@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/auth-status-client-tokens.js

@@ -0,0 +1,214 @@
+/**
+ * Client token listing and proactive refresh for auth status.
+ *
+ * @fileoverview Stored app tokens, auto-refresh when credentials exist
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const { successGlyph, failureGlyph } = require('../utils/cli-test-layout-chalk');
+const {
+  getOrRefreshClientToken,
+  loadClientCredentials,
+  refreshClientToken,
+  isTokenExpired
+} = require('../utils/token-manager');
+
+/**
+ * @param {string} controllerUrl
+ * @param {string} storedController
+ * @returns {boolean}
+ */
+function controllersMatch(controllerUrl, storedController) {
+  if (!storedController) {
+    return false;
+  }
+  return config.normalizeControllerUrl(storedController) === config.normalizeControllerUrl(controllerUrl);
+}
+
+/**
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Record<string, { controller?: string, token?: string, expiresAt?: string }>>}
+ */
+async function getClientEntriesForController(environment, controllerUrl) {
+  const configData = await config.getConfig();
+  const clients = configData.environments?.[environment]?.clients || {};
+  const out = {};
+  for (const [appName, tokenData] of Object.entries(clients)) {
+    if (controllersMatch(controllerUrl, tokenData?.controller)) {
+      out[appName] = tokenData;
+    }
+  }
+  return out;
+}
+
+/**
+ * Refresh expired client tokens when secrets.local.yaml (or env) has client id/secret.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<number>} Count refreshed
+ */
+async function refreshExpiredClientTokensWherePossible(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  let refreshed = 0;
+  for (const appName of Object.keys(entries)) {
+    const tokenData = entries[appName];
+    if (!tokenData?.token || !isTokenExpired(tokenData.expiresAt)) {
+      continue;
+    }
+    const credentials = await loadClientCredentials(appName);
+    if (!credentials?.clientId || !credentials?.clientSecret) {
+      continue;
+    }
+    try {
+      await refreshClientToken(environment, appName, controllerUrl);
+      refreshed += 1;
+    } catch {
+      // Skip apps without valid credentials or controller errors
+    }
+  }
+  return refreshed;
+}
+
+/**
+ * @param {string} expiresAt
+ * @returns {'valid'|'expired'|'unknown'}
+ */
+function tokenExpiryState(expiresAt) {
+  if (!expiresAt) {
+    return 'unknown';
+  }
+  return isTokenExpired(expiresAt) ? 'expired' : 'valid';
+}
+
+/**
+ * Build rows for stored client tokens table.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Array<{ appName: string, expiresAt: string, state: string, logoutCmd: string }>>}
+ */
+async function listClientTokenRows(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const rows = [];
+  for (const appName of Object.keys(entries).sort()) {
+    const tokenData = entries[appName];
+    const state = tokenExpiryState(tokenData.expiresAt);
+    const credentials = await loadClientCredentials(appName);
+    const canRefresh = !!(credentials?.clientId && credentials?.clientSecret);
+    let stateLabel = state;
+    if (state === 'expired' && canRefresh) {
+      stateLabel = 'expired (credentials available — refreshed on status if possible)';
+    } else if (state === 'expired' && !canRefresh) {
+      stateLabel = 'expired (no client id/secret in secrets — logout or login)';
+    }
+    rows.push({
+      appName,
+      expiresAt: tokenData.expiresAt || '—',
+      state: stateLabel,
+      logoutCmd: `aifabrix logout -e ${environment} -a ${appName}`
+    });
+  }
+  return rows;
+}
+
+/**
+ * Print stored application client tokens and logout commands.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @param {number} [refreshedCount]
+ * @returns {Promise<void>}
+ */
+async function displayStoredClientTokensSection(environment, controllerUrl, refreshedCount = 0) {
+  const rows = await listClientTokenRows(environment, controllerUrl);
+  if (rows.length === 0) {
+    return;
+  }
+
+  logger.log('');
+  logger.log(chalk.bold('Stored application client tokens:'));
+  if (refreshedCount > 0) {
+    logger.log(
+      chalk.gray(
+        `  Refreshed ${refreshedCount} expired token(s) using client id/secret from secrets.local.yaml or env.`
+      )
+    );
+  }
+  logger.log(chalk.gray(`  Environment: ${environment} · Controller: ${controllerUrl}`));
+  logger.log('');
+  for (const row of rows) {
+    const icon = row.state.startsWith('valid') ? successGlyph() : failureGlyph();
+    logger.log(`  ${icon} ${chalk.cyan(row.appName)}`);
+    logger.log(`      Expires: ${chalk.gray(row.expiresAt)}`);
+    logger.log(`      Status: ${row.state}`);
+    logger.log(`      Clear: ${chalk.gray(row.logoutCmd)}`);
+  }
+  logger.log('');
+  logger.log(chalk.gray('  Clear all client tokens for this environment:'), chalk.gray(`aifabrix logout -e ${environment}`));
+  logger.log(chalk.gray('  Clear device login for this controller:'), chalk.gray(`aifabrix logout -c ${controllerUrl}`));
+  logger.log('');
+}
+
+/**
+ * Resolve a working client token (refresh when expired if credentials exist).
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {function(string, string, string, string, string): Promise<Object>} validateClientTokenFn
+ * @returns {Promise<Object|null>}
+ */
+async function tryResolveClientTokenAuth(controllerUrl, environment, validateClientTokenFn) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const appNames = Object.keys(entries);
+  if (appNames.length === 0) {
+    return null;
+  }
+
+  const ordered = ['dataplane', ...appNames.filter(a => a !== 'dataplane').sort()];
+  let lastFailure = null;
+
+  for (const appName of ordered) {
+    try {
+      const refreshed = await getOrRefreshClientToken(environment, appName, controllerUrl);
+      if (!refreshed?.token) {
+        continue;
+      }
+      const stored = await config.getClientToken(environment, appName);
+      const result = await validateClientTokenFn(
+        refreshed.token,
+        controllerUrl,
+        environment,
+        appName,
+        stored?.expiresAt
+      );
+      if (result.authenticated) {
+        return result;
+      }
+      lastFailure = result;
+    } catch {
+      // Try next app
+    }
+  }
+
+  return lastFailure;
+}
+
+module.exports = {
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection,
+  tryResolveClientTokenAuth,
+  listClientTokenRows,
+  getClientEntriesForController
+};

package/lib/commands/auth-status-dataplane-version.js

@@ -0,0 +1,269 @@
+/**
+ * Auth-status dataplane version refresh + compatibility resolution (plan 142.0).
+ *
+ * Extracted from `auth-status.js` to keep that file under the 500-line limit
+ * (`.cursor/rules/project-rules.mdc → File and Function Size Limits`). The
+ * helpers here are pure-ish (only depend on the dataplane health API and the
+ * `device.<controllerUrl>` cache module) so they are easy to mock in unit
+ * tests.
+ *
+ * @fileoverview Resolve dataplane version + Builder CLI compatibility for auth status
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
+const {
+  updateDeviceDataplaneVersions,
+  getDeviceDataplaneVersions
+} = require('../core/config-device-dataplane');
+const {
+  getInstalledCliVersion
+} = require('../utils/dataplane-cli-version-gate');
+const { isAtLeast, isValidSemver } = require('../utils/semver-compare');
+
+/** Max wall time for post-login version cache refresh (silent after success banner). */
+const LOGIN_POST_REFRESH_BUDGET_MS = 12000;
+
+/** Per health probe during login refresh (two endpoints may be tried). */
+const LOGIN_HEALTH_PROBE_TIMEOUT_MS = 6000;
+
+/**
+ * Resolve when `promise` settles or when `timeoutMs` elapses (returns undefined).
+ * @template T
+ * @param {Promise<T>} promise
+ * @param {number} timeoutMs
+ * @returns {Promise<T|undefined>}
+ */
+function raceWithTimeout(promise, timeoutMs) {
+  return Promise.race([
+    promise,
+    new Promise((resolve) => {
+      setTimeout(() => resolve(undefined), timeoutMs);
+    })
+  ]);
+}
+
+/**
+ * Per plan 142.0: invalid semver from the dataplane is logged but does **not**
+ * block the CLI; missing min version means no enforcement.
+ *
+ * @param {string} cliVersion
+ * @param {string|undefined} minBuilderCliVersion
+ * @returns {boolean}
+ */
+function computeCompatibility(cliVersion, minBuilderCliVersion) {
+  if (!minBuilderCliVersion) return true;
+  if (!isValidSemver(minBuilderCliVersion) || !isValidSemver(cliVersion)) {
+    return true;
+  }
+  return isAtLeast(cliVersion, minBuilderCliVersion);
+}
+
+/**
+ * Read `device.<controllerUrl>` cache without throwing.
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<Object|null>}
+ */
+async function safeReadCache(controllerUrl) {
+  if (!controllerUrl) return null;
+  try {
+    return await getDeviceDataplaneVersions(controllerUrl);
+  } catch (_error) {
+    return null;
+  }
+}
+
+/**
+ * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
+ * and derive the compatibility verdict against the installed Builder CLI.
+ * Falls back to the cached entry when the live probe fails so `auth status`
+ * still shows the last-known values offline.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (cache key)
+ * @param {string} dataplaneUrl - Dataplane base URL for the health probe
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options = {}) {
+  const cliVersion = getInstalledCliVersion();
+  let dataplaneVersion;
+  let minBuilderCliVersion;
+  const healthOpts = {};
+  if (options.healthTimeoutMs !== undefined && options.healthTimeoutMs !== null) {
+    healthOpts.timeoutMs = options.healthTimeoutMs;
+  }
+
+  try {
+    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl, healthOpts);
+    if (snapshot) {
+      dataplaneVersion = snapshot.version;
+      minBuilderCliVersion = snapshot.minBuilderCliVersion;
+      try {
+        await updateDeviceDataplaneVersions(controllerUrl, {
+          version: dataplaneVersion,
+          minBuilderCliVersion: minBuilderCliVersion || null
+        });
+      } catch (_persistError) {
+        // cache write failure must not break the display
+      }
+    }
+  } catch (_fetchError) {
+    // ignore — fall through to cached values
+  }
+
+  if (!dataplaneVersion && !minBuilderCliVersion) {
+    const cached = await safeReadCache(controllerUrl);
+    if (cached) {
+      dataplaneVersion = cached.version;
+      minBuilderCliVersion = cached.minBuilderCliVersion;
+    }
+  }
+
+  const compatible = computeCompatibility(cliVersion, minBuilderCliVersion);
+  return { dataplaneVersion, minBuilderCliVersion, cliVersion, compatible };
+}
+
+/**
+ * Load cached versions only (no live probe). Used when the dataplane is
+ * unreachable so `auth status` can still surface a known compatibility floor.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function loadCachedVersionInfo(controllerUrl) {
+  const cliVersion = getInstalledCliVersion();
+  const cached = await safeReadCache(controllerUrl);
+  const dataplaneVersion = cached ? cached.version : undefined;
+  const minBuilderCliVersion = cached ? cached.minBuilderCliVersion : undefined;
+  return {
+    dataplaneVersion,
+    minBuilderCliVersion,
+    cliVersion,
+    compatible: computeCompatibility(cliVersion, minBuilderCliVersion)
+  };
+}
+
+/**
+ * Resolve bearer auth after login (device token preferred, else client app token).
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} loginOptions
+ * @returns {Promise<Object|null>}
+ */
+async function resolveAuthConfigAfterLogin(controllerUrl, environment, loginOptions) {
+  const { getOrRefreshDeviceToken, getDeploymentAuth } = require('../utils/token-manager');
+  const device = await getOrRefreshDeviceToken(controllerUrl);
+  if (device && device.token) {
+    return { type: 'bearer', token: device.token };
+  }
+  if (!loginOptions.app) {
+    return null;
+  }
+  try {
+    return await getDeploymentAuth(controllerUrl, environment, loginOptions.app);
+  } catch (_authError) {
+    return null;
+  }
+}
+
+/**
+ * Resolve dataplane URL after login (mirrors auth-status silent resolver).
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} authConfig
+ * @returns {Promise<string|null>}
+ */
+async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authConfig) {
+  const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
+  const { getDataplaneUrl } = require('../datasource/deploy');
+  try {
+    const dataplaneAppKey = await findDataplaneServiceAppKey(
+      controllerUrl,
+      environment,
+      authConfig
+    );
+    if (dataplaneAppKey) {
+      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
+    }
+    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+  } catch (_resolveError) {
+    return null;
+  }
+}
+
+/**
+ * Best-effort health refresh after login when dataplane URL is discoverable.
+ * Never throws — cache failures must not block login success.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (device cache key)
+ * @param {Object} [loginOptions]
+ * @param {string} [loginOptions.app] - App name (credentials login) for client-token auth
+ * @returns {Promise<void>}
+ */
+async function tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions = {}) {
+  const { resolveEnvironment } = require('../core/config');
+  const environment = await resolveEnvironment();
+  const authConfig = await resolveAuthConfigAfterLogin(
+    controllerUrl,
+    environment,
+    loginOptions
+  );
+  if (!authConfig) {
+    return;
+  }
+  const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
+    controllerUrl,
+    environment,
+    authConfig
+  );
+  if (dataplaneUrl) {
+    await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, {
+      healthTimeoutMs: LOGIN_HEALTH_PROBE_TIMEOUT_MS
+    });
+  }
+}
+
+async function tryRefreshDataplaneVersionAfterLogin(controllerUrl, loginOptions = {}) {
+  if (!controllerUrl || typeof controllerUrl !== 'string') {
+    return;
+  }
+  try {
+    await raceWithTimeout(
+      tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions),
+      LOGIN_POST_REFRESH_BUDGET_MS
+    );
+  } catch (_error) {
+    // best-effort only
+  }
+}
+
+module.exports = {
+  refreshDataplaneVersionInfo,
+  loadCachedVersionInfo,
+  computeCompatibility,
+  tryRefreshDataplaneVersionAfterLogin,
+  LOGIN_POST_REFRESH_BUDGET_MS,
+  LOGIN_HEALTH_PROBE_TIMEOUT_MS,
+  raceWithTimeout
+};

package/lib/commands/auth-status-display.js

@@ -0,0 +1,94 @@
+/**
+ * Auth-status dataplane version block + blocking upgrade UX (plan 142.0).
+ *
+ * Kept in a separate module so `auth-status.js` stays under the 500-line
+ * limit and so the same display helpers can be reused by future dataplane
+ * gate surfaces (`upload`, `wizard`, `deploy`, …).
+ *
+ * @fileoverview TTY rendering for dataplane / Builder CLI compatibility
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  successGlyph,
+  failureGlyph
+} = require('../utils/cli-test-layout-chalk');
+const {
+  formatCliVersionGateError
+} = require('../utils/dataplane-cli-version-help');
+
+/**
+ * Format a single key/value version line indented under the dataplane block.
+ * @private
+ * @param {string} label
+ * @param {string|undefined|null} value
+ * @returns {string}
+ */
+function versionLine(label, value) {
+  const display = value && String(value).trim() ? chalk.cyan(value) : chalk.gray('—');
+  return `  ${label}: ${display}`;
+}
+
+/**
+ * Render the dataplane version subsection on `aifabrix auth status`.
+ *
+ * Designed to be called immediately after the existing connection/status line,
+ * so the output reads as a single grouped block per layout.md §HEADER BLOCK.
+ *
+ * @param {Object} params
+ * @param {boolean} params.connected - Whether dataplane reachability probe passed
+ * @param {string|undefined} params.dataplaneVersion - From `device.<controllerUrl>.dataplane-version`
+ * @param {string|undefined} params.minBuilderCliVersion - From `device.<controllerUrl>.dataplane-min-cli-version`
+ * @param {string} params.cliVersion - Installed Builder CLI version
+ * @param {boolean} params.compatible - true when CLI ≥ minimum (or no minimum enforced)
+ * @returns {void}
+ */
+function displayDataplaneVersionSection({
+  connected,
+  dataplaneVersion,
+  minBuilderCliVersion,
+  cliVersion,
+  compatible
+}) {
+  if (!connected && !dataplaneVersion) {
+    // Nothing to add — keep auth status quiet when the dataplane probe failed
+    // and no cached version is known (the reachability line already told the user).
+    return;
+  }
+  logger.log(versionLine('Dataplane version', dataplaneVersion));
+  logger.log(versionLine('Min Builder CLI', minBuilderCliVersion));
+  logger.log(versionLine('This CLI', cliVersion));
+  if (!minBuilderCliVersion) {
+    logger.log(`  Compatibility: ${chalk.gray('Not enforced')}`);
+    return;
+  }
+  if (compatible) {
+    logger.log(`  Compatibility: ${successGlyph()} ${chalk.green('OK')}`);
+  } else {
+    logger.log(`  Compatibility: ${failureGlyph()} ${chalk.red('Upgrade required')}`);
+  }
+}
+
+/**
+ * Render the blocking upgrade block (red ✖ + Next actions) under the
+ * dataplane subsection when the CLI is incompatible.
+ *
+ * @param {Object} params
+ * @param {string} params.required - Required minimum semver
+ * @param {string} params.installed - Currently installed semver
+ * @returns {void}
+ */
+function displayCliUpgradeRequired({ required, installed }) {
+  logger.log('');
+  logger.log(formatCliVersionGateError(required, installed));
+}
+
+module.exports = {
+  displayDataplaneVersionSection,
+  displayCliUpgradeRequired
+};