@aifabrix/builder 2.45.5 → 2.46.0

package/lib/schema/infra.parameter.yaml

@@ -28,6 +28,11 @@ standardUpInfraEnsureKeys:
   - databases-dataplane-2-passwordKeyVault
   - databases-dataplane-3-urlKeyVault
   - databases-dataplane-3-passwordKeyVault
+  # Miso-controller Entra onboarding (vendor app); required for aifabrix resolve miso-controller
+  - entra-callback-state-secret
+  - entra-callback-uri
+  - entra-client-idKeyVault
+  - entra-client-secretKeyVault
 parameters:
   - key: postgres-passwordKeyVault
     scope: infra
@@ -117,6 +122,46 @@ parameters:
       vaultSecretName: keycloak-client-secretKeyVault
       notes: Per-app OAuth client secret from Keycloak registration; generated on first ensure.
 
+  # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
+  # allow local resolve and start-dev; set real values before Entra admin-consent flows.
+  - key: entra-callback-state-secret
+    scope: shared-service
+    generator:
+      type: randomBytes32
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Shared HMAC secret (min 16 chars) for OAuth state between controller and Mori callback;
+        maps to ENTRA_CALLBACK_STATE_SECRET in miso-controller env.template.
+
+  - key: entra-callback-uri
+    scope: shared-service
+    generator:
+      type: emptyString
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        ENTRA_ID_CENTRAL_CALLBACK_URI — Mori web redirect (e.g. …/entra-id-concent/callback);
+        empty locally until Mori URL is configured.
+
+  - key: entra-client-idKeyVault
+    scope: shared-service
+    generator:
+      type: emptyString
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Vendor Entra app client id (ENTRA_ID_CLIENT_ID); empty for local dev without Entra flows.
+
+  - key: entra-client-secretKeyVault
+    scope: shared-service
+    generator:
+      type: emptyString
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET); empty for local dev without Entra flows.
+
   # Keycloak events: webhook signature secret used by miso-controller (KEYCLOAK_EVENTS_SECRET).
   # This must exist on first boot because up-platform runs containers from templates (no prior resolve).
   - key: keycloak-events-secretKeyVault

package/lib/schema/type/credential-field-registry.json

@@ -1,9 +1,9 @@
 {
-  "version": 5,
+  "version": 6,
   "semantics": {
     "visibility.show": "When false, the field name is omitted from default portal field lists, embedded credential form field lists, and from public API credentialConfig read models (GET/list with decrypt=false), in addition to any omission driven by encrypted. GET with decrypt=true returns the full decrypted config for authorized callers and does not apply this visibility filter.",
     "visibility.showValue": "UI-only: whether stored values may be shown versus placeholders in form flows that honor this flag. Does not control encryption at rest or public API stripping.",
-    "display.enabled": "When false, disables the input in linked credential edit mode only; create flow always allows editing.",
+    "display.enabled": "When false, disables the input in credential forms (create and linked edit).",
     "encrypted": "When true, this config key holds secret material: the server encrypts values at rest, omits the key from public credentialConfig (GET/list with decrypt=false), drives credentialSecretPresence hints, and must stay aligned with CredentialEncryptionService."
   },
   "credentialTypes": {
@@ -17,10 +17,6 @@
         {
           "name": "grantType",
           "options": [
-            {
-              "value": "authorization_code",
-              "label": "Authorization Code"
-            },
             {
               "value": "client_credentials",
               "label": "Client Credentials"
@@ -31,6 +27,20 @@
             "label": "Grant Type",
             "control": "select",
             "required": true,
+            "enabled": false
+          },
+          "visibility": {
+            "show": true,
+            "showValue": true
+          },
+          "encrypted": false
+        },
+        {
+          "name": "baseUrl",
+          "required": false,
+          "display": {
+            "label": "Base URL",
+            "control": "text",
             "enabled": true
           },
           "visibility": {
@@ -40,10 +50,10 @@
           "encrypted": false
         },
         {
-          "name": "tokenUrl",
+          "name": "clientId",
           "required": true,
           "display": {
-            "label": "Token URL",
+            "label": "Client ID",
             "control": "text",
             "required": true,
             "enabled": true
@@ -55,10 +65,10 @@
           "encrypted": false
         },
         {
-          "name": "clientId",
+          "name": "tokenUrl",
           "required": true,
           "display": {
-            "label": "Client ID",
+            "label": "Token URL",
             "control": "text",
             "required": true,
             "enabled": true
@@ -85,10 +95,10 @@
           "encrypted": true
         },
         {
-          "name": "scope",
+          "name": "testEndpoint",
           "required": false,
           "display": {
-            "label": "Scope",
+            "label": "Test Endpoint",
             "control": "text",
             "enabled": true
           },
@@ -99,18 +109,32 @@
           "encrypted": false
         },
         {
-          "name": "refreshToken",
+          "name": "tenantId",
           "required": false,
           "display": {
-            "label": "Refresh Token",
-            "control": "password",
-            "enabled": false
+            "label": "Tenant ID",
+            "control": "text",
+            "enabled": true
           },
           "visibility": {
             "show": false,
-            "showValue": false
+            "showValue": true
           },
-          "encrypted": true
+          "encrypted": false
+        },
+        {
+          "name": "scope",
+          "required": false,
+          "display": {
+            "label": "Scope",
+            "control": "text",
+            "enabled": true
+          },
+          "visibility": {
+            "show": true,
+            "showValue": true
+          },
+          "encrypted": false
         },
         {
           "name": "accessToken",
@@ -125,26 +149,36 @@
             "showValue": false
           },
           "encrypted": true
-        },
+        }
+      ]
+    },
+    "apiKey": {
+      "active": true,
+      "display": {
+        "label": "API Key",
+        "order": 1
+      },
+      "configuration": [
         {
-          "name": "baseUrl",
-          "required": false,
+          "name": "apiKey",
+          "required": true,
           "display": {
-            "label": "Base URL",
-            "control": "text",
+            "label": "API Key",
+            "control": "password",
+            "required": true,
             "enabled": true
           },
           "visibility": {
             "show": true,
-            "showValue": true
+            "showValue": false
           },
-          "encrypted": false
+          "encrypted": true
         },
         {
-          "name": "authorizationUrl",
+          "name": "baseUrl",
           "required": false,
           "display": {
-            "label": "Authorization URL",
+            "label": "Base URL",
             "control": "text",
             "enabled": true
           },
@@ -155,10 +189,11 @@
           "encrypted": false
         },
         {
-          "name": "redirectUri",
+          "name": "headerName",
+          "placeholder": "Authorization",
           "required": false,
           "display": {
-            "label": "Redirect URI",
+            "label": "Header Name",
             "control": "text",
             "enabled": true
           },
@@ -169,10 +204,10 @@
           "encrypted": false
         },
         {
-          "name": "tenantId",
+          "name": "testEndpoint",
           "required": false,
           "display": {
-            "label": "Tenant ID",
+            "label": "Test Endpoint",
             "control": "text",
             "enabled": true
           },
@@ -183,10 +218,11 @@
           "encrypted": false
         },
         {
-          "name": "testEndpoint",
+          "name": "prefix",
+          "placeholder": "Bearer",
           "required": false,
           "display": {
-            "label": "Test Endpoint",
+            "label": "Prefix",
             "control": "text",
             "enabled": true
           },
@@ -198,18 +234,18 @@
         }
       ]
     },
-    "apiKey": {
+    "bearerToken": {
       "active": true,
       "display": {
-        "label": "API Key",
-        "order": 1
+        "label": "Bearer token",
+        "order": 2
       },
       "configuration": [
         {
           "name": "apiKey",
           "required": true,
           "display": {
-            "label": "API Key",
+            "label": "Bearer token",
             "control": "password",
             "required": true,
             "enabled": true
@@ -220,36 +256,6 @@
           },
           "encrypted": true
         },
-        {
-          "name": "headerName",
-          "placeholder": "Authorization",
-          "required": false,
-          "display": {
-            "label": "Header Name",
-            "control": "text",
-            "enabled": true
-          },
-          "visibility": {
-            "show": true,
-            "showValue": true
-          },
-          "encrypted": false
-        },
-        {
-          "name": "prefix",
-          "placeholder": "Bearer",
-          "required": false,
-          "display": {
-            "label": "Prefix",
-            "control": "text",
-            "enabled": true
-          },
-          "visibility": {
-            "show": true,
-            "showValue": true
-          },
-          "encrypted": false
-        },
         {
           "name": "baseUrl",
           "required": false,
@@ -284,7 +290,7 @@
       "active": true,
       "display": {
         "label": "Basic Auth",
-        "order": 2
+        "order": 3
       },
       "configuration": [
         {
@@ -303,33 +309,33 @@
           "encrypted": true
         },
         {
-          "name": "password",
-          "required": true,
+          "name": "baseUrl",
+          "required": false,
           "display": {
-            "label": "Password",
-            "control": "password",
-            "required": true,
+            "label": "Base URL",
+            "control": "text",
             "enabled": true
           },
           "visibility": {
             "show": true,
-            "showValue": false
+            "showValue": true
           },
-          "encrypted": true
+          "encrypted": false
         },
         {
-          "name": "baseUrl",
-          "required": false,
+          "name": "password",
+          "required": true,
           "display": {
-            "label": "Base URL",
-            "control": "text",
+            "label": "Password",
+            "control": "password",
+            "required": true,
             "enabled": true
           },
           "visibility": {
             "show": true,
-            "showValue": true
+            "showValue": false
           },
-          "encrypted": false
+          "encrypted": true
         }
       ]
     },
@@ -337,7 +343,7 @@
       "active": true,
       "display": {
         "label": "Query Parameter",
-        "order": 3
+        "order": 4
       },
       "configuration": [
         {
@@ -357,33 +363,33 @@
           "encrypted": false
         },
         {
-          "name": "paramValue",
-          "required": true,
+          "name": "baseUrl",
+          "required": false,
           "display": {
-            "label": "Parameter Value",
-            "control": "password",
-            "required": true,
+            "label": "Base URL",
+            "control": "text",
             "enabled": true
           },
           "visibility": {
             "show": true,
-            "showValue": false
+            "showValue": true
           },
-          "encrypted": true
+          "encrypted": false
         },
         {
-          "name": "baseUrl",
-          "required": false,
+          "name": "paramValue",
+          "required": true,
           "display": {
-            "label": "Base URL",
-            "control": "text",
+            "label": "Parameter Value",
+            "control": "password",
+            "required": true,
             "enabled": true
           },
           "visibility": {
             "show": true,
-            "showValue": true
+            "showValue": false
           },
-          "encrypted": false
+          "encrypted": true
         }
       ]
     },
@@ -391,7 +397,7 @@
       "active": false,
       "display": {
         "label": "OIDC",
-        "order": 4
+        "order": 5
       },
       "configuration": [
         {
@@ -482,7 +488,7 @@
       "active": false,
       "display": {
         "label": "HMAC",
-        "order": 5
+        "order": 6
       },
       "configuration": [
         {

package/lib/utils/aifabrix-test-runtime-guard.js

@@ -0,0 +1,125 @@
+/**
+ * Refuse writes to live ~/.aifabrix paths during Jest runs.
+ *
+ * @fileoverview Test-runtime write guard for secrets and admin-secrets files
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const ALLOW_ENV = 'ALLOW_AIFABRIX_TEST_WRITE_REAL_CONFIG';
+
+/**
+ * @returns {boolean}
+ */
+function isJestTestProcess() {
+  return Boolean(process.env.JEST_WORKER_ID) || process.env.NODE_ENV === 'test';
+}
+
+/** Legacy mock Fabrix dir used across unit tests (not the operator tree when homedir differs). */
+const JEST_MOCK_FABRIX_ROOT = path.join('/home', 'test', '.aifabrix');
+
+/** Additional protected trees in cloud / monorepo dev (see plan 185 Phase 2.5). */
+const EXTRA_PROTECTED_FABRIX_ROOTS = ['/workspace/.aifabrix'];
+
+/**
+ * Resolve symlinks so `~/.aifabrix` → `/workspace/.aifabrix` matches both paths.
+ * @param {string} p
+ * @returns {string}
+ */
+function resolveFabrixPathKey(p) {
+  const resolved = path.resolve(p);
+  try {
+    if (fs.existsSync(resolved)) {
+      return fs.realpathSync(resolved);
+    }
+  } catch {
+    // ignore
+  }
+  return resolved;
+}
+
+/**
+ * @returns {string[]} Absolute live config directory paths (deduped by realpath).
+ */
+function getLiveFabrixConfigDirCandidates() {
+  const keys = new Set();
+  const dirs = [];
+  const add = (dir) => {
+    if (!dir || typeof dir !== 'string') return;
+    const key = resolveFabrixPathKey(dir);
+    if (keys.has(key)) return;
+    keys.add(key);
+    dirs.push(key);
+  };
+  add(path.join(path.resolve(os.homedir()), '.aifabrix'));
+  for (const root of EXTRA_PROTECTED_FABRIX_ROOTS) {
+    add(root);
+  }
+  return dirs;
+}
+
+/**
+ * True when the path is the operator's live ~/.aifabrix tree (not the legacy /home/test mock).
+ * @param {string} filePath
+ * @returns {boolean}
+ */
+function isLiveFabrixConfigPath(filePath) {
+  if (!filePath || typeof filePath !== 'string') return false;
+  const normalized = resolveFabrixPathKey(filePath);
+  if (
+    normalized === JEST_MOCK_FABRIX_ROOT ||
+    normalized.startsWith(`${JEST_MOCK_FABRIX_ROOT}${path.sep}`)
+  ) {
+    return false;
+  }
+  for (const liveRoot of getLiveFabrixConfigDirCandidates()) {
+    if (normalized === liveRoot || normalized.startsWith(`${liveRoot}${path.sep}`)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * During Jest, writes are allowed everywhere except the live ~/.aifabrix tree.
+ * @param {string} filePath
+ * @returns {boolean}
+ */
+function isAllowedTestWritePath(filePath) {
+  if (!filePath || typeof filePath !== 'string') return true;
+  if (process.env[ALLOW_ENV] === '1' || process.env[ALLOW_ENV] === 'true') {
+    return true;
+  }
+  if (!isJestTestProcess()) return true;
+  return !isLiveFabrixConfigPath(filePath);
+}
+
+/**
+ * @param {string} filePath
+ * @throws {Error} When Jest would write outside sandbox
+ */
+function assertWritableSecretsPathForTests(filePath) {
+  if (!isJestTestProcess()) return;
+  if (isAllowedTestWritePath(filePath)) return;
+  throw new Error(
+    `Refusing to write secrets to live config path during tests: ${filePath}. ` +
+      'Use the Jest sandbox (default) or set ALLOW_AIFABRIX_TEST_WRITE_REAL_CONFIG=1.'
+  );
+}
+
+module.exports = {
+  ALLOW_ENV,
+  EXTRA_PROTECTED_FABRIX_ROOTS,
+  isJestTestProcess,
+  resolveFabrixPathKey,
+  getLiveFabrixConfigDirCandidates,
+  isLiveFabrixConfigPath,
+  isAllowedTestWritePath,
+  assertWritableSecretsPathForTests
+};