groupId>')
+    .description('Add user to group (controller ids)')
+    .action(async(userId, groupId) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await addUserToGroup(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(userId, 'userId'),
+          requireNonEmpty(groupId, 'groupId'),
+          {}
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Membership created: ${userId} → ${groupId}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  memCmd
+    .command('remove <userId> <groupId>')
+    .description('Remove user from group')
+    .action(async(userId, groupId) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await removeUserFromGroup(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(userId, 'userId'),
+          requireNonEmpty(groupId, 'groupId')
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Membership removed: ${userId} → ${groupId}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} roleCmd
+ */
+function setupIdentityRoleCommands(roleCmd) {
+  roleCmd
+    .command('list')
+    .description('List roles and group mappings for an environment')
+    .requiredOption('-e, --env <key>', 'Environment key (dev, tst, pro)')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = await resolveEnvKey(options);
+        const res = await listEnvironmentRoles(controllerUrl, envKey, authConfig);
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || data?.roles || [];
+        (items || []).forEach((r) => {
+          const groups = Array.isArray(r.groups) ? r.groups.join(', ') : '';
+          logger.log(`  ${r.value || r.role || r.name}  →  ${groups || '—'}`);
+        });
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  roleCmd
+    .command('set-groups <roleValue>')
+    .description('Map role to groups in an environment')
+    .requiredOption('-e, --env <key>', 'Environment key')
+    .requiredOption('--groups <names>', 'Comma-separated group names')
+    .action(async(roleValue, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = await resolveEnvKey(options);
+        const groups = parseGroupsList(options.groups);
+        const res = await updateRoleGroups(
+          controllerUrl,
+          envKey,
+          requireNonEmpty(roleValue, 'roleValue'),
+          authConfig,
+          groups
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Role ${roleValue} mapped to ${groups.length} group(s) in ${envKey}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cacheCmd
+ */
+function setupIdentityCacheCommands(cacheCmd) {
+  cacheCmd
+    .command('clear')
+    .description('Clear all controller auth/RBAC cache entries')
+    .action(async() => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await clearAuthCache(controllerUrl, authConfig);
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine('Controller cache cleared'));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  cacheCmd
+    .command('invalidate')
+    .description('Invalidate controller cache entries by pattern')
+    .requiredOption('--pattern <pattern>', 'Cache key pattern (e.g. permissions:*)')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await invalidateAuthCache(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(options.pattern, 'pattern')
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Cache invalidated for pattern: ${options.pattern}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  setupIdentityMembershipCommands,
+  setupIdentityRoleCommands,
+  setupIdentityCacheCommands
+};

package/lib/commands/identity-shared.js

@@ -0,0 +1,94 @@
+/**
+ * @fileoverview Shared auth/helpers for identity CLI commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const {
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage
+} = require('../identity/identity-apply-core');
+
+/**
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAndAuth() {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Not authenticated for controller: ${controllerUrl}. Run "aifabrix login" and try again.`
+    );
+  }
+  return {
+    controllerUrl: deviceToken.controller || normalized,
+    authConfig: { type: 'bearer', token: deviceToken.token }
+  };
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function resolveEnvKey(options = {}) {
+  const fromFlag = options.env || options.environment;
+  if (fromFlag) {
+    return String(fromFlag).trim();
+  }
+  const env = await resolveEnvironment();
+  return env || 'dev';
+}
+
+/**
+ * @param {string} raw
+ * @param {string} label
+ * @returns {string}
+ */
+function requireNonEmpty(raw, label) {
+  const s = String(raw || '').trim();
+  if (!s) {
+    throw new Error(`${label} is required.`);
+  }
+  return s;
+}
+
+/**
+ * @param {string} groupsArg
+ * @returns {string[]}
+ */
+function parseGroupsList(groupsArg) {
+  const raw = String(groupsArg || '').trim();
+  if (!raw) {
+    throw new Error('--groups is required (comma-separated group names).');
+  }
+  const parts = raw
+    .split(',')
+    .map((g) => g.trim())
+    .filter(Boolean);
+  if (parts.length === 0) {
+    throw new Error('At least one group name is required in --groups.');
+  }
+  return parts;
+}
+
+module.exports = {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  parseGroupsList,
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage
+};

package/lib/commands/identity-user-cli.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Identity user subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine, headerKeyValue } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const {
+  listUsers,
+  getUser,
+  createUser,
+  listUserGroups
+} = require('../api/users.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+function registerUserCreate(userCmd) {
+  userCmd
+    .command('create')
+    .description('Create a user on the controller')
+    .requiredOption('--email <email>', 'User email')
+    .option('--first-name <name>', 'First name')
+    .option('--last-name <name>', 'Last name')
+    .option('--display-name <name>', 'Display name')
+    .option('--username <name>', 'Username')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await createUser(controllerUrl, authConfig, {
+          email: requireNonEmpty(options.email, 'email'),
+          firstName: options.firstName,
+          lastName: options.lastName,
+          displayName: options.displayName,
+          username: options.username,
+          status: 'active'
+        });
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        logger.log(formatSuccessLine(`User created: ${row.id} (${row.email})`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserList(userCmd) {
+  userCmd
+    .command('list')
+    .description('List users')
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search users')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listUsers(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search
+        });
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        logger.log(chalk.bold(`\nUsers (${items.length} shown):\n`));
+        items.forEach((u) => logger.log(`  ${u.id}  ${u.email}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserGet(userCmd) {
+  userCmd
+    .command('get <idOrEmail>')
+    .description('Get user by id or email')
+    .option('--json', 'JSON output')
+    .action(async(idOrEmail, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await getUser(controllerUrl, authConfig, requireNonEmpty(idOrEmail, 'idOrEmail'));
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        if (options.json) {
+          printJson(row);
+          return;
+        }
+        logger.log(headerKeyValue('Id:', row.id));
+        logger.log(headerKeyValue('Email:', row.email));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserGroups(userCmd) {
+  userCmd
+    .command('groups <idOrEmail>')
+    .description('List groups for a user')
+    .option('--json', 'JSON output')
+    .action(async(idOrEmail, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listUserGroups(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(idOrEmail, 'idOrEmail')
+        );
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((g) => logger.log(`  ${g.id || g.groupId}  ${g.name || ''}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} userCmd
+ */
+function setupIdentityUserCommands(userCmd) {
+  registerUserCreate(userCmd);
+  registerUserList(userCmd);
+  registerUserGet(userCmd);
+  registerUserGroups(userCmd);
+}
+
+module.exports = {
+  setupIdentityUserCommands
+};

package/lib/commands/identity.js

@@ -0,0 +1,43 @@
+/**
+ * Identity and RBAC commands (Controller users, groups, sync, cache).
+ *
+ * @fileoverview `aifabrix identity` command group
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { setupIdentityUserCommands } = require('./identity-user-cli');
+const { setupIdentityGroupCommands } = require('./identity-group-cli');
+const {
+  setupIdentityMembershipCommands,
+  setupIdentityRoleCommands,
+  setupIdentityCacheCommands
+} = require('./identity-membership-role-cache');
+const { setupIdentityApplyCommand, setupIdentitySyncCommand } = require('./identity-apply-sync');
+const { IDENTITY_HELP_AFTER } = require('../cli/setup-app.help');
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupIdentityCommands(program) {
+  const identityCmd = program
+    .command('identity')
+    .description('Manage controller users, groups, RBAC mappings, cache, and dataplane identity sync')
+    .addHelpText('after', IDENTITY_HELP_AFTER);
+
+  setupIdentityUserCommands(identityCmd.command('user').description('User commands'));
+  setupIdentityGroupCommands(identityCmd.command('group').description('Group commands'));
+  setupIdentityMembershipCommands(
+    identityCmd.command('membership').description('User–group membership commands')
+  );
+  setupIdentityRoleCommands(identityCmd.command('role').description('Environment role commands'));
+  setupIdentityCacheCommands(identityCmd.command('cache').description('Controller cache commands'));
+  setupIdentityApplyCommand(identityCmd);
+  setupIdentitySyncCommand(identityCmd);
+}
+
+module.exports = {
+  setupIdentityCommands
+};

package/lib/commands/login.js

@@ -17,6 +17,7 @@ const logger = require('../utils/logger');
 const { handleCredentialsLogin } = require('./login-credentials');
 const { handleDeviceCodeLogin } = require('./login-device');
 const { resolveControllerUrl } = require('../utils/controller-url');
+const { tryRefreshDataplaneVersionAfterLogin } = require('./auth-status-dataplane-version');
 
 /**
  * Determine and validate authentication method
@@ -161,6 +162,47 @@ async function handleDeviceCodeLoginFlow(controllerUrl, environment, options) {
   });
 }
 
+/**
+ * @param {string} controllerUrl
+ * @param {Object} options
+ * @param {boolean} skipRefresh
+ * @returns {Promise<void>}
+ */
+async function refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh) {
+  if (skipRefresh) return;
+  await tryRefreshDataplaneVersionAfterLogin(controllerUrl, options);
+}
+
+/**
+ * @returns {Promise<'credentials'|'device'>}
+ */
+async function executeLoginMethod(method, controllerUrl, environment, options, skipRefresh) {
+  if (method === 'credentials') {
+    await handleCredentialsLoginFlow(controllerUrl, environment, options);
+    await refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh);
+    return 'credentials';
+  }
+  await handleDeviceCodeLoginFlow(controllerUrl, environment, options);
+  await refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh);
+  return 'device';
+}
+
+/**
+ * @param {Object} options
+ * @param {string} controllerUrl
+ * @param {string} environment
+ */
+function logLoginSuccessFooter(options, controllerUrl, environment) {
+  if (options.compact) return;
+  logger.log(formatSuccessParagraph('Successfully logged in!'));
+  logger.log(chalk.gray(`Controller: ${controllerUrl}`));
+  logger.log(chalk.gray(`Environment: ${environment}`));
+  if (options.app) {
+    logger.log(chalk.gray(`App: ${options.app}`));
+  }
+  logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
+}
+
 async function handleLogin(options) {
   if (!options.compact) {
     logger.log(chalk.blue('\n🔐 Logging in to Miso Controller...\n'));
@@ -169,25 +211,13 @@ async function handleLogin(options) {
   const controllerUrl = await normalizeControllerUrl(options);
   const environment = await handleEnvironmentConfig(options);
   const method = await determineAuthMethod(options.method);
-
   validateScopeOptions(method, options);
 
-  if (method === 'credentials') {
-    await handleCredentialsLoginFlow(controllerUrl, environment, options);
-  } else if (method === 'device') {
-    await handleDeviceCodeLoginFlow(controllerUrl, environment, options);
-    return; // Early return for device flow (already saved config)
-  }
+  const skipRefresh = options.skipDataplaneVersionRefresh === true;
+  const flow = await executeLoginMethod(method, controllerUrl, environment, options, skipRefresh);
+  if (flow === 'device') return;
 
-  if (!options.compact) {
-    logger.log(formatSuccessParagraph('Successfully logged in!'));
-    logger.log(chalk.gray(`Controller: ${controllerUrl}`));
-    logger.log(chalk.gray(`Environment: ${environment}`));
-    if (options.app) {
-      logger.log(chalk.gray(`App: ${options.app}`));
-    }
-    logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
-  }
+  logLoginSuccessFooter(options, controllerUrl, environment);
 }
 
 module.exports = { handleLogin };