@aifabrix/builder 2.45.5 → 2.46.0

package/lib/infrastructure/admin-secrets-ensure.js

@@ -0,0 +1,130 @@
+/**
+ * Ensure `admin-secrets.env` exists and reflects CLI / setup password bundles.
+ *
+ * @fileoverview ensureAdminSecrets for up-infra and setup
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fsRealSync = require('../internal/fs-real-sync');
+const adminSecrets = require('../core/admin-secrets');
+const logger = require('../utils/logger');
+const paths = require('../utils/paths');
+const {
+  loadAdminMergedDefaultsForInfra,
+  resolveAdminPasswordAndEmailCli,
+  computeAdminSecretsBackfillFlags,
+  resolvePasswordForAdminFile
+} = require('./admin-secrets-resolve');
+const { syncAdminKvFromPasswordBundle, syncRequiredKvFromPasswordBundle } = require('./admin-secrets-sync');
+const { applyAdminSecretsFromBundle: applyAdminSecretsFromBundleImpl } = require('./admin-secrets-apply');
+
+/**
+ * @param {() => object} getCoreSecrets
+ * @param {(devId: number|string) => string} getInfraDirName
+ * @param {(infraDir: string) => void} logVolumeResetHint
+ * @param {Function} applyAdminSecretsUpdate
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function ensureAdminSecrets(
+  getCoreSecrets,
+  getInfraDirName,
+  logVolumeResetHint,
+  applyAdminSecretsUpdate,
+  options = {}
+) {
+  const { passwordBundleFromCliOptions } = require('../core/admin-secrets-bundle');
+  const bundle = options.passwordBundle || passwordBundleFromCliOptions(options);
+  const mergedDefaults = loadAdminMergedDefaultsForInfra(options);
+  const { adminPwdOverride, passwordToUse, emailOverride, emailToUse } = resolveAdminPasswordAndEmailCli(
+    options,
+    mergedDefaults
+  );
+  const adminSecretsPath = path.join(paths.getAifabrixSystemDir(), 'admin-secrets.env');
+
+  if (!fsRealSync.existsSync(adminSecretsPath)) {
+    logger.log('Generating admin-secrets.env...');
+    await getCoreSecrets().generateAdminSecretsEnv(undefined);
+  }
+
+  if (bundle) {
+    const adminObj = await adminSecrets.readAndDecryptAdminSecrets(adminSecretsPath);
+    await applyAdminSecretsFromBundleImpl({
+      getCoreSecrets,
+      syncAdminKvFromPasswordBundle,
+      syncRequiredKvFromPasswordBundle,
+      syncAdminKv: options.syncAdminKv === true,
+      logVolumeResetHint,
+      infraDirForHint: path.join(paths.getAifabrixSystemDir(), getInfraDirName(0)),
+      adminSecretsPath,
+      adminObj,
+      bundle,
+      email: emailToUse
+    });
+    return adminSecretsPath;
+  }
+
+  const adminObj = await adminSecrets.readAndDecryptAdminSecrets(adminSecretsPath);
+  return applyLegacyAdminSecretsUpdate(
+    applyAdminSecretsUpdate,
+    adminSecretsPath,
+    adminObj,
+    {
+      adminPwdOverride,
+      passwordToUse,
+      emailOverride,
+      emailToUse,
+      mergedDefaults,
+      syncAdminKv: options.syncAdminKv === true
+    }
+  );
+}
+
+/**
+ * @param {Function} applyAdminSecretsUpdate
+ * @param {string} adminSecretsPath
+ * @param {Object} adminObj
+ * @param {Object} ctx
+ * @returns {Promise<string>}
+ */
+async function applyLegacyAdminSecretsUpdate(
+  applyAdminSecretsUpdate,
+  adminSecretsPath,
+  adminObj,
+  ctx
+) {
+  const { needsPasswordBackfill, needsEmailBackfill } = computeAdminSecretsBackfillFlags(adminObj);
+  const shouldOverwriteWithAdminPwd = ctx.adminPwdOverride !== null;
+  const shouldOverwriteEmail = ctx.emailOverride !== null;
+  const updateEmail = shouldOverwriteEmail || needsEmailBackfill;
+
+  if (!shouldOverwriteWithAdminPwd && !needsPasswordBackfill && !updateEmail) {
+    return adminSecretsPath;
+  }
+
+  const passwordForFile = resolvePasswordForAdminFile(
+    shouldOverwriteWithAdminPwd,
+    needsPasswordBackfill,
+    ctx.passwordToUse,
+    adminObj,
+    ctx.mergedDefaults
+  );
+
+  await applyAdminSecretsUpdate(
+    adminSecretsPath,
+    adminObj,
+    passwordForFile,
+    shouldOverwriteWithAdminPwd,
+    { updateEmail, emailToUse: ctx.emailToUse },
+    ctx.syncAdminKv === true
+  );
+  return adminSecretsPath;
+}
+
+module.exports = {
+  ensureAdminSecrets
+};

package/lib/infrastructure/admin-secrets-resolve.js

@@ -0,0 +1,95 @@
+/**
+ * Resolve admin password/email for ensureAdminSecrets from CLI and catalog defaults.
+ *
+ * @fileoverview CLI + catalog resolution for admin-secrets.env
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  mergeInfraParameterDefaultsForCli,
+  getInfraParameterCatalog,
+  readRelaxedCatalogDefaults
+} = require('../parameters/infra-parameter-catalog');
+
+/**
+ * @param {Object} options
+ * @returns {Object}
+ */
+function loadAdminMergedDefaultsForInfra(options) {
+  try {
+    return mergeInfraParameterDefaultsForCli(getInfraParameterCatalog().data, options);
+  } catch {
+    return mergeInfraParameterDefaultsForCli({}, options);
+  }
+}
+
+/**
+ * @param {Object} options
+ * @param {Object} mergedDefaults
+ * @returns {{ adminPwdOverride: string|null, passwordToUse: string, emailOverride: string|null, emailToUse: string }}
+ */
+function resolveAdminPasswordAndEmailCli(options, mergedDefaults) {
+  const infraDefaults = readRelaxedCatalogDefaults();
+  const adminPwdCli = String(options.adminPassword || options.adminPwd || '').trim();
+  const adminPwdOverride = adminPwdCli !== '' ? adminPwdCli : null;
+  const passwordToUse =
+    adminPwdOverride !== null
+      ? adminPwdOverride
+      : mergedDefaults.adminPassword || infraDefaults.adminPassword || '';
+  const emailCli = String(options.adminEmail || '').trim();
+  const emailOverride = emailCli !== '' ? emailCli : null;
+  const emailToUse =
+    emailOverride !== null
+      ? emailOverride
+      : mergedDefaults.adminEmail || infraDefaults.adminEmail || '';
+  return { adminPwdOverride, passwordToUse, emailOverride, emailToUse };
+}
+
+/**
+ * @param {Object} adminObj
+ * @returns {{ needsPasswordBackfill: boolean, needsEmailBackfill: boolean }}
+ */
+function computeAdminSecretsBackfillFlags(adminObj) {
+  const needsPasswordBackfill =
+    !(adminObj.POSTGRES_PASSWORD && adminObj.POSTGRES_PASSWORD.trim()) ||
+    !(adminObj.PGADMIN_DEFAULT_PASSWORD && adminObj.PGADMIN_DEFAULT_PASSWORD.trim()) ||
+    !(adminObj.REDIS_COMMANDER_PASSWORD && adminObj.REDIS_COMMANDER_PASSWORD.trim());
+  const needsEmailBackfill = !(adminObj.PGADMIN_DEFAULT_EMAIL && adminObj.PGADMIN_DEFAULT_EMAIL.trim());
+  return { needsPasswordBackfill, needsEmailBackfill };
+}
+
+/**
+ * @param {boolean} shouldOverwriteWithAdminPwd
+ * @param {boolean} needsPasswordBackfill
+ * @param {string} passwordToUse
+ * @param {Object} adminObj
+ * @param {Object} mergedDefaults
+ * @returns {string}
+ */
+function resolvePasswordForAdminFile(
+  shouldOverwriteWithAdminPwd,
+  needsPasswordBackfill,
+  passwordToUse,
+  adminObj,
+  mergedDefaults
+) {
+  if (shouldOverwriteWithAdminPwd || needsPasswordBackfill) {
+    return passwordToUse;
+  }
+  return (
+    String(adminObj.POSTGRES_PASSWORD || '').trim() ||
+    mergedDefaults.adminPassword ||
+    readRelaxedCatalogDefaults().adminPassword ||
+    ''
+  );
+}
+
+module.exports = {
+  loadAdminMergedDefaultsForInfra,
+  resolveAdminPasswordAndEmailCli,
+  computeAdminSecretsBackfillFlags,
+  resolvePasswordForAdminFile
+};

package/lib/infrastructure/admin-secrets-sync.js

@@ -0,0 +1,91 @@
+/**
+ * Sync admin passwords into catalog kv secrets store.
+ *
+ * @fileoverview {{adminPassword}} placeholder sync for setup / up-infra
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const secretsEnsure = require('../core/secrets-ensure');
+
+/**
+ * @param {string} password
+ * @returns {Promise<void>}
+ */
+async function syncAdminPasswordKeysToStore(password) {
+  const trimmed = String(password || '').trim();
+  if (!trimmed) return;
+  try {
+    const { syncLiteralKvSecretsFromCliOverrides } = require('../core/secrets-infra-placeholder-sync');
+    const { buildInfraPlaceholderContext } = require('../core/secrets-ensure');
+    const ipc = require('../parameters/infra-parameter-catalog');
+    const placeholderContext = buildInfraPlaceholderContext({
+      adminPassword: trimmed,
+      adminPwd: trimmed
+    });
+    await syncLiteralKvSecretsFromCliOverrides(
+      { adminPassword: trimmed, adminPwd: trimmed },
+      placeholderContext,
+      (key, val) => secretsEnsure.setSecretInStore(key, val),
+      () => ipc
+    );
+  } catch (err) {
+    logger.warn(`Could not sync admin password keys to secrets store: ${err.message}`);
+  }
+}
+
+/**
+ * Keep kv:// secrets aligned with admin-secrets for platform install (required for pro split bundles).
+ * @param {Object|null} bundle
+ * @returns {Promise<void>}
+ */
+async function syncRequiredKvFromPasswordBundle(bundle) {
+  if (!bundle) return;
+  const { syncLiteralKvSecretsFromCliOverrides } = require('../core/secrets-infra-placeholder-sync');
+  const { buildInfraPlaceholderContext } = require('../core/secrets-ensure');
+  const ipc = require('../parameters/infra-parameter-catalog');
+
+  if (bundle.mode === 'single') {
+    const pwd = bundle.password;
+    await secretsEnsure.setSecretInStore('keycloak-admin-passwordKeyVault', pwd);
+    const ctx = buildInfraPlaceholderContext({ userPassword: pwd });
+    await syncLiteralKvSecretsFromCliOverrides(
+      { userPassword: pwd },
+      ctx,
+      (key, val) => secretsEnsure.setSecretInStore(key, val),
+      () => ipc
+    );
+    return;
+  }
+
+  await secretsEnsure.setSecretInStore('keycloak-admin-passwordKeyVault', bundle.keycloak);
+  const userCtx = buildInfraPlaceholderContext({ userPassword: bundle.platform });
+  await syncLiteralKvSecretsFromCliOverrides(
+    { userPassword: bundle.platform },
+    userCtx,
+    (key, val) => secretsEnsure.setSecretInStore(key, val),
+    () => ipc
+  );
+}
+
+/**
+ * @param {Object|null} bundle
+ * @returns {Promise<void>}
+ */
+async function syncAdminKvFromPasswordBundle(bundle) {
+  await syncRequiredKvFromPasswordBundle(bundle);
+  if (bundle.mode === 'single') {
+    await syncAdminPasswordKeysToStore(bundle.password);
+  } else {
+    await syncAdminPasswordKeysToStore(bundle.infra);
+  }
+}
+
+module.exports = {
+  syncAdminPasswordKeysToStore,
+  syncRequiredKvFromPasswordBundle,
+  syncAdminKvFromPasswordBundle
+};

package/lib/infrastructure/helpers.js

@@ -11,19 +11,13 @@
 
 const path = require('path');
 const fs = require('fs');
-const fsRealSync = require('../internal/fs-real-sync');
 const { nodeFs } = require('../internal/node-fs');
 const chalk = require('chalk');
 const handlebars = require('handlebars');
 const adminSecrets = require('../core/admin-secrets');
 const logger = require('../utils/logger');
 const paths = require('../utils/paths');
-const secretsEnsure = require('../core/secrets-ensure');
-const {
-  mergeInfraParameterDefaultsForCli,
-  getInfraParameterCatalog,
-  readRelaxedCatalogDefaults
-} = require('../parameters/infra-parameter-catalog');
+const { readRelaxedCatalogDefaults } = require('../parameters/infra-parameter-catalog');
 const { checkDockerAvailability } = require('./helpers-docker-check');
 
 /**
@@ -77,23 +71,12 @@ function logVolumeResetHint(infraDir) {
   ));
 }
 
-/**
- * Sync postgres-passwordKeyVault to the main secrets store (file or remote).
- * @param {string} password - Password to store
- */
-async function syncPostgresPasswordToStore(password) {
-  try {
-    await secretsEnsure.setSecretInStore('postgres-passwordKeyVault', password);
-  } catch (err) {
-    logger.warn(`Could not sync postgres-passwordKeyVault to secrets store: ${err.message}`);
-  }
-}
-
-/** Non-email defaults for admin-secrets.env merge (email default comes from infra.parameter.yaml `defaults`). */
-const DEFAULT_ADMIN_OBJ = {
-  REDIS_HOST: 'local:redis:6379:0:',
-  REDIS_COMMANDER_USER: 'admin'
-};
+const { syncAdminPasswordKeysToStore } = require('./admin-secrets-sync');
+const {
+  DEFAULT_ADMIN_OBJ,
+  writeAdminSecretsFile: writeAdminSecretsFileImpl
+} = require('./admin-secrets-apply');
+const { ensureAdminSecrets: ensureAdminSecretsImpl } = require('./admin-secrets-ensure');
 
 /**
  * Writes merged admin secrets to disk and logs/syncs as needed.
@@ -109,20 +92,25 @@ async function applyAdminSecretsUpdate(
   adminObj,
   passwordToUse,
   shouldOverwriteWithAdminPwd,
-  emailOpts
+  emailOpts,
+  syncAdminKv = false
 ) {
   const merged = { ...DEFAULT_ADMIN_OBJ, ...adminObj };
   merged.POSTGRES_PASSWORD = passwordToUse;
   merged.PGADMIN_DEFAULT_PASSWORD = passwordToUse;
   merged.REDIS_COMMANDER_PASSWORD = passwordToUse;
+  merged.KEYCLOAK_ADMIN_USERNAME = merged.KEYCLOAK_ADMIN_USERNAME || 'admin';
+  merged.KEYCLOAK_ADMIN_PASSWORD = passwordToUse;
+  merged.PLATFORM_ADMIN_PASSWORD = passwordToUse;
   if (emailOpts && emailOpts.updateEmail && emailOpts.emailToUse) {
     merged.PGADMIN_DEFAULT_EMAIL = emailOpts.emailToUse;
   }
-  const content = await getCoreSecrets().formatAdminSecretsContent(merged);
-  fsRealSync.writeFileSync(adminSecretsPath, content, { mode: 0o600 });
+  await writeAdminSecretsFileImpl(getCoreSecrets, adminSecretsPath, merged, null);
   if (shouldOverwriteWithAdminPwd) {
     logger.log('Updated admin password in admin-secrets.env.');
-    await syncPostgresPasswordToStore(passwordToUse);
+    if (syncAdminKv) {
+      await syncAdminPasswordKeysToStore(passwordToUse);
+    }
     logVolumeResetHint(path.join(paths.getAifabrixSystemDir(), getInfraDirName(0)));
   } else if (emailOpts && emailOpts.updateEmail) {
     logger.log('Updated admin email in admin-secrets.env.');
@@ -131,109 +119,15 @@ async function applyAdminSecretsUpdate(
   }
 }
 
-function loadAdminMergedDefaultsForInfra(options) {
-  try {
-    return mergeInfraParameterDefaultsForCli(getInfraParameterCatalog().data, options);
-  } catch {
-    return mergeInfraParameterDefaultsForCli({}, options);
-  }
-}
-
-function resolveAdminPasswordAndEmailCli(options, mergedDefaults) {
-  const infraDefaults = readInfraDefaultScalars();
-  const adminPwdCli = String(options.adminPassword || options.adminPwd || '').trim();
-  const adminPwdOverride = adminPwdCli !== '' ? adminPwdCli : null;
-  const passwordToUse =
-    adminPwdOverride !== null
-      ? adminPwdOverride
-      : mergedDefaults.adminPassword || infraDefaults.adminPassword || '';
-  const emailCli = String(options.adminEmail || '').trim();
-  const emailOverride = emailCli !== '' ? emailCli : null;
-  const emailToUse =
-    emailOverride !== null
-      ? emailOverride
-      : mergedDefaults.adminEmail || infraDefaults.adminEmail || '';
-  return { adminPwdOverride, passwordToUse, emailOverride, emailToUse };
-}
-
-function computeAdminSecretsBackfillFlags(adminObj) {
-  const needsPasswordBackfill =
-    !(adminObj.POSTGRES_PASSWORD && adminObj.POSTGRES_PASSWORD.trim()) ||
-    !(adminObj.PGADMIN_DEFAULT_PASSWORD && adminObj.PGADMIN_DEFAULT_PASSWORD.trim()) ||
-    !(adminObj.REDIS_COMMANDER_PASSWORD && adminObj.REDIS_COMMANDER_PASSWORD.trim());
-  const needsEmailBackfill = !(adminObj.PGADMIN_DEFAULT_EMAIL && adminObj.PGADMIN_DEFAULT_EMAIL.trim());
-  return { needsPasswordBackfill, needsEmailBackfill };
-}
-
-function resolvePasswordForAdminFile(
-  shouldOverwriteWithAdminPwd,
-  needsPasswordBackfill,
-  passwordToUse,
-  adminObj,
-  mergedDefaults
-) {
-  if (shouldOverwriteWithAdminPwd || needsPasswordBackfill) {
-    return passwordToUse;
-  }
-  return (
-    String(adminObj.POSTGRES_PASSWORD || '').trim() ||
-    mergedDefaults.adminPassword ||
-    readInfraDefaultScalars().adminPassword ||
-    ''
-  );
-}
-
-/**
- * Ensure admin secrets file exists and set admin password.
- * When adminPwd is provided, update POSTGRES_PASSWORD, PGADMIN_DEFAULT_PASSWORD, REDIS_COMMANDER_PASSWORD
- * in admin-secrets.env (overwrites existing values). Otherwise only backfill empty fields.
- * Reads and writes using decrypted values; writes encrypted when secrets-encryption key is set.
- *
- * @async
- * @param {Object} [options] - Options
- * @param {string} [options.adminPassword] - Override admin password (alias: adminPwd)
- * @param {string} [options.adminPwd] - Override admin password for Postgres, pgAdmin, Redis Commander
- * @param {string} [options.adminEmail] - Override pgAdmin default email (matches {{adminEmail}} defaults)
- * @param {string} [options.userPassword] - Reserved for Keycloak user template (secrets use ensureInfraSecrets)
- * @returns {Promise<string>} Path to admin secrets file
- */
+/** @param {Object} [options] @returns {Promise<string>} */
 async function ensureAdminSecrets(options = {}) {
-  const mergedDefaults = loadAdminMergedDefaultsForInfra(options);
-  const { adminPwdOverride, passwordToUse, emailOverride, emailToUse } = resolveAdminPasswordAndEmailCli(
-    options,
-    mergedDefaults
+  return ensureAdminSecretsImpl(
+    getCoreSecrets,
+    getInfraDirName,
+    logVolumeResetHint,
+    applyAdminSecretsUpdate,
+    options
   );
-  const adminSecretsPath = path.join(paths.getAifabrixSystemDir(), 'admin-secrets.env');
-
-  if (!fsRealSync.existsSync(adminSecretsPath)) {
-    logger.log('Generating admin-secrets.env...');
-    await getCoreSecrets().generateAdminSecretsEnv(undefined);
-    return adminSecretsPath;
-  }
-
-  const adminObj = await adminSecrets.readAndDecryptAdminSecrets(adminSecretsPath);
-  const { needsPasswordBackfill, needsEmailBackfill } = computeAdminSecretsBackfillFlags(adminObj);
-  const shouldOverwriteWithAdminPwd = adminPwdOverride !== null;
-  const shouldOverwriteEmail = emailOverride !== null;
-  const updateEmail = shouldOverwriteEmail || needsEmailBackfill;
-
-  if (!shouldOverwriteWithAdminPwd && !needsPasswordBackfill && !updateEmail) {
-    return adminSecretsPath;
-  }
-
-  const passwordForFile = resolvePasswordForAdminFile(
-    shouldOverwriteWithAdminPwd,
-    needsPasswordBackfill,
-    passwordToUse,
-    adminObj,
-    mergedDefaults
-  );
-
-  await applyAdminSecretsUpdate(adminSecretsPath, adminObj, passwordForFile, shouldOverwriteWithAdminPwd, {
-    updateEmail,
-    emailToUse
-  });
-  return adminSecretsPath;
 }
 
 /** Host-side pgpass for pgAdmin bind mount (must exist before container starts so servers.json import succeeds). */

package/lib/infrastructure/index.js

@@ -85,6 +85,7 @@ async function prepareInfrastructureEnvironment(developerId, options = {}) {
     adminPwd: adminPass,
     adminEmail: options.adminEmail,
     userPassword: options.userPassword,
+    passwordBundle: options.passwordBundle,
     tlsEnabled
   };
   await secretsEnsure.ensureInfraSecrets(infraOpts);
@@ -188,12 +189,9 @@ async function stopAllAppContainers(devId) {
  * @returns {Promise<void>}
  */
 async function removeAppVolumes(appNames, devId) {
-  const { getAppVolumeName } = require('../app/down');
-  const idNum = typeof devId === 'string' ? parseInt(devId, 10) : devId;
+  const { getAppVolumeNameCandidates } = require('../app/down');
   for (const appName of appNames) {
-    const primaryName = getAppVolumeName(appName, devId);
-    const legacyDev0Name = idNum === 0 ? `aifabrix_dev0_${appName}_data` : null;
-    const candidates = Array.from(new Set([primaryName, legacyDev0Name].filter(Boolean)));
+    const candidates = getAppVolumeNameCandidates(appName, devId);
     for (const volumeName of candidates) {
       try {
         await execAsyncWithCwd(`docker volume rm -f ${volumeName}`);
@@ -380,5 +378,6 @@ module.exports = {
   getInfraStatus,
   getAppStatus,
   restartService,
-  ensureAdminSecrets
+  ensureAdminSecrets,
+  removeAppVolumes
 };

package/lib/infrastructure/orphan-infra-docker-teardown.js

@@ -47,16 +47,22 @@ function getInfraServiceContainerNames(devId) {
  * @param {string|number} devId - Developer ID
  * @returns {string[]}
  */
+const { collectDeveloperVolumeIdSuffixes } = require('../utils/developer-volume-id');
+
 function getInfraNamedVolumeCandidates(devId) {
   const idNum = typeof devId === 'string' ? parseInt(devId, 10) : devId;
   if (idNum === 0) {
     return ['infra_postgres_data', 'infra_redis_data', 'infra_pgadmin_data'];
   }
-  return [
-    `infra_dev${devId}_postgres_data`,
-    `infra_dev${devId}_redis_data`,
-    `infra_dev${devId}_pgadmin_data`
-  ];
+  const suffixes = collectDeveloperVolumeIdSuffixes(devId);
+  const bases = ['postgres_data', 'redis_data', 'pgadmin_data'];
+  const names = [];
+  for (const suffix of suffixes) {
+    for (const base of bases) {
+      names.push(`infra_dev${suffix}_${base}`);
+    }
+  }
+  return [...new Set(names)];
 }
 
 /**