@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/identity-user-cli.js

@@ -6,9 +6,8 @@
 
 'use strict';
 
-const chalk = require('chalk');
 const logger = require('../utils/logger');
-const { formatBlockingError, formatSuccessLine, headerKeyValue } = require('../utils/cli-layout-chalk');
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-layout-chalk');
 const {
   resolveControllerAndAuth,
   requireNonEmpty,
@@ -21,11 +20,27 @@ const {
   createUser,
   listUserGroups
 } = require('../api/users.api');
+const {
+  extractPaginatedList,
+  printIdentityEmpty,
+  printIdentityListHeader,
+  printIdentityNotFound,
+  printIdentityTable,
+  printListPaginationFooter,
+  printUserGroupsTable,
+  printUserRecord,
+  USER_LIST_COLUMNS
+} = require('../identity/identity-display');
+const { resolveIdentityUsername } = require('../identity/username-default');
 
 function printJson(data) {
   logger.log(JSON.stringify(data, null, 2));
 }
 
+function userNotFoundHints() {
+  return ['af identity user list --search <text>', 'Check email, username, or id spelling'];
+}
+
 function registerUserCreate(userCmd) {
   userCmd
     .command('create')
@@ -38,12 +53,13 @@ function registerUserCreate(userCmd) {
     .action(async(options) => {
       try {
         const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const email = requireNonEmpty(options.email, 'email');
         const res = await createUser(controllerUrl, authConfig, {
-          email: requireNonEmpty(options.email, 'email'),
+          email,
           firstName: options.firstName,
           lastName: options.lastName,
           displayName: options.displayName,
-          username: options.username,
+          username: resolveIdentityUsername({ username: options.username, email }),
           status: 'active'
         });
         throwIfApiFailed(res);
@@ -62,26 +78,41 @@ function registerUserList(userCmd) {
     .description('List users')
     .option('--page <n>', 'Page', (v) => parseInt(v, 10))
     .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
-    .option('--search <text>', 'Search users')
+    .option('--search <text>', 'Search users (email, username, name)')
+    .option('--email <email>', 'Exact email filter')
     .option('--json', 'JSON output')
     .action(async(options) => {
       try {
         const { controllerUrl, authConfig } = await resolveControllerAndAuth();
-        const res = await listUsers(controllerUrl, authConfig, {
+        const params = {
           page: options.page,
           pageSize: options.pageSize,
           search: options.search
-        });
+        };
+        if (options.email) {
+          params.filter = `email:eq:${options.email}`;
+          delete params.search;
+        }
+        const res = await listUsers(controllerUrl, authConfig, params);
         throwIfApiFailed(res);
-        const data = unwrapControllerData(res);
         if (options.json) {
-          printJson(data);
+          printJson(res.data ?? res);
           return;
         }
-        const items = Array.isArray(data) ? data : data?.data || [];
-        logger.log(chalk.bold(`\nUsers (${items.length} shown):\n`));
-        items.forEach((u) => logger.log(`  ${u.id}  ${u.email}`));
-        logger.log('');
+        const { items, meta } = extractPaginatedList(res);
+        printIdentityListHeader({
+          emoji: '👤',
+          title: 'Users',
+          context: controllerUrl,
+          shown: items.length,
+          total: meta?.totalItems ?? items.length
+        });
+        if (items.length === 0) {
+          printIdentityEmpty('No users found.', ['Try --search or --email']);
+          return;
+        }
+        printIdentityTable(USER_LIST_COLUMNS, items);
+        printListPaginationFooter(meta);
       } catch (e) {
         logger.error(formatBlockingError(e.message));
         process.exit(1);
@@ -91,22 +122,28 @@ function registerUserList(userCmd) {
 
 function registerUserGet(userCmd) {
   userCmd
-    .command('get <idOrEmail>')
-    .description('Get user by id or email')
+    .command('get <userIdOrEmail>')
+    .description('Get user by id, email, or username')
     .option('--json', 'JSON output')
-    .action(async(idOrEmail, options) => {
+    .action(async(userIdOrEmail, options) => {
       try {
         const { controllerUrl, authConfig } = await resolveControllerAndAuth();
-        const res = await getUser(controllerUrl, authConfig, requireNonEmpty(idOrEmail, 'idOrEmail'));
-        throwIfApiFailed(res);
+        const value = requireNonEmpty(userIdOrEmail, 'userIdOrEmail');
+        const res = await getUser(controllerUrl, authConfig, value);
+        if (!res || res.success === false) {
+          printIdentityNotFound('User', value, userNotFoundHints());
+          process.exit(1);
+        }
         const row = unwrapControllerData(res);
+        if (!row?.id) {
+          printIdentityNotFound('User', value, userNotFoundHints());
+          process.exit(1);
+        }
         if (options.json) {
           printJson(row);
           return;
         }
-        logger.log(headerKeyValue('Id:', row.id));
-        logger.log(headerKeyValue('Email:', row.email));
-        logger.log('');
+        printUserRecord(row);
       } catch (e) {
         logger.error(formatBlockingError(e.message));
         process.exit(1);
@@ -116,26 +153,35 @@ function registerUserGet(userCmd) {
 
 function registerUserGroups(userCmd) {
   userCmd
-    .command('groups <idOrEmail>')
-    .description('List groups for a user')
+    .command('groups <userIdOrEmail>')
+    .description('List groups for a user (by id, email, or username)')
     .option('--json', 'JSON output')
-    .action(async(idOrEmail, options) => {
+    .action(async(userIdOrEmail, options) => {
       try {
         const { controllerUrl, authConfig } = await resolveControllerAndAuth();
-        const res = await listUserGroups(
-          controllerUrl,
-          authConfig,
-          requireNonEmpty(idOrEmail, 'idOrEmail')
-        );
-        throwIfApiFailed(res);
+        const value = requireNonEmpty(userIdOrEmail, 'userIdOrEmail');
+        const res = await listUserGroups(controllerUrl, authConfig, value);
+        if (!res || res.success === false) {
+          printIdentityNotFound('User', value, userNotFoundHints());
+          process.exit(1);
+        }
         const data = unwrapControllerData(res);
+        const items = Array.isArray(data) ? data : data?.data || [];
         if (options.json) {
-          printJson(data);
+          printJson(items);
           return;
         }
-        const items = Array.isArray(data) ? data : data?.data || [];
-        items.forEach((g) => logger.log(`  ${g.id || g.groupId}  ${g.name || ''}`));
-        logger.log('');
+        printIdentityListHeader({
+          emoji: '👥',
+          title: `Groups for ${value}`,
+          shown: items.length,
+          total: items.length
+        });
+        if (items.length === 0) {
+          printIdentityEmpty('No group memberships found.');
+          return;
+        }
+        printUserGroupsTable(items);
       } catch (e) {
         logger.error(formatBlockingError(e.message));
         process.exit(1);

package/lib/commands/lifecycle-command-action.js

@@ -0,0 +1,123 @@
+/**
+ * @fileoverview CLI action for `aifabrix lifecycle` certification report (plan 150.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { handleCommandError } = require('../utils/cli-utils');
+const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { runLifecycleForExternalSystem } = require('./lifecycle-external');
+const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
+const { VERDICT } = require('../lifecycle/product-model');
+const { exitCodeFromVerdict } = require('../lifecycle/exit-codes');
+const { lifecycleHasGovernanceSubjects } = require('../lifecycle/lifecycle-governance-options');
+
+/**
+ * @param {Object} options
+ * @param {import('commander').Command} [cmd]
+ * @returns {Object}
+ */
+function normalizeLifecycleCliOptions(options, cmd) {
+  const raw = cmd && Array.isArray(cmd.rawArgs) ? cmd.rawArgs : [];
+  const has = flag => raw.includes(flag);
+  return {
+    env: options.env || 'dev',
+    verbose: options.verbose === true || has('-v') || has('--verbose'),
+    debug: options.debug === true || has('-d') || has('--debug'),
+    json: options.json === true || has('--json'),
+    run: options.run === true || has('--run'),
+    noSync: cliOptsSkipSync(options, cmd),
+    force: options.force === true || has('--force'),
+    subjectUserId: options.subjectUserId || [],
+    subjectEmail: options.subjectEmail || [],
+    certificationProfile: options.certificationProfile || 'bronze'
+  };
+}
+
+/**
+ * @param {Object} report
+ * @returns {string}
+ */
+function lifecycleVerdictFromReport(report) {
+  const ops = report.operations?.verdict;
+  const trust = report.trust?.verdict;
+  const gov = report.governance?.verdict;
+  if (ops === VERDICT.FAILED || trust === VERDICT.FAILED || gov === VERDICT.FAILED) {
+    return VERDICT.FAILED;
+  }
+  if (
+    ops === VERDICT.VERIFIED &&
+    trust === VERDICT.VERIFIED &&
+    gov === VERDICT.VERIFIED
+  ) {
+    return VERDICT.VERIFIED;
+  }
+  return VERDICT.NOT_VERIFIED;
+}
+
+async function runLifecycleCommandAction(appName, options, cmd) {
+  const opts = normalizeLifecycleCliOptions(options, cmd);
+  if (lifecycleHasGovernanceSubjects(opts) && !opts.run) {
+    throw new Error(
+      '--subject-user-id and --subject-email require --run on lifecycle (use verify-governance for governance-only)'
+    );
+  }
+  const result = await runLifecycleForExternalSystem(appName, opts);
+  const report = result.report;
+
+  if (opts.json) {
+    const envelope = {
+      systemKey: result.systemKey,
+      command: 'lifecycle',
+      certification: report.certification,
+      operations: report.operations,
+      trust: report.trust,
+      governance: report.governance,
+      recommendations: report.recommendations,
+      warnings: report.warnings,
+      openApiPublished: result.openApiPublished === true,
+      certificationProgress: result.certificationProgress ?? null,
+      stepsRun: result.stepsRun
+    };
+    if (opts.verbose) {
+      envelope.datasources = report.datasources;
+    }
+    logger.log(JSON.stringify(envelope, null, 2));
+  } else {
+    displayLifecycleReportTTY(result.systemKey, report, {
+      details: opts.verbose,
+      openApiPublished: result.openApiPublished === true,
+      certificationProgress: result.certificationProgress ?? null,
+      dataplaneUrl: result.dataplaneUrl ?? null,
+      dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
+    });
+  }
+
+  const pillarVerdict = lifecycleVerdictFromReport(report);
+  const exitCode =
+    pillarVerdict === VERDICT.VERIFIED
+      ? 0
+      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+  if (exitCode !== 0) {
+    process.exit(exitCode);
+  }
+}
+
+async function lifecycleCommandHandler(appName, options, cmd) {
+  try {
+    await runLifecycleCommandAction(appName, options, cmd);
+  } catch (error) {
+    handleCommandError(error, 'lifecycle');
+    process.exit(3);
+  }
+}
+
+module.exports = {
+  normalizeLifecycleCliOptions,
+  runLifecycleCommandAction,
+  lifecycleCommandHandler,
+  lifecycleVerdictFromReport
+};

package/lib/commands/lifecycle-external.js

@@ -0,0 +1,268 @@
+/**
+ * @fileoverview lifecycle certification report — GET default, --run optional (plan 150.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getSystemLifecycleReport, runSystemLifecycle } = require('../api/lifecycle.api');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { getConfig } = require('../core/config');
+const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { syncLocalIfRequested } = require('./test-e2e-external');
+const { runVerifyOperationsForExternalSystem } = require('./verify-operations-external');
+const { runVerifyTrustForExternalSystem } = require('./verify-trust-external');
+const { runGovernanceVerifyForExternalSystem } = require('./governance-verify-external');
+const { VERDICT } = require('../lifecycle/product-model');
+const { buildCertificationProgress } = require('../lifecycle/certification-progress');
+const { resolveOpenApiPublished } = require('../lifecycle/open-api-published');
+const { runWithVerifyStepProgress } = require('../lifecycle/verify-step-progress');
+const { resolveDataplaneUiBaseUrl } = require('../lifecycle/dataplane-ui-url');
+const {
+  lifecycleHasGovernanceSubjects,
+  lifecycleGovernanceNeedsWork,
+  buildGovernanceOptsFromLifecycle
+} = require('../lifecycle/lifecycle-governance-options');
+
+/**
+ * @async
+ * @param {string|null|undefined} dataplaneUrl
+ * @returns {Promise<string|null>}
+ */
+async function resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl) {
+  try {
+    return await resolveDataplaneUiBaseUrl(dataplaneUrl);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }>}
+ */
+async function resolveLifecycleAuth(systemKey, options) {
+  if (!cliOptsSkipSync(options) && options.run === true) {
+    options.lifecycleProgress?.setLabel?.('Checking config on dataplane');
+    const uploadCtx = await syncLocalIfRequested(systemKey, {
+      ...options,
+      suppressPipelineSpinner: true
+    });
+    if (uploadCtx) {
+      options.lifecycleProgress?.setLabel?.('Processing');
+      return { authConfig: uploadCtx.authConfig, dataplaneUrl: uploadCtx.dataplaneUrl };
+    }
+  }
+  const configObj = await getConfig();
+  return setupIntegrationTestAuth(systemKey, { environment: options.env }, configObj);
+}
+
+/**
+ * Generate + verify governance when lifecycle --run includes subject selectors.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {Object} authConfig
+ * @param {string} dataplaneUrl
+ * @param {Object} options
+ */
+async function runLifecycleGovernanceCombinedIfNeeded(
+  systemKey,
+  report,
+  authConfig,
+  dataplaneUrl,
+  options
+) {
+  if (!lifecycleHasGovernanceSubjects(options)) {
+    return;
+  }
+  if (!lifecycleGovernanceNeedsWork(report)) {
+    return;
+  }
+  const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
+  await runVerifyGovernanceCombined(
+    systemKey,
+    buildGovernanceOptsFromLifecycle(options, { authConfig, dataplaneUrl })
+  );
+}
+
+/**
+ * Run missing verify pillars locally when lifecycle/run API unavailable.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {Object} options
+ */
+async function runMissingVerifyStepsLocally(systemKey, report, options) {
+  const runOpts = { ...options, noSync: true };
+  if (report.operations?.verdict !== VERDICT.VERIFIED) {
+    await runVerifyOperationsForExternalSystem(systemKey, runOpts);
+  }
+  if (report.trust?.verdict !== VERDICT.VERIFIED) {
+    await runVerifyTrustForExternalSystem(systemKey, runOpts);
+  }
+  if (report.governance?.verdict !== VERDICT.VERIFIED) {
+    if (lifecycleHasGovernanceSubjects(options)) {
+      const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
+      await runVerifyGovernanceCombined(
+        systemKey,
+        buildGovernanceOptsFromLifecycle(options, {
+          authConfig: options.authConfig,
+          dataplaneUrl: options.dataplaneUrl
+        })
+      );
+    } else {
+      await runGovernanceVerifyForExternalSystem(systemKey, runOpts);
+    }
+  }
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} report
+ * @param {string} dataplaneUrl
+ * @param {string|null} dataplaneUiBaseUrl
+ * @param {Object} authConfig
+ * @param {Object} [extra]
+ * @returns {Promise<Object>}
+ */
+async function buildLifecycleResult(
+  systemKey,
+  report,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  authConfig,
+  extra = {}
+) {
+  const openApiPublished = await resolveOpenApiPublished(dataplaneUrl, authConfig, systemKey);
+  return {
+    systemKey,
+    command: 'lifecycle',
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    openApiPublished,
+    certificationProgress: buildCertificationProgress(report, { openApiPublished }),
+    ...extra
+  };
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} authConfig
+ * @param {string} dataplaneUrl
+ * @param {string|null} dataplaneUiBaseUrl
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runLifecycleViaDataplaneApi(
+  systemKey,
+  authConfig,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  options
+) {
+  if (lifecycleHasGovernanceSubjects(options)) {
+    const preReport = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+      details: options.verbose === true
+    });
+    await runLifecycleGovernanceCombinedIfNeeded(
+      systemKey,
+      preReport,
+      authConfig,
+      dataplaneUrl,
+      options
+    );
+  }
+  const runRes = await runSystemLifecycle(dataplaneUrl, authConfig, systemKey, {});
+  return buildLifecycleResult(
+    systemKey,
+    runRes.report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { stepsRun: runRes.stepsRun || [], source: 'api' }
+  );
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function executeLifecycleWork(systemKey, options = {}) {
+  const { authConfig, dataplaneUrl } = await resolveLifecycleAuth(systemKey, options);
+  const dataplaneUiBaseUrl = await resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl);
+
+  if (options.run === true) {
+    try {
+      return await runLifecycleViaDataplaneApi(
+        systemKey,
+        authConfig,
+        dataplaneUrl,
+        dataplaneUiBaseUrl,
+        options
+      );
+    } catch {
+      const preReport = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+        details: options.verbose === true
+      });
+      await runMissingVerifyStepsLocally(systemKey, preReport, {
+        ...options,
+        authConfig,
+        dataplaneUrl
+      });
+    }
+  }
+
+  const report = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+    details: options.verbose === true
+  });
+  return buildLifecycleResult(
+    systemKey,
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { source: options.run ? 'local-fallback' : 'api' }
+  );
+}
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runLifecycleForExternalSystem(systemKey, options = {}) {
+  const pathsUtil = require('../utils/paths');
+  const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
+  if (!appType || appType.baseDir !== 'integration') {
+    throw new Error(
+      'lifecycle applies to external integration folders only (integration/<systemKey>/).'
+    );
+  }
+
+  if (options.run === true) {
+    return runWithVerifyStepProgress(
+      'Processing',
+      async(progress) => executeLifecycleWork(systemKey, { ...options, lifecycleProgress: progress }),
+      { json: options.json === true }
+    );
+  }
+
+  return executeLifecycleWork(systemKey, options);
+}
+
+module.exports = {
+  runLifecycleForExternalSystem,
+  runMissingVerifyStepsLocally,
+  runLifecycleGovernanceCombinedIfNeeded,
+  resolveLifecycleAuth
+};

package/lib/commands/login.js

@@ -85,7 +85,7 @@ async function normalizeControllerUrl(options) {
   if (!controllerUrl) {
     controllerUrl = await resolveControllerUrl();
   }
-  controllerUrl = String(controllerUrl).replace(/\/+$/, '');
+  controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
   // Save controller URL to config
   await setControllerUrl(controllerUrl);
   if (!options.compact) {
@@ -170,6 +170,14 @@ async function handleDeviceCodeLoginFlow(controllerUrl, environment, options) {
  */
 async function refreshDataplaneVersionIfNeeded(controllerUrl, options, skipRefresh) {
   if (skipRefresh) return;
+  if (!options.compact) {
+    const { LOGIN_POST_REFRESH_BUDGET_MS } = require('./auth-status-dataplane-version');
+    logger.log(
+      chalk.gray(
+        `Syncing dataplane version cache (optional, up to ${Math.round(LOGIN_POST_REFRESH_BUDGET_MS / 1000)}s)...`
+      )
+    );
+  }
   await tryRefreshDataplaneVersionAfterLogin(controllerUrl, options);
 }
 
@@ -213,7 +221,8 @@ async function handleLogin(options) {
   const method = await determineAuthMethod(options.method);
   validateScopeOptions(method, options);
 
-  const skipRefresh = options.skipDataplaneVersionRefresh === true;
+  const skipRefresh =
+    options.skipDataplaneVersionRefresh === true || options.skipVersionCache === true;
   const flow = await executeLoginMethod(method, controllerUrl, environment, options, skipRefresh);
   if (flow === 'device') return;