@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/identity-apply-sync.js

@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Identity apply and sync commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk
+} = require('./identity-shared');
+const { clearAuthCache } = require('../api/auth-cache.api');
+const { fullSyncToDataplane } = require('../api/dataplane-sync.api');
+const { runIdentityApply } = require('../identity/identity-apply-service');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+/**
+ * @param {import('commander').Command} identityCmd
+ */
+function setupIdentityApplyCommand(identityCmd) {
+  identityCmd
+    .command('apply')
+    .description('Apply users/groups/memberships from a CSV file (users.csv shape)')
+    .requiredOption('--file <path>', 'CSV file path')
+    .option('-e, --env <key>', 'Environment for --sync')
+    .option('--filter-prefix <prefix>', 'Only rows whose Id starts with this prefix')
+    .option('--dry-run', 'Parse and plan only; no writes')
+    .option('--sync', 'Run dataplane full sync after apply')
+    .option('--purge-cache', 'Clear controller cache before sync')
+    .option('--allow-empty-sync', 'Do not fail when sync reports usersProcessed=0')
+    .option('--json', 'JSON summary')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = options.sync ? await resolveEnvKey(options) : undefined;
+        const summary = await runIdentityApply(controllerUrl, authConfig, {
+          filePath: requireNonEmpty(options.file, 'file'),
+          filterPrefix: options.filterPrefix,
+          dryRun: Boolean(options.dryRun),
+          purgeCache: Boolean(options.purgeCache),
+          sync: Boolean(options.sync),
+          envKey,
+          allowEmptySync: Boolean(options.allowEmptySync)
+        });
+        if (options.json) {
+          printJson(summary);
+          return;
+        }
+        logger.log(formatSuccessLine('Identity apply finished'));
+        logger.log(
+          `  groups: ${summary.groupsProcessed} processed (${summary.groupsCreated} created)`
+        );
+        logger.log(`  users: ${summary.usersProcessed} processed (${summary.usersCreated} created)`);
+        logger.log(
+          `  memberships: ${summary.membershipsProcessed} processed (${summary.membershipsCreated} created, ${summary.membershipsSkipped} skipped)`
+        );
+        if (summary.syncStats) {
+          logger.log(
+            `  sync: usersProcessed=${summary.syncStats.usersProcessed ?? 0} groupsProcessed=${summary.syncStats.groupsProcessed ?? 0}`
+          );
+        }
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} identityCmd
+ */
+function setupIdentitySyncCommand(identityCmd) {
+  identityCmd
+    .command('sync')
+    .description('Full identity sync from controller to dataplane')
+    .option('-e, --env <key>', 'Environment key')
+    .option('--purge-cache', 'Clear controller cache before sync')
+    .option('--allow-empty-sync', 'Do not fail when usersProcessed=0')
+    .option('--json', 'JSON stats')
+    .action(async(options) => runIdentitySyncAction(options));
+}
+
+/**
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function maybePurgeCache(controllerUrl, authConfig, purgeCache) {
+  if (!purgeCache) {
+    return;
+  }
+  const cacheRes = await clearAuthCache(controllerUrl, authConfig);
+  throwIfApiFailed(cacheRes);
+  logger.log(formatSuccessLine('Controller cache cleared'));
+}
+
+async function runIdentitySyncAction(options) {
+  try {
+    const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+    const envKey = await resolveEnvKey(options);
+    await maybePurgeCache(controllerUrl, authConfig, options.purgeCache);
+    const res = await fullSyncToDataplane(controllerUrl, authConfig, envKey);
+    throwIfApiFailed(res);
+    const stats = unwrapControllerData(res);
+    assertSyncStatsOk(stats, { allowEmptySync: options.allowEmptySync });
+    if (options.json) {
+      printJson(stats);
+      return;
+    }
+    logger.log(formatSuccessLine(`Identity synced to dataplane (${envKey})`));
+    logger.log(`  usersProcessed=${stats?.usersProcessed ?? 0}`);
+    logger.log(`  groupsProcessed=${stats?.groupsProcessed ?? 0}`);
+  } catch (e) {
+    logger.error(formatBlockingError(e.message));
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  setupIdentityApplyCommand,
+  setupIdentitySyncCommand
+};

package/lib/commands/identity-group-cli.js

@@ -0,0 +1,146 @@
+/**
+ * @fileoverview Identity group subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine, headerKeyValue } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const { listGroups, getGroup, createGroup, listGroupMembers } = require('../api/groups.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+function registerGroupCreate(groupCmd) {
+  groupCmd
+    .command('create')
+    .description('Create a group')
+    .requiredOption('--name <name>', 'Group name (unique key)')
+    .requiredOption('--display-name <name>', 'Display name')
+    .option('--description <text>', 'Description')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await createGroup(controllerUrl, authConfig, {
+          name: requireNonEmpty(options.name, 'name'),
+          displayName: requireNonEmpty(options.displayName, 'display-name'),
+          description: options.description
+        });
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        logger.log(formatSuccessLine(`Group created: ${row.id} (${row.name})`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupList(groupCmd) {
+  groupCmd
+    .command('list')
+    .description('List groups')
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search groups')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listGroups(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search
+        });
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((g) => logger.log(`  ${g.id}  ${g.name}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupGet(groupCmd) {
+  groupCmd
+    .command('get <idOrName>')
+    .description('Get group by id or name')
+    .option('--json', 'JSON output')
+    .action(async(idOrName, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await getGroup(controllerUrl, authConfig, requireNonEmpty(idOrName, 'idOrName'));
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        if (options.json) {
+          printJson(row);
+          return;
+        }
+        logger.log(headerKeyValue('Id:', row.id));
+        logger.log(headerKeyValue('Name:', row.name));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupMembers(groupCmd) {
+  groupCmd
+    .command('members <idOrName>')
+    .description('List members of a group')
+    .option('--json', 'JSON output')
+    .action(async(idOrName, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listGroupMembers(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(idOrName, 'idOrName')
+        );
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((m) => logger.log(`  ${m.userId || m.id}  ${m.email || ''}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} groupCmd
+ */
+function setupIdentityGroupCommands(groupCmd) {
+  registerGroupCreate(groupCmd);
+  registerGroupList(groupCmd);
+  registerGroupGet(groupCmd);
+  registerGroupMembers(groupCmd);
+}
+
+module.exports = {
+  setupIdentityGroupCommands
+};

package/lib/commands/identity-membership-role-cache.js

@@ -0,0 +1,175 @@
+/**
+ * @fileoverview Identity membership, role, and cache subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  parseGroupsList,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const { addUserToGroup, removeUserFromGroup } = require('../api/user-groups.api');
+const { listEnvironmentRoles, updateRoleGroups } = require('../api/environments.api');
+const { clearAuthCache, invalidateAuthCache } = require('../api/auth-cache.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+/**
+ * @param {import('commander').Command} memCmd
+ */
+function setupIdentityMembershipCommands(memCmd) {
+  memCmd
+    .command('add <userId> <groupId>')
+    .description('Add user to group (controller ids)')
+    .action(async(userId, groupId) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await addUserToGroup(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(userId, 'userId'),
+          requireNonEmpty(groupId, 'groupId'),
+          {}
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Membership created: ${userId} → ${groupId}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  memCmd
+    .command('remove <userId> <groupId>')
+    .description('Remove user from group')
+    .action(async(userId, groupId) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await removeUserFromGroup(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(userId, 'userId'),
+          requireNonEmpty(groupId, 'groupId')
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Membership removed: ${userId} → ${groupId}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} roleCmd
+ */
+function setupIdentityRoleCommands(roleCmd) {
+  roleCmd
+    .command('list')
+    .description('List roles and group mappings for an environment')
+    .requiredOption('-e, --env <key>', 'Environment key (dev, tst, pro)')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = await resolveEnvKey(options);
+        const res = await listEnvironmentRoles(controllerUrl, envKey, authConfig);
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || data?.roles || [];
+        (items || []).forEach((r) => {
+          const groups = Array.isArray(r.groups) ? r.groups.join(', ') : '';
+          logger.log(`  ${r.value || r.role || r.name}  →  ${groups || '—'}`);
+        });
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  roleCmd
+    .command('set-groups <roleValue>')
+    .description('Map role to groups in an environment')
+    .requiredOption('-e, --env <key>', 'Environment key')
+    .requiredOption('--groups <names>', 'Comma-separated group names')
+    .action(async(roleValue, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = await resolveEnvKey(options);
+        const groups = parseGroupsList(options.groups);
+        const res = await updateRoleGroups(
+          controllerUrl,
+          envKey,
+          requireNonEmpty(roleValue, 'roleValue'),
+          authConfig,
+          groups
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Role ${roleValue} mapped to ${groups.length} group(s) in ${envKey}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cacheCmd
+ */
+function setupIdentityCacheCommands(cacheCmd) {
+  cacheCmd
+    .command('clear')
+    .description('Clear all controller auth/RBAC cache entries')
+    .action(async() => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await clearAuthCache(controllerUrl, authConfig);
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine('Controller cache cleared'));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+
+  cacheCmd
+    .command('invalidate')
+    .description('Invalidate controller cache entries by pattern')
+    .requiredOption('--pattern <pattern>', 'Cache key pattern (e.g. permissions:*)')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await invalidateAuthCache(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(options.pattern, 'pattern')
+        );
+        throwIfApiFailed(res);
+        logger.log(formatSuccessLine(`Cache invalidated for pattern: ${options.pattern}`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  setupIdentityMembershipCommands,
+  setupIdentityRoleCommands,
+  setupIdentityCacheCommands
+};

package/lib/commands/identity-shared.js

@@ -0,0 +1,94 @@
+/**
+ * @fileoverview Shared auth/helpers for identity CLI commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const {
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage
+} = require('../identity/identity-apply-core');
+
+/**
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAndAuth() {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Not authenticated for controller: ${controllerUrl}. Run "aifabrix login" and try again.`
+    );
+  }
+  return {
+    controllerUrl: deviceToken.controller || normalized,
+    authConfig: { type: 'bearer', token: deviceToken.token }
+  };
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function resolveEnvKey(options = {}) {
+  const fromFlag = options.env || options.environment;
+  if (fromFlag) {
+    return String(fromFlag).trim();
+  }
+  const env = await resolveEnvironment();
+  return env || 'dev';
+}
+
+/**
+ * @param {string} raw
+ * @param {string} label
+ * @returns {string}
+ */
+function requireNonEmpty(raw, label) {
+  const s = String(raw || '').trim();
+  if (!s) {
+    throw new Error(`${label} is required.`);
+  }
+  return s;
+}
+
+/**
+ * @param {string} groupsArg
+ * @returns {string[]}
+ */
+function parseGroupsList(groupsArg) {
+  const raw = String(groupsArg || '').trim();
+  if (!raw) {
+    throw new Error('--groups is required (comma-separated group names).');
+  }
+  const parts = raw
+    .split(',')
+    .map((g) => g.trim())
+    .filter(Boolean);
+  if (parts.length === 0) {
+    throw new Error('At least one group name is required in --groups.');
+  }
+  return parts;
+}
+
+module.exports = {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  parseGroupsList,
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage
+};

package/lib/commands/identity-user-cli.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Identity user subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine, headerKeyValue } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const {
+  listUsers,
+  getUser,
+  createUser,
+  listUserGroups
+} = require('../api/users.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+function registerUserCreate(userCmd) {
+  userCmd
+    .command('create')
+    .description('Create a user on the controller')
+    .requiredOption('--email <email>', 'User email')
+    .option('--first-name <name>', 'First name')
+    .option('--last-name <name>', 'Last name')
+    .option('--display-name <name>', 'Display name')
+    .option('--username <name>', 'Username')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await createUser(controllerUrl, authConfig, {
+          email: requireNonEmpty(options.email, 'email'),
+          firstName: options.firstName,
+          lastName: options.lastName,
+          displayName: options.displayName,
+          username: options.username,
+          status: 'active'
+        });
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        logger.log(formatSuccessLine(`User created: ${row.id} (${row.email})`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserList(userCmd) {
+  userCmd
+    .command('list')
+    .description('List users')
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search users')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listUsers(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search
+        });
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        logger.log(chalk.bold(`\nUsers (${items.length} shown):\n`));
+        items.forEach((u) => logger.log(`  ${u.id}  ${u.email}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserGet(userCmd) {
+  userCmd
+    .command('get <idOrEmail>')
+    .description('Get user by id or email')
+    .option('--json', 'JSON output')
+    .action(async(idOrEmail, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await getUser(controllerUrl, authConfig, requireNonEmpty(idOrEmail, 'idOrEmail'));
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        if (options.json) {
+          printJson(row);
+          return;
+        }
+        logger.log(headerKeyValue('Id:', row.id));
+        logger.log(headerKeyValue('Email:', row.email));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerUserGroups(userCmd) {
+  userCmd
+    .command('groups <idOrEmail>')
+    .description('List groups for a user')
+    .option('--json', 'JSON output')
+    .action(async(idOrEmail, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listUserGroups(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(idOrEmail, 'idOrEmail')
+        );
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((g) => logger.log(`  ${g.id || g.groupId}  ${g.name || ''}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} userCmd
+ */
+function setupIdentityUserCommands(userCmd) {
+  registerUserCreate(userCmd);
+  registerUserList(userCmd);
+  registerUserGet(userCmd);
+  registerUserGroups(userCmd);
+}
+
+module.exports = {
+  setupIdentityUserCommands
+};