@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/setup-platform-auth.js

@@ -0,0 +1,76 @@
+/**
+ * Session-aware platform controller URL + auth for `aifabrix setup`.
+ *
+ * @fileoverview Setup platform-controller persistence and login gate
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const upCommon = require('./up-common');
+const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { isPlatformAuthValidForController } = require('../utils/controller-url');
+const { infoLine } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+
+/**
+ * Recompute `controller` and `platform-controller` from traefik / setupPlatformMode / front-door config.
+ * Call after setup changes platform topology (fresh install, re-install, wipe-data) so a prior
+ * full-platform URL (e.g. `http://localhost:3600/miso`) is not reused in single mode.
+ *
+ * @async
+ * @returns {Promise<string>} Normalized platform controller URL
+ */
+async function syncPlatformControllerUrlsInConfig() {
+  const platformControllerUrl = await resolvePlatformControllerUrl();
+  await config.setPlatformControllerUrl(platformControllerUrl);
+  await config.setControllerUrl(platformControllerUrl);
+  return platformControllerUrl;
+}
+
+/**
+ * Resolve absolute platform controller URL, persist `platform-controller` and `controller`,
+ * and optionally apply `up-platform --force` config (token clear only when not logged in).
+ *
+ * @async
+ * @param {{ applyForceConfig?: boolean, clearTokensAlways?: boolean }} [opts]
+ * @returns {Promise<{
+ *   platformControllerUrl: string,
+ *   skipLoginIfAuthenticated: boolean,
+ *   forceSummary: object|null
+ * }>}
+ */
+async function ensureSetupPlatformAuth(opts = {}) {
+  const platformControllerUrl = await syncPlatformControllerUrlsInConfig();
+
+  let forceSummary = null;
+  let skipLoginIfAuthenticated = await isPlatformAuthValidForController(platformControllerUrl);
+  const clearTokensAlways = opts.clearTokensAlways === true;
+  if (opts.applyForceConfig === true) {
+    forceSummary = await upCommon.applyUpPlatformForceConfig({
+      silent: true,
+      clearTokens: clearTokensAlways || !skipLoginIfAuthenticated,
+      defaultControllerUrl: platformControllerUrl
+    });
+    if (clearTokensAlways || (forceSummary && forceSummary.deviceCleared > 0)) {
+      skipLoginIfAuthenticated = false;
+    }
+  }
+
+  if (skipLoginIfAuthenticated) {
+    logger.log(infoLine(`Already authenticated to ${platformControllerUrl}`));
+  }
+
+  return {
+    platformControllerUrl,
+    skipLoginIfAuthenticated,
+    forceSummary
+  };
+}
+
+module.exports = {
+  syncPlatformControllerUrlsInConfig,
+  ensureSetupPlatformAuth
+};

package/lib/commands/setup-prompts-admin.js

@@ -0,0 +1,244 @@
+/**
+ * Admin credential prompts for `aifabrix setup` (dev / pro installation profiles).
+ *
+ * @fileoverview Setup installation profile + password bundle prompts
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { generateProAdminPasswords } = require('../core/admin-password-generator');
+const {
+  singlePasswordBundle,
+  splitPasswordBundle
+} = require('../core/admin-secrets-bundle');
+const {
+  INSTALLATION_PROFILE,
+  normalizeInstallationProfile,
+  isProInstallationProfile
+} = require('../core/setup-installation-profile');
+const { validateEmail, validatePassword } = require('./setup-prompts-validators');
+
+/**
+ * Resolve installation profile from CLI options or config (interactive fallback in orchestrator).
+ * @param {Object} [options]
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function resolveInstallationProfileFromOptions(options = {}) {
+  const cli = options.installation ?? options.installationProfile;
+  if (cli !== undefined && cli !== null && String(cli).trim() !== '') {
+    return normalizeInstallationProfile(cli);
+  }
+  try {
+    return await config.getSetupInstallationProfile();
+  } catch {
+    return INSTALLATION_PROFILE.DEV;
+  }
+}
+
+/**
+ * @async
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function promptInstallationProfile() {
+  const { profile } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'profile',
+      message: 'Installation profile:',
+      choices: [
+        {
+          name: 'Development (dev) — one admin password for all services',
+          value: INSTALLATION_PROFILE.DEV
+        },
+        {
+          name: 'Production (pro) — autogenerate strong passwords or enter manually',
+          value: INSTALLATION_PROFILE.PRO
+        }
+      ],
+      default: INSTALLATION_PROFILE.DEV
+    }
+  ]);
+  return profile;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function promptAdminEmail(options = {}) {
+  const cli = String(options.adminEmail || '').trim();
+  if (cli) return cli;
+
+  let defaultEmail;
+  try {
+    const saved = await config.getAdminEmail();
+    defaultEmail = saved && saved.trim() ? saved.trim() : undefined;
+  } catch {
+    defaultEmail = undefined;
+  }
+  const emailQuestion = {
+    type: 'input',
+    name: 'adminEmail',
+    message: 'Admin email (Keycloak / pgAdmin login):',
+    validate: validateEmail
+  };
+  if (defaultEmail !== undefined) {
+    emailQuestion.default = defaultEmail;
+  }
+  const { adminEmail } = await inquirer.prompt([emailQuestion]);
+  return String(adminEmail).trim();
+}
+
+/**
+ * @async
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSingle>}
+ */
+async function promptDevPasswordBundle() {
+  const answers = await inquirer.prompt([
+    {
+      type: 'password',
+      name: 'adminPassword',
+      message: 'Admin password (Postgres / Keycloak / pgAdmin / platform login):',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'adminPasswordConfirm',
+      message: 'Confirm admin password:',
+      mask: '*',
+      validate(input, all) {
+        if (input !== all.adminPassword) return 'Passwords do not match';
+        return true;
+      }
+    }
+  ]);
+  return singlePasswordBundle(answers.adminPassword);
+}
+
+/**
+ * Print pro autogenerated passwords once (never log plaintext elsewhere).
+ * @param {{ infra: string, keycloak: string, platform: string }} passwords
+ */
+function displayProPasswordsOnce(passwords) {
+  logger.log('');
+  logger.log(chalk.bold.yellow('Save these passwords now — they will not be shown again.'));
+  logger.log(chalk.gray('────────────────────────────────────────'));
+  logger.log(`  Infra (Postgres / pgAdmin / Redis Commander): ${passwords.infra}`);
+  logger.log(`  Keycloak install admin:                     ${passwords.keycloak}`);
+  logger.log(`  Platform UI login (user admin):             ${passwords.platform}`);
+  logger.log(chalk.gray('────────────────────────────────────────'));
+  logger.log('');
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSingle|import('../core/admin-secrets-bundle').AdminPasswordBundleSplit>}
+ */
+async function promptProPasswordBundle(options = {}) {
+  const modeCli = String(options.proPasswordMode || '').trim().toLowerCase();
+  if (modeCli === 'autogen') {
+    const generated = generateProAdminPasswords();
+    if (options.quiet !== true) {
+      displayProPasswordsOnce(generated);
+    }
+    return splitPasswordBundle(generated);
+  }
+  if (modeCli === 'manual' && String(options.adminPassword || '').trim()) {
+    return singlePasswordBundle(String(options.adminPassword).trim());
+  }
+
+  const { method } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'method',
+      message: 'How do you want to set admin passwords (pro installation)?',
+      choices: [
+        { name: 'Autogenerate strong passwords (recommended, shown once)', value: 'autogen' },
+        { name: 'Enter one password manually (same for all roles)', value: 'manual-single' },
+        { name: 'Enter separate passwords (infra / Keycloak / platform)', value: 'manual-split' }
+      ],
+      default: 'autogen'
+    }
+  ]);
+
+  if (method === 'autogen') {
+    const generated = generateProAdminPasswords();
+    displayProPasswordsOnce(generated);
+    return splitPasswordBundle(generated);
+  }
+  if (method === 'manual-split') {
+    return promptProManualSplitBundle();
+  }
+  return promptDevPasswordBundle();
+}
+
+/**
+ * @async
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSplit>}
+ */
+async function promptProManualSplitBundle() {
+  const answers = await inquirer.prompt([
+    {
+      type: 'password',
+      name: 'infra',
+      message: 'Infra password (Postgres / pgAdmin / Redis Commander):',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'keycloak',
+      message: 'Keycloak install admin password:',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'platform',
+      message: 'Platform UI login password (user admin):',
+      mask: '*',
+      validate: validatePassword
+    }
+  ]);
+  return splitPasswordBundle(answers);
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<{ adminEmail: string, passwordBundle: object, profile: 'dev'|'pro' }>}
+ */
+async function promptAdminCredentialsWithProfile(options = {}) {
+  let profile = await resolveInstallationProfileFromOptions(options);
+  const hasCliProfile =
+    options.installation !== undefined ||
+    options.installationProfile !== undefined;
+  if (!hasCliProfile) {
+    profile = await promptInstallationProfile();
+  }
+  await config.setSetupInstallationProfile(profile);
+
+  const adminEmail = await promptAdminEmail(options);
+  const passwordBundle = isProInstallationProfile(profile)
+    ? await promptProPasswordBundle(options)
+    : await promptDevPasswordBundle();
+
+  return { adminEmail, passwordBundle, profile };
+}
+
+module.exports = {
+  INSTALLATION_PROFILE,
+  resolveInstallationProfileFromOptions,
+  promptInstallationProfile,
+  promptAdminEmail,
+  promptDevPasswordBundle,
+  promptProPasswordBundle,
+  displayProPasswordsOnce,
+  promptAdminCredentialsWithProfile
+};

package/lib/commands/setup-prompts-platform-mode.js

@@ -0,0 +1,70 @@
+/**
+ * Setup prompts for platform topology mode (single vs single-traefik; full via CLI only).
+ *
+ * @fileoverview Setup platform mode prompt + CLI option normalization
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const inquirer = require('inquirer');
+const {
+  normalizeSetupPlatformMode,
+  SETUP_PLATFORM_MODE,
+  SETUP_PLATFORM_MODE_CLI_VALUES,
+  getSetupPlatformModePromptChoices
+} = require('../core/setup-platform-mode');
+
+/**
+ * Resolve platform mode from CLI options, if provided.
+ * @param {Object} [options]
+ * @returns {'single'|'single-traefik'|'full'|null}
+ */
+function resolvePlatformModeFromOptions(options = {}) {
+  const raw = options.platform;
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    return null;
+  }
+  const rawNorm = String(raw).trim().toLowerCase();
+  const isCanonical = SETUP_PLATFORM_MODE_CLI_VALUES.includes(rawNorm);
+  const isAlias =
+    rawNorm === 'ingress' ||
+    rawNorm === 'single-ingress' ||
+    rawNorm === 'traefik' ||
+    rawNorm === 'all' ||
+    rawNorm === 'full-platform' ||
+    rawNorm === 'platform-full';
+  if (!isCanonical && !isAlias) {
+    const allowed = SETUP_PLATFORM_MODE_CLI_VALUES.join(', ');
+    throw new Error(`--platform must be one of: ${allowed} (example: aifabrix setup --platform single-traefik)`);
+  }
+  return normalizeSetupPlatformMode(raw);
+}
+
+/**
+ * @async
+ * @param {Object} [options]
+ * @returns {Promise<'single'|'single-traefik'|'full'>}
+ */
+async function promptSetupPlatformMode(options = {}) {
+  const fromCli = resolvePlatformModeFromOptions(options);
+  if (fromCli) return fromCli;
+
+  const { mode } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'mode',
+      message: 'Platform mode:',
+      choices: getSetupPlatformModePromptChoices(),
+      default: SETUP_PLATFORM_MODE.SINGLE
+    }
+  ]);
+  return normalizeSetupPlatformMode(mode);
+}
+
+module.exports = {
+  resolvePlatformModeFromOptions,
+  promptSetupPlatformMode,
+  getSetupPlatformModePromptChoices
+};

package/lib/commands/setup-prompts-validators.js

@@ -0,0 +1,36 @@
+/**
+ * Shared validators for setup prompts.
+ *
+ * @fileoverview Email/password validation for setup wizard
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} input
+ * @returns {true|string}
+ */
+function validateEmail(input) {
+  const value = (input || '').trim();
+  if (!value) return 'Admin email is required';
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) return 'Enter a valid email address';
+  return true;
+}
+
+/**
+ * @param {string} input
+ * @returns {true|string}
+ */
+function validatePassword(input) {
+  const value = String(input ?? '');
+  if (value.length === 0) return 'Admin password is required';
+  if (value.length < 8) return 'Admin password must be at least 8 characters';
+  return true;
+}
+
+module.exports = {
+  validateEmail,
+  validatePassword
+};

package/lib/commands/setup-prompts.js

@@ -28,16 +28,20 @@ const path = require('path');
 const inquirer = require('inquirer');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
-const config = require('../core/config');
 const secretsCore = require('../core/secrets');
 const secretsEnsure = require('../core/secrets-ensure');
 const { formatSuccessLine, infoLine } = require('../utils/cli-test-layout-chalk');
+const { validateEmail, validatePassword } = require('./setup-prompts-validators');
+const {
+  promptAdminCredentialsWithProfile,
+  promptInstallationProfile,
+  INSTALLATION_PROFILE
+} = require('./setup-prompts-admin');
 
 /** Mode identifiers. Public so callers can switch on them without string typos. */
 const MODE = Object.freeze({
   REINSTALL: 'reinstall',
   WIPE_DATA: 'wipe-data',
-  CLEAN_FILES: 'clean-files',
   UPDATE_IMAGES: 'update-images'
 });
 
@@ -76,10 +80,6 @@ async function promptModeSelection() {
           name: 'Reset databases (keeps volumes, removes DBs/users)',
           value: MODE.WIPE_DATA
         },
-        {
-          name: 'Refresh platform config (keeps data, re-copy platform files)',
-          value: MODE.CLEAN_FILES
-        },
         {
           name: 'Update images + restart services (keeps data)',
           value: MODE.UPDATE_IMAGES
@@ -111,79 +111,23 @@ async function confirmDestructiveMode(mode, assumeYes) {
 }
 
 /**
- * Validate an email address (RFC 5322-lite for CLI use).
- * @param {string} input
- * @returns {true|string}
- */
-function validateEmail(input) {
-  const value = (input || '').trim();
-  if (!value) return 'Admin email is required';
-  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) return 'Enter a valid email address';
-  return true;
-}
-
-/**
- * Validate a password (non-empty, at least 8 chars).
- * @param {string} input
- * @returns {true|string}
- */
-function validatePassword(input) {
-  const value = String(input ?? '');
-  if (value.length === 0) return 'Admin password is required';
-  if (value.length < 8) return 'Admin password must be at least 8 characters';
-  return true;
-}
-
-/**
- * Prompt for admin email + password (fresh install only).
- * Reads {@link module:lib/core/config.getAdminEmail} so a previous `aifabrix setup` can prefill the
- * email field (user may change it before continuing).
- * Asks once for the password and once for confirmation; returns trimmed email
- * and the verbatim password (never logged).
+ * Prompt for admin credentials (dev or pro installation profile).
  *
  * @async
- * @returns {Promise<{ adminEmail: string, adminPassword: string }>}
+ * @param {Object} [options] - CLI options (`installation`, `proPasswordMode`, `adminEmail`, `adminPassword`, `quiet`)
+ * @returns {Promise<{ adminEmail: string, adminPassword: string, passwordBundle: object, profile: string }>}
  */
-async function promptAdminCredentials() {
-  let defaultEmail;
-  try {
-    const saved = await config.getAdminEmail();
-    defaultEmail = saved && saved.trim() ? saved.trim() : undefined;
-  } catch {
-    defaultEmail = undefined;
-  }
-  const emailQuestion = {
-    type: 'input',
-    name: 'adminEmail',
-    message: 'Admin email (Keycloak / pgAdmin login):',
-    validate: validateEmail
-  };
-  if (defaultEmail !== undefined) {
-    emailQuestion.default = defaultEmail;
-  }
-  const answers = await inquirer.prompt([
-    emailQuestion,
-    {
-      type: 'password',
-      name: 'adminPassword',
-      message: 'Admin password (Postgres / Keycloak / pgAdmin):',
-      mask: '*',
-      validate: validatePassword
-    },
-    {
-      type: 'password',
-      name: 'adminPasswordConfirm',
-      message: 'Confirm admin password:',
-      mask: '*',
-      validate(input, all) {
-        if (input !== all.adminPassword) return 'Passwords do not match';
-        return true;
-      }
-    }
-  ]);
+async function promptAdminCredentials(options = {}) {
+  const result = await promptAdminCredentialsWithProfile(options);
+  const legacyPassword =
+    result.passwordBundle.mode === 'single'
+      ? result.passwordBundle.password
+      : result.passwordBundle.platform;
   return {
-    adminEmail: String(answers.adminEmail).trim(),
-    adminPassword: answers.adminPassword
+    adminEmail: result.adminEmail,
+    adminPassword: legacyPassword,
+    passwordBundle: result.passwordBundle,
+    profile: result.profile
   };
 }
 
@@ -411,11 +355,15 @@ module.exports = {
   MODE,
   AI_KEYS,
   BUILDER_DIR_ACTION,
+  INSTALLATION_PROFILE,
   formatBuilderPlatformReplaceLines,
   promptModeSelection,
   confirmDestructiveMode,
+  promptInstallationProfile,
   promptAdminCredentials,
   promptAiTool,
   detectAiToolStatus,
-  promptBuilderDirConflict
+  promptBuilderDirConflict,
+  validateEmail,
+  validatePassword
 };

package/lib/commands/setup-run-context.js

@@ -0,0 +1,45 @@
+/**
+ * Marks when `aifabrix setup` is running platform bring-up (suppress noisy token refresh warnings).
+ *
+ * @fileoverview Setup flow context flag
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+let setupPlatformFlowActive = false;
+let setupCommandFlowActive = false;
+
+function beginSetupCommandFlow() {
+  setupCommandFlowActive = true;
+}
+
+function endSetupCommandFlow() {
+  setupCommandFlowActive = false;
+}
+
+function isSetupCommandFlow() {
+  return setupCommandFlowActive === true;
+}
+
+function beginSetupPlatformFlow() {
+  setupPlatformFlowActive = true;
+}
+
+function endSetupPlatformFlow() {
+  setupPlatformFlowActive = false;
+}
+
+function isSetupPlatformFlow() {
+  return setupPlatformFlowActive === true;
+}
+
+module.exports = {
+  beginSetupCommandFlow,
+  endSetupCommandFlow,
+  isSetupCommandFlow,
+  beginSetupPlatformFlow,
+  endSetupPlatformFlow,
+  isSetupPlatformFlow
+};

package/lib/commands/setup-spinners.js

@@ -0,0 +1,39 @@
+/**
+ * Spinner helpers for `aifabrix setup` mode handlers.
+ *
+ * @fileoverview TTY progress spinners for setup commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const ora = require('ora');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+function shouldUseSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+function startSpinner(text) {
+  if (!shouldUseSpinner()) {
+    logger.log(formatProgress(text));
+    return null;
+  }
+  return ora({ text, spinner: 'dots' }).start();
+}
+
+function stopSpinnerSuccess(spinner, text) {
+  if (!spinner) {
+    logger.log(formatSuccessLine(text));
+    return;
+  }
+  spinner.succeed(text);
+}
+
+module.exports = {
+  shouldUseSpinner,
+  startSpinner,
+  stopSpinnerSuccess
+};