@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/repair-external-run.js

@@ -0,0 +1,216 @@
+/**
+ * External integration repair orchestration (local file updates, manifest, README).
+ *
+ * @fileoverview Repair external integration run pipeline
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { normalizeDatasourceKeysAndFilenames } = require('./repair-datasource-keys');
+const { resolveSystemContext } = require('./repair-system-alignment');
+const { persistChangesAndRegenerate, regenerateReadmeIfRequested } = require('./repair-persist');
+const { runRepairSteps } = require('./repair-steps');
+const { runDatasourceRepairs } = require('./repair-datasource-run');
+const { maybeRepairRbac } = require('./repair-rbac');
+const { maybeRunOpenApiSyncForMcp } = require('./repair-openapi-sync');
+
+/**
+ * @param {Object} steps
+ * @param {boolean} anyUpdated
+ * @param {boolean} manifestRegenerated
+ * @param {boolean} readmeRegenerated
+ * @param {Object} ctx
+ * @returns {Object}
+ */
+function buildRepairResult(steps, anyUpdated, manifestRegenerated, readmeRegenerated, ctx) {
+  return Object.assign(
+    {
+      updated: anyUpdated,
+      actionsPerformed: ctx.actionsPerformed === true,
+      changes: ctx.changes,
+      warnings: ctx.warnings || [],
+      changedFiles: ctx.changedFiles || [],
+      systemFiles: ctx.systemFiles,
+      datasourceFiles: ctx.datasourceFiles,
+      backupPaths: ctx.backupPaths || []
+    },
+    {
+      appKeyFixed: steps.appKeyFixed,
+      datasourceKeysFixed: steps.datasourceKeysFixed,
+      rbacFileCreated: steps.rbacFileCreated,
+      envTemplateRepaired: steps.envTemplateRepaired,
+      manifestRegenerated,
+      readmeRegenerated
+    }
+  );
+}
+
+/**
+ * @param {Object} params
+ * @returns {Object}
+ */
+function prepareRepairWorkspace(params) {
+  const {
+    options,
+    appPath,
+    configPath,
+    dryRun,
+    authOption,
+    backupCtx,
+    variables,
+    systemFiles,
+    datasourceFiles: initialDatasourceFiles
+  } = params;
+  const changes = [];
+  const warnings = [];
+  const { systemFilePath, systemParsed, systemKey } = resolveSystemContext(appPath, systemFiles);
+  const rbacFmt = options.format === 'json' ? 'json' : 'yaml';
+  const { updated: keysNormalized, datasourceFiles } = normalizeDatasourceKeysAndFilenames(
+    appPath,
+    initialDatasourceFiles,
+    systemKey,
+    { variables, dryRun, changes, backupCtx }
+  );
+  return {
+    options,
+    appPath,
+    configPath,
+    dryRun,
+    authOption,
+    backupCtx,
+    variables,
+    systemFiles,
+    changes,
+    warnings,
+    systemFilePath,
+    systemParsed,
+    systemKey,
+    rbacFmt,
+    keysNormalized,
+    datasourceFiles
+  };
+}
+
+/**
+ * @param {Object} ws
+ * @returns {Promise<Object>}
+ */
+async function runRepairIntegrationFileSteps(ws) {
+  const steps = runRepairSteps({
+    appPath: ws.appPath,
+    configPath: ws.configPath,
+    variables: ws.variables,
+    systemFilePath: ws.systemFilePath,
+    systemParsed: ws.systemParsed,
+    systemKey: ws.systemKey,
+    systemFiles: ws.systemFiles,
+    datasourceFiles: ws.datasourceFiles,
+    dryRun: ws.dryRun,
+    changes: ws.changes,
+    warnings: ws.warnings,
+    auth: ws.authOption,
+    format: ws.rbacFmt,
+    backupCtx: ws.backupCtx
+  });
+  const datasourceRepairUpdated = runDatasourceRepairs(
+    ws.appPath,
+    ws.datasourceFiles,
+    {
+      expose: Boolean(ws.options.expose),
+      sync: Boolean(ws.options.sync),
+      test: Boolean(ws.options.test),
+      backupCtx: ws.backupCtx
+    },
+    ws.dryRun,
+    ws.changes
+  );
+  const openapiActionsPerformed = await maybeRunOpenApiSyncForMcp({
+    options: ws.options,
+    dryRun: ws.dryRun,
+    appPath: ws.appPath,
+    systemKey: ws.systemKey,
+    datasourceFiles: ws.datasourceFiles,
+    changes: ws.changes
+  });
+  const { rbacMigratedFromSystem, rbacMergeUpdated } = maybeRepairRbac(
+    ws.appPath,
+    ws.systemFilePath,
+    ws.systemParsed,
+    ws.datasourceFiles,
+    { rbac: Boolean(ws.options.rbac), rbacFmt: ws.rbacFmt, dryRun: ws.dryRun, changes: ws.changes, backupCtx: ws.backupCtx }
+  );
+  const anyLocalUpdated =
+    ws.keysNormalized || steps.updated || datasourceRepairUpdated || rbacMigratedFromSystem || rbacMergeUpdated;
+  return {
+    steps,
+    anyLocalUpdated,
+    changes: ws.changes,
+    warnings: ws.warnings,
+    openapiActionsPerformed,
+    systemFiles: ws.systemFiles,
+    datasourceFiles: ws.datasourceFiles
+  };
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function runRepairLocalUpdates(params) {
+  const ws = prepareRepairWorkspace(params);
+  return runRepairIntegrationFileSteps(ws);
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} local
+ * @returns {Promise<Object>}
+ */
+async function finalizeRepairIntegration(params, local) {
+  const { appName, options, appPath, configPath, dryRun, backupPaths, backupCtx, variables, originalYamlContent } =
+    params;
+  const { steps, anyLocalUpdated, changes, warnings, openapiActionsPerformed, systemFiles, datasourceFiles } = local;
+  let manifestRegenerated = false;
+  if (anyLocalUpdated && !dryRun) {
+    manifestRegenerated = await persistChangesAndRegenerate({
+      configPath,
+      variables,
+      appName,
+      appPath,
+      changes,
+      originalYamlContent,
+      backupCtx
+    });
+  }
+  const readmeRegenerated = await regenerateReadmeIfRequested(
+    appName,
+    appPath,
+    { ...options, backupCtx },
+    changes
+  );
+  const changedFiles = dryRun ? backupCtx.wouldChangeFiles : backupCtx.changedFiles;
+  return buildRepairResult(steps, anyLocalUpdated, manifestRegenerated, readmeRegenerated, {
+    actionsPerformed: openapiActionsPerformed,
+    changes,
+    warnings,
+    changedFiles,
+    systemFiles,
+    datasourceFiles,
+    backupPaths
+  });
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function runRepairExternalIntegration(params) {
+  const local = await runRepairLocalUpdates(params);
+  return finalizeRepairIntegration(params, local);
+}
+
+module.exports = {
+  runRepairExternalIntegration
+};

package/lib/commands/repair-openapi-sync.js

@@ -15,10 +15,15 @@ const path = require('path');
 const fs = require('fs');
 
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const {
+  getDeploymentAuth,
+  requireBearerForDataplanePipeline,
+  applyLabDataplaneApiKeyBearer
+} = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { uploadFileAs } = require('../utils/file-upload');
 const { listOpenAPIFiles } = require('../api/external-systems.api');
+const { resolveLabDataplaneApiKey } = require('../utils/credential-secrets-env');
 
 async function fileExistsAsync(filePath) {
   try {
@@ -29,11 +34,25 @@ async function fileExistsAsync(filePath) {
   }
 }
 
-async function resolveDataplaneAndAuth(systemKey) {
+function authForJwtOnlyDataplaneRoutes(authConfig) {
+  const copy = { ...(authConfig || {}) };
+  if (copy.type === 'client-token' && resolveLabDataplaneApiKey()) {
+    return applyLabDataplaneApiKeyBearer(copy);
+  }
+  return copy;
+}
+
+async function resolveDataplaneAndAuth(systemKey, preResolved = {}) {
+  if (preResolved.dataplaneUrl && preResolved.authConfig) {
+    const authConfig = authForJwtOnlyDataplaneRoutes(preResolved.authConfig);
+    return { dataplaneUrl: preResolved.dataplaneUrl, authConfig };
+  }
   const { resolveEnvironment } = require('../core/config');
   const environment = await resolveEnvironment();
   const controllerUrl = await resolveControllerUrl();
-  const authConfig = await getDeploymentAuth(controllerUrl, environment, systemKey);
+  const authConfig = authForJwtOnlyDataplaneRoutes(
+    await getDeploymentAuth(controllerUrl, environment, systemKey)
+  );
   requireBearerForDataplanePipeline(authConfig);
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, { silent: true });
   return { dataplaneUrl, authConfig };
@@ -115,7 +134,10 @@ async function syncOpenApiFilesForMcp(opts) {
   const openapiDir = path.join(appPath, 'openapi');
   if (!(await fileExistsAsync(openapiDir))) return { uploaded: 0, skipped: 0 };
 
-  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey);
+  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey, {
+    dataplaneUrl: opts.dataplaneUrl,
+    authConfig: opts.authConfig
+  });
   const existingKeys = await getExistingOpenApiKeys(dataplaneUrl, systemKey, authConfig);
   const uploadedKeys = new Set(existingKeys);
   let uploaded = 0;
@@ -164,9 +186,32 @@ async function maybeSyncOpenApiFilesForMcp(opts) {
   return lines;
 }
 
+/**
+ * @param {Object} args
+ * @returns {Promise<boolean>}
+ */
+async function maybeRunOpenApiSyncForMcp({ options, dryRun, appPath, systemKey, datasourceFiles, changes }) {
+  if (!options.api) return false;
+  try {
+    const openapiLines = await maybeSyncOpenApiFilesForMcp({
+      enabled: true,
+      dryRun,
+      appPath,
+      systemKey,
+      datasourceFiles
+    });
+    openapiLines.forEach((l) => changes.push(l));
+    return openapiLines.length > 0;
+  } catch (err) {
+    changes.push(`OpenAPI upload for MCP failed: ${err.message}`);
+    return false;
+  }
+}
+
 module.exports = {
   documentKeyToLocalOpenApiPath,
   maybeSyncOpenApiFilesForMcp,
+  maybeRunOpenApiSyncForMcp,
   syncOpenApiFilesForMcp
 };
 

package/lib/commands/repair-persist.js

@@ -17,6 +17,7 @@ const { getDeployJsonPath } = require('../utils/paths');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { writeConfigFile, writeYamlPreservingComments, isYamlPath } = require('../utils/config-format');
 const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
 const logger = require('../utils/logger');
 const generator = require('../generator');
 const { generateReadmeFromDeployJson } = require('../generator/split-readme');
@@ -40,6 +41,7 @@ function inferExternalReadmeFileExt(appPath) {
 async function regenerateManifest(appName, appPath, changes, backupCtx) {
   try {
     const deployPath = getDeployJsonPath(appName, 'external', true);
+    trackRepairWrite(deployPath, backupCtx);
     backupIntegrationFile(deployPath, backupCtx);
     const outPath = await generator.generateDeployJson(appName, { appPath });
     changes.push(`Regenerated ${path.basename(outPath)}`);
@@ -70,6 +72,7 @@ async function regenerateReadmeIfRequested(appName, appPath, options, changes) {
     const fileExt = inferExternalReadmeFileExt(appPath);
     const readmeContent = generateReadmeFromDeployJson(deployment, { fileExt });
     const readmePath = path.join(appPath, 'README.md');
+    trackRepairWrite(readmePath, options.backupCtx);
     if (!options.dryRun) {
       backupIntegrationFile(readmePath, options.backupCtx);
       fs.writeFileSync(readmePath, readmeContent, { mode: 0o644, encoding: 'utf8' });
@@ -84,6 +87,7 @@ async function regenerateReadmeIfRequested(appName, appPath, options, changes) {
 
 function persistChangesAndRegenerate(opts) {
   const { configPath, variables, appName, appPath, changes, originalYamlContent, backupCtx } = opts;
+  trackRepairWrite(configPath, backupCtx);
   backupIntegrationFile(configPath, backupCtx);
   if (originalYamlContent !== null && originalYamlContent !== undefined && typeof originalYamlContent === 'string' && isYamlPath(configPath)) {
     writeYamlPreservingComments(configPath, originalYamlContent, variables);

package/lib/commands/repair-rbac.js

@@ -361,10 +361,61 @@ function mergeRbacFromDatasources(appPath, systemParsed, datasourceFiles, extrac
 }
 
 const { migrateSystemRbacIntoRbacFile } = require('./repair-rbac-migrate');
+const { resolveRbacPath } = require('../utils/app-config-resolver');
+
+/**
+ * @param {Object} opts
+ * @returns {boolean}
+ */
+function createRbacFromSystemIfNeeded(opts) {
+  const { appPath, systemFilePath, systemParsed, dryRun, changes, format, backupCtx } = opts;
+  if (resolveRbacPath(appPath)) return false;
+  const rbacFromSystem = extractRbacFromSystem(systemParsed);
+  if (!rbacFromSystem) return false;
+  if (!dryRun) {
+    const rbacFormat = format === 'json' ? 'json' : 'yaml';
+    const defaultRbacPath = path.join(appPath, rbacFormat === 'json' ? 'rbac.json' : 'rbac.yaml');
+    writeConfigFile(defaultRbacPath, rbacFromSystem, rbacFormat);
+    delete systemParsed.roles;
+    delete systemParsed.permissions;
+    backupIntegrationFile(systemFilePath, backupCtx);
+    writeConfigFile(systemFilePath, systemParsed);
+  }
+  changes.push('Created rbac.yaml from system roles/permissions');
+  changes.push('Removed roles/permissions from system file (now in rbac file)');
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string} systemFilePath
+ * @param {Object} systemParsed
+ * @param {string[]} datasourceFiles
+ * @param {Object} options
+ * @returns {{ rbacMigratedFromSystem: boolean, rbacMergeUpdated: boolean }}
+ */
+function maybeRepairRbac(appPath, systemFilePath, systemParsed, datasourceFiles, options) {
+  if (!options.rbac) return { rbacMigratedFromSystem: false, rbacMergeUpdated: false };
+  const { dryRun, changes, backupCtx, rbacFmt } = options;
+  const rbacMigratedFromSystem = migrateSystemRbacIntoRbacFile(appPath, systemFilePath, systemParsed, {
+    dryRun,
+    changes,
+    backupCtx
+  });
+  const rbacMergeUpdated = mergeRbacFromDatasources(appPath, systemParsed, datasourceFiles, extractRbacFromSystem, {
+    format: rbacFmt,
+    dryRun,
+    changes,
+    backupCtx
+  });
+  return { rbacMigratedFromSystem, rbacMergeUpdated };
+}
 
 module.exports = {
   extractRbacFromSystem,
   getCapabilitiesFromDatasource,
   mergeRbacFromDatasources,
-  migrateSystemRbacIntoRbacFile
+  migrateSystemRbacIntoRbacFile,
+  createRbacFromSystemIfNeeded,
+  maybeRepairRbac
 };

package/lib/commands/repair-steps.js

@@ -0,0 +1,160 @@
+/**
+ * Core repair step runner (integration block, system alignment, auth, RBAC file, env.template).
+ *
+ * @fileoverview Repair step orchestration
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { writeConfigFile } = require('../utils/config-format');
+const { trackRepairWrite } = require('./repair-changed-files');
+const { repairEnvTemplate, normalizeSystemFileAuthAndConfig } = require('./repair-env-template');
+const { createRbacFromSystemIfNeeded } = require('./repair-rbac');
+const {
+  alignAppKeyWithSystem,
+  alignDatasourceSystemKeys,
+  alignSystemFileDataSources,
+  ensureExternalIntegrationBlock,
+  removeAuthVarsFromConfiguration
+} = require('./repair-system-alignment');
+const {
+  isAllowedRepairAuth,
+  normalizeRepairAuthOption,
+  buildAuthenticationForRepair,
+  mergePreservedAuthVariables,
+  repairAuthChangeLabel,
+  auditRepairAuthenticationWarnings,
+  normalizeAuthenticationSchemaShape,
+  getAuthCredentialTemplate
+} = require('./repair-auth-apply');
+
+/**
+ * Apply --auth: replace system file authentication with canonical block for the given method.
+ * @param {Object} ctx - Context with systemParsed, systemKey, auth, dryRun, changes
+ * @returns {boolean} True if auth was replaced
+ */
+function applyAuthMethod(ctx) {
+  if (!ctx.auth || typeof ctx.auth !== 'string') return false;
+  const authOption = normalizeRepairAuthOption(ctx.auth);
+  if (!isAllowedRepairAuth(authOption)) {
+    throw new Error(
+      'Invalid --auth "' +
+        `${ctx.auth}". Allowed methods: oauth2, aad, apikey, bearerToken, basic, queryParam, oidc, hmac, none`
+    );
+  }
+  const existingAuth = ctx.systemParsed.authentication || ctx.systemParsed.auth || {};
+  const newAuth = buildAuthenticationForRepair(ctx.systemKey, authOption);
+  const existingCredential = getAuthCredentialTemplate(existingAuth) || {};
+  const mergedVariables = { ...(newAuth.credential?.variables || {}) };
+  mergePreservedAuthVariables(
+    mergedVariables,
+    existingCredential.variables && typeof existingCredential.variables === 'object'
+      ? existingCredential.variables
+      : existingAuth.variables
+  );
+  if (newAuth.authType === 'credential' && newAuth.credential) {
+    newAuth.credential.variables = mergedVariables;
+    if (existingCredential.displayName !== undefined) {
+      newAuth.credential.displayName = existingCredential.displayName;
+    } else if (existingAuth.displayName !== undefined) {
+      newAuth.credential.displayName = existingAuth.displayName;
+    }
+  }
+  ctx.systemParsed.authentication = newAuth;
+  delete ctx.systemParsed.auth;
+  ctx.changes.push(`Set authentication method to ${repairAuthChangeLabel(authOption)}`);
+  return true;
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} flags
+ * @returns {boolean}
+ */
+function persistSystemFileRepair(ctx, flags) {
+  const systemFileUpdated =
+    flags.authReplaced ||
+    flags.authShapeNormalized ||
+    flags.systemAuthConfigNormalized ||
+    flags.systemDataSourcesAligned ||
+    flags.authVarsRemoved;
+  if (!systemFileUpdated) {
+    return false;
+  }
+  trackRepairWrite(ctx.systemFilePath, ctx.backupCtx);
+  if (!ctx.dryRun) {
+    backupIntegrationFile(ctx.systemFilePath, ctx.backupCtx);
+    writeConfigFile(ctx.systemFilePath, ctx.systemParsed);
+  }
+  return true;
+}
+
+/**
+ * @param {Object} ctx
+ * @returns {{ updated: boolean, appKeyFixed: boolean, datasourceKeysFixed: boolean, rbacFileCreated: boolean, envTemplateRepaired: boolean }}
+ */
+function runRepairSteps(ctx) {
+  const bc = ctx.backupCtx;
+  let updated = ensureExternalIntegrationBlock(
+    ctx.variables, ctx.systemFiles, ctx.datasourceFiles, ctx.changes
+  );
+  const authReplaced = applyAuthMethod(ctx);
+  updated = updated || authReplaced;
+  const authShapeNormalized = normalizeAuthenticationSchemaShape(
+    ctx.systemParsed,
+    ctx.systemKey,
+    ctx.changes
+  );
+  updated = updated || authShapeNormalized;
+  const systemAuthConfigNormalized = normalizeSystemFileAuthAndConfig(
+    ctx.systemParsed, ctx.systemKey, ctx.changes
+  );
+  const systemDataSourcesAligned = alignSystemFileDataSources(
+    ctx.appPath, ctx.systemParsed, ctx.datasourceFiles, ctx.systemKey, ctx.dryRun, ctx.changes
+  );
+  const authVarsRemoved = removeAuthVarsFromConfiguration(
+    ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes
+  );
+  const systemFileUpdated = persistSystemFileRepair(ctx, {
+    authReplaced,
+    authShapeNormalized,
+    systemAuthConfigNormalized,
+    systemDataSourcesAligned,
+    authVarsRemoved
+  });
+  updated = updated || systemFileUpdated;
+  const appKeyFixed = alignAppKeyWithSystem(
+    ctx.variables, ctx.systemKey, ctx.systemParsed, ctx.changes
+  );
+  const datasourceKeysFixed = alignDatasourceSystemKeys(
+    ctx.appPath, ctx.datasourceFiles, ctx.systemKey, ctx.dryRun, ctx.changes, bc
+  );
+  const rbacFileCreated = createRbacFromSystemIfNeeded({
+    appPath: ctx.appPath,
+    systemFilePath: ctx.systemFilePath,
+    systemParsed: ctx.systemParsed,
+    dryRun: ctx.dryRun,
+    changes: ctx.changes,
+    format: ctx.format,
+    backupCtx: bc
+  });
+  const envTemplateRepaired = repairEnvTemplate(
+    ctx.appPath, ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes, bc
+  );
+  updated = updated || appKeyFixed || datasourceKeysFixed || rbacFileCreated || envTemplateRepaired;
+  auditRepairAuthenticationWarnings(ctx.systemParsed, ctx.warnings);
+  return {
+    updated,
+    appKeyFixed,
+    datasourceKeysFixed,
+    rbacFileCreated,
+    envTemplateRepaired
+  };
+}
+
+module.exports = {
+  runRepairSteps
+};

package/lib/commands/repair-system-alignment.js

@@ -177,13 +177,16 @@ function alignSystemFileDataSources(appPath, systemParsed, datasourceFiles, syst
 function buildAuthVarNames(systemParsed, _systemKey) {
   const names = new Set();
   const auth = systemParsed.authentication;
-  if (auth && typeof auth.variables === 'object') {
-    for (const k of Object.keys(auth.variables)) {
+  if (!auth || typeof auth !== 'object') return names;
+  const credential =
+    auth.credential && typeof auth.credential === 'object' ? auth.credential : auth;
+  if (typeof credential.variables === 'object') {
+    for (const k of Object.keys(credential.variables)) {
       names.add(String(k).toUpperCase().replace(/_/g, ''));
     }
   }
-  if (auth && typeof auth.security === 'object') {
-    for (const k of Object.keys(auth.security)) {
+  if (typeof credential.security === 'object') {
+    for (const k of Object.keys(credential.security)) {
       names.add(securityKeyToVar(k));
     }
   }