@aifabrix/builder 2.45.5 → 2.47.0

package/lib/utils/controller-url.js

@@ -12,6 +12,7 @@
 const { getDeveloperIdNumber } = require('./env-map');
 const devConfig = require('./dev-config');
 const config = require('../core/config');
+const { getDeviceToken, isTokenExpired } = require('./token-manager');
 
 /**
  * Calculate default controller URL based on developer ID
@@ -40,7 +41,6 @@ function normalizeUrl(url) {
   }
   return url.trim().replace(/\/+$/, '');
 }
-
 /**
  * True when `config.yaml` has a non-expired-looking device entry for this controller URL
  * (normalized host/path comparison).
@@ -68,6 +68,90 @@ async function hasStoredDeviceTokenForController(controllerUrl) {
   }
 }
 
+/**
+ * True when a stored, non-expired device token exists (local config only — no refresh HTTP).
+ * Setup uses this to decide whether to skip the device-login step; avoids refresh warnings
+ * when the controller is not up yet or `device:` is empty.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<boolean>}
+ */
+async function isDeviceTokenUsableForController(controllerUrl) {
+  if (!(await hasStoredDeviceTokenForController(controllerUrl))) {
+    return false;
+  }
+  const want = normalizeUrl(controllerUrl);
+  try {
+    const tokenInfo = await getDeviceToken(want);
+    return Boolean(tokenInfo && tokenInfo.token && !isTokenExpired(tokenInfo.expiresAt));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when a stored device token can be refreshed (if needed) and validated against the controller API.
+ * Prefer this after the controller is reachable (guided platform auth step). Falls back to local expiry-only
+ * check when the controller is not reachable yet.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<boolean>}
+ */
+async function isPlatformAuthValidForController(controllerUrl) {
+  if (!(await hasStoredDeviceTokenForController(controllerUrl))) {
+    return false;
+  }
+  const want = normalizeUrl(controllerUrl);
+
+  if (!(await isControllerHealthReachable(want))) {
+    return isDeviceTokenUsableForController(controllerUrl);
+  }
+
+  const { getOrRefreshDeviceToken } = require('./token-manager');
+  const { getAuthUser } = require('../api/auth.api');
+
+  let tokenResult = null;
+  try {
+    tokenResult = await getOrRefreshDeviceToken(want);
+  } catch {
+    tokenResult = null;
+  }
+
+  if (!tokenResult || !tokenResult.token) {
+    return false;
+  }
+
+  try {
+    const response = await getAuthUser(want, { type: 'bearer', token: tokenResult.token });
+    return Boolean(response.success && response.data && response.data.authenticated !== false);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Best-effort GET /health on the controller (no auth). Used to avoid token refresh HTTP
+ * during setup before Miso Controller is running.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<boolean>}
+ */
+async function isControllerHealthReachable(controllerUrl) {
+  const base = normalizeUrl(controllerUrl);
+  if (!base) {
+    return false;
+  }
+  try {
+    const res = await fetch(`${base}/health`, { signal: AbortSignal.timeout(2500) });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Get controller URL from logged-in user's device tokens.
  * Prefers the entry under {@link config.controller} when it matches a `device` key; otherwise a
@@ -152,6 +236,9 @@ async function resolveControllerUrl() {
 module.exports = {
   getDefaultControllerUrl,
   hasStoredDeviceTokenForController,
+  isDeviceTokenUsableForController,
+  isPlatformAuthValidForController,
+  isControllerHealthReachable,
   getControllerUrlFromLoggedInUser,
   getControllerFromConfig,
   resolveControllerUrl

package/lib/utils/credential-secrets-env-kv.js

@@ -0,0 +1,216 @@
+/**
+ * KV_* env key ↔ kv:// path mapping and payload reference scanning.
+ *
+ * @fileoverview KV path helpers for credential-secrets-env
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const KV_PREFIX = 'KV_';
+const KV_REF_PATTERN = /kv:\/\/([a-zA-Z0-9_\-/]+)/g;
+
+/**
+ * Converts systemKey to KV_* prefix (e.g. hubspot -> HUBSPOT, my-hubspot -> MY_HUBSPOT).
+ * @param {string} systemKey - System key
+ * @returns {string}
+ */
+function systemKeyToKvPrefix(systemKey) {
+  if (!systemKey || typeof systemKey !== 'string') return '';
+  return systemKey.replace(/-/g, '_').toUpperCase();
+}
+
+/**
+ * Maps authentication security key (camelCase) to env VAR (UPPERCASE, no underscores).
+ * @param {string} securityKey - Security key (e.g. 'clientId', 'clientSecret')
+ * @returns {string}
+ */
+function securityKeyToVar(securityKey) {
+  if (!securityKey || typeof securityKey !== 'string') return '';
+  return securityKey.replace(/_/g, '').toUpperCase();
+}
+
+/** Known single-segment variable suffixes (uppercase) for inferring var vs namespace in env keys */
+const VAR_SUFFIXES = new Set(['ID', 'SECRET', 'KEY', 'TOKEN', 'URL', 'USERNAME', 'PASSWORD']);
+
+/**
+ * Converts var segment(s) from env key to path-style camelCase.
+ * @param {string[]} varSegments - One or two segments (e.g. ['CLIENT', 'ID'], ['CLIENTID'])
+ * @returns {string}
+ */
+function varSegmentsToCamelCase(varSegments) {
+  if (!varSegments || varSegments.length === 0) return '';
+  if (varSegments.length === 1) {
+    const s = varSegments[0].toLowerCase();
+    if (s.endsWith('id') && s.length > 2) return s.slice(0, -2) + 'Id';
+    if (s.endsWith('secret') && s.length > 6) return s.slice(0, -6) + 'Secret';
+    if (s.endsWith('key') && s.length > 3) return s.slice(0, -3) + 'Key';
+    if (s.endsWith('token') && s.length > 5) return s.slice(0, -5) + 'Token';
+    if (s.endsWith('url') && s.length > 3) return s.slice(0, -3) + 'Url';
+    return s;
+  }
+  return varSegments.map((seg, i) => {
+    const lower = seg.toLowerCase();
+    return i === 0 ? lower : lower.charAt(0).toUpperCase() + lower.slice(1);
+  }).join('');
+}
+
+/**
+ * @param {string[]} segments - Parsed segments after KV_ prefix
+ * @param {string} systemKey - System key (e.g. 'microsoft-teams')
+ * @returns {string|null}
+ */
+function kvPathWithSystemKey(segments, systemKey) {
+  const prefixInKey = systemKey.replace(/-/g, '_').toUpperCase();
+  const prefixSegs = prefixInKey.split('_').filter(Boolean);
+  if (segments.length <= prefixSegs.length) return null;
+  const prefixMatch = prefixSegs.every((p, i) => segments[i] === p);
+  if (!prefixMatch) return null;
+  const varSegments = segments.slice(prefixSegs.length);
+  const pathVar = varSegmentsToCamelCase(varSegments);
+  return pathVar ? `kv://${systemKey}/${pathVar}` : null;
+}
+
+/**
+ * @param {string[]} segments - Parsed segments after KV_ prefix
+ * @returns {string|null}
+ */
+function kvPathInferred(segments) {
+  if (segments.length === 1) return `kv://${segments[0].toLowerCase()}`;
+  const varSegmentCount = (segments.length >= 2 && VAR_SUFFIXES.has(segments[segments.length - 1])) ? 2 : 1;
+  const namespace = segments.slice(0, -varSegmentCount).map(s => s.toLowerCase()).join('-');
+  const varSegments = segments.slice(-varSegmentCount);
+  const pathVar = varSegmentsToCamelCase(varSegments);
+  return (namespace && pathVar) ? `kv://${namespace}/${pathVar}` : null;
+}
+
+/**
+ * @param {string} securityKey - Security key (e.g. 'apiKey', 'clientId')
+ * @returns {string}
+ */
+function getKvPathSegmentForSecurityKey(securityKey) {
+  if (!securityKey || typeof securityKey !== 'string') return '';
+  return varSegmentsToCamelCase([securityKeyToVar(securityKey)]);
+}
+
+/**
+ * @param {string} envKey - Env var name (e.g. KV_MICROSOFT_TEAMS_CLIENT_ID)
+ * @param {string} [systemKey] - Optional system key
+ * @returns {string|null}
+ */
+function kvEnvKeyToPath(envKey, systemKey) {
+  if (!envKey || typeof envKey !== 'string' || !envKey.toUpperCase().startsWith(KV_PREFIX)) return null;
+  const rest = envKey.slice(KV_PREFIX.length).trim();
+  if (!rest) return null;
+  const segments = rest.split('_').filter(Boolean);
+  if (segments.length === 0) return null;
+
+  const hasSystemKey = typeof systemKey === 'string' && systemKey.length > 0;
+  if (hasSystemKey) return kvPathWithSystemKey(segments, systemKey);
+  return kvPathInferred(segments);
+}
+
+/**
+ * @param {Object.<string, string>} envMap - Key-value map from .env
+ * @param {string} [systemKey]
+ * @returns {Array<{ key: string, value: string }>}
+ */
+function collectKvEnvVarsAsSecretItems(envMap, systemKey) {
+  if (!envMap || typeof envMap !== 'object') {
+    return [];
+  }
+  const items = [];
+  for (const [envKey, rawValue] of Object.entries(envMap)) {
+    const value = typeof rawValue === 'string' ? rawValue.trim() : '';
+    if (value === '') continue;
+    let kvPath = null;
+    if (value.startsWith('kv://') && isValidKvPath(value)) {
+      kvPath = value;
+    }
+    if (!kvPath) kvPath = kvEnvKeyToPath(envKey, systemKey) || kvEnvKeyToPath(envKey);
+    if (!kvPath) continue;
+    items.push({ key: kvPath, value });
+  }
+  return items;
+}
+
+/**
+ * @param {Object} secrets - Loaded secrets object
+ * @param {string} value - Value (may be "kv://..." or plain)
+ * @returns {string|null}
+ */
+function resolveKvValue(secrets, value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('kv://')) {
+    return trimmed;
+  }
+  const pathMatch = trimmed.match(/^kv:\/\/([a-zA-Z0-9_\-/]+)$/);
+  if (!pathMatch) return null;
+  const pathKey = pathMatch[1];
+  const resolved = secrets[pathKey];
+  if (resolved === undefined) return null;
+  return typeof resolved === 'string' ? resolved : String(resolved);
+}
+
+/**
+ * @param {Object|Array|string|number|boolean|null} obj
+ * @param {Set<string>} [acc]
+ * @returns {string[]}
+ */
+function collectKvRefsFromPayload(obj, acc = new Set()) {
+  if (obj === null || obj === undefined) {
+    return Array.from(acc);
+  }
+  if (typeof obj === 'string') {
+    let m;
+    KV_REF_PATTERN.lastIndex = 0;
+    while ((m = KV_REF_PATTERN.exec(obj)) !== null) {
+      acc.add(`kv://${m[1]}`);
+    }
+    return Array.from(acc);
+  }
+  if (Array.isArray(obj)) {
+    for (const item of obj) {
+      collectKvRefsFromPayload(item, acc);
+    }
+    return Array.from(acc);
+  }
+  if (typeof obj === 'object') {
+    for (const v of Object.values(obj)) {
+      collectKvRefsFromPayload(v, acc);
+    }
+    return Array.from(acc);
+  }
+  return Array.from(acc);
+}
+
+/**
+ * @param {string} key - kv:// path
+ * @returns {boolean}
+ */
+function isValidKvPath(key) {
+  return typeof key === 'string' && /^kv:\/\/[a-z0-9][a-z0-9\-/]*$/i.test(key.trim());
+}
+
+/**
+ * @param {unknown} resolved
+ * @returns {boolean}
+ */
+function isNonEmptySecretValue(resolved) {
+  if (resolved === null || resolved === undefined) {
+    return false;
+  }
+  return String(resolved).trim() !== '';
+}
+
+module.exports = {
+  collectKvEnvVarsAsSecretItems,
+  collectKvRefsFromPayload,
+  getKvPathSegmentForSecurityKey,
+  isNonEmptySecretValue,
+  isValidKvPath,
+  kvEnvKeyToPath,
+  resolveKvValue,
+  securityKeyToVar,
+  systemKeyToKvPrefix
+};