@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/setup-modes.js

@@ -1,12 +1,11 @@
 /**
  * Mode handlers for `aifabrix setup`.
  *
- * Five small handlers, one per branch of the setup decision tree:
- *   - {@link runFreshInstall}     — no infra: wizard for admin creds + AI tool, then up-infra + up-platform.
- *   - {@link runReinstall}        — Mode 1: down-infra -v, wipe local secrets, up-infra, up-platform --force.
- *   - {@link runWipeData}         — Mode 2: drop DBs/roles, wipe local secrets, up-infra, up-platform --force.
- *   - {@link runCleanInstallFiles}— Mode 3: wipe local secrets, up-infra, up-platform --force (templates re-copied).
- *   - {@link runUpdateImages}     — Mode 4: docker pull infra + platform images, up-infra, up-platform.
+ * Handlers for the setup decision tree:
+ *   - {@link runFreshInstall}  — no infra running: wipe volumes, wizard, up-infra, image pull, up-platform --force.
+ *   - {@link runReinstall}     — down-infra -v, image pull, up-infra, up-platform --force.
+ *   - {@link runWipeData}      — drop DBs/roles, image pull, up-infra, up-platform --force.
+ *   - {@link runUpdateImages}  — image pull, up-infra, up-platform (no --force).
  *
  * Every handler ends with `up-infra` (idempotent, reads flags from
  * `config.yaml`) followed by `up-platform`. Optional service keys
@@ -25,30 +24,24 @@
 const fs = require('fs');
 const path = require('path');
 const chalk = require('chalk');
-const ora = require('ora');
 
 const config = require('../core/config');
 const infra = require('../infrastructure');
 const pathsUtil = require('../utils/paths');
 const logger = require('../utils/logger');
-const dockerUtils = require('../utils/docker');
-const dockerExec = require('../utils/docker-exec');
-const {
-  formatSuccessLine,
-  formatProgress,
-  infoLine,
-  sectionTitle,
-  formatDatasourceListRow,
-  successGlyph
-} = require('../utils/cli-test-layout-chalk');
+const { successGlyph } = require('../utils/cli-test-layout-chalk');
+const { startSpinner, stopSpinnerSuccess } = require('./setup-spinners');
+const { runSetupImageRefresh } = require('./setup-image-refresh');
+const { beginSetupPlatformFlow, endSetupPlatformFlow } = require('./setup-run-context');
 const { withMutedLogger } = require('../utils/with-muted-logger');
-const infraHelpers = require('../infrastructure/helpers');
-
 const upMiso = require('./up-miso');
 const upDataplane = require('./up-dataplane');
 const upCommon = require('./up-common');
 const postgresWipe = require('../utils/postgres-wipe');
+const postgresBootstrap = require('../utils/postgres-platform-bootstrap');
+const appLib = require('../app');
 const setupPrompts = require('./setup-prompts');
+const { ensureSetupPlatformAuth, syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const { handleLogin } = require('./login');
 const infraGuided = require('../cli/infra-guided');
 const {
@@ -167,8 +160,10 @@ function handleBuilderDirAction(action) {
   return { aborted: false, backedUp: [], skipClean: false };
 }
 
-async function maybePromptForExistingBuilderDir({ force }) {
-  if (force !== true) return { aborted: false, backedUp: [], skipClean: false };
+async function maybePromptForExistingBuilderDir({ force, skipBuilderConflictPrompt }) {
+  if (force !== true || skipBuilderConflictPrompt === true) {
+    return { aborted: false, backedUp: [], skipClean: false };
+  }
   const existing = getBuilderRootEntriesOrNull();
   const { sysRoot, apps: systemPlatformApps } = getNonEmptySystemPlatformApps();
   if (!existing && systemPlatformApps.length === 0) {
@@ -186,26 +181,6 @@ async function maybePromptForExistingBuilderDir({ force }) {
   return handleBuilderDirAction(action);
 }
 
-function shouldUseSpinner() {
-  return Boolean(process && process.stdout && process.stdout.isTTY);
-}
-
-function startSpinner(text) {
-  if (!shouldUseSpinner()) {
-    logger.log(formatProgress(text));
-    return null;
-  }
-  return ora({ text, spinner: 'dots' }).start();
-}
-
-function stopSpinnerSuccess(spinner, text) {
-  if (!spinner) {
-    logger.log(formatSuccessLine(text));
-    return;
-  }
-  spinner.succeed(text);
-}
-
 /**
  * Start infrastructure using the developer's `config.yaml` flags.
  * Mirrors the relevant slice of `runUpInfraCommand` from `lib/cli/setup-infra.js`
@@ -217,6 +192,7 @@ function stopSpinnerSuccess(spinner, text) {
  * @param {Object} [overrides] - Optional admin overrides (fresh install only)
  * @param {string} [overrides.adminEmail] - Override pgAdmin / Keycloak admin email
  * @param {string} [overrides.adminPassword] - Override Postgres / pgAdmin / Keycloak admin password
+ * @param {Object} [overrides.passwordBundle] - Dev/pro bundle from setup wizard
  * @returns {Promise<void>}
  */
 async function startInfraFromConfig(overrides = {}) {
@@ -226,14 +202,19 @@ async function startInfraFromConfig(overrides = {}) {
   const emailFromConfig = typeof cfg.adminEmail === 'string' ? cfg.adminEmail.trim() : '';
   const adminEmailMerged = emailOverride || emailFromConfig || undefined;
   const effective = computeEffectiveInfraOptionalFlags(cfg, {});
+  const legacyPwd =
+    overrides.passwordBundle && overrides.passwordBundle.mode === 'single'
+      ? overrides.passwordBundle.password
+      : overrides.adminPassword;
   await withMutedLogger(async() => {
     await infra.startInfra(null, {
       traefik: effective.traefik,
       pgadmin: effective.pgadmin,
       redisCommander: effective.redisCommander,
-      adminPassword: overrides.adminPassword,
-      adminPwd: overrides.adminPassword,
+      adminPassword: legacyPwd,
+      adminPwd: legacyPwd,
       adminEmail: adminEmailMerged,
+      passwordBundle: overrides.passwordBundle,
       tlsEnabled: cfg.tlsEnabled === true
     });
   });
@@ -245,31 +226,64 @@ async function startInfraFromConfig(overrides = {}) {
  * builder dirs, then `up-miso` followed by `up-dataplane`.
  *
  * @async
- * @param {{ force?: boolean }} [opts]
+ * @param {{
+ *   force?: boolean,
+ *   skipBuilderConflictPrompt?: boolean,
+ *   skipPrepareTemplates?: boolean,
+ *   skipForceClean?: boolean,
+ *   clearTokensAlways?: boolean,
+ *   requireKeycloakRealm?: boolean
+ * }} [opts]
  * @returns {Promise<void>}
  */
 async function runUpPlatform(opts = {}) {
-  const preflight = await maybePromptForExistingBuilderDir({ force: opts.force === true });
+  const preflight = await maybePromptForExistingBuilderDir({
+    force: opts.force === true,
+    skipBuilderConflictPrompt: opts.skipBuilderConflictPrompt === true
+  });
   if (preflight.aborted) return;
 
-  let forceCleanSummary = null;
-  if (opts.force === true) {
-    const forceSummary = await upCommon.applyUpPlatformForceConfig({ silent: true });
-    if (preflight.skipClean !== true) {
-      const cleanedApps = await upCommon.cleanBuilderAppDirs(PLATFORM_APPS, { silent: true });
-      forceCleanSummary = { forceSummary, cleanedApps };
-    } else {
-      forceCleanSummary = { forceSummary, cleanedApps: [] };
+  if (opts.skipPrepareTemplates !== true) {
+    await upCommon.prepareUrlsLocalRegistryForUpPlatform({ silent: opts.quiet === true });
+  }
+  beginSetupPlatformFlow();
+  let authCtx;
+  try {
+    const setupAuthOpts = { applyForceConfig: opts.force === true };
+    if (opts.clearTokensAlways === true) {
+      setupAuthOpts.clearTokensAlways = true;
     }
+    authCtx = await ensureSetupPlatformAuth(setupAuthOpts);
+  } catch (authErr) {
+    endSetupPlatformFlow();
+    throw authErr;
+  }
+
+  let forceCleanSummary = null;
+  if (opts.force === true && opts.skipForceClean !== true) {
+    const cleanedApps =
+      preflight.skipClean !== true
+        ? await upCommon.cleanBuilderAppDirs(PLATFORM_APPS, { silent: true })
+        : [];
+    forceCleanSummary = { forceSummary: authCtx.forceSummary, cleanedApps };
+  }
+
+  try {
+    await infraGuided.runGuidedUpPlatform(
+      {
+        base: true,
+        platformControllerUrl: authCtx.platformControllerUrl,
+        skipLoginIfAuthenticated: authCtx.skipLoginIfAuthenticated,
+        requireKeycloakRealm: opts.requireKeycloakRealm === true
+      },
+      upMiso.handleUpMiso,
+      upDataplane.handleUpDataplane,
+      handleLogin,
+      forceCleanSummary
+    );
+  } finally {
+    endSetupPlatformFlow();
   }
-  // Reuse the same guided UX as `aifabrix up-platform` (keycloak → miso → auth → dataplane → footer).
-  await infraGuided.runGuidedUpPlatform(
-    { base: true },
-    upMiso.handleUpMiso,
-    upDataplane.handleUpDataplane,
-    handleLogin,
-    forceCleanSummary
-  );
 }
 
 /**
@@ -280,76 +294,15 @@ async function runUpPlatform(opts = {}) {
  */
 function removeUserLocalSecrets() {
   const target = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(target);
   if (!fs.existsSync(target)) return false;
   fs.rmSync(target, { force: true });
-  logger.log(chalk.gray(` ${successGlyph()} Removed ${target}`));
-  return true;
-}
-
-/**
- * Pull infra-compose images (postgres, redis, optional pgadmin/redis-commander/traefik).
- * Best-effort: warns and continues when the compose file is missing.
- *
- * @async
- * @returns {Promise<void>}
- */
-async function pullInfraImages() {
-  const devId = await config.getDeveloperId();
-  const infraDir = path.join(pathsUtil.getAifabrixSystemDir(), infraHelpers.getInfraDirName(devId));
-  const composePath = path.join(infraDir, 'compose.yaml');
-  if (!fs.existsSync(composePath)) {
-    logger.log(chalk.yellow(`No infra compose file at ${composePath}; skipping image pull.`));
-    return;
-  }
-  const project = infraHelpers.getInfraProjectName(devId);
-  const composeCmd = await dockerUtils.getComposeCommand();
-  logger.log('');
-  logger.log(sectionTitle('Pull images'));
-  const spin = startSpinner('Pulling infrastructure images...');
-  await dockerExec.execWithDockerEnv(`${composeCmd} -f "${composePath}" -p ${project} pull`, { cwd: infraDir });
-  stopSpinnerSuccess(spin, 'Infrastructure images pulled');
-}
-
-/**
- * Pull a single platform app image based on `builder/<appName>/application.yaml`.
- * Tolerates missing config / unresolvable images by warning and continuing.
- *
- * @async
- * @param {string} appName
- * @returns {Promise<void>}
- */
-async function pullPlatformAppImage(appName) {
-  let imageRef = '';
-  try {
-    const { loadConfigFile } = require('../utils/config-format');
-    const builderPath = pathsUtil.getBuilderPath(appName);
-    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-    const cfg = loadConfigFile(configPath) || {};
-    const deploy = cfg.deploy || {};
-    if (typeof deploy.image === 'string' && deploy.image.trim()) {
-      imageRef = deploy.image.trim();
-    }
-  } catch {
-    imageRef = '';
-  }
-  if (!imageRef) {
-    logger.log(formatDatasourceListRow('skipped', appName, 'no image ref'));
-    return;
-  }
-  try {
-    const spin = startSpinner(`Pulling ${appName} image...`);
-    await dockerExec.execWithDockerEnv(`docker pull ${imageRef}`);
-    stopSpinnerSuccess(spin, `Pulled ${appName} image`);
-  } catch (err) {
-    logger.log(chalk.yellow(`Could not pull ${imageRef}: ${err.message}`));
-  }
-}
-
-/** Pull every platform app image. */
-async function pullPlatformImages() {
-  for (const appName of PLATFORM_APPS) {
-    await pullPlatformAppImage(appName);
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (!isSetupQuietOutput()) {
+    logger.log(chalk.gray(` ${successGlyph()} Removed ${target}`));
   }
+  return true;
 }
 
 /**
@@ -357,24 +310,42 @@ async function pullPlatformImages() {
  * then up-infra + up-platform.
  *
  * @async
- * @param {{ adminEmail: string, adminPassword: string }} adminCreds
+ * @param {{ adminEmail: string, adminPassword?: string, passwordBundle?: object }} adminCreds
  * @returns {Promise<void>}
  */
 async function runFreshInstall(adminCreds) {
-  logger.log(infoLine('Setup: fresh install'));
+  removeUserLocalSecrets();
+  const resetSpin = startSpinner('Fresh install: clearing previous data...');
+  await withMutedLogger(async() => {
+    await infra.stopInfraWithVolumes();
+    await infra.removeAppVolumes(PLATFORM_APPS, await config.getDeveloperId());
+  });
+  stopSpinnerSuccess(resetSpin, 'Previous data cleared');
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({
     adminEmail: adminCreds.adminEmail,
-    adminPassword: adminCreds.adminPassword
+    adminPassword: adminCreds.adminPassword,
+    passwordBundle: adminCreds.passwordBundle
   });
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
+  await runSetupImageRefresh({ quiet: true });
   // Bring up infra first, then collect optional platform-level secrets (AI tool)
   // so the flow feels like a product installer: infra → platform configuration → platform services.
   await setupPrompts.promptAiTool({ silentIfConfigured: true });
   // Fresh-install should reset dev defaults (env + controller URL) the same way
   // as other setup recovery paths, otherwise the platform can come up pointed at
   // stale configuration.
-  await runUpPlatform({ force: true });
+  const dbSpin = startSpinner('Preparing platform databases...');
+  await withMutedLogger(() => postgresBootstrap.bootstrapPlatformPostgresDatabases());
+  stopSpinnerSuccess(dbSpin, 'Platform databases ready');
+  await runUpPlatform({
+    force: true,
+    skipBuilderConflictPrompt: true,
+    skipPrepareTemplates: true,
+    skipForceClean: true,
+    clearTokensAlways: true,
+    requireKeycloakRealm: true
+  });
 }
 
 /**
@@ -385,67 +356,94 @@ async function runFreshInstall(adminCreds) {
  * @returns {Promise<void>}
  */
 async function runReinstall() {
-  logger.log(infoLine('Setup: re-install (volumes will be removed)'));
-  const downSpin = startSpinner('Stopping infrastructure (down-infra -v)...');
+  const downSpin = startSpinner('Re-installing (removing volumes)...');
   await withMutedLogger(async() => {
     await infra.stopInfraWithVolumes();
   });
-  stopSpinnerSuccess(downSpin, 'Infrastructure stopped and volumes removed');
+  stopSpinnerSuccess(downSpin, 'Previous data cleared');
+  await syncPlatformControllerUrlsInConfig();
   removeUserLocalSecrets();
+  await runSetupImageRefresh({ quiet: true });
+  const adminCreds = await setupPrompts.promptAdminCredentials();
+  await config.setAdminEmail(adminCreds.adminEmail);
   await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
-  await startInfraFromConfig({});
+  await startInfraFromConfig({
+    adminEmail: adminCreds.adminEmail,
+    adminPassword: adminCreds.adminPassword,
+    passwordBundle: adminCreds.passwordBundle
+  });
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
-  await runUpPlatform({ force: true });
+  const dbSpin = startSpinner('Preparing platform databases...');
+  await withMutedLogger(() => postgresBootstrap.bootstrapPlatformPostgresDatabases());
+  stopSpinnerSuccess(dbSpin, 'Platform databases ready');
+  await runUpPlatform({
+    force: true,
+    skipBuilderConflictPrompt: true,
+    clearTokensAlways: true,
+    requireKeycloakRealm: true
+  });
 }
 
 /**
- * Mode 2 — Wipe data: drop DBs and DB users, wipe local secrets, then
- * up-infra + up-platform --force. Postgres volume + admin password preserved.
+ * Stop platform app containers so the next up-platform cycle starts clean after a DB wipe.
  *
  * @async
  * @returns {Promise<void>}
  */
-async function runWipeData() {
-  logger.log(infoLine('Setup: wipe data (databases and DB users)'));
-  await postgresWipe.wipePostgresData();
-  removeUserLocalSecrets();
-  await setupPrompts.promptAiTool({ silentIfConfigured: true });
-  const infraSpin = startSpinner('Starting infrastructure...');
-  await startInfraFromConfig({});
-  stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
-  await runUpPlatform({ force: true });
+async function stopPlatformAppContainers() {
+  const developerId = await config.getDeveloperId();
+  await withMutedLogger(async() => {
+    for (const appName of PLATFORM_APPS) {
+      try {
+        await appLib.stopAndRemoveContainer(appName, developerId, false);
+      } catch {
+        // Container may already be stopped.
+      }
+    }
+  });
 }
 
 /**
- * Mode 3 — Clean install files: wipe local secrets, then up-infra +
- * up-platform --force (which removes builder/<keycloak|miso-controller|dataplane>
- * and re-fetches from templates).
+ * Mode 2 — Wipe data: drop DBs and DB users, wipe local secrets, then
+ * up-infra + up-platform --force. Postgres volume + admin password preserved.
  *
  * @async
  * @returns {Promise<void>}
  */
-async function runCleanInstallFiles() {
-  logger.log(infoLine('Setup: clean installation files and re-install platform services'));
-  removeUserLocalSecrets();
+async function runWipeData() {
+  const wipeSpin = startSpinner('Resetting databases and DB users...');
+  await withMutedLogger(async() => {
+    await postgresWipe.wipePostgresData();
+    removeUserLocalSecrets();
+    await stopPlatformAppContainers();
+  });
+  stopSpinnerSuccess(wipeSpin, 'Databases reset');
+  await runSetupImageRefresh({ quiet: true });
   await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({});
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
-  await runUpPlatform({ force: true });
+  const dbSpin = startSpinner('Preparing platform databases...');
+  await withMutedLogger(() => postgresBootstrap.bootstrapPlatformPostgresDatabases());
+  stopSpinnerSuccess(dbSpin, 'Platform databases ready');
+  await runUpPlatform({
+    force: true,
+    skipBuilderConflictPrompt: true,
+    clearTokensAlways: true,
+    requireKeycloakRealm: true
+  });
 }
 
 /**
- * Mode 4 — Update images: docker pull infra + platform images, then up-infra +
+ * Mode 3 — Update images: docker pull infra + platform images, then up-infra +
  * up-platform (no force; secrets and data preserved).
  *
  * @async
  * @returns {Promise<void>}
  */
 async function runUpdateImages() {
-  logger.log(infoLine('Setup: update docker images'));
-  await pullInfraImages();
-  await pullPlatformImages();
+  await runSetupImageRefresh({ quiet: true });
   await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({});
@@ -458,11 +456,9 @@ module.exports = {
   startInfraFromConfig,
   runUpPlatform,
   removeUserLocalSecrets,
-  pullInfraImages,
-  pullPlatformImages,
+  runSetupImageRefresh,
   runFreshInstall,
   runReinstall,
   runWipeData,
-  runCleanInstallFiles,
   runUpdateImages
 };

package/lib/commands/setup-platform-auth.js

@@ -0,0 +1,76 @@
+/**
+ * Session-aware platform controller URL + auth for `aifabrix setup`.
+ *
+ * @fileoverview Setup platform-controller persistence and login gate
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const upCommon = require('./up-common');
+const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { isPlatformAuthValidForController } = require('../utils/controller-url');
+const { infoLine } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+
+/**
+ * Recompute `controller` and `platform-controller` from traefik / setupPlatformMode / front-door config.
+ * Call after setup changes platform topology (fresh install, re-install, wipe-data) so a prior
+ * full-platform URL (e.g. `http://localhost:3600/miso`) is not reused in single mode.
+ *
+ * @async
+ * @returns {Promise<string>} Normalized platform controller URL
+ */
+async function syncPlatformControllerUrlsInConfig() {
+  const platformControllerUrl = await resolvePlatformControllerUrl();
+  await config.setPlatformControllerUrl(platformControllerUrl);
+  await config.setControllerUrl(platformControllerUrl);
+  return platformControllerUrl;
+}
+
+/**
+ * Resolve absolute platform controller URL, persist `platform-controller` and `controller`,
+ * and optionally apply `up-platform --force` config (token clear only when not logged in).
+ *
+ * @async
+ * @param {{ applyForceConfig?: boolean, clearTokensAlways?: boolean }} [opts]
+ * @returns {Promise<{
+ *   platformControllerUrl: string,
+ *   skipLoginIfAuthenticated: boolean,
+ *   forceSummary: object|null
+ * }>}
+ */
+async function ensureSetupPlatformAuth(opts = {}) {
+  const platformControllerUrl = await syncPlatformControllerUrlsInConfig();
+
+  let forceSummary = null;
+  let skipLoginIfAuthenticated = await isPlatformAuthValidForController(platformControllerUrl);
+  const clearTokensAlways = opts.clearTokensAlways === true;
+  if (opts.applyForceConfig === true) {
+    forceSummary = await upCommon.applyUpPlatformForceConfig({
+      silent: true,
+      clearTokens: clearTokensAlways || !skipLoginIfAuthenticated,
+      defaultControllerUrl: platformControllerUrl
+    });
+    if (clearTokensAlways || (forceSummary && forceSummary.deviceCleared > 0)) {
+      skipLoginIfAuthenticated = false;
+    }
+  }
+
+  if (skipLoginIfAuthenticated) {
+    logger.log(infoLine(`Already authenticated to ${platformControllerUrl}`));
+  }
+
+  return {
+    platformControllerUrl,
+    skipLoginIfAuthenticated,
+    forceSummary
+  };
+}
+
+module.exports = {
+  syncPlatformControllerUrlsInConfig,
+  ensureSetupPlatformAuth
+};