@aifabrix/builder 2.45.0 → 2.46.0

package/lib/datasource/agent-trust-run.js

@@ -0,0 +1,95 @@
+/**
+ * @fileoverview Run dataplane agent metadata validation for one datasource (404.5 / plan 143).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const { getConfig } = require('../core/config');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { getSystemKeyFromAppKey } = require('./integration-context');
+const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { buildMinimalUploadSyncOptions } = require('../utils/upload-sync-options');
+const { fetchTrustRunFromDataplane } = require('./agent-trust-fetch');
+
+async function maybeSyncBeforeTrust({ noSync, authConfig, systemKey, options = {} }) {
+  if (noSync === true) return;
+  requireBearerForDataplanePipeline(authConfig);
+  logger.log(chalk.cyan('Syncing local config to dataplane…'));
+  const { uploadExternalSystem } = require('../commands/upload');
+  await uploadExternalSystem(systemKey, buildMinimalUploadSyncOptions(options));
+  logger.log(formatSuccessLine('Sync complete'));
+}
+
+function buildTransportFailureTrustRun(datasourceKey, systemKey, err) {
+  return {
+    datasourceKey,
+    systemKey,
+    status: 'fail',
+    trustDecision: 'notTrusted',
+    validationStatus: 'failed',
+    confidence: 0,
+    summary: err && err.message ? String(err.message) : 'Request failed',
+    transportError: true
+  };
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @returns {Promise<{ trustRun: Object, apiError: Object|null }>}
+ */
+async function runDatasourceAgentTrust(datasourceKey, options = {}) {
+  if (!datasourceKey || typeof datasourceKey !== 'string') {
+    throw new Error('Datasource key is required');
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const systemKey = await getSystemKeyFromAppKey(appKey);
+
+  let authConfig = options.authConfig;
+  let dataplaneUrl = options.dataplaneUrl || options.dataplane;
+  if (!authConfig || !dataplaneUrl) {
+    const configObj = await getConfig();
+    const auth = await setupIntegrationTestAuth(
+      appKey,
+      { environment: options.environment, dataplane: options.dataplane },
+      configObj
+    );
+    authConfig = auth.authConfig;
+    dataplaneUrl = auth.dataplaneUrl;
+  }
+
+  await maybeSyncBeforeTrust({
+    noSync: options.noSync === true,
+    authConfig,
+    systemKey,
+    options
+  });
+
+  try {
+    const trustRun = await fetchTrustRunFromDataplane({
+      datasourceKey,
+      systemKey,
+      dataplaneUrl,
+      authConfig,
+      options
+    });
+    return { trustRun, apiError: null };
+  } catch (err) {
+    return {
+      trustRun: buildTransportFailureTrustRun(datasourceKey, systemKey, err),
+      apiError: err
+    };
+  }
+}
+
+module.exports = {
+  runDatasourceAgentTrust,
+  maybeSyncBeforeTrust
+};

package/lib/datasource/agent-trust-timeout.js

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview HTTP timeout parsing for agent trust CLI (plan 143).
+ */
+
+'use strict';
+
+const DEFAULT_TRUST_TIMEOUT_MS = 120000;
+
+/**
+ * @param {Object} [options]
+ * @returns {number}
+ */
+function parseTrustTimeoutMs(options = {}) {
+  const raw = options.timeout;
+  if (raw !== undefined && raw !== null && raw !== '') {
+    const n = parseInt(String(raw), 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return DEFAULT_TRUST_TIMEOUT_MS;
+}
+
+module.exports = {
+  DEFAULT_TRUST_TIMEOUT_MS,
+  parseTrustTimeoutMs
+};

package/lib/datasource/audit-evidence-display.js

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview TTY and JSON output for audit evidence verification (407.3)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  sectionTitle,
+  formatSuccessLine,
+  formatBlockingError,
+  successGlyph,
+  failureGlyph
+} = require('../utils/cli-test-layout-chalk');
+
+const SEP = '────────────────────────────────';
+
+/**
+ * @param {'passed'|'failed'} status
+ * @returns {string}
+ */
+function rowGlyph(status) {
+  return status === 'passed' ? successGlyph() : failureGlyph();
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} result
+ * @param {boolean} [verbose]
+ */
+function displayAuditEvidenceMatrixTTY(result, verbose = false) {
+  logger.log(SEP);
+  logger.log(sectionTitle('Audit evidence matrix'));
+  logger.log(chalk.gray(`  Datasource: ${result.datasourceKey}`));
+  if (result.correlationId) {
+    logger.log(chalk.gray(`  Correlation: ${result.correlationId}`));
+  }
+  if (verbose && result.executionIds.length) {
+    logger.log(chalk.gray(`  Execution ids: ${result.executionIds.length}`));
+  }
+  logger.log('');
+  for (const row of result.matrix || []) {
+    logger.log(`  ${rowGlyph(row.status)} Row ${row.row}: ${row.detail}`);
+    if (verbose && row.code) {
+      logger.log(chalk.gray(`      code: ${row.code}`));
+    }
+  }
+  logger.log('');
+  if (result.status === 'passed') {
+    logger.log(formatSuccessLine('Audit evidence verification passed'));
+  } else {
+    const failed = (result.matrix || []).filter(r => r.status === 'failed').length;
+    logger.log(formatBlockingError(`Audit evidence verification failed (${failed} row(s))`));
+  }
+  logger.log(SEP);
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} result
+ */
+function printAuditEvidenceVerificationJson(result) {
+  logger.log(
+    JSON.stringify({
+      auditEvidenceVerification: {
+        status: result.status,
+        datasourceKey: result.datasourceKey,
+        correlationId: result.correlationId,
+        executionIds: result.executionIds,
+        matrix: result.matrix
+      }
+    })
+  );
+}
+
+module.exports = {
+  displayAuditEvidenceMatrixTTY,
+  printAuditEvidenceVerificationJson
+};

package/lib/datasource/audit-evidence-extract-debug.js

@@ -0,0 +1,115 @@
+/**
+ * @fileoverview Extract execution ids from DatasourceTestRun debug / async E2E payloads
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { parseCapacityDetailKey } = require('../utils/load-cip-capacity-display-config');
+
+/**
+ * @param {Array<*>} ids
+ * @returns {string[]}
+ */
+function dedupeIds(ids) {
+  if (!Array.isArray(ids)) return [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of ids) {
+    const id = raw !== null && raw !== undefined ? String(raw).trim() : '';
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+
+/**
+ * @param {*} node
+ * @param {string[]} out
+ */
+function collectExecutionIdFields(node, out) {
+  if (!node || typeof node !== 'object') return;
+  if (typeof node.executionId === 'string' && node.executionId.trim()) {
+    out.push(node.executionId.trim());
+  }
+  if (Array.isArray(node.jobs)) {
+    for (const job of node.jobs) collectExecutionIdFields(job, out);
+  }
+  if (Array.isArray(node.datasources)) {
+    for (const ds of node.datasources) collectExecutionIdFields(ds, out);
+  }
+  if (node.audit && typeof node.audit === 'object') {
+    collectExecutionIdFields(node.audit, out);
+  }
+  if (node.evidence && typeof node.evidence === 'object') {
+    collectExecutionIdFields(node.evidence, out);
+  }
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function executionIdsFromDebugEnvelope(envelope) {
+  const dbg = envelope && envelope.debug;
+  if (!dbg || typeof dbg !== 'object') return [];
+  const found = [];
+  if (dbg.executionIds) {
+    found.push(...(Array.isArray(dbg.executionIds) ? dbg.executionIds : [dbg.executionIds]));
+  }
+  const asyncDbg = dbg.e2eAsyncDebug;
+  if (asyncDbg && Array.isArray(asyncDbg.stepDebug)) {
+    for (const step of asyncDbg.stepDebug) {
+      if (step && step.evidence) collectExecutionIdFields(step.evidence, found);
+    }
+  }
+  return dedupeIds(found);
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {Object|null}
+ */
+function getCapacityStepFromEnvelope(envelope) {
+  const asyncDbg = envelope && envelope.debug && envelope.debug.e2eAsyncDebug;
+  if (!asyncDbg || !Array.isArray(asyncDbg.stepDebug)) return null;
+  return asyncDbg.stepDebug.find(s => s && s.name === 'capacity') || null;
+}
+
+/**
+ * Operation names from CIP capacity evidence keys (`capacity:<op>#<index>`), without product aliases.
+ * @param {*} details
+ * @returns {Set<string>}
+ */
+function collectCipOpsFromCapabilityDetails(details) {
+  const ops = new Set();
+  if (!Array.isArray(details)) return ops;
+  for (const ds of details) {
+    if (!ds || !Array.isArray(ds.capabilityDetails)) continue;
+    for (const item of ds.capabilityDetails) {
+      const parsed = parseCapacityDetailKey(item && item.key);
+      if (parsed && parsed.op) ops.add(parsed.op);
+    }
+  }
+  return ops;
+}
+
+/**
+ * CIP operation names from capacity step (insert, update, list, …).
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function cipOperationsFromDebugEnvelope(envelope) {
+  const capStep = getCapacityStepFromEnvelope(envelope);
+  if (!capStep || !capStep.evidence) return [];
+  return [...collectCipOpsFromCapabilityDetails(capStep.evidence.datasources)];
+}
+
+module.exports = {
+  dedupeIds,
+  executionIdsFromDebugEnvelope,
+  cipOperationsFromDebugEnvelope,
+  collectExecutionIdFields
+};

package/lib/datasource/audit-evidence-extract.js

@@ -0,0 +1,180 @@
+/**
+ * @fileoverview Extract audit evidence inputs from DatasourceTestRun envelope or debug log
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fsp = require('node:fs').promises;
+const { getIntegrationPath } = require('../utils/paths');
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { getLatestLogPath } = require('./log-viewer');
+const {
+  executionIdsFromDebugEnvelope,
+  cipOperationsFromDebugEnvelope,
+  dedupeIds: dedupeIdsFromDebug
+} = require('./audit-evidence-extract-debug');
+const loadCipCapacityDisplayConfig = require('../utils/load-cip-capacity-display-config');
+
+/** @param {Array<*>} ids @returns {string[]} */
+function dedupeIds(ids) {
+  return dedupeIdsFromDebug(ids);
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function executionIdsFromEnvelope(envelope) {
+  const audit = envelope && envelope.audit;
+  const merged = [
+    ...(audit && audit.executionIds ? audit.executionIds : []),
+    ...executionIdsFromDebugEnvelope(envelope)
+  ];
+  return dedupeIds(merged);
+}
+
+/**
+ * E2E uses testRunId as CipExecution.correlationId (see external_data_e2e_helpers).
+ * @param {Object|null|undefined} envelope
+ * @returns {string|null}
+ */
+function correlationIdFromAsyncDebug(envelope) {
+  const dbg = envelope && envelope.debug;
+  const asyncDbg = dbg && dbg.e2eAsyncDebug;
+  if (!asyncDbg || typeof asyncDbg !== 'object') return null;
+  const requestId =
+    asyncDbg.requestId !== undefined && asyncDbg.requestId !== null
+      ? String(asyncDbg.requestId).trim()
+      : '';
+  if (requestId) return requestId;
+  const nested =
+    asyncDbg.testRunId !== undefined && asyncDbg.testRunId !== null
+      ? String(asyncDbg.testRunId).trim()
+      : '';
+  return nested || null;
+}
+
+/**
+ * Ephemeral envelope runId (run-*) is not stored as CipExecution.correlationId.
+ * @param {string} runId
+ * @returns {boolean}
+ */
+function isEphemeralEnvelopeRunId(runId) {
+  return /^run-[a-f0-9]{12}$/i.test(runId);
+}
+
+function correlationIdFromEnvelope(envelope) {
+  if (!envelope || typeof envelope !== 'object') return null;
+  const testRunId =
+    envelope.testRunId !== undefined && envelope.testRunId !== null
+      ? String(envelope.testRunId).trim()
+      : '';
+  if (testRunId && !isEphemeralEnvelopeRunId(testRunId)) return testRunId;
+  const fromDebug = correlationIdFromAsyncDebug(envelope);
+  if (fromDebug) return fromDebug;
+  const runId =
+    envelope.runId !== undefined && envelope.runId !== null ? String(envelope.runId).trim() : '';
+  if (runId && !isEphemeralEnvelopeRunId(runId)) return runId;
+  return null;
+}
+
+/**
+ * Expected capacity/sync operations for matrix rows 1 and 8.
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function expectedOperationsFromEnvelope(envelope) {
+  const fromCapacity = cipOperationsFromDebugEnvelope(envelope);
+  if (fromCapacity.length) return fromCapacity;
+  const { standardOrder } = loadCipCapacityDisplayConfig.getCipCapacityDisplayConfig();
+  const allowed = new Set(
+    (standardOrder || []).map(op => String(op).trim().toLowerCase()).filter(Boolean)
+  );
+  const ops = new Set();
+  const caps = envelope && Array.isArray(envelope.capabilities) ? envelope.capabilities : [];
+  for (const cap of caps) {
+    if (!cap || cap.status === 'skipped' || !cap.key) continue;
+    const key = String(cap.key).trim().toLowerCase();
+    if (allowed.has(key)) ops.add(key);
+  }
+  const integration = envelope && envelope.integration;
+  if (integration && integration.sync && integration.sync.status === 'ok') {
+    ops.add('list');
+  }
+  return [...ops];
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {{ datasourceKey: string, correlationId: string|null, executionIds: string[], expectedOperations: string[] }}
+ */
+function extractAuditEvidenceContext(envelope, opts = {}) {
+  if (!envelope || typeof envelope !== 'object') {
+    return {
+      datasourceKey: opts.datasourceKey ? String(opts.datasourceKey).trim() : '',
+      correlationId: null,
+      executionIds: [],
+      expectedOperations: []
+    };
+  }
+  const datasourceKey =
+    opts.datasourceKey !== undefined && opts.datasourceKey !== null
+      ? String(opts.datasourceKey).trim()
+      : envelope.datasourceKey !== undefined && envelope.datasourceKey !== null
+        ? String(envelope.datasourceKey).trim()
+        : '';
+  return {
+    datasourceKey,
+    correlationId: correlationIdFromEnvelope(envelope),
+    executionIds: executionIdsFromEnvelope(envelope),
+    expectedOperations: expectedOperationsFromEnvelope(envelope)
+  };
+}
+
+/**
+ * @param {Object} logPayload - Saved test-e2e debug log `{ request, response }`
+ * @returns {Object|null}
+ */
+function envelopeFromLogPayload(logPayload) {
+  if (!logPayload || typeof logPayload !== 'object') return null;
+  if (logPayload.response && typeof logPayload.response === 'object') {
+    return logPayload.response;
+  }
+  return logPayload;
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @param {string} [options.app]
+ * @param {string} [options.file]
+ * @returns {Promise<Object|null>}
+ */
+async function loadEnvelopeFromLatestE2eLog(datasourceKey, options = {}) {
+  if (options.file) {
+    const raw = await fsp.readFile(path.resolve(options.file), 'utf8');
+    const parsed = JSON.parse(raw);
+    return envelopeFromLogPayload(parsed);
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const logsDir = path.join(getIntegrationPath(appKey), 'logs');
+  const logPath = await getLatestLogPath(logsDir, 'test-e2e-');
+  if (!logPath) return null;
+  const raw = await fsp.readFile(logPath, 'utf8');
+  const parsed = JSON.parse(raw);
+  return envelopeFromLogPayload(parsed);
+}
+
+module.exports = {
+  dedupeIds,
+  executionIdsFromEnvelope,
+  correlationIdFromEnvelope,
+  expectedOperationsFromEnvelope,
+  extractAuditEvidenceContext,
+  envelopeFromLogPayload,
+  loadEnvelopeFromLatestE2eLog
+};

package/lib/datasource/audit-evidence-matrix-rows.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Plan 407.1 nine-row audit evidence matrix checks (pure helpers)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const CAPTURED = 'captured';
+
+const RBAC_SKIP_REASON_PREFIXES = [
+  'rbacAuditInternalPath',
+  'rbacAuditApiKeyBypass',
+  'rbacAudit'
+];
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceMatrixRow} row
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function passRow(row, detail, code) {
+  const out = { ...row, status: 'passed', detail };
+  if (code) {
+    out.code = code;
+  }
+  return out;
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceMatrixRow} row
+ * @param {string} detail
+ * @param {string} [code]
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function failRow(row, detail, code) {
+  return { ...row, status: 'failed', detail, code: code || row.code };
+}
+
+/**
+ * @param {*} ref
+ * @returns {boolean}
+ */
+function hasFkRef(ref) {
+  if (!ref || typeof ref !== 'object') return false;
+  const id = ref.id !== undefined && ref.id !== null ? String(ref.id).trim() : '';
+  const key = ref.key !== undefined && ref.key !== null ? String(ref.key).trim() : '';
+  return Boolean(id || key);
+}
+
+/**
+ * @param {Object} item
+ * @returns {boolean}
+ */
+function executionRowCaptured(item) {
+  if (!item || typeof item !== 'object') return false;
+  const rbacOk = item.rbacAuditStatus === CAPTURED && hasFkRef(item.rbacDecision);
+  const abacOk = item.abacAuditStatus === CAPTURED && hasFkRef(item.abacTrace);
+  return rbacOk && abacOk;
+}
+
+/**
+ * Row 1 — executions by datasource.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow1ExecutionsByDatasource(input) {
+  const row = { row: 1, status: 'failed', detail: '', code: 'executionsByDatasource' };
+  const { executions, minExpected } = input;
+  const total = input.totalItems !== undefined ? input.totalItems : executions.length;
+  if (total < minExpected) {
+    return failRow(row, `executions=${total} expected>=${minExpected}`, 'executionsCountLow');
+  }
+  const captured = executions.filter(executionRowCaptured).length;
+  if (captured < minExpected) {
+    return failRow(
+      row,
+      `executions=${total} captured=${captured} (need captured rbac/abac FKs)`,
+      'executionsNotCaptured'
+    );
+  }
+  return passRow(row, `executions=${total} captured=${captured}`, 'executionsByDatasource');
+}
+
+/**
+ * Row 2 — RBAC decisions list.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow2RbacDecisionsList(input) {
+  const row = { row: 2, status: 'failed', detail: '', code: 'rbacListEmpty' };
+  const items = input.rbacItems || [];
+  const total = input.totalItems !== undefined ? input.totalItems : items.length;
+  if (total < 1 || items.length < 1) {
+    return failRow(row, 'rbac-decisions list empty', 'rbacListEmpty');
+  }
+  const first = items[0];
+  const execRef = first && first.executionId;
+  if (!hasFkRef(execRef)) {
+    return failRow(row, 'rbac row missing executionId ref', 'rbacMissingExecutionId');
+  }
+  const reason = first && first.reason ? String(first.reason) : '';
+  const skipOk =
+    reason &&
+    RBAC_SKIP_REASON_PREFIXES.some(prefix => reason.startsWith(prefix) || reason.includes(prefix));
+  if (!skipOk && !reason) {
+    return failRow(row, 'rbac row missing skip/capture reason', 'rbacReasonMissing');
+  }
+  return passRow(row, `rbac rows=${total} reason=${reason || 'present'}`, 'rbacListOk');
+}
+
+/**
+ * Row 3 — ABAC traces list.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow3AbacTracesList(input) {
+  const row = { row: 3, status: 'failed', detail: '', code: 'abacListEmpty' };
+  const items = input.abacItems || [];
+  const total = input.totalItems !== undefined ? input.totalItems : items.length;
+  if (total < 1 || items.length < 1) {
+    return failRow(row, 'abac-traces list empty', 'abacListEmpty');
+  }
+  const first = items[0];
+  const decision = first && first.decision ? String(first.decision) : '';
+  const reason = first && first.reason ? String(first.reason) : '';
+  if (!reason) {
+    return failRow(row, 'abac row missing reason', 'abacReasonMissing');
+  }
+  return passRow(row, `abac rows=${total} decision=${decision || 'n/a'} reason=${reason}`, 'abacListOk');
+}
+
+/**
+ * Rows 4–7, 9 — per-execution sub-resources.
+ * @param {number} rowNum
+ * @param {string} code
+ * @param {string} label
+ * @param {*} payload
+ * @param {(payload: *) => boolean} isValid
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkPerExecutionRow(rowNum, code, label, payload, isValid) {
+  const row = { row: rowNum, status: 'failed', detail: '', code };
+  if (!isValid(payload)) {
+    return failRow(row, `${label} missing or invalid`, code);
+  }
+  return passRow(row, `${label} ok`, `${label}Ok`);
+}
+
+module.exports = {
+  CAPTURED,
+  RBAC_SKIP_REASON_PREFIXES,
+  hasFkRef,
+  executionRowCaptured,
+  checkRow1ExecutionsByDatasource,
+  checkRow2RbacDecisionsList,
+  checkRow3AbacTracesList,
+  checkPerExecutionRow
+};