@aifabrix/builder 2.45.5 → 2.47.0

package/lib/channels/channel-audit.js

@@ -0,0 +1,101 @@
+/**
+ * Structured audit logging for channel install (plan 152).
+ *
+ * @fileoverview Channel install audit events — no secrets in payloads
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+
+/**
+ * @param {string} eventName
+ * @param {Object} payload
+ */
+function emitChannelAuditEvent(eventName, payload) {
+  logger.log(
+    JSON.stringify({
+      event: eventName,
+      ...payload,
+      timestamp: new Date().toISOString()
+    })
+  );
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditArtifactGenerated(channelTarget, details) {
+  emitChannelAuditEvent('channelArtifactGenerated', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditConfigPatched(channelTarget, details) {
+  emitChannelAuditEvent('channelConfigPatched', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditCredentialCreated(channelTarget, details) {
+  emitChannelAuditEvent('channelCredentialCreated', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditCredentialUpdated(channelTarget, details) {
+  emitChannelAuditEvent('channelCredentialUpdated', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditApprovalRequired(channelTarget, details) {
+  emitChannelAuditEvent('channelApprovalRequired', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditApprovalCompleted(channelTarget, details) {
+  emitChannelAuditEvent('channelApprovalCompleted', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditValidated(channelTarget, details) {
+  emitChannelAuditEvent('channelValidated', { channelTarget, ...details });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} details
+ */
+function auditFailed(channelTarget, details) {
+  emitChannelAuditEvent('channelFailed', { channelTarget, ...details });
+}
+
+module.exports = {
+  emitChannelAuditEvent,
+  auditArtifactGenerated,
+  auditConfigPatched,
+  auditCredentialCreated,
+  auditCredentialUpdated,
+  auditApprovalRequired,
+  auditApprovalCompleted,
+  auditValidated,
+  auditFailed
+};

package/lib/channels/channel-auth-context.js

@@ -0,0 +1,37 @@
+/**
+ * Resolve controller, dataplane, and auth for channel install.
+ *
+ * @fileoverview Channel install auth context (plan 152)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { getDeploymentAuth } = require('../utils/token-manager');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
+
+/**
+ * @async
+ * @param {string} channelTarget
+ * @param {{ silent?: boolean }} [opts]
+ * @returns {Promise<{ controllerUrl: string, environment: string, dataplaneUrl: string, authConfig: Object }>}
+ */
+async function resolveChannelAuthContext(channelTarget, opts = {}) {
+  const controllerUrl = await resolveControllerUrl();
+  const environment = (await config.getEnvironment()) || 'dev';
+  const authConfig = await getDeploymentAuth(controllerUrl, environment, channelTarget);
+  if (!authConfig) {
+    throw new Error('Authentication required. Run "aifabrix login" first.');
+  }
+  const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, {
+    silent: opts.silent === true
+  });
+  return { controllerUrl, environment, dataplaneUrl, authConfig };
+}
+
+module.exports = {
+  resolveChannelAuthContext
+};

package/lib/channels/channel-credential.js

@@ -0,0 +1,200 @@
+/**
+ * Channel credential matrix and provisioning (plan 152).
+ *
+ * @fileoverview Ensure channel credentials exist; push secrets from integration env
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { listCredentials } = require('../api/credentials.api');
+const { credentialSelection } = require('../api/wizard.api');
+const { pushCredentialSecrets } = require('../utils/credential-secrets-env');
+const { getIntegrationPath } = require('../utils/paths');
+const {
+  auditCredentialCreated,
+  auditCredentialUpdated,
+  auditFailed
+} = require('./channel-audit');
+
+/** @type {Record<string, { method: string, displayName: string, credentialConfig: Object }>} */
+const CREDENTIAL_SPECS = {
+  slack: {
+    method: 'hmac',
+    credentialConfig: {
+      type: 'hmac',
+      signingSecret: 'pending-channel-install',
+      algorithm: 'sha256',
+      signatureHeader: 'X-Slack-Signature',
+      timestampHeader: 'X-Slack-Request-Timestamp',
+      signaturePrefix: 'v0=',
+      timestampMaxAge: 300
+    }
+  },
+  'teams-bot': {
+    method: 'oidc',
+    credentialConfig: {
+      type: 'oidc',
+      openIdConfigUrl: 'https://login.botframework.com/v1/.well-known/openid_configuration',
+      clientId: 'pending-channel-install',
+      validateSignature: true,
+      algorithms: ['RS256'],
+      clockSkewSeconds: 300
+    }
+  },
+  'microsoft-copilot': {
+    method: 'oauth2',
+    credentialConfig: {
+      type: 'oauth2',
+      grantType: 'client_credentials',
+      tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+      clientId: 'pending-channel-install',
+      clientSecret: 'pending-channel-install'
+    }
+  },
+  chatgpt: {
+    method: 'apiKey',
+    credentialConfig: {
+      type: 'apiKey',
+      apiKey: 'pending-channel-install',
+      headerName: 'Authorization',
+      prefix: 'Bearer'
+    }
+  },
+  'web-embed': {
+    method: 'apiKey',
+    credentialConfig: {
+      type: 'apiKey',
+      apiKey: 'pending-channel-install',
+      headerName: 'Authorization',
+      prefix: 'Bearer'
+    }
+  }
+};
+
+/**
+ * @param {Object} response
+ * @returns {Object[]}
+ */
+function extractCredentials(response) {
+  const body = response?.data ?? response;
+  const data = body?.data ?? body;
+  const items = data?.credentials ?? data?.items ?? (Array.isArray(data) ? data : []);
+  return Array.isArray(items) ? items : [];
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {typeof import('./channel-targets').CHANNEL_TARGETS[string]} target
+ * @returns {{ method: ChannelCredentialMethod, displayName: string, credentialConfig: Object }}
+ */
+function buildCredentialSpec(channelTarget, target) {
+  const base = CREDENTIAL_SPECS[channelTarget];
+  if (!base) {
+    throw new Error(`No credential spec for channel target "${channelTarget}"`);
+  }
+  return {
+    method: base.method,
+    displayName: `${target.key} assistant channel`,
+    credentialConfig: base.credentialConfig
+  };
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {string} credentialKey
+ * @returns {Promise<Object|null>}
+ */
+async function findCredentialByKey(ctx, credentialKey) {
+  const response = await listCredentials(ctx.dataplaneUrl, ctx.authConfig, { pageSize: 200 });
+  const items = extractCredentials(response);
+  return items.find((item) => item.key === credentialKey || item.credentialKey === credentialKey) || null;
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {string} channelTarget
+ * @param {Object} target
+ * @returns {Promise<Object>}
+ */
+async function createChannelCredential(ctx, channelTarget, target) {
+  const spec = buildCredentialSpec(channelTarget, target);
+  const payload = {
+    action: 'create',
+    credentialConfig: {
+      key: target.credentialKey,
+      displayName: spec.displayName,
+      description: 'Assistant channel credential (secrets via kv:// env.template)',
+      credentialConfig: spec.credentialConfig,
+      isActive: true
+    }
+  };
+  const response = await credentialSelection(ctx.dataplaneUrl, ctx.authConfig, payload);
+  auditCredentialCreated(channelTarget, { credentialKey: target.credentialKey, method: spec.method });
+  return { created: true, credentialIdOrKey: response?.data?.credentialIdOrKey || target.credentialKey };
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {string} channelTarget
+ * @returns {Promise<{ pushed: number }>}
+ */
+async function pushIntegrationSecrets(ctx, channelTarget) {
+  const integrationDir = getIntegrationPath(channelTarget);
+  const envPath = path.join(integrationDir, '.env');
+  const result = await pushCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, {
+    envFilePath: envPath,
+    appName: channelTarget,
+    quiet: true
+  });
+  return { pushed: result?.pushed ?? 0, skipped: result?.skipped === true };
+}
+
+/**
+ * Ensure channel credential record exists; optionally push secrets from integration/.env.
+ * Does not rotate secrets when force is set (plan 152 V1).
+ *
+ * @async
+ * @param {Object} params
+ * @param {Object} params.ctx
+ * @param {string} params.channelTarget
+ * @param {Object} params.target
+ * @param {boolean} [params.force]
+ * @returns {Promise<Object>}
+ */
+async function ensureChannelCredential(params) {
+  const { ctx, channelTarget, target, force = false } = params;
+  const existing = await findCredentialByKey(ctx, target.credentialKey);
+  if (existing) {
+    auditCredentialUpdated(channelTarget, {
+      credentialKey: target.credentialKey,
+      rotated: false,
+      force: force === true
+    });
+    const secretPush = await pushIntegrationSecrets(ctx, channelTarget);
+    return { existed: true, credentialKey: target.credentialKey, secretPush };
+  }
+
+  try {
+    const created = await createChannelCredential(ctx, channelTarget, target);
+    const secretPush = await pushIntegrationSecrets(ctx, channelTarget);
+    return { ...created, credentialKey: target.credentialKey, secretPush };
+  } catch (err) {
+    auditFailed(channelTarget, { phase: 'credential', error: err.message });
+    throw err;
+  }
+}
+
+module.exports = {
+  buildCredentialSpec,
+  extractCredentials,
+  findCredentialByKey,
+  createChannelCredential,
+  pushIntegrationSecrets,
+  ensureChannelCredential
+};

package/lib/channels/channel-display-name.js

@@ -0,0 +1,64 @@
+/**
+ * Environment-scoped assistant channel display names (plan 152).
+ *
+ * @fileoverview Base name (e.g. Elsa) → Elsa (dev) | Elsa (tst) | Elsa in production
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const ENV_SUFFIX_PATTERN = /\s+\((dev|tst|test|pro|prod|production)\)$/i;
+
+/**
+ * Strip a trailing environment suffix so --name can be re-run safely.
+ * @param {string} name
+ * @returns {string}
+ */
+function normalizeBaseChannelName(name) {
+  if (!name || typeof name !== 'string') {
+    throw new Error('Channel base name is required');
+  }
+  const trimmed = name.trim();
+  if (!trimmed) {
+    throw new Error('Channel base name is required');
+  }
+  return trimmed.replace(ENV_SUFFIX_PATTERN, '').trim();
+}
+
+/**
+ * @param {string} environment
+ * @returns {boolean}
+ */
+function isProductionEnvironment(environment) {
+  const env = String(environment || '').toLowerCase();
+  return env === 'pro' || env === 'prod' || env === 'production';
+}
+
+/**
+ * Resolve customer-visible channel name for the active environment.
+ * @param {string} baseName - Canonical product name (e.g. Elsa)
+ * @param {string} environment - dev | tst | pro
+ * @returns {string}
+ */
+function resolveChannelDisplayName(baseName, environment) {
+  const base = normalizeBaseChannelName(baseName);
+  const env = String(environment || 'dev').toLowerCase();
+
+  if (isProductionEnvironment(env)) {
+    return base;
+  }
+  if (env === 'dev') {
+    return `${base} (dev)`;
+  }
+  if (env === 'tst' || env === 'test') {
+    return `${base} (tst)`;
+  }
+  return `${base} (${env})`;
+}
+
+module.exports = {
+  normalizeBaseChannelName,
+  isProductionEnvironment,
+  resolveChannelDisplayName
+};

package/lib/channels/channel-external-system.js

@@ -0,0 +1,106 @@
+/**
+ * External system channel config helpers (plan 152).
+ *
+ * @fileoverview Patch config.extensions.channel on deployed communication systems
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getExternalSystem, updateExternalSystem } = require('../api/external-systems.api');
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
+
+/**
+ * @param {Object|null} system
+ * @returns {Object|null}
+ */
+function getExistingChannelExtension(system) {
+  if (!system || typeof system !== 'object') return null;
+  const channel = system.config?.extensions?.channel;
+  return channel && typeof channel === 'object' ? channel : null;
+}
+
+/**
+ * @param {Object} params
+ * @param {typeof import('./channel-targets').CHANNEL_TARGETS[string]} target
+ * @param {string} params.name
+ * @param {string} params.baseName
+ * @param {string} params.description
+ * @param {string} params.artifactHash
+ * @param {string} params.status
+ * @returns {Object}
+ */
+function buildChannelExtensionBlock(params, target) {
+  return {
+    type: target.channelType,
+    name: params.name,
+    baseName: params.baseName,
+    description: params.description,
+    capabilities: [...target.capabilities],
+    status: params.status,
+    artifactHash: params.artifactHash,
+    credentialKey: target.credentialKey
+  };
+}
+
+/**
+ * @param {Object} system
+ * @param {Object} channelBlock
+ * @returns {Object}
+ */
+function mergeChannelIntoSystem(system, channelBlock) {
+  const config = system.config && typeof system.config === 'object' ? { ...system.config } : {};
+  const extensions =
+    config.extensions && typeof config.extensions === 'object' ? { ...config.extensions } : {};
+  extensions.channel = channelBlock;
+  config.extensions = extensions;
+  return { ...system, config, displayName: channelBlock.name };
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {string} ctx.dataplaneUrl
+ * @param {Object} ctx.authConfig
+ * @param {string} ctx.channelTarget
+ * @returns {Promise<Object>}
+ */
+async function fetchCommunicationSystem(ctx) {
+  const res = await getExternalSystem(ctx.dataplaneUrl, ctx.channelTarget, ctx.authConfig);
+  const system = unwrapApiData(res);
+  if (!system || typeof system !== 'object') {
+    throw new Error(
+      `Communication external system "${ctx.channelTarget}" was not found. ` +
+        `Run: aifabrix deploy ${ctx.channelTarget}`
+    );
+  }
+  const kind = system.systemKind || system.systemKindKey;
+  if (kind && kind !== 'communication') {
+    throw new Error(
+      `External system "${ctx.channelTarget}" is not systemKind communication (found: ${kind}).`
+    );
+  }
+  return system;
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {Object} channelBlock
+ * @returns {Promise<Object>}
+ */
+async function patchChannelExtension(ctx, channelBlock) {
+  const system = await fetchCommunicationSystem(ctx);
+  const merged = mergeChannelIntoSystem(system, channelBlock);
+  const res = await updateExternalSystem(ctx.dataplaneUrl, ctx.channelTarget, ctx.authConfig, merged);
+  return unwrapApiData(res) || merged;
+}
+
+module.exports = {
+  getExistingChannelExtension,
+  buildChannelExtensionBlock,
+  mergeChannelIntoSystem,
+  fetchCommunicationSystem,
+  patchChannelExtension
+};