@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/auth-status-client-tokens.js

@@ -0,0 +1,214 @@
+/**
+ * Client token listing and proactive refresh for auth status.
+ *
+ * @fileoverview Stored app tokens, auto-refresh when credentials exist
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const { successGlyph, failureGlyph } = require('../utils/cli-test-layout-chalk');
+const {
+  getOrRefreshClientToken,
+  loadClientCredentials,
+  refreshClientToken,
+  isTokenExpired
+} = require('../utils/token-manager');
+
+/**
+ * @param {string} controllerUrl
+ * @param {string} storedController
+ * @returns {boolean}
+ */
+function controllersMatch(controllerUrl, storedController) {
+  if (!storedController) {
+    return false;
+  }
+  return config.normalizeControllerUrl(storedController) === config.normalizeControllerUrl(controllerUrl);
+}
+
+/**
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Record<string, { controller?: string, token?: string, expiresAt?: string }>>}
+ */
+async function getClientEntriesForController(environment, controllerUrl) {
+  const configData = await config.getConfig();
+  const clients = configData.environments?.[environment]?.clients || {};
+  const out = {};
+  for (const [appName, tokenData] of Object.entries(clients)) {
+    if (controllersMatch(controllerUrl, tokenData?.controller)) {
+      out[appName] = tokenData;
+    }
+  }
+  return out;
+}
+
+/**
+ * Refresh expired client tokens when secrets.local.yaml (or env) has client id/secret.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<number>} Count refreshed
+ */
+async function refreshExpiredClientTokensWherePossible(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  let refreshed = 0;
+  for (const appName of Object.keys(entries)) {
+    const tokenData = entries[appName];
+    if (!tokenData?.token || !isTokenExpired(tokenData.expiresAt)) {
+      continue;
+    }
+    const credentials = await loadClientCredentials(appName);
+    if (!credentials?.clientId || !credentials?.clientSecret) {
+      continue;
+    }
+    try {
+      await refreshClientToken(environment, appName, controllerUrl);
+      refreshed += 1;
+    } catch {
+      // Skip apps without valid credentials or controller errors
+    }
+  }
+  return refreshed;
+}
+
+/**
+ * @param {string} expiresAt
+ * @returns {'valid'|'expired'|'unknown'}
+ */
+function tokenExpiryState(expiresAt) {
+  if (!expiresAt) {
+    return 'unknown';
+  }
+  return isTokenExpired(expiresAt) ? 'expired' : 'valid';
+}
+
+/**
+ * Build rows for stored client tokens table.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @returns {Promise<Array<{ appName: string, expiresAt: string, state: string, logoutCmd: string }>>}
+ */
+async function listClientTokenRows(environment, controllerUrl) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const rows = [];
+  for (const appName of Object.keys(entries).sort()) {
+    const tokenData = entries[appName];
+    const state = tokenExpiryState(tokenData.expiresAt);
+    const credentials = await loadClientCredentials(appName);
+    const canRefresh = !!(credentials?.clientId && credentials?.clientSecret);
+    let stateLabel = state;
+    if (state === 'expired' && canRefresh) {
+      stateLabel = 'expired (credentials available — refreshed on status if possible)';
+    } else if (state === 'expired' && !canRefresh) {
+      stateLabel = 'expired (no client id/secret in secrets — logout or login)';
+    }
+    rows.push({
+      appName,
+      expiresAt: tokenData.expiresAt || '—',
+      state: stateLabel,
+      logoutCmd: `aifabrix logout -e ${environment} -a ${appName}`
+    });
+  }
+  return rows;
+}
+
+/**
+ * Print stored application client tokens and logout commands.
+ *
+ * @async
+ * @param {string} environment
+ * @param {string} controllerUrl
+ * @param {number} [refreshedCount]
+ * @returns {Promise<void>}
+ */
+async function displayStoredClientTokensSection(environment, controllerUrl, refreshedCount = 0) {
+  const rows = await listClientTokenRows(environment, controllerUrl);
+  if (rows.length === 0) {
+    return;
+  }
+
+  logger.log('');
+  logger.log(chalk.bold('Stored application client tokens:'));
+  if (refreshedCount > 0) {
+    logger.log(
+      chalk.gray(
+        `  Refreshed ${refreshedCount} expired token(s) using client id/secret from secrets.local.yaml or env.`
+      )
+    );
+  }
+  logger.log(chalk.gray(`  Environment: ${environment} · Controller: ${controllerUrl}`));
+  logger.log('');
+  for (const row of rows) {
+    const icon = row.state.startsWith('valid') ? successGlyph() : failureGlyph();
+    logger.log(`  ${icon} ${chalk.cyan(row.appName)}`);
+    logger.log(`      Expires: ${chalk.gray(row.expiresAt)}`);
+    logger.log(`      Status: ${row.state}`);
+    logger.log(`      Clear: ${chalk.gray(row.logoutCmd)}`);
+  }
+  logger.log('');
+  logger.log(chalk.gray('  Clear all client tokens for this environment:'), chalk.gray(`aifabrix logout -e ${environment}`));
+  logger.log(chalk.gray('  Clear device login for this controller:'), chalk.gray(`aifabrix logout -c ${controllerUrl}`));
+  logger.log('');
+}
+
+/**
+ * Resolve a working client token (refresh when expired if credentials exist).
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {function(string, string, string, string, string): Promise<Object>} validateClientTokenFn
+ * @returns {Promise<Object|null>}
+ */
+async function tryResolveClientTokenAuth(controllerUrl, environment, validateClientTokenFn) {
+  const entries = await getClientEntriesForController(environment, controllerUrl);
+  const appNames = Object.keys(entries);
+  if (appNames.length === 0) {
+    return null;
+  }
+
+  const ordered = ['dataplane', ...appNames.filter(a => a !== 'dataplane').sort()];
+  let lastFailure = null;
+
+  for (const appName of ordered) {
+    try {
+      const refreshed = await getOrRefreshClientToken(environment, appName, controllerUrl);
+      if (!refreshed?.token) {
+        continue;
+      }
+      const stored = await config.getClientToken(environment, appName);
+      const result = await validateClientTokenFn(
+        refreshed.token,
+        controllerUrl,
+        environment,
+        appName,
+        stored?.expiresAt
+      );
+      if (result.authenticated) {
+        return result;
+      }
+      lastFailure = result;
+    } catch {
+      // Try next app
+    }
+  }
+
+  return lastFailure;
+}
+
+module.exports = {
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection,
+  tryResolveClientTokenAuth,
+  listClientTokenRows,
+  getClientEntriesForController
+};

package/lib/commands/auth-status-dataplane-version.js

@@ -17,13 +17,36 @@
 const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
 const {
   updateDeviceDataplaneVersions,
-  getDeviceDataplaneVersions
+  getDeviceDataplaneVersions,
+  isCacheStale
 } = require('../core/config-device-dataplane');
 const {
   getInstalledCliVersion
 } = require('../utils/dataplane-cli-version-gate');
 const { isAtLeast, isValidSemver } = require('../utils/semver-compare');
 
+/** Max wall time for post-login version cache refresh (silent after success banner). */
+const LOGIN_POST_REFRESH_BUDGET_MS = 8000;
+
+/** Per health probe during login refresh (legacy /health first, then v1). */
+const LOGIN_HEALTH_PROBE_TIMEOUT_MS = 3000;
+
+/**
+ * Resolve when `promise` settles or when `timeoutMs` elapses (returns undefined).
+ * @template T
+ * @param {Promise<T>} promise
+ * @param {number} timeoutMs
+ * @returns {Promise<T|undefined>}
+ */
+function raceWithTimeout(promise, timeoutMs) {
+  return Promise.race([
+    promise,
+    new Promise((resolve) => {
+      setTimeout(() => resolve(undefined), timeoutMs);
+    })
+  ]);
+}
+
 /**
  * Per plan 142.0: invalid semver from the dataplane is logged but does **not**
  * block the CLI; missing min version means no enforcement.
@@ -57,28 +80,35 @@ async function safeReadCache(controllerUrl) {
 }
 
 /**
- * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
- * and derive the compatibility verdict against the installed Builder CLI.
- * Falls back to the cached entry when the live probe fails so `auth status`
- * still shows the last-known values offline.
- *
+ * Build optional fetch args for {@link fetchDataplaneGeneralHealth}.
+ * @param {Object} [options]
+ * @returns {Object}
+ */
+function buildHealthFetchOptions(options = {}) {
+  const healthOpts = {};
+  if (options.healthTimeoutMs !== undefined && options.healthTimeoutMs !== null) {
+    healthOpts.timeoutMs = options.healthTimeoutMs;
+  }
+  if (options.endpointOrder) {
+    healthOpts.endpointOrder = options.endpointOrder;
+  }
+  return healthOpts;
+}
+
+/**
+ * Probe dataplane health and persist version fields when available.
  * @async
- * @param {string} controllerUrl - Controller URL (cache key)
- * @param {string} dataplaneUrl - Dataplane base URL for the health probe
- * @returns {Promise<{
- *   dataplaneVersion: string|undefined,
- *   minBuilderCliVersion: string|undefined,
- *   cliVersion: string,
- *   compatible: boolean
- * }>}
+ * @param {string} controllerUrl
+ * @param {string} dataplaneUrl
+ * @param {Object} healthOpts
+ * @returns {Promise<{ dataplaneVersion: string|undefined, minBuilderCliVersion: string|undefined }>}
  */
-async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl) {
-  const cliVersion = getInstalledCliVersion();
+async function fetchAndPersistHealthSnapshot(controllerUrl, dataplaneUrl, healthOpts) {
   let dataplaneVersion;
   let minBuilderCliVersion;
 
   try {
-    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl);
+    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl, healthOpts);
     if (snapshot) {
       dataplaneVersion = snapshot.version;
       minBuilderCliVersion = snapshot.minBuilderCliVersion;
@@ -95,14 +125,63 @@ async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl) {
     // ignore — fall through to cached values
   }
 
-  if (!dataplaneVersion && !minBuilderCliVersion) {
-    const cached = await safeReadCache(controllerUrl);
-    if (cached) {
-      dataplaneVersion = cached.version;
-      minBuilderCliVersion = cached.minBuilderCliVersion;
-    }
+  return { dataplaneVersion, minBuilderCliVersion };
+}
+
+/**
+ * Fill missing version fields from the device cache when live probe failed.
+ * @async
+ * @param {string} controllerUrl
+ * @param {string|undefined} dataplaneVersion
+ * @param {string|undefined} minBuilderCliVersion
+ * @returns {Promise<{ dataplaneVersion: string|undefined, minBuilderCliVersion: string|undefined }>}
+ */
+async function resolveVersionFieldsFromCache(controllerUrl, dataplaneVersion, minBuilderCliVersion) {
+  if (dataplaneVersion || minBuilderCliVersion) {
+    return { dataplaneVersion, minBuilderCliVersion };
   }
 
+  const cached = await safeReadCache(controllerUrl);
+  if (!cached) {
+    return { dataplaneVersion, minBuilderCliVersion };
+  }
+
+  return {
+    dataplaneVersion: cached.version,
+    minBuilderCliVersion: cached.minBuilderCliVersion
+  };
+}
+
+/**
+ * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
+ * and derive the compatibility verdict against the installed Builder CLI.
+ * Falls back to the cached entry when the live probe fails so `auth status`
+ * still shows the last-known values offline.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (cache key)
+ * @param {string} dataplaneUrl - Dataplane base URL for the health probe
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options = {}) {
+  const cliVersion = getInstalledCliVersion();
+  const healthOpts = buildHealthFetchOptions(options);
+  let { dataplaneVersion, minBuilderCliVersion } = await fetchAndPersistHealthSnapshot(
+    controllerUrl,
+    dataplaneUrl,
+    healthOpts
+  );
+  ({ dataplaneVersion, minBuilderCliVersion } = await resolveVersionFieldsFromCache(
+    controllerUrl,
+    dataplaneVersion,
+    minBuilderCliVersion
+  ));
+
   const compatible = computeCompatibility(cliVersion, minBuilderCliVersion);
   return { dataplaneVersion, minBuilderCliVersion, cliVersion, compatible };
 }
@@ -158,33 +237,6 @@ async function resolveAuthConfigAfterLogin(controllerUrl, environment, loginOpti
   }
 }
 
-/**
- * Resolve dataplane URL after login (mirrors auth-status silent resolver).
- * @private
- * @async
- * @param {string} controllerUrl
- * @param {string} environment
- * @param {Object} authConfig
- * @returns {Promise<string|null>}
- */
-async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authConfig) {
-  const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
-  const { getDataplaneUrl } = require('../datasource/deploy');
-  try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(
-      controllerUrl,
-      environment,
-      authConfig
-    );
-    if (dataplaneAppKey) {
-      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-    }
-    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
-  } catch (_resolveError) {
-    return null;
-  }
-}
-
 /**
  * Best-effort health refresh after login when dataplane URL is discoverable.
  * Never throws — cache failures must not block login success.
@@ -195,29 +247,48 @@ async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authCon
  * @param {string} [loginOptions.app] - App name (credentials login) for client-token auth
  * @returns {Promise<void>}
  */
+async function tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions = {}) {
+  const cached = await safeReadCache(controllerUrl);
+  if (cached && !isCacheStale(cached)) {
+    return;
+  }
+
+  const { resolveEnvironment } = require('../core/config');
+  const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
+  const environment = await resolveEnvironment();
+  const authConfig = await resolveAuthConfigAfterLogin(
+    controllerUrl,
+    environment,
+    loginOptions
+  );
+  if (!authConfig) {
+    return;
+  }
+  let dataplaneUrl = null;
+  try {
+    dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, {
+      silent: true
+    });
+  } catch (_resolveError) {
+    return;
+  }
+  if (dataplaneUrl) {
+    await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, {
+      healthTimeoutMs: LOGIN_HEALTH_PROBE_TIMEOUT_MS,
+      endpointOrder: 'legacy-first'
+    });
+  }
+}
+
 async function tryRefreshDataplaneVersionAfterLogin(controllerUrl, loginOptions = {}) {
   if (!controllerUrl || typeof controllerUrl !== 'string') {
     return;
   }
   try {
-    const { resolveEnvironment } = require('../core/config');
-    const environment = await resolveEnvironment();
-    const authConfig = await resolveAuthConfigAfterLogin(
-      controllerUrl,
-      environment,
-      loginOptions
+    await raceWithTimeout(
+      tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions),
+      LOGIN_POST_REFRESH_BUDGET_MS
     );
-    if (!authConfig) {
-      return;
-    }
-    const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
-      controllerUrl,
-      environment,
-      authConfig
-    );
-    if (dataplaneUrl) {
-      await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl);
-    }
   } catch (_error) {
     // best-effort only
   }
@@ -227,5 +298,8 @@ module.exports = {
   refreshDataplaneVersionInfo,
   loadCachedVersionInfo,
   computeCompatibility,
-  tryRefreshDataplaneVersionAfterLogin
+  tryRefreshDataplaneVersionAfterLogin,
+  LOGIN_POST_REFRESH_BUDGET_MS,
+  LOGIN_HEALTH_PROBE_TIMEOUT_MS,
+  raceWithTimeout
 };

package/lib/commands/auth-status.js

@@ -11,13 +11,10 @@
 const chalk = require('chalk');
 const { failureGlyph, successGlyph } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
-const config = require('../core/config');
-const { getConfig } = config;
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { getAuthUser } = require('../api/auth.api');
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
-const { getDataplaneUrl } = require('../datasource/deploy');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { checkDataplaneHealth } = require('../utils/dataplane-health');
 const {
   displayDataplaneVersionSection,
@@ -32,6 +29,11 @@ const {
   EXIT_CLI_VERSION_INCOMPATIBLE,
   EXIT_OK
 } = require('../utils/cli-exit-codes');
+const {
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection,
+  tryResolveClientTokenAuth
+} = require('./auth-status-client-tokens');
 
 /**
  * Format expiration date for display
@@ -94,22 +96,6 @@ async function checkDeviceToken(controllerUrl) {
   }
 }
 
-/**
- * Decrypt token if encrypted
- * @async
- * @param {string} token - Token to decrypt
- * @returns {Promise<string>} Decrypted token
- */
-async function decryptTokenIfNeeded(token) {
-  const { decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
-  const encryptionKey = await config.getSecretsEncryptionKey();
-
-  if (encryptionKey && isTokenEncrypted(token)) {
-    return await decryptToken(token, encryptionKey);
-  }
-  return token;
-}
-
 /**
  * Validate client token and return result
  * @async
@@ -156,29 +142,14 @@ async function validateClientToken(token, controllerUrl, environment, appName, e
 }
 
 /**
- * Check and validate client token
+ * Check and validate client token (refreshes when expired if client credentials exist).
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} environment - Environment key
  * @returns {Promise<Object|null>} Token validation result or null
  */
 async function checkClientToken(controllerUrl, environment) {
-  const configData = await getConfig();
-  const environments = configData.environments || {};
-  const envConfig = environments[environment];
-
-  if (!envConfig || !envConfig.clients) {
-    return null;
-  }
-
-  for (const [appName, tokenData] of Object.entries(envConfig.clients)) {
-    if (tokenData.controller === controllerUrl && tokenData.token) {
-      const token = await decryptTokenIfNeeded(tokenData.token);
-      return await validateClientToken(token, controllerUrl, environment, appName, tokenData.expiresAt);
-    }
-  }
-
-  return null;
+  return tryResolveClientTokenAuth(controllerUrl, environment, validateClientToken);
 }
 
 /**
@@ -239,11 +210,7 @@ function displayTokenInfo(tokenInfo) {
  */
 async function resolveDataplaneUrlSilent(controllerUrl, environment, authConfig) {
   try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
-    if (dataplaneAppKey) {
-      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-    }
-    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+    return await resolveDataplaneUrl(controllerUrl, environment, authConfig, { silent: true });
   } catch {
     return null;
   }
@@ -382,18 +349,34 @@ async function buildDataplaneInfo(controllerUrl, environment, authConfig) {
  * @param {boolean} [options.validate] - If true, exit with code 1 when not authenticated, or code 3 when CLI is older than dataplane minimum
  * @returns {Promise<void>} Resolves when status is displayed
  */
+/**
+ * Prefer a working device token; fall back to environment client credentials when the
+ * stored device token is expired or rejected (common in long-lived dev VMs).
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @returns {Promise<Object|null>}
+ */
+async function resolveAuthenticatedTokenInfo(controllerUrl, environment) {
+  const deviceResult = await checkDeviceToken(controllerUrl);
+  if (deviceResult && deviceResult.authenticated) {
+    return deviceResult;
+  }
+  const clientResult = await checkClientToken(controllerUrl, environment);
+  if (clientResult && clientResult.authenticated) {
+    return clientResult;
+  }
+  return deviceResult || clientResult || null;
+}
+
 async function handleAuthStatus(options = {}) {
   const { resolveEnvironment } = require('../core/config');
   const controllerUrl = await resolveControllerUrl();
   const environment = await resolveEnvironment();
 
-  // Check device token first (preferred)
-  let tokenInfo = await checkDeviceToken(controllerUrl);
-
-  // If no device token, check client token
-  if (!tokenInfo) {
-    tokenInfo = await checkClientToken(controllerUrl, environment);
-  }
+  const refreshedCount = await refreshExpiredClientTokensWherePossible(environment, controllerUrl);
+  const tokenInfo = await resolveAuthenticatedTokenInfo(controllerUrl, environment);
 
   let dataplaneInfo = null;
   if (tokenInfo && tokenInfo.authenticated && tokenInfo.token) {
@@ -402,6 +385,7 @@ async function handleAuthStatus(options = {}) {
   }
 
   displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo);
+  await displayStoredClientTokensSection(environment, controllerUrl, refreshedCount);
 
   if (options.validate) {
     if (!tokenInfo || !tokenInfo.authenticated) {
@@ -427,10 +411,7 @@ async function getValidatedAuthContext() {
   const controllerUrl = await resolveControllerUrl();
   const environment = await resolveEnvironment();
 
-  let tokenInfo = await checkDeviceToken(controllerUrl);
-  if (!tokenInfo) {
-    tokenInfo = await checkClientToken(controllerUrl, environment);
-  }
+  const tokenInfo = await resolveAuthenticatedTokenInfo(controllerUrl, environment);
 
   if (!tokenInfo || !tokenInfo.authenticated || !tokenInfo.token) {
     throw new Error('Not authenticated. Run "aifabrix login" or configure client credentials.');
@@ -442,4 +423,12 @@ async function getValidatedAuthContext() {
   return { controllerUrl, environment, authConfig, dataplaneUrl };
 }
 
-module.exports = { handleAuthStatus, getValidatedAuthContext };
+module.exports = {
+  handleAuthStatus,
+  getValidatedAuthContext,
+  resolveAuthenticatedTokenInfo,
+  checkDeviceToken,
+  checkClientToken,
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection
+};