@aifabrix/builder 2.45.0 → 2.46.0

package/lib/datasource/audit-evidence-operation-aliases.js

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview Normalize CIP execution operation labels for Plan 407 audit matrix
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * Align list API operation values with builder E2E expectations (matches e2e_audit_operation.py).
+ * @param {*} operation
+ * @returns {string}
+ */
+function normalizeAuditOperation(operation) {
+  const raw = operation !== undefined && operation !== null ? String(operation).trim() : '';
+  if (!raw) return '';
+  let op = raw === 'updateBasic' ? 'updatebasic' : raw.toLowerCase();
+  if (op === 'create') op = 'insert';
+  return op;
+}
+
+/**
+ * @param {Array<{ operation?: string }>} executions
+ * @param {string[]} expectedOperations
+ * @returns {boolean}
+ */
+/**
+ * API filter values to try for a matrix-expected operation (DB may use create vs insert).
+ * @param {string} expectedOp
+ * @returns {string[]}
+ */
+function operationQueryVariants(expectedOp) {
+  const n = normalizeAuditOperation(expectedOp);
+  if (!n) return [];
+  const variants = new Set([n]);
+  if (n === 'insert') variants.add('create');
+  if (n === 'updatebasic') {
+    variants.add('updateBasic');
+    variants.add('updatebasic');
+  }
+  if (n === 'updateaddress') {
+    variants.add('updateAddress');
+    variants.add('updateaddress');
+  }
+  return [...variants];
+}
+
+function executionsCoverExpectedOperations(executions, expectedOperations) {
+  const expected = (expectedOperations || [])
+    .map(normalizeAuditOperation)
+    .filter(Boolean);
+  if (!expected.length) return true;
+  const ops = new Set(
+    (executions || []).map(e => normalizeAuditOperation(e && e.operation)).filter(Boolean)
+  );
+  return expected.every(op => ops.has(op));
+}
+
+module.exports = {
+  normalizeAuditOperation,
+  operationQueryVariants,
+  executionsCoverExpectedOperations
+};

package/lib/datasource/audit-evidence-poll.js

@@ -0,0 +1,109 @@
+/**
+ * @fileoverview Bounded poll until audit execution rows are captured (407.3)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { executionRowCaptured } = require('./audit-evidence-matrix-rows');
+
+const DEFAULT_MAX_WAIT_MS = 15000;
+const DEFAULT_INTERVAL_MS = 2000;
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+/**
+ * @param {Array} executions
+ * @param {number} minExpected
+ * @returns {boolean}
+ */
+function executionsReady(executions, minExpected) {
+  if (!Array.isArray(executions) || executions.length < minExpected) return false;
+  const captured = executions.filter(executionRowCaptured).length;
+  return captured >= minExpected;
+}
+
+/**
+ * @param {Array} executions
+ * @param {string[]} executionIds
+ * @returns {boolean}
+ */
+function allEnvelopeIdsPresent(executions, executionIds) {
+  if (!Array.isArray(executionIds) || !executionIds.length) return true;
+  const found = new Set(
+    (executions || []).map(e => (e && e.id ? String(e.id) : '')).filter(Boolean)
+  );
+  return executionIds.every(id => found.has(String(id)));
+}
+
+/**
+ * E2E: wait until envelope executionIds are visible and captured in list API.
+ * @param {Array} executions
+ * @param {number} minExpected
+ * @param {string[]} [executionIds]
+ * @returns {boolean}
+ */
+function executionsReadyForVerify(executions, minExpected, executionIds) {
+  const min = Math.max(1, minExpected || 1);
+  if (Array.isArray(executionIds) && executionIds.length) {
+    const need = Math.min(min, executionIds.length);
+    if (!allEnvelopeIdsPresent(executions, executionIds)) return false;
+    const captured = executionIds.filter(id =>
+      (executions || []).some(
+        e => String(e.id) === String(id) && executionRowCaptured(e)
+      )
+    ).length;
+    return captured >= need;
+  }
+  return executionsReady(executions, min);
+}
+
+/**
+ * @async
+ * @param {Object} opts
+ * @param {() => Promise<{ data: Array, meta: Object|null }>} opts.fetchExecutions
+ * @param {number} opts.minExpected
+ * @param {number} [opts.maxWaitMs]
+ * @param {number} [opts.intervalMs]
+ * @returns {Promise<{ data: Array, meta: Object|null, timedOut: boolean }>}
+ */
+async function pollExecutionsUntilReady(opts) {
+  const minExpected = Math.max(1, opts.minExpected || 1);
+  const executionIds = Array.isArray(opts.executionIds) ? opts.executionIds : [];
+  const maxWaitMs =
+    opts.maxWaitMs !== undefined && opts.maxWaitMs !== null ? opts.maxWaitMs : DEFAULT_MAX_WAIT_MS;
+  const intervalMs =
+    opts.intervalMs !== undefined && opts.intervalMs !== null
+      ? opts.intervalMs
+      : DEFAULT_INTERVAL_MS;
+  const deadline = Date.now() + maxWaitMs;
+  let last = { data: [], meta: null };
+
+  while (Date.now() <= deadline) {
+    last = await opts.fetchExecutions();
+    if (executionsReadyForVerify(last.data, minExpected, executionIds)) {
+      return { ...last, timedOut: false };
+    }
+    if (Date.now() + intervalMs > deadline) break;
+    await sleep(intervalMs);
+  }
+
+  return { ...last, timedOut: true };
+}
+
+module.exports = {
+  DEFAULT_MAX_WAIT_MS,
+  DEFAULT_INTERVAL_MS,
+  sleep,
+  executionsReady,
+  allEnvelopeIdsPresent,
+  executionsReadyForVerify,
+  pollExecutionsUntilReady
+};

package/lib/datasource/audit-evidence-run.js

@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Orchestrate audit evidence verification after E2E or from saved logs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { getConfig } = require('../core/config');
+const {
+  extractAuditEvidenceContext,
+  loadEnvelopeFromLatestE2eLog
+} = require('./audit-evidence-extract');
+const { verifyAuditEvidenceMatrix } = require('./audit-evidence-verify');
+const {
+  displayAuditEvidenceMatrixTTY,
+  printAuditEvidenceVerificationJson
+} = require('./audit-evidence-display');
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }>}
+ */
+async function resolveAuditVerifyAuth(datasourceKey, options) {
+  if (options.authConfig && options.dataplaneUrl) {
+    return { authConfig: options.authConfig, dataplaneUrl: options.dataplaneUrl };
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const configObj = await getConfig();
+  const auth = await setupIntegrationTestAuth(appKey, options, configObj);
+  return { authConfig: auth.authConfig, dataplaneUrl: auth.dataplaneUrl };
+}
+
+/**
+ * @param {Object} envelope
+ * @param {string} datasourceKey
+ * @param {Object} [opts]
+ * @returns {Object}
+ */
+function buildVerifyContext(envelope, datasourceKey, opts = {}) {
+  const ctx = extractAuditEvidenceContext(envelope);
+  if (datasourceKey) ctx.datasourceKey = String(datasourceKey).trim();
+  if (opts.correlationId) ctx.correlationId = String(opts.correlationId).trim();
+  if (opts.executionId) {
+    const id = String(opts.executionId).trim();
+    if (id && !ctx.executionIds.includes(id)) ctx.executionIds.unshift(id);
+  }
+  return ctx;
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} envelope - DatasourceTestRun
+ * @param {Object} options
+ * @returns {Promise<{ verification: import('../api/types/audit.types').AuditEvidenceVerification, exitCode: number }>}
+ */
+async function runAuditEvidenceVerification(datasourceKey, envelope, options = {}) {
+  const ctx = buildVerifyContext(envelope, datasourceKey, options);
+  if (!ctx.executionIds.length && !ctx.correlationId) {
+    const verification = failedVerification(
+      datasourceKey,
+      ctx,
+      'missing audit.executionIds and testRunId/correlationId',
+      'auditIdsMissing'
+    );
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: 1 };
+  }
+  let auth;
+  try {
+    auth = await resolveAuditVerifyAuth(datasourceKey, options);
+  } catch (err) {
+    const verification = failedVerification(datasourceKey, ctx, err.message, 'authFailed');
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: 3 };
+  }
+
+  try {
+    const verification = await verifyAuditEvidenceMatrix({
+      dataplaneUrl: auth.dataplaneUrl,
+      authConfig: auth.authConfig,
+      datasourceKey: ctx.datasourceKey,
+      correlationId: ctx.correlationId,
+      executionIds: ctx.executionIds,
+      expectedOperations: ctx.expectedOperations,
+      maxWaitMs: options.auditPollMaxWaitMs,
+      intervalMs: options.auditPollIntervalMs
+    });
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: verification.status === 'passed' ? 0 : 1 };
+  } catch (err) {
+    const verification = failedVerification(datasourceKey, ctx, err.message, 'verifyError');
+    emitVerificationOutput(verification, options);
+    const code = err.status === 401 || err.status === 403 ? 3 : 1;
+    return { verification, exitCode: code };
+  }
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} ctx
+ * @param {string} message
+ * @param {string} code
+ * @returns {import('../api/types/audit.types').AuditEvidenceVerification}
+ */
+function failedVerification(datasourceKey, ctx, message, code) {
+  return {
+    status: 'failed',
+    datasourceKey,
+    correlationId: ctx.correlationId || null,
+    executionIds: ctx.executionIds || [],
+    matrix: [{ row: 0, status: 'failed', detail: message, code }]
+  };
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} verification
+ * @param {Object} options
+ */
+function emitVerificationOutput(verification, options) {
+  if (options.json) {
+    printAuditEvidenceVerificationJson(verification);
+    return;
+  }
+  if (!options.quiet) {
+    displayAuditEvidenceMatrixTTY(verification, options.verbose === true);
+  }
+}
+
+/**
+ * Run audit matrix when E2E succeeded and --verify-audit is set.
+ * @param {number} e2eExitCode
+ * @param {string} datasourceKey
+ * @param {Object|null} envelope
+ * @param {Object} options
+ * @returns {Promise<number>}
+ */
+async function maybeVerifyAuditAfterE2E(e2eExitCode, datasourceKey, envelope, options = {}) {
+  const enabled =
+    options.verifyAudit === true && options.noVerifyAudit !== true;
+  if (!enabled || e2eExitCode !== 0 || !envelope) {
+    return e2eExitCode;
+  }
+  const pollMsRaw = parseInt(String(options.auditPollMs || options.auditPollMaxWaitMs || '15000'), 10);
+  const pollInterval = parseInt(
+    String(options.auditPollIntervalMs || '2000'),
+    10
+  );
+  const ctx = buildVerifyContext(envelope, datasourceKey, options);
+  const pollMs = Math.max(
+    Number.isFinite(pollMsRaw) ? pollMsRaw : 15000,
+    (ctx.executionIds && ctx.executionIds.length >= 7) ? 30000 : 0
+  );
+  const { exitCode } = await runAuditEvidenceVerification(datasourceKey, envelope, {
+    app: options.app,
+    env: options.env,
+    verbose: options.verbose,
+    json: options.json,
+    authConfig: options.authConfig,
+    dataplaneUrl: options.dataplaneUrl,
+    auditPollMaxWaitMs: pollMs,
+    auditPollIntervalMs: Number.isFinite(pollInterval) ? pollInterval : 2000
+  });
+  return exitCode;
+}
+
+module.exports = {
+  runAuditEvidenceVerification,
+  maybeVerifyAuditAfterE2E,
+  loadEnvelopeFromLatestE2eLog,
+  buildVerifyContext,
+  resolveAuditVerifyAuth
+};

package/lib/datasource/audit-evidence-verify-helpers.js

@@ -0,0 +1,167 @@
+/**
+ * @fileoverview Helpers for audit evidence matrix verification (sub-resource validators, rows 8–9)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { checkPerExecutionRow } = require('./audit-evidence-matrix-rows');
+const {
+  normalizeAuditOperation,
+  executionsCoverExpectedOperations
+} = require('./audit-evidence-operation-aliases');
+
+/**
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow8CorrelationGroup(input) {
+  const row = { row: 8, status: 'failed', detail: '', code: 'correlationGroup' };
+  const items = input.executions || [];
+  if (!items.length) {
+    return {
+      ...row,
+      detail: input.correlationId
+        ? 'no executions for correlation or datasource filter'
+        : 'no correlationId and no executions',
+      code: 'correlationEmpty'
+    };
+  }
+  const expected = (input.expectedOperations || [])
+    .map(normalizeAuditOperation)
+    .filter(Boolean);
+  if (expected.length && !executionsCoverExpectedOperations(items, expected)) {
+    const ops = new Set(
+      items.map(e => normalizeAuditOperation(e && e.operation)).filter(Boolean)
+    );
+    const missing = expected.filter(op => !ops.has(op));
+    return {
+      ...row,
+      detail: `missing ops: ${missing.join(', ')}`,
+      code: 'correlationOpsMissing'
+    };
+  }
+  const opCount = new Set(
+    items.map(e => normalizeAuditOperation(e && e.operation)).filter(Boolean)
+  ).size;
+  return {
+    ...row,
+    status: 'passed',
+    detail: `correlation ops=${opCount || items.length}`,
+    code: 'correlationGroup'
+  };
+}
+
+/**
+ * Prefer executions tied to this run (by id), then correlation query, then datasource list.
+ * @param {Object} ctx
+ * @param {Array} executions
+ * @param {Array} corrQueryRows
+ * @returns {Array}
+ */
+function resolveRow8Executions(ctx, executions, corrQueryRows) {
+  const idSet = new Set(
+    (ctx.executionIds || []).map(id => String(id).trim()).filter(Boolean)
+  );
+  let byId = [];
+  if (idSet.size && executions && executions.length) {
+    byId = executions.filter(e => e && e.id && idSet.has(String(e.id)));
+  }
+  const expected = ctx.expectedOperations || [];
+  if (byId.length && executionsCoverExpectedOperations(byId, expected)) {
+    return byId;
+  }
+  if (corrQueryRows && corrQueryRows.length && executionsCoverExpectedOperations(corrQueryRows, expected)) {
+    return corrQueryRows;
+  }
+  if (byId.length) return byId;
+  if (corrQueryRows && corrQueryRows.length) return corrQueryRows;
+  return executions || [];
+}
+
+/**
+ * @param {Set<string>} traceIds
+ * @param {string[]} execIds
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow9Traces(traceIds, execIds) {
+  const row = { row: 9, status: 'failed', detail: '', code: 'traceMismatch' };
+  if (!execIds.length) {
+    return { ...row, detail: 'no execution ids', code: 'auditIdsMissing' };
+  }
+  if (traceIds.size < 1) {
+    return { ...row, detail: 'no trace payloads resolved', code: 'traceEmpty' };
+  }
+  if (traceIds.size < execIds.length) {
+    return {
+      ...row,
+      detail: `distinct traces=${traceIds.size} executionIds=${execIds.length}`,
+      code: 'traceCountLow'
+    };
+  }
+  return { ...row, status: 'passed', detail: `traces=${traceIds.size} ids=${execIds.length}` };
+}
+
+function isRbacSubResourceValid(body) {
+  return !!(body && typeof body === 'object' && (body.id || body.decision || body.summary));
+}
+
+function isAbacSubResourceValid(body) {
+  return !!(body && typeof body === 'object' && (body.id || body.decision || body.traceId));
+}
+
+function isErrorsValid(body) {
+  if (Array.isArray(body)) return true;
+  if (body && typeof body === 'object' && Array.isArray(body.data)) return true;
+  return body && typeof body === 'object';
+}
+
+function isStepsValid(body) {
+  if (Array.isArray(body) && body.length > 0) return true;
+  if (body && Array.isArray(body.steps) && body.steps.length > 0) return true;
+  return body && typeof body === 'object' && Object.keys(body).length > 0;
+}
+
+/**
+ * @param {Array} executions
+ * @param {string[]} fallbackIds
+ * @returns {string[]}
+ */
+function resolveExecutionIdsForChecks(executions, fallbackIds) {
+  const fromRows = (executions || [])
+    .map(e => (e && e.id ? String(e.id).trim() : ''))
+    .filter(Boolean);
+  return [...new Set(fromRows.concat(fallbackIds || []))];
+}
+
+/**
+ * @param {Object} opts
+ * @returns {Promise<import('../api/types/audit.types').AuditEvidenceMatrixRow>}
+ */
+async function checkPerExecutionSub(opts) {
+  const { dataplaneUrl, authConfig, executionId, rowNum, label, fetcher, isValid } = opts;
+  try {
+    const body = await fetcher(dataplaneUrl, authConfig, executionId);
+    return checkPerExecutionRow(rowNum, `${label}Null`, label, body, isValid);
+  } catch (err) {
+    return {
+      row: rowNum,
+      status: 'failed',
+      detail: `${label}: ${err.message}`,
+      code: `${label}Error`
+    };
+  }
+}
+
+module.exports = {
+  checkRow8CorrelationGroup,
+  resolveRow8Executions,
+  checkRow9Traces,
+  isRbacSubResourceValid,
+  isAbacSubResourceValid,
+  isErrorsValid,
+  isStepsValid,
+  resolveExecutionIdsForChecks,
+  checkPerExecutionSub
+};