@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/identity.js

@@ -0,0 +1,43 @@
+/**
+ * Identity and RBAC commands (Controller users, groups, sync, cache).
+ *
+ * @fileoverview `aifabrix identity` command group
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { setupIdentityUserCommands } = require('./identity-user-cli');
+const { setupIdentityGroupCommands } = require('./identity-group-cli');
+const {
+  setupIdentityMembershipCommands,
+  setupIdentityRoleCommands,
+  setupIdentityCacheCommands
+} = require('./identity-membership-role-cache');
+const { setupIdentityApplyCommand, setupIdentitySyncCommand } = require('./identity-apply-sync');
+const { IDENTITY_HELP_AFTER } = require('../cli/setup-app.help');
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupIdentityCommands(program) {
+  const identityCmd = program
+    .command('identity')
+    .description('Manage controller users, groups, RBAC mappings, cache, and dataplane identity sync')
+    .addHelpText('after', IDENTITY_HELP_AFTER);
+
+  setupIdentityUserCommands(identityCmd.command('user').description('User commands'));
+  setupIdentityGroupCommands(identityCmd.command('group').description('Group commands'));
+  setupIdentityMembershipCommands(
+    identityCmd.command('membership').description('User–group membership commands')
+  );
+  setupIdentityRoleCommands(identityCmd.command('role').description('Environment role commands'));
+  setupIdentityCacheCommands(identityCmd.command('cache').description('Controller cache commands'));
+  setupIdentityApplyCommand(identityCmd);
+  setupIdentitySyncCommand(identityCmd);
+}
+
+module.exports = {
+  setupIdentityCommands
+};

package/lib/commands/lifecycle-command-action.js

@@ -0,0 +1,123 @@
+/**
+ * @fileoverview CLI action for `aifabrix lifecycle` certification report (plan 150.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { handleCommandError } = require('../utils/cli-utils');
+const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { runLifecycleForExternalSystem } = require('./lifecycle-external');
+const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
+const { VERDICT } = require('../lifecycle/product-model');
+const { exitCodeFromVerdict } = require('../lifecycle/exit-codes');
+const { lifecycleHasGovernanceSubjects } = require('../lifecycle/lifecycle-governance-options');
+
+/**
+ * @param {Object} options
+ * @param {import('commander').Command} [cmd]
+ * @returns {Object}
+ */
+function normalizeLifecycleCliOptions(options, cmd) {
+  const raw = cmd && Array.isArray(cmd.rawArgs) ? cmd.rawArgs : [];
+  const has = flag => raw.includes(flag);
+  return {
+    env: options.env || 'dev',
+    verbose: options.verbose === true || has('-v') || has('--verbose'),
+    debug: options.debug === true || has('-d') || has('--debug'),
+    json: options.json === true || has('--json'),
+    run: options.run === true || has('--run'),
+    noSync: cliOptsSkipSync(options, cmd),
+    force: options.force === true || has('--force'),
+    subjectUserId: options.subjectUserId || [],
+    subjectEmail: options.subjectEmail || [],
+    certificationProfile: options.certificationProfile || 'bronze'
+  };
+}
+
+/**
+ * @param {Object} report
+ * @returns {string}
+ */
+function lifecycleVerdictFromReport(report) {
+  const ops = report.operations?.verdict;
+  const trust = report.trust?.verdict;
+  const gov = report.governance?.verdict;
+  if (ops === VERDICT.FAILED || trust === VERDICT.FAILED || gov === VERDICT.FAILED) {
+    return VERDICT.FAILED;
+  }
+  if (
+    ops === VERDICT.VERIFIED &&
+    trust === VERDICT.VERIFIED &&
+    gov === VERDICT.VERIFIED
+  ) {
+    return VERDICT.VERIFIED;
+  }
+  return VERDICT.NOT_VERIFIED;
+}
+
+async function runLifecycleCommandAction(appName, options, cmd) {
+  const opts = normalizeLifecycleCliOptions(options, cmd);
+  if (lifecycleHasGovernanceSubjects(opts) && !opts.run) {
+    throw new Error(
+      '--subject-user-id and --subject-email require --run on lifecycle (use verify-governance for governance-only)'
+    );
+  }
+  const result = await runLifecycleForExternalSystem(appName, opts);
+  const report = result.report;
+
+  if (opts.json) {
+    const envelope = {
+      systemKey: result.systemKey,
+      command: 'lifecycle',
+      certification: report.certification,
+      operations: report.operations,
+      trust: report.trust,
+      governance: report.governance,
+      recommendations: report.recommendations,
+      warnings: report.warnings,
+      openApiPublished: result.openApiPublished === true,
+      certificationProgress: result.certificationProgress ?? null,
+      stepsRun: result.stepsRun
+    };
+    if (opts.verbose) {
+      envelope.datasources = report.datasources;
+    }
+    logger.log(JSON.stringify(envelope, null, 2));
+  } else {
+    displayLifecycleReportTTY(result.systemKey, report, {
+      details: opts.verbose,
+      openApiPublished: result.openApiPublished === true,
+      certificationProgress: result.certificationProgress ?? null,
+      dataplaneUrl: result.dataplaneUrl ?? null,
+      dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
+    });
+  }
+
+  const pillarVerdict = lifecycleVerdictFromReport(report);
+  const exitCode =
+    pillarVerdict === VERDICT.VERIFIED
+      ? 0
+      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+  if (exitCode !== 0) {
+    process.exit(exitCode);
+  }
+}
+
+async function lifecycleCommandHandler(appName, options, cmd) {
+  try {
+    await runLifecycleCommandAction(appName, options, cmd);
+  } catch (error) {
+    handleCommandError(error, 'lifecycle');
+    process.exit(3);
+  }
+}
+
+module.exports = {
+  normalizeLifecycleCliOptions,
+  runLifecycleCommandAction,
+  lifecycleCommandHandler,
+  lifecycleVerdictFromReport
+};

package/lib/commands/lifecycle-external.js

@@ -0,0 +1,268 @@
+/**
+ * @fileoverview lifecycle certification report — GET default, --run optional (plan 150.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getSystemLifecycleReport, runSystemLifecycle } = require('../api/lifecycle.api');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { getConfig } = require('../core/config');
+const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { syncLocalIfRequested } = require('./test-e2e-external');
+const { runVerifyOperationsForExternalSystem } = require('./verify-operations-external');
+const { runVerifyTrustForExternalSystem } = require('./verify-trust-external');
+const { runGovernanceVerifyForExternalSystem } = require('./governance-verify-external');
+const { VERDICT } = require('../lifecycle/product-model');
+const { buildCertificationProgress } = require('../lifecycle/certification-progress');
+const { resolveOpenApiPublished } = require('../lifecycle/open-api-published');
+const { runWithVerifyStepProgress } = require('../lifecycle/verify-step-progress');
+const { resolveDataplaneUiBaseUrl } = require('../lifecycle/dataplane-ui-url');
+const {
+  lifecycleHasGovernanceSubjects,
+  lifecycleGovernanceNeedsWork,
+  buildGovernanceOptsFromLifecycle
+} = require('../lifecycle/lifecycle-governance-options');
+
+/**
+ * @async
+ * @param {string|null|undefined} dataplaneUrl
+ * @returns {Promise<string|null>}
+ */
+async function resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl) {
+  try {
+    return await resolveDataplaneUiBaseUrl(dataplaneUrl);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }>}
+ */
+async function resolveLifecycleAuth(systemKey, options) {
+  if (!cliOptsSkipSync(options) && options.run === true) {
+    options.lifecycleProgress?.setLabel?.('Checking config on dataplane');
+    const uploadCtx = await syncLocalIfRequested(systemKey, {
+      ...options,
+      suppressPipelineSpinner: true
+    });
+    if (uploadCtx) {
+      options.lifecycleProgress?.setLabel?.('Processing');
+      return { authConfig: uploadCtx.authConfig, dataplaneUrl: uploadCtx.dataplaneUrl };
+    }
+  }
+  const configObj = await getConfig();
+  return setupIntegrationTestAuth(systemKey, { environment: options.env }, configObj);
+}
+
+/**
+ * Generate + verify governance when lifecycle --run includes subject selectors.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {Object} authConfig
+ * @param {string} dataplaneUrl
+ * @param {Object} options
+ */
+async function runLifecycleGovernanceCombinedIfNeeded(
+  systemKey,
+  report,
+  authConfig,
+  dataplaneUrl,
+  options
+) {
+  if (!lifecycleHasGovernanceSubjects(options)) {
+    return;
+  }
+  if (!lifecycleGovernanceNeedsWork(report)) {
+    return;
+  }
+  const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
+  await runVerifyGovernanceCombined(
+    systemKey,
+    buildGovernanceOptsFromLifecycle(options, { authConfig, dataplaneUrl })
+  );
+}
+
+/**
+ * Run missing verify pillars locally when lifecycle/run API unavailable.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {Object} options
+ */
+async function runMissingVerifyStepsLocally(systemKey, report, options) {
+  const runOpts = { ...options, noSync: true };
+  if (report.operations?.verdict !== VERDICT.VERIFIED) {
+    await runVerifyOperationsForExternalSystem(systemKey, runOpts);
+  }
+  if (report.trust?.verdict !== VERDICT.VERIFIED) {
+    await runVerifyTrustForExternalSystem(systemKey, runOpts);
+  }
+  if (report.governance?.verdict !== VERDICT.VERIFIED) {
+    if (lifecycleHasGovernanceSubjects(options)) {
+      const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
+      await runVerifyGovernanceCombined(
+        systemKey,
+        buildGovernanceOptsFromLifecycle(options, {
+          authConfig: options.authConfig,
+          dataplaneUrl: options.dataplaneUrl
+        })
+      );
+    } else {
+      await runGovernanceVerifyForExternalSystem(systemKey, runOpts);
+    }
+  }
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {string} dataplaneUrl
+ * @param {string|null} dataplaneUiBaseUrl
+ * @param {Object} authConfig
+ * @param {Object} [extra]
+ * @returns {Promise<Object>}
+ */
+async function buildLifecycleResult(
+  systemKey,
+  report,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  authConfig,
+  extra = {}
+) {
+  const openApiPublished = await resolveOpenApiPublished(dataplaneUrl, authConfig, systemKey);
+  return {
+    systemKey,
+    command: 'lifecycle',
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    openApiPublished,
+    certificationProgress: buildCertificationProgress(report, { openApiPublished }),
+    ...extra
+  };
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} authConfig
+ * @param {string} dataplaneUrl
+ * @param {string|null} dataplaneUiBaseUrl
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runLifecycleViaDataplaneApi(
+  systemKey,
+  authConfig,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  options
+) {
+  if (lifecycleHasGovernanceSubjects(options)) {
+    const preReport = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+      details: options.verbose === true
+    });
+    await runLifecycleGovernanceCombinedIfNeeded(
+      systemKey,
+      preReport,
+      authConfig,
+      dataplaneUrl,
+      options
+    );
+  }
+  const runRes = await runSystemLifecycle(dataplaneUrl, authConfig, systemKey, {});
+  return buildLifecycleResult(
+    systemKey,
+    runRes.report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { stepsRun: runRes.stepsRun || [], source: 'api' }
+  );
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function executeLifecycleWork(systemKey, options = {}) {
+  const { authConfig, dataplaneUrl } = await resolveLifecycleAuth(systemKey, options);
+  const dataplaneUiBaseUrl = await resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl);
+
+  if (options.run === true) {
+    try {
+      return await runLifecycleViaDataplaneApi(
+        systemKey,
+        authConfig,
+        dataplaneUrl,
+        dataplaneUiBaseUrl,
+        options
+      );
+    } catch {
+      const preReport = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+        details: options.verbose === true
+      });
+      await runMissingVerifyStepsLocally(systemKey, preReport, {
+        ...options,
+        authConfig,
+        dataplaneUrl
+      });
+    }
+  }
+
+  const report = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+    details: options.verbose === true
+  });
+  return buildLifecycleResult(
+    systemKey,
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { source: options.run ? 'local-fallback' : 'api' }
+  );
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runLifecycleForExternalSystem(systemKey, options = {}) {
+  const pathsUtil = require('../utils/paths');
+  const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
+  if (!appType || appType.baseDir !== 'integration') {
+    throw new Error(
+      'lifecycle applies to external integration folders only (integration/<systemKey>/).'
+    );
+  }
+
+  if (options.run === true) {
+    return runWithVerifyStepProgress(
+      'Processing',
+      async(progress) => executeLifecycleWork(systemKey, { ...options, lifecycleProgress: progress }),
+      { json: options.json === true }
+    );
+  }
+
+  return executeLifecycleWork(systemKey, options);
+}
+
+module.exports = {
+  runLifecycleForExternalSystem,
+  runMissingVerifyStepsLocally,
+  runLifecycleGovernanceCombinedIfNeeded,
+  resolveLifecycleAuth
+};

package/lib/commands/login.js

@@ -17,6 +17,7 @@ const logger = require('../utils/logger');
 const { handleCredentialsLogin } = require('./login-credentials');
 const { handleDeviceCodeLogin } = require('./login-device');
 const { resolveControllerUrl } = require('../utils/controller-url');
+const { tryRefreshDataplaneVersionAfterLogin } = require('./auth-status-dataplane-version');
 
 /**
  * Determine and validate authentication method
@@ -84,7 +85,7 @@ async function normalizeControllerUrl(options) {
   if (!controllerUrl) {
     controllerUrl = await resolveControllerUrl();
   }
-  controllerUrl = String(controllerUrl).replace(/\/+$/, '');
+  controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
   // Save controller URL to config
   await setControllerUrl(controllerUrl);
   if (!options.compact) {
@@ -161,6 +162,55 @@ async function handleDeviceCodeLoginFlow(controllerUrl, environment, options) {
   });
 }
 
+/**
+ * @param {string} controllerUrl
+ * @param {Object} options
+ * @param {boolean} skipRefresh
+ * @returns {Promise<void>}
+ */
+async function refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh) {
+  if (skipRefresh) return;
+  if (!options.compact) {
+    const { LOGIN_POST_REFRESH_BUDGET_MS } = require('./auth-status-dataplane-version');
+    logger.log(
+      chalk.gray(
+        `Syncing dataplane version cache (optional, up to ${Math.round(LOGIN_POST_REFRESH_BUDGET_MS / 1000)}s)...`
+      )
+    );
+  }
+  await tryRefreshDataplaneVersionAfterLogin(controllerUrl, options);
+}
+
+/**
+ * @returns {Promise<'credentials'|'device'>}
+ */
+async function executeLoginMethod(method, controllerUrl, environment, options, skipRefresh) {
+  if (method === 'credentials') {
+    await handleCredentialsLoginFlow(controllerUrl, environment, options);
+    await refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh);
+    return 'credentials';
+  }
+  await handleDeviceCodeLoginFlow(controllerUrl, environment, options);
+  await refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh);
+  return 'device';
+}
+
+/**
+ * @param {Object} options
+ * @param {string} controllerUrl
+ * @param {string} environment
+ */
+function logLoginSuccessFooter(options, controllerUrl, environment) {
+  if (options.compact) return;
+  logger.log(formatSuccessParagraph('Successfully logged in!'));
+  logger.log(chalk.gray(`Controller: ${controllerUrl}`));
+  logger.log(chalk.gray(`Environment: ${environment}`));
+  if (options.app) {
+    logger.log(chalk.gray(`App: ${options.app}`));
+  }
+  logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
+}
+
 async function handleLogin(options) {
   if (!options.compact) {
     logger.log(chalk.blue('\n🔐 Logging in to Miso Controller...\n'));
@@ -169,25 +219,14 @@ async function handleLogin(options) {
   const controllerUrl = await normalizeControllerUrl(options);
   const environment = await handleEnvironmentConfig(options);
   const method = await determineAuthMethod(options.method);
-
   validateScopeOptions(method, options);
 
-  if (method === 'credentials') {
-    await handleCredentialsLoginFlow(controllerUrl, environment, options);
-  } else if (method === 'device') {
-    await handleDeviceCodeLoginFlow(controllerUrl, environment, options);
-    return; // Early return for device flow (already saved config)
-  }
+  const skipRefresh =
+    options.skipDataplaneVersionRefresh === true || options.skipVersionCache === true;
+  const flow = await executeLoginMethod(method, controllerUrl, environment, options, skipRefresh);
+  if (flow === 'device') return;
 
-  if (!options.compact) {
-    logger.log(formatSuccessParagraph('Successfully logged in!'));
-    logger.log(chalk.gray(`Controller: ${controllerUrl}`));
-    logger.log(chalk.gray(`Environment: ${environment}`));
-    if (options.app) {
-      logger.log(chalk.gray(`App: ${options.app}`));
-    }
-    logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
-  }
+  logLoginSuccessFooter(options, controllerUrl, environment);
 }
 
 module.exports = { handleLogin };