@aifabrix/builder 2.45.0 → 2.46.0

package/lib/identity/identity-apply-phases.js

@@ -0,0 +1,244 @@
+/**
+ * @fileoverview Phased execution for identity apply
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getGroup, createGroup } = require('../api/groups.api');
+const { createUser } = require('../api/users.api');
+const { addUserToGroup } = require('../api/user-groups.api');
+const { clearAuthCache } = require('../api/auth-cache.api');
+const { fullSyncToDataplane } = require('../api/dataplane-sync.api');
+const {
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk,
+  apiErrorMessage,
+  findExistingUser
+} = require('./identity-apply-core');
+
+/**
+ * @param {string} msg
+ * @returns {boolean}
+ */
+function isAlreadyMemberError(msg) {
+  return /already a member|409|Conflict/i.test(String(msg || ''));
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {{ name: string, displayName: string }} spec
+ * @param {boolean} dryRun
+ * @returns {Promise<{ id: string, created: boolean }>}
+ */
+async function ensureGroup(controllerUrl, authConfig, spec, dryRun) {
+  const name = spec.name;
+  const existingRes = await getGroup(controllerUrl, authConfig, name);
+  const existing = unwrapControllerData(existingRes);
+  if (existing && existing.id) {
+    return { id: existing.id, created: false };
+  }
+  if (dryRun) {
+    return { id: `(dry-run:${name})`, created: true };
+  }
+  const createdRes = await createGroup(controllerUrl, authConfig, {
+    name,
+    displayName: spec.displayName || name
+  });
+  throwIfApiFailed(createdRes);
+  const created = unwrapControllerData(createdRes);
+  return { id: created.id, created: true };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} userSpec
+ * @param {boolean} dryRun
+ * @returns {Promise<{ id: string, created: boolean }>}
+ */
+async function ensureUser(controllerUrl, authConfig, userSpec, dryRun) {
+  const existing = await findExistingUser(controllerUrl, authConfig, userSpec);
+  if (existing && existing.id) {
+    return { id: existing.id, created: false };
+  }
+  if (dryRun) {
+    return { id: `(dry-run:${userSpec.email})`, created: true };
+  }
+  const body = {
+    email: userSpec.email,
+    firstName: userSpec.firstName,
+    lastName: userSpec.lastName,
+    displayName: userSpec.displayName,
+    username: userSpec.username,
+    status: 'active'
+  };
+  Object.keys(body).forEach((k) => {
+    if (body[k] === undefined || body[k] === '') {
+      delete body[k];
+    }
+  });
+  const createdRes = await createUser(controllerUrl, authConfig, body);
+  throwIfApiFailed(createdRes);
+  const created = unwrapControllerData(createdRes);
+  return { id: created.id, created: true };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Map} groups
+ * @param {boolean} dryRun
+ * @returns {Promise<{ map: Map<string, string>, created: number, processed: number }>}
+ */
+async function applyGroupsPhase(controllerUrl, authConfig, groups, dryRun) {
+  const map = new Map();
+  let created = 0;
+  let processed = 0;
+  for (const spec of groups.values()) {
+    const out = await ensureGroup(controllerUrl, authConfig, spec, dryRun);
+    map.set(spec.name, out.id);
+    processed += 1;
+    if (out.created) {
+      created += 1;
+    }
+  }
+  return { map, created, processed };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Map} users
+ * @param {boolean} dryRun
+ * @returns {Promise<{ map: Map<string, string>, created: number, processed: number }>}
+ */
+async function applyUsersPhase(controllerUrl, authConfig, users, dryRun) {
+  const map = new Map();
+  let created = 0;
+  let processed = 0;
+  for (const [userKey, userSpec] of users.entries()) {
+    const out = await ensureUser(controllerUrl, authConfig, userSpec, dryRun);
+    map.set(userKey, out.id);
+    processed += 1;
+    if (out.created) {
+      created += 1;
+    }
+  }
+  return { map, created, processed };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object[]} memberships
+ * @param {Map<string, string>} userIdByKey
+ * @param {Map<string, string>} groupIdByName
+ * @param {boolean} dryRun
+ * @returns {Promise<{ created: number, processed: number, skipped: number }>}
+ */
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} m
+ * @param {Map<string, string>} userIdByKey
+ * @param {Map<string, string>} groupIdByName
+ * @param {boolean} dryRun
+ * @returns {Promise<'created'|'skipped'|'dry'>}
+ */
+async function applyOneMembership(controllerUrl, authConfig, m, userIdByKey, groupIdByName, dryRun) {
+  const userId = userIdByKey.get(m.userKey);
+  const groupId = groupIdByName.get(m.groupName);
+  if (!userId || !groupId) {
+    return 'skipped';
+  }
+  if (dryRun) {
+    return 'dry';
+  }
+  const res = await addUserToGroup(controllerUrl, authConfig, userId, groupId, {});
+  if (res && res.success !== false) {
+    return 'created';
+  }
+  if (isAlreadyMemberError(apiErrorMessage(res))) {
+    return 'skipped';
+  }
+  throw new Error(apiErrorMessage(res));
+}
+
+async function applyMembershipsPhase(
+  controllerUrl,
+  authConfig,
+  memberships,
+  userIdByKey,
+  groupIdByName,
+  dryRun
+) {
+  let created = 0;
+  let processed = 0;
+  let skipped = 0;
+  for (const m of memberships) {
+    const userId = userIdByKey.get(m.userKey);
+    const groupId = groupIdByName.get(m.groupName);
+    if (!userId || !groupId) {
+      continue;
+    }
+    processed += 1;
+    const outcome = await applyOneMembership(
+      controllerUrl,
+      authConfig,
+      m,
+      userIdByKey,
+      groupIdByName,
+      dryRun
+    );
+    if (outcome === 'created' || outcome === 'dry') {
+      created += 1;
+    } else if (outcome === 'skipped') {
+      skipped += 1;
+    }
+  }
+  return { created, processed, skipped };
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} opts
+ * @returns {Promise<Object|null>}
+ */
+async function maybePurgeAndSync(controllerUrl, authConfig, opts) {
+  if (opts.dryRun) {
+    return null;
+  }
+  if (opts.purgeCache) {
+    const cacheRes = await clearAuthCache(controllerUrl, authConfig);
+    throwIfApiFailed(cacheRes);
+  }
+  if (!opts.sync || !opts.envKey) {
+    return null;
+  }
+  const syncRes = await fullSyncToDataplane(controllerUrl, authConfig, opts.envKey);
+  throwIfApiFailed(syncRes);
+  const stats = unwrapControllerData(syncRes);
+  assertSyncStatsOk(stats, { allowEmptySync: opts.allowEmptySync });
+  return stats;
+}
+
+module.exports = {
+  ensureGroup,
+  ensureUser,
+  applyGroupsPhase,
+  applyUsersPhase,
+  applyMembershipsPhase,
+  maybePurgeAndSync
+};

package/lib/identity/identity-apply-service.js

@@ -0,0 +1,77 @@
+/**
+ * @fileoverview Bulk identity apply (CSV) against miso-controller
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { parseUsersCsvFile, buildApplyPlanFromRows } = require('./identity-csv-parser');
+const {
+  applyGroupsPhase,
+  applyUsersPhase,
+  applyMembershipsPhase,
+  maybePurgeAndSync
+} = require('./identity-apply-phases');
+
+const {
+  unwrapControllerData,
+  apiErrorMessage,
+  throwIfApiFailed,
+  findExistingUser
+} = require('./identity-apply-core');
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runIdentityApply(controllerUrl, authConfig, options) {
+  const { rows } = parseUsersCsvFile(options.filePath, options.filterPrefix);
+  if (!rows.length) {
+    throw new Error('No data rows to apply after parsing CSV');
+  }
+  const plan = buildApplyPlanFromRows(rows);
+  const dryRun = Boolean(options.dryRun);
+
+  const groupPhase = await applyGroupsPhase(controllerUrl, authConfig, plan.groups, dryRun);
+  const userPhase = await applyUsersPhase(controllerUrl, authConfig, plan.users, dryRun);
+  const memPhase = await applyMembershipsPhase(
+    controllerUrl,
+    authConfig,
+    plan.memberships,
+    userPhase.map,
+    groupPhase.map,
+    dryRun
+  );
+
+  const syncStats = await maybePurgeAndSync(controllerUrl, authConfig, {
+    dryRun,
+    purgeCache: Boolean(options.purgeCache),
+    sync: Boolean(options.sync),
+    envKey: options.envKey,
+    allowEmptySync: Boolean(options.allowEmptySync)
+  });
+
+  return {
+    groupsProcessed: groupPhase.processed,
+    groupsCreated: groupPhase.created,
+    usersProcessed: userPhase.processed,
+    usersCreated: userPhase.created,
+    membershipsProcessed: memPhase.processed,
+    membershipsCreated: memPhase.created,
+    membershipsSkipped: memPhase.skipped,
+    dryRun,
+    syncStats
+  };
+}
+
+module.exports = {
+  unwrapControllerData,
+  apiErrorMessage,
+  throwIfApiFailed,
+  runIdentityApply,
+  findExistingUser
+};

package/lib/identity/identity-csv-parser.js

@@ -0,0 +1,114 @@
+/**
+ * @fileoverview Parse controller users.csv-style files for identity apply
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { readFileSync } = require('../internal/fs-real-sync');
+
+/**
+ * Parse one CSV line respecting double-quoted fields.
+ * @param {string} line
+ * @returns {string[]}
+ */
+function parseCsvLine(line) {
+  const out = [];
+  let cur = '';
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    if (ch === '"') {
+      if (inQuotes && line[i + 1] === '"') {
+        cur += '"';
+        i += 1;
+      } else {
+        inQuotes = !inQuotes;
+      }
+    } else if (ch === ',' && !inQuotes) {
+      out.push(cur.trim());
+      cur = '';
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur.trim());
+  return out;
+}
+
+/**
+ * @param {string} filePath
+ * @param {string} [filterPrefix]
+ * @returns {{ headers: string[], rows: Object[] }}
+ */
+function parseUsersCsvFile(filePath, filterPrefix = '') {
+  const raw = readFileSync(filePath, 'utf8');
+  const lines = raw.split(/\r?\n/).filter((l) => l.trim().length > 0);
+  if (lines.length < 2) {
+    throw new Error('CSV must include a header row and at least one data row');
+  }
+  const headers = parseCsvLine(lines[0]);
+  const prefix = String(filterPrefix || '').trim();
+  const rows = [];
+  for (let i = 1; i < lines.length; i += 1) {
+    const cells = parseCsvLine(lines[i]);
+    const row = {};
+    headers.forEach((h, idx) => {
+      row[h] = cells[idx] !== undefined ? cells[idx] : '';
+    });
+    const id = String(row.Id || row.id || '').trim();
+    if (prefix && id && !id.startsWith(prefix)) {
+      continue;
+    }
+    rows.push(row);
+  }
+  return { headers, rows };
+}
+
+/**
+ * Build unique entities from CSV rows (users.csv shape).
+ * @param {Object[]} rows
+ * @returns {{ groups: Map<string, { name: string, displayName: string }>, users: Map<string, Object>, memberships: { userKey: string, groupName: string }[] }}
+ */
+// eslint-disable-next-line complexity -- row shape varies; logic is linear per field
+function buildApplyPlanFromRows(rows) {
+  const groups = new Map();
+  const users = new Map();
+  const memberships = [];
+
+  for (const row of rows) {
+    const csvId = String(row.Id || row.id || '').trim();
+    const email = String(row.Email || row.email || '').trim();
+    if (!email) {
+      continue;
+    }
+    const userKey = csvId || email;
+    const groupName = String(row.GroupId || row.groupId || '').trim();
+    const groupDisplay = String(row.GroupName || row.groupName || groupName).trim();
+    if (groupName) {
+      if (!groups.has(groupName)) {
+        groups.set(groupName, { name: groupName, displayName: groupDisplay || groupName });
+      }
+      memberships.push({ userKey, groupName });
+    }
+    if (!users.has(userKey)) {
+      users.set(userKey, {
+        csvId,
+        email,
+        firstName: String(row.FirstName || row.firstName || '').trim() || undefined,
+        lastName: String(row.LastName || row.lastName || '').trim() || undefined,
+        displayName: String(row.DisplayName || row.displayName || '').trim() || undefined,
+        username: String(row.UserPrincipalName || row.userPrincipalName || row.username || '').trim() || undefined
+      });
+    }
+  }
+
+  return { groups, users, memberships };
+}
+
+module.exports = {
+  parseCsvLine,
+  parseUsersCsvFile,
+  buildApplyPlanFromRows
+};

package/lib/infrastructure/admin-secrets-apply.js

@@ -0,0 +1,84 @@
+/**
+ * Write admin-secrets.env from setup password bundles.
+ *
+ * @fileoverview Apply dev/pro bundles to admin-secrets.env
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fsRealSync = require('../internal/fs-real-sync');
+const logger = require('../utils/logger');
+const { applyPasswordBundleToAdminObj } = require('../core/admin-secrets-bundle');
+
+const DEFAULT_ADMIN_OBJ = {
+  REDIS_HOST: 'local:redis:6379:0:',
+  REDIS_COMMANDER_USER: 'admin'
+};
+
+/**
+ * @param {() => object} getCoreSecrets
+ * @param {string} adminSecretsPath
+ * @param {Object.<string, string>} merged
+ * @param {string|null} logMessage
+ */
+async function writeAdminSecretsFile(getCoreSecrets, adminSecretsPath, merged, logMessage) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(adminSecretsPath);
+  const content = await getCoreSecrets().formatAdminSecretsContent(merged);
+  fsRealSync.writeFileSync(adminSecretsPath, content, { mode: 0o600 });
+  if (logMessage) {
+    logger.log(logMessage);
+  }
+}
+
+/**
+ * @param {Object} ctx
+ * @param {() => object} ctx.getCoreSecrets
+ * @param {(bundle: object) => Promise<void>} [ctx.syncAdminKvFromPasswordBundle]
+ * @param {(bundle: object) => Promise<void>} [ctx.syncRequiredKvFromPasswordBundle]
+ * @param {boolean} [ctx.syncAdminKv]
+ * @param {(dir: string) => void} ctx.logVolumeResetHint
+ * @param {string} ctx.infraDirForHint
+ * @param {string} ctx.adminSecretsPath
+ * @param {Object} ctx.adminObj
+ * @param {Object} ctx.bundle
+ * @param {string} [ctx.email]
+ */
+async function applyAdminSecretsFromBundle(ctx) {
+  const {
+    getCoreSecrets,
+    syncAdminKvFromPasswordBundle,
+    syncRequiredKvFromPasswordBundle,
+    syncAdminKv,
+    logVolumeResetHint,
+    infraDirForHint,
+    adminSecretsPath,
+    adminObj,
+    bundle,
+    email
+  } = ctx;
+  let merged = applyPasswordBundleToAdminObj({ ...DEFAULT_ADMIN_OBJ, ...adminObj }, bundle);
+  if (email && String(email).trim()) {
+    merged = { ...merged, PGADMIN_DEFAULT_EMAIL: String(email).trim() };
+  }
+  await writeAdminSecretsFile(
+    getCoreSecrets,
+    adminSecretsPath,
+    merged,
+    'Updated admin credentials in admin-secrets.env.'
+  );
+  if (syncAdminKv && typeof syncAdminKvFromPasswordBundle === 'function') {
+    await syncAdminKvFromPasswordBundle(bundle);
+  } else if (typeof syncRequiredKvFromPasswordBundle === 'function') {
+    await syncRequiredKvFromPasswordBundle(bundle);
+  }
+  logVolumeResetHint(infraDirForHint);
+}
+
+module.exports = {
+  DEFAULT_ADMIN_OBJ,
+  writeAdminSecretsFile,
+  applyAdminSecretsFromBundle
+};

package/lib/infrastructure/admin-secrets-ensure.js

@@ -0,0 +1,130 @@
+/**
+ * Ensure `admin-secrets.env` exists and reflects CLI / setup password bundles.
+ *
+ * @fileoverview ensureAdminSecrets for up-infra and setup
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fsRealSync = require('../internal/fs-real-sync');
+const adminSecrets = require('../core/admin-secrets');
+const logger = require('../utils/logger');
+const paths = require('../utils/paths');
+const {
+  loadAdminMergedDefaultsForInfra,
+  resolveAdminPasswordAndEmailCli,
+  computeAdminSecretsBackfillFlags,
+  resolvePasswordForAdminFile
+} = require('./admin-secrets-resolve');
+const { syncAdminKvFromPasswordBundle, syncRequiredKvFromPasswordBundle } = require('./admin-secrets-sync');
+const { applyAdminSecretsFromBundle: applyAdminSecretsFromBundleImpl } = require('./admin-secrets-apply');
+
+/**
+ * @param {() => object} getCoreSecrets
+ * @param {(devId: number|string) => string} getInfraDirName
+ * @param {(infraDir: string) => void} logVolumeResetHint
+ * @param {Function} applyAdminSecretsUpdate
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function ensureAdminSecrets(
+  getCoreSecrets,
+  getInfraDirName,
+  logVolumeResetHint,
+  applyAdminSecretsUpdate,
+  options = {}
+) {
+  const { passwordBundleFromCliOptions } = require('../core/admin-secrets-bundle');
+  const bundle = options.passwordBundle || passwordBundleFromCliOptions(options);
+  const mergedDefaults = loadAdminMergedDefaultsForInfra(options);
+  const { adminPwdOverride, passwordToUse, emailOverride, emailToUse } = resolveAdminPasswordAndEmailCli(
+    options,
+    mergedDefaults
+  );
+  const adminSecretsPath = path.join(paths.getAifabrixSystemDir(), 'admin-secrets.env');
+
+  if (!fsRealSync.existsSync(adminSecretsPath)) {
+    logger.log('Generating admin-secrets.env...');
+    await getCoreSecrets().generateAdminSecretsEnv(undefined);
+  }
+
+  if (bundle) {
+    const adminObj = await adminSecrets.readAndDecryptAdminSecrets(adminSecretsPath);
+    await applyAdminSecretsFromBundleImpl({
+      getCoreSecrets,
+      syncAdminKvFromPasswordBundle,
+      syncRequiredKvFromPasswordBundle,
+      syncAdminKv: options.syncAdminKv === true,
+      logVolumeResetHint,
+      infraDirForHint: path.join(paths.getAifabrixSystemDir(), getInfraDirName(0)),
+      adminSecretsPath,
+      adminObj,
+      bundle,
+      email: emailToUse
+    });
+    return adminSecretsPath;
+  }
+
+  const adminObj = await adminSecrets.readAndDecryptAdminSecrets(adminSecretsPath);
+  return applyLegacyAdminSecretsUpdate(
+    applyAdminSecretsUpdate,
+    adminSecretsPath,
+    adminObj,
+    {
+      adminPwdOverride,
+      passwordToUse,
+      emailOverride,
+      emailToUse,
+      mergedDefaults,
+      syncAdminKv: options.syncAdminKv === true
+    }
+  );
+}
+
+/**
+ * @param {Function} applyAdminSecretsUpdate
+ * @param {string} adminSecretsPath
+ * @param {Object} adminObj
+ * @param {Object} ctx
+ * @returns {Promise<string>}
+ */
+async function applyLegacyAdminSecretsUpdate(
+  applyAdminSecretsUpdate,
+  adminSecretsPath,
+  adminObj,
+  ctx
+) {
+  const { needsPasswordBackfill, needsEmailBackfill } = computeAdminSecretsBackfillFlags(adminObj);
+  const shouldOverwriteWithAdminPwd = ctx.adminPwdOverride !== null;
+  const shouldOverwriteEmail = ctx.emailOverride !== null;
+  const updateEmail = shouldOverwriteEmail || needsEmailBackfill;
+
+  if (!shouldOverwriteWithAdminPwd && !needsPasswordBackfill && !updateEmail) {
+    return adminSecretsPath;
+  }
+
+  const passwordForFile = resolvePasswordForAdminFile(
+    shouldOverwriteWithAdminPwd,
+    needsPasswordBackfill,
+    ctx.passwordToUse,
+    adminObj,
+    ctx.mergedDefaults
+  );
+
+  await applyAdminSecretsUpdate(
+    adminSecretsPath,
+    adminObj,
+    passwordForFile,
+    shouldOverwriteWithAdminPwd,
+    { updateEmail, emailToUse: ctx.emailToUse },
+    ctx.syncAdminKv === true
+  );
+  return adminSecretsPath;
+}
+
+module.exports = {
+  ensureAdminSecrets
+};