@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/secrets-get.js

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview aifabrix secret get – read one secret (local user file or shared-only)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const path = require('path');
+const { getAifabrixSecretsPath } = require('../core/config');
+const { decryptSecretsObject } = require('../core/secrets-load');
+const { loadPrimaryUserSecrets } = require('../utils/secrets-utils');
+const { loadConfiguredSharedSecretsStore } = require('../utils/remote-secrets-loader');
+const remoteDevAuth = require('../utils/remote-dev-auth');
+const devApi = require('../api/dev.api');
+const logger = require('../utils/logger');
+
+const REMOTE_NOT_CONFIGURED_MSG =
+  'Remote server is not configured. Set remote-server and run "aifabrix dev init" first.';
+
+/**
+ * Human-readable label for which store(s) were queried (paths included for file stores).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<string>}
+ */
+async function resolveSecretsScopeLabel(options) {
+  const useSharedOnly = Boolean(options.shared || options['shared']);
+  const generalSecretsPath = await getAifabrixSecretsPath();
+
+  if (useSharedOnly) {
+    if (!generalSecretsPath) {
+      return 'shared secrets (aifabrix-secrets not configured; run aifabrix secret set-secrets-file <path>)';
+    }
+    const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+    if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+      const host = remoteDevAuth.getSharedSecretsRemoteHostname(target) || target;
+      return `shared secrets API (${host})`;
+    }
+    const resolved = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+    return `shared secrets file ${resolved}`;
+  }
+
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  return `local secrets file ${userPath}`;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isSecretPresent(value) {
+  if (value === undefined || value === null) {
+    return false;
+  }
+  return String(value).trim() !== '';
+}
+
+/**
+ * @param {Array<{ name?: string, key?: string, value?: unknown }>} items
+ * @returns {Record<string, string>}
+ */
+function remoteSecretItemsToMap(items) {
+  const raw = {};
+  for (const item of items) {
+    const name = item?.name || item?.key;
+    if (typeof name === 'string' && item.value !== undefined) {
+      raw[name] = String(item.value);
+    }
+  }
+  return raw;
+}
+
+/**
+ * @param {string} target
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadRemoteSharedSecretsDecrypted(target) {
+  const auth = await remoteDevAuth.getRemoteDevAuth();
+  if (!auth) {
+    throw new Error(REMOTE_NOT_CONFIGURED_MSG);
+  }
+  const items = await devApi.listSecrets(
+    auth.serverUrl,
+    auth.clientCertPem,
+    auth.serverCaPem || undefined,
+    target
+  );
+  const label = remoteDevAuth.getSharedSecretsRemoteHostname(target) || 'shared secrets API';
+  return decryptSecretsObject(remoteSecretItemsToMap(items), { defaultSourceLabel: label });
+}
+
+/**
+ * Load shared secrets (file or remote), decrypted.
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSharedSecretsDecrypted() {
+  const generalSecretsPath = await getAifabrixSecretsPath();
+  if (!generalSecretsPath) {
+    throw new Error('Shared secrets not configured. Set aifabrix-secrets in config.yaml.');
+  }
+
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    return loadRemoteSharedSecretsDecrypted(target);
+  }
+
+  const raw = await loadConfiguredSharedSecretsStore();
+  if (!raw || typeof raw !== 'object') {
+    return {};
+  }
+  const resolvedPath = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+  return decryptSecretsObject(raw, { defaultSourceLabel: resolvedPath });
+}
+
+/**
+ * Load and decrypt the primary user secrets file only (not aifabrix-secrets / shared).
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadLocalUserSecretsDecrypted() {
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const raw = loadPrimaryUserSecrets();
+  return decryptSecretsObject(raw || {}, { defaultSourceLabel: userPath });
+}
+
+/**
+ * Load secrets for lookup: local user file (default) or shared store only (--shared).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSecretsForGet(options) {
+  if (options.shared || options['shared']) {
+    return loadSharedSecretsDecrypted();
+  }
+  return loadLocalUserSecretsDecrypted();
+}
+
+/**
+ * Handle secret get command.
+ * @param {string} key - Secret key (no kv:// prefix)
+ * @param {Object} options
+ * @param {boolean} [options.shared] - Shared store only (aifabrix-secrets); default is local user file only
+ * @param {boolean} [options.exists] - Exit 0 when present; no stdout (script-friendly)
+ * @param {boolean} [options.json] - JSON { key, exists, value }
+ * @returns {Promise<{ key: string, exists: boolean, value?: string }>}
+ */
+async function handleSecretsGet(key, options = {}) {
+  if (!key || typeof key !== 'string') {
+    throw new Error('Secret key is required and must be a string');
+  }
+  if (key.startsWith('kv://')) {
+    throw new Error(
+      'Secret key must not start with kv://. Use the key path without the prefix (e.g. hubspot-demo/token).'
+    );
+  }
+
+  const secrets = await loadSecretsForGet(options);
+  const value = secrets[key];
+  const present = isSecretPresent(value);
+
+  if (!present) {
+    const scope = await resolveSecretsScopeLabel(options);
+    throw new Error(`Secret '${key}' is missing or empty in ${scope}.`);
+  }
+
+  if (options.exists || options['exists']) {
+    return { key, exists: true };
+  }
+
+  if (options.json || options['json']) {
+    logger.log(JSON.stringify({ key, exists: true, value: String(value) }));
+    return { key, exists: true, value: String(value) };
+  }
+
+  logger.log(String(value));
+  return { key, exists: true, value: String(value) };
+}
+
+module.exports = {
+  handleSecretsGet,
+  isSecretPresent,
+  loadSecretsForGet,
+  loadLocalUserSecretsDecrypted,
+  resolveSecretsScopeLabel
+};

package/lib/commands/secrets-remove-all.js

@@ -56,6 +56,8 @@ function listKeysFromYamlFile(filePath) {
  * @param {string} filePath - Absolute path
  */
 function writeEmptySecretsFile(filePath) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const yamlContent = yaml.dump({}, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false });
   fs.writeFileSync(filePath, yamlContent, { mode: 0o600 });
 }
@@ -217,4 +219,4 @@ async function handleSecretsRemoveAll(options) {
   await removeAllSharedSecrets(generalSecretsPath, options);
 }
 
-module.exports = { handleSecretsRemoveAll };
+module.exports = { handleSecretsRemoveAll, writeEmptySecretsFile };

package/lib/commands/setup-image-refresh.js

@@ -0,0 +1,146 @@
+/**
+ * Template materialization and Docker image pull for `aifabrix setup` modes.
+ *
+ * @fileoverview Setup image refresh and platform template bootstrap
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const chalk = require('chalk');
+
+const config = require('../core/config');
+const pathsUtil = require('../utils/paths');
+const logger = require('../utils/logger');
+const dockerUtils = require('../utils/docker');
+const dockerExec = require('../utils/docker-exec');
+const infraHelpers = require('../infrastructure/helpers');
+const upCommon = require('./up-common');
+const { sectionTitle, formatDatasourceListRow } = require('../utils/cli-test-layout-chalk');
+const { startSpinner, stopSpinnerSuccess } = require('./setup-spinners');
+
+const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane'];
+
+/**
+ * Pull infra-compose images (postgres, redis, optional pgadmin/redis-commander/traefik).
+ *
+ * @async
+ * @param {{ quiet?: boolean }} [opts]
+ * @returns {Promise<void>}
+ */
+async function pullInfraImages(opts = {}) {
+  const quiet = Boolean(opts.quiet);
+  const devId = await config.getDeveloperId();
+  const infraDir = path.join(pathsUtil.getAifabrixSystemDir(), infraHelpers.getInfraDirName(devId));
+  const composePath = path.join(infraDir, 'compose.yaml');
+  if (!fs.existsSync(composePath)) {
+    if (!quiet) {
+      logger.log(chalk.yellow(`No infra compose file at ${composePath}; skipping image pull.`));
+    }
+    return;
+  }
+  const project = infraHelpers.getInfraProjectName(devId);
+  const composeCmd = await dockerUtils.getComposeCommand();
+  if (!quiet) {
+    logger.log('');
+    logger.log(sectionTitle('Pull images'));
+  }
+  if (quiet) {
+    await dockerExec.execWithDockerEnv(`${composeCmd} -f "${composePath}" -p ${project} pull`, { cwd: infraDir });
+    return;
+  }
+  const spin = startSpinner('Pulling infrastructure images...');
+  await dockerExec.execWithDockerEnv(`${composeCmd} -f "${composePath}" -p ${project} pull`, { cwd: infraDir });
+  stopSpinnerSuccess(spin, 'Infrastructure images pulled');
+}
+
+/**
+ * @param {string} appName
+ * @returns {string} deploy.image or empty
+ */
+function readPlatformDeployImageRef(appName) {
+  try {
+    const { loadConfigFile } = require('../utils/config-format');
+    const builderPath = pathsUtil.getBuilderPath(appName);
+    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
+    const cfg = loadConfigFile(configPath) || {};
+    const image = cfg.deploy && cfg.deploy.image;
+    return typeof image === 'string' ? image.trim() : '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Pull one platform app image from `builder/<app>/application.yaml` deploy.image.
+ *
+ * @async
+ * @param {string} appName
+ * @param {{ quiet?: boolean }} [opts]
+ * @returns {Promise<boolean>} True when a pull was attempted
+ */
+async function pullPlatformAppImage(appName, opts = {}) {
+  const quiet = Boolean(opts.quiet);
+  const imageRef = readPlatformDeployImageRef(appName);
+  if (!imageRef) {
+    if (!quiet) {
+      logger.log(formatDatasourceListRow('skipped', appName, 'no image ref'));
+    }
+    return false;
+  }
+  try {
+    if (!quiet) {
+      const spin = startSpinner(`Pulling ${appName} image...`);
+      await dockerExec.execWithDockerEnv(`docker pull ${imageRef}`);
+      stopSpinnerSuccess(spin, `Pulled ${appName} image`);
+    } else {
+      await dockerExec.execWithDockerEnv(`docker pull ${imageRef}`);
+    }
+  } catch (err) {
+    logger.log(chalk.yellow(`Could not pull ${imageRef}: ${err.message}`));
+  }
+  return true;
+}
+
+/**
+ * @async
+ * @param {{ quiet?: boolean }} [opts]
+ * @returns {Promise<number>} Count of images pulled
+ */
+async function pullPlatformImages(opts = {}) {
+  let pulled = 0;
+  for (const appName of PLATFORM_APPS) {
+    if (await pullPlatformAppImage(appName, opts)) {
+      pulled += 1;
+    }
+  }
+  return pulled;
+}
+
+/**
+ * Materialize platform templates and pull infra + platform images.
+ *
+ * @async
+ * @param {{ quiet?: boolean }} [opts]
+ * @returns {Promise<void>}
+ */
+async function runSetupImageRefresh(opts = {}) {
+  const quiet = Boolean(opts.quiet);
+  const spin = quiet ? startSpinner('Preparing platform configuration...') : null;
+  await upCommon.prepareUrlsLocalRegistryForUpPlatform({ silent: quiet });
+  await pullInfraImages({ quiet });
+  await pullPlatformImages({ quiet });
+  if (quiet) {
+    stopSpinnerSuccess(spin, 'Platform configuration ready');
+  }
+}
+
+module.exports = {
+  PLATFORM_APPS,
+  pullInfraImages,
+  pullPlatformImages,
+  runSetupImageRefresh
+};