@aifabrix/builder 2.45.5 → 2.46.0

package/lib/cli/setup-utility.js

@@ -1,4 +1,3 @@
-const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * CLI utility command setup (resolve, json, split-json, show, validate, diff).
  *
@@ -10,12 +9,15 @@ const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const path = require('path');
 const fs = require('fs');
 const chalk = require('chalk');
+const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const generator = require('../generator');
 const logger = require('../utils/logger');
 const { handleCommandError, logOfflinePathWhenType } = require('../utils/cli-utils');
 const { detectAppType, getDeployJsonPath, getResolveAppPath } = require('../utils/paths');
 const { setupResolveCommand } = require('./setup-utility-resolve');
-const { JSON_HELP_AFTER, VALIDATE_HELP_AFTER, REPAIR_HELP_AFTER } = require('./setup-utility-help-after');
+const { setupRepairCommand } = require('./setup-utility-repair');
+const { setupValidateDiffCommands } = require('./setup-utility-validate');
+const { JSON_HELP_AFTER } = require('./setup-utility-help-after');
 
 /**
  * Resolve app path and type for split-json (integration first, then builder).
@@ -136,100 +138,6 @@ function setupSplitJsonCommand(program) {
     });
 }
 
-function buildRepairExternalIntegrationOptions(appName, options, format) {
-  const all = options.all === true;
-  return {
-    auth: options.auth,
-    doc: options.doc || all,
-    dryRun: options.dryRun,
-    format,
-    rbac: options.rbac || all,
-    expose: options.expose || all,
-    sync: options.sync || all,
-    api: options.api || all,
-    test: options.test || all,
-    backup: options.backup,
-    noBackup: options.noBackup
-  };
-}
-
-function logRepairResult(options, result) {
-  if (options.dryRun && result.updated && result.changes.length > 0) {
-    logger.log(chalk.yellow('\nWould apply:'));
-    result.changes.forEach(c => logger.log(chalk.gray(`  ${c}`)));
-    return;
-  }
-  if (Array.isArray(result.backupPaths) && result.backupPaths.length > 0) {
-    result.backupPaths.forEach((p) => logger.log(chalk.gray(`Backup: ${p}`)));
-  }
-  if (result.updated) {
-    logger.log(formatSuccessParagraph('Repaired external integration config.'));
-    return;
-  }
-  if (Array.isArray(result.changes) && result.changes.length > 0) {
-    logger.log(formatSuccessParagraph('Repair actions completed.'));
-    result.changes.forEach(c => logger.log(chalk.gray(`  ${c}`)));
-    return;
-  }
-  if (result.readmeRegenerated) {
-    logger.log(formatSuccessParagraph('Regenerated README.md from deployment manifest.'));
-    return;
-  }
-  logger.log(chalk.gray('No changes needed; config already matches files on disk.'));
-}
-
-/**
- * Handler for `aifabrix repair <systemKey>`.
- * @param {string} appName
- * @param {object} options - Commander options
- * @returns {Promise<void>}
- */
-async function handleRepairCommand(appName, options) {
-  const { repairExternalIntegration } = require('../commands/repair');
-  const { detectAppType } = require('../utils/paths');
-  const { appPath } = await detectAppType(appName);
-  logOfflinePathWhenType(appPath);
-  let format = 'yaml';
-  try {
-    const config = require('../core/config');
-    format = (await config.getFormat()) || format;
-  } catch (_) {
-    /* default yaml when config unavailable */
-  }
-  const result = await repairExternalIntegration(
-    appName,
-    buildRepairExternalIntegrationOptions(appName, options, format)
-  );
-  logRepairResult(options, result);
-}
-
-function setupRepairCommand(program) {
-  program.command('repair <systemKey>')
-    .description('Fix external integration drift (files, RBAC, manifest, …)')
-    .option('--all', 'Run all repair actions (api, doc, expose, rbac, sync, test)')
-    .option(
-      '--api',
-      'Validate and sync API contracts needed for OpenAPI/MCP (uses local OpenAPI specs at integration/<systemKey>/openapi/*.json when present)'
-    )
-    .option('--auth <method>', 'Set authentication method (oauth2, aad, apikey, basic, queryParam, oidc, hmac, none); updates system file and env.template')
-    .option('--doc', 'Regenerate README.md from deployment manifest')
-    .option('--expose', 'Set exposed.schema on each datasource from all fieldMappings.attributes keys (metadata.<key>); removes deprecated exposed.attributes if present')
-    .option('--rbac', 'Ensure RBAC permissions per datasource and add default Admin/Reader roles if none exist')
-    .option('--sync', 'Add default sync section to datasources that lack it')
-    .option('--test', 'Generate testPayload.payloadTemplate and testPayload.expectedResult from attributes')
-    .option('--no-backup', 'Skip timestamped copies under integration/<systemKey>/backup/')
-    .option('--dry-run', 'Report changes only; do not write')
-    .addHelpText('after', REPAIR_HELP_AFTER)
-    .action(async(appName, options) => {
-      try {
-        await handleRepairCommand(appName, options);
-      } catch (error) {
-        handleCommandError(error, 'repair');
-        process.exit(1);
-      }
-    });
-}
-
 async function resolveConvertTargetFormat(options) {
   const config = require('../core/config');
   const effectiveFormat = options.format || (await config.getFormat());
@@ -316,149 +224,6 @@ function setupSplitJsonConvertShowCommands(program) {
   setupShowCommand(program);
 }
 
-function emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat) {
-  if (outFormat === 'json' || !result?.appPath || !appOrFile || typeof appOrFile !== 'string') {
-    return;
-  }
-  try {
-    if (fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile()) {
-      return;
-    }
-    const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
-    emitManifestMetadataLineIfTTY(logger, {
-      appKey: appOrFile,
-      appPath: result.appPath,
-      envOnly: false,
-      json: false
-    });
-  } catch {
-    /* ignore emit failures */
-  }
-}
-
-async function runValidateBatchBranch(validate, opts) {
-  const integration = opts.integration === true;
-  const builder = opts.builder === true;
-  if (!integration && !builder) {
-    return false;
-  }
-  const outFormat = (opts.format || 'default').toLowerCase();
-  const batchResult = integration && builder
-    ? await validate.validateAll(opts)
-    : integration
-      ? await validate.validateAllIntegrations(opts)
-      : await validate.validateAllBuilderApps(opts);
-  if (outFormat === 'json') {
-    logger.log(JSON.stringify(batchResult, null, 2));
-  } else {
-    validate.displayBatchValidationResults(batchResult);
-  }
-  if (!batchResult.valid) process.exit(1);
-  return true;
-}
-
-async function runProtectionValidateBranch(appOrFile, opts) {
-  const { validateProtectionBatchCommand } = require('../protection/validate-batch');
-  const code = await validateProtectionBatchCommand(
-    {
-      env: opts.env,
-      json: (opts.format || '').toLowerCase() === 'json',
-      warningsAsErrors: opts.warningsAsErrors === true,
-      simulate: opts.simulate === true,
-      verbose: opts.verbose === true
-    },
-    logger
-  );
-  if (code !== 0) {
-    process.exit(code);
-  }
-}
-
-function buildValidateJsonPayload(result, appOrFile) {
-  let payload = result;
-  try {
-    if (result?.appPath && appOrFile && typeof appOrFile === 'string') {
-      if (!(fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile())) {
-        const { getManifestSourcePayload } = require('../utils/manifest-source-emit');
-        payload = { ...result, manifestSource: getManifestSourcePayload(appOrFile, result.appPath) };
-      }
-    }
-  } catch {
-    /* keep plain result */
-  }
-  return payload;
-}
-
-function displaySingleValidateResult(appOrFile, result, outFormat, validate) {
-  emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat);
-  if (outFormat === 'json') {
-    logger.log(JSON.stringify(buildValidateJsonPayload(result, appOrFile), null, 2));
-    return;
-  }
-  validate.displayValidationResults(result);
-}
-
-async function runValidateCommand(appOrFile, options) {
-  const validate = require('../validation/validate');
-  const opts = options.opts ? options.opts() : options;
-  const { isProtectionScope } = require('../protection/scope');
-  if (isProtectionScope(appOrFile)) {
-    await runProtectionValidateBranch(appOrFile, opts);
-    return;
-  }
-  if (await runValidateBatchBranch(validate, opts)) {
-    return;
-  }
-  const outFormat = (opts.format || 'default').toLowerCase();
-  if (!appOrFile || typeof appOrFile !== 'string') {
-    logger.log(chalk.red('App name or file path is required, or use --integration / --builder'));
-    process.exit(1);
-  }
-  const result = await validate.validateAppOrFile(appOrFile, {
-    ...opts,
-    certSync: opts.certSync === true
-  });
-  displaySingleValidateResult(appOrFile, result, outFormat, validate);
-  if (!result.valid) process.exit(1);
-}
-
-function setupValidateDiffCommands(program) {
-  program.command('validate [appKey|systemKey|file]')
-    .description('Validate appKey, systemKey, file path, .protection batch, or all under integration/ and builder/')
-    .addHelpText('after', VALIDATE_HELP_AFTER)
-    .option('--format <format>', 'Output format: json | default (human-readable)')
-    .option('--integration', 'Validate all applications under integration/')
-    .option('--builder', 'Validate all applications under builder/')
-    .option('--warnings-as-errors', 'For .protection: pass strict=true to dataplane validate')
-    .option('--simulate', 'For .protection: run simulate after validate')
-    .option(
-      '--cert-sync',
-      'After successful validation of an external integration, refresh the system file certification block from the dataplane (requires login)'
-    )
-    .action((appOrFile, options) => {
-      runValidateCommand(appOrFile, options).catch((error) => {
-        handleCommandError(error, 'validate');
-        process.exit(1);
-      });
-    });
-
-  program.command('diff <file1> <file2>')
-    .description('Diff two config files (optional schema validate)')
-    .option('--no-validate', 'Skip schema validation (type check still applied)')
-    .action(async(file1, file2, cmd) => {
-      try {
-        const diff = require('../core/diff');
-        const opts = cmd.opts();
-        const result = await diff.compareFiles(file1, file2, { validate: opts.validate !== false });
-        diff.formatDiffOutput(result);
-        if (!result.identical) process.exit(1);
-      } catch (error) {
-        handleCommandError(error, 'diff');
-        process.exit(1);
-      }
-    });
-}
-
 /**
  * Sets up utility commands
  * @param {Command} program - Commander program instance

package/lib/commands/auth-status-client-tokens.js

@@ -0,0 +1,214 @@
+/**
+ * Client token listing and proactive refresh for auth status.
+ *
+ * @fileoverview Stored app tokens, auto-refresh when credentials exist
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const { successGlyph, failureGlyph } = require('../utils/cli-test-layout-chalk');
+const {
+  getOrRefreshClientToken,
+  loadClientCredentials,
+  refreshClientToken,
+  isTokenExpired
+} = require('../utils/token-manager');
+
+/**
+ * @param {string} controllerUrl
+ * @param {string} storedController
+ * @returns {boolean}
+ */
+function controllersMatch(controllerUrl, storedController) {
+  if (!storedController) {
+    return false;
+  }
+  return config.normalizeControllerUrl(storedController) === config.normalizeControllerUrl(controllerUrl);
+}
+
+/**
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Record<string, { controller?: string, token?: string, expiresAt?: string }>>}
+ */
+async function getClientEntriesForController(environment, controllerUrl) {
+  const configData = await config.getConfig();
+  const clients = configData.environments?.[environment]?.clients || {};
+  const out = {};
+  for (const [appName, tokenData] of Object.entries(clients)) {
+    if (controllersMatch(controllerUrl, tokenData?.controller)) {
+      out[appName] = tokenData;
+    }
+  }
+  return out;
+}
+
+/**
+ * Refresh expired client tokens when secrets.local.yaml (or env) has client id/secret.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<number>} Count refreshed
+ */
+async function refreshExpiredClientTokensWherePossible(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  let refreshed = 0;
+  for (const appName of Object.keys(entries)) {
+    const tokenData = entries[appName];
+    if (!tokenData?.token || !isTokenExpired(tokenData.expiresAt)) {
+      continue;
+    }
+    const credentials = await loadClientCredentials(appName);
+    if (!credentials?.clientId || !credentials?.clientSecret) {
+      continue;
+    }
+    try {
+      await refreshClientToken(environment, appName, controllerUrl);
+      refreshed += 1;
+    } catch {
+      // Skip apps without valid credentials or controller errors
+    }
+  }
+  return refreshed;
+}
+
+/**
+ * @param {string} expiresAt
+ * @returns {'valid'|'expired'|'unknown'}
+ */
+function tokenExpiryState(expiresAt) {
+  if (!expiresAt) {
+    return 'unknown';
+  }
+  return isTokenExpired(expiresAt) ? 'expired' : 'valid';
+}
+
+/**
+ * Build rows for stored client tokens table.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Array<{ appName: string, expiresAt: string, state: string, logoutCmd: string }>>}
+ */
+async function listClientTokenRows(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const rows = [];
+  for (const appName of Object.keys(entries).sort()) {
+    const tokenData = entries[appName];
+    const state = tokenExpiryState(tokenData.expiresAt);
+    const credentials = await loadClientCredentials(appName);
+    const canRefresh = !!(credentials?.clientId && credentials?.clientSecret);
+    let stateLabel = state;
+    if (state === 'expired' && canRefresh) {
+      stateLabel = 'expired (credentials available — refreshed on status if possible)';
+    } else if (state === 'expired' && !canRefresh) {
+      stateLabel = 'expired (no client id/secret in secrets — logout or login)';
+    }
+    rows.push({
+      appName,
+      expiresAt: tokenData.expiresAt || '—',
+      state: stateLabel,
+      logoutCmd: `aifabrix logout -e ${environment} -a ${appName}`
+    });
+  }
+  return rows;
+}
+
+/**
+ * Print stored application client tokens and logout commands.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @param {number} [refreshedCount]
+ * @returns {Promise<void>}
+ */
+async function displayStoredClientTokensSection(environment, controllerUrl, refreshedCount = 0) {
+  const rows = await listClientTokenRows(environment, controllerUrl);
+  if (rows.length === 0) {
+    return;
+  }
+
+  logger.log('');
+  logger.log(chalk.bold('Stored application client tokens:'));
+  if (refreshedCount > 0) {
+    logger.log(
+      chalk.gray(
+        `  Refreshed ${refreshedCount} expired token(s) using client id/secret from secrets.local.yaml or env.`
+      )
+    );
+  }
+  logger.log(chalk.gray(`  Environment: ${environment} · Controller: ${controllerUrl}`));
+  logger.log('');
+  for (const row of rows) {
+    const icon = row.state.startsWith('valid') ? successGlyph() : failureGlyph();
+    logger.log(`  ${icon} ${chalk.cyan(row.appName)}`);
+    logger.log(`      Expires: ${chalk.gray(row.expiresAt)}`);
+    logger.log(`      Status: ${row.state}`);
+    logger.log(`      Clear: ${chalk.gray(row.logoutCmd)}`);
+  }
+  logger.log('');
+  logger.log(chalk.gray('  Clear all client tokens for this environment:'), chalk.gray(`aifabrix logout -e ${environment}`));
+  logger.log(chalk.gray('  Clear device login for this controller:'), chalk.gray(`aifabrix logout -c ${controllerUrl}`));
+  logger.log('');
+}
+
+/**
+ * Resolve a working client token (refresh when expired if credentials exist).
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {function(string, string, string, string, string): Promise<Object>} validateClientTokenFn
+ * @returns {Promise<Object|null>}
+ */
+async function tryResolveClientTokenAuth(controllerUrl, environment, validateClientTokenFn) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const appNames = Object.keys(entries);
+  if (appNames.length === 0) {
+    return null;
+  }
+
+  const ordered = ['dataplane', ...appNames.filter(a => a !== 'dataplane').sort()];
+  let lastFailure = null;
+
+  for (const appName of ordered) {
+    try {
+      const refreshed = await getOrRefreshClientToken(environment, appName, controllerUrl);
+      if (!refreshed?.token) {
+        continue;
+      }
+      const stored = await config.getClientToken(environment, appName);
+      const result = await validateClientTokenFn(
+        refreshed.token,
+        controllerUrl,
+        environment,
+        appName,
+        stored?.expiresAt
+      );
+      if (result.authenticated) {
+        return result;
+      }
+      lastFailure = result;
+    } catch {
+      // Try next app
+    }
+  }
+
+  return lastFailure;
+}
+
+module.exports = {
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection,
+  tryResolveClientTokenAuth,
+  listClientTokenRows,
+  getClientEntriesForController
+};

package/lib/commands/auth-status-dataplane-version.js

@@ -24,6 +24,28 @@ const {
 } = require('../utils/dataplane-cli-version-gate');
 const { isAtLeast, isValidSemver } = require('../utils/semver-compare');
 
+/** Max wall time for post-login version cache refresh (silent after success banner). */
+const LOGIN_POST_REFRESH_BUDGET_MS = 12000;
+
+/** Per health probe during login refresh (two endpoints may be tried). */
+const LOGIN_HEALTH_PROBE_TIMEOUT_MS = 6000;
+
+/**
+ * Resolve when `promise` settles or when `timeoutMs` elapses (returns undefined).
+ * @template T
+ * @param {Promise<T>} promise
+ * @param {number} timeoutMs
+ * @returns {Promise<T|undefined>}
+ */
+function raceWithTimeout(promise, timeoutMs) {
+  return Promise.race([
+    promise,
+    new Promise((resolve) => {
+      setTimeout(() => resolve(undefined), timeoutMs);
+    })
+  ]);
+}
+
 /**
  * Per plan 142.0: invalid semver from the dataplane is logged but does **not**
  * block the CLI; missing min version means no enforcement.
@@ -72,13 +94,17 @@ async function safeReadCache(controllerUrl) {
  *   compatible: boolean
  * }>}
  */
-async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl) {
+async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options = {}) {
   const cliVersion = getInstalledCliVersion();
   let dataplaneVersion;
   let minBuilderCliVersion;
+  const healthOpts = {};
+  if (options.healthTimeoutMs !== undefined && options.healthTimeoutMs !== null) {
+    healthOpts.timeoutMs = options.healthTimeoutMs;
+  }
 
   try {
-    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl);
+    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl, healthOpts);
     if (snapshot) {
       dataplaneVersion = snapshot.version;
       minBuilderCliVersion = snapshot.minBuilderCliVersion;
@@ -195,29 +221,38 @@ async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authCon
  * @param {string} [loginOptions.app] - App name (credentials login) for client-token auth
  * @returns {Promise<void>}
  */
+async function tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions = {}) {
+  const { resolveEnvironment } = require('../core/config');
+  const environment = await resolveEnvironment();
+  const authConfig = await resolveAuthConfigAfterLogin(
+    controllerUrl,
+    environment,
+    loginOptions
+  );
+  if (!authConfig) {
+    return;
+  }
+  const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
+    controllerUrl,
+    environment,
+    authConfig
+  );
+  if (dataplaneUrl) {
+    await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, {
+      healthTimeoutMs: LOGIN_HEALTH_PROBE_TIMEOUT_MS
+    });
+  }
+}
+
 async function tryRefreshDataplaneVersionAfterLogin(controllerUrl, loginOptions = {}) {
   if (!controllerUrl || typeof controllerUrl !== 'string') {
     return;
   }
   try {
-    const { resolveEnvironment } = require('../core/config');
-    const environment = await resolveEnvironment();
-    const authConfig = await resolveAuthConfigAfterLogin(
-      controllerUrl,
-      environment,
-      loginOptions
-    );
-    if (!authConfig) {
-      return;
-    }
-    const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
-      controllerUrl,
-      environment,
-      authConfig
+    await raceWithTimeout(
+      tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions),
+      LOGIN_POST_REFRESH_BUDGET_MS
     );
-    if (dataplaneUrl) {
-      await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl);
-    }
   } catch (_error) {
     // best-effort only
   }
@@ -227,5 +262,8 @@ module.exports = {
   refreshDataplaneVersionInfo,
   loadCachedVersionInfo,
   computeCompatibility,
-  tryRefreshDataplaneVersionAfterLogin
+  tryRefreshDataplaneVersionAfterLogin,
+  LOGIN_POST_REFRESH_BUDGET_MS,
+  LOGIN_HEALTH_PROBE_TIMEOUT_MS,
+  raceWithTimeout
 };