@aifabrix/builder 2.49.1 → 2.50.0

package/lib/commands/repair-datasource-operation-security.js

@@ -0,0 +1,180 @@
+/**
+ * Bind openapi.operations.*.security from rbac permissions for COM publish.
+ *
+ * @fileoverview repair-datasource-operation-security
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
+const { resolveRbacPath } = require('../utils/app-config-resolver');
+
+/**
+ * @param {Object} rbac
+ * @returns {Map<string, string[]>}
+ */
+function permissionRoleIndex(rbac) {
+  const index = new Map();
+  const perms = rbac && Array.isArray(rbac.permissions) ? rbac.permissions : [];
+  for (const perm of perms) {
+    if (!perm || typeof perm !== 'object') continue;
+    const name = typeof perm.name === 'string' ? perm.name.trim() : '';
+    if (!name) continue;
+    const roles = Array.isArray(perm.roles)
+      ? perm.roles.filter((r) => typeof r === 'string' && r.trim())
+      : [];
+    if (roles.length) index.set(name, roles);
+  }
+  return index;
+}
+
+/**
+ * @param {Map<string, string[]>} permIndex
+ * @param {string} resourceType
+ * @param {string} opKey
+ * @returns {Object[]|null}
+ */
+function expectedSecurityForOperation(permIndex, resourceType, opKey) {
+  const permName = `${resourceType}:${opKey}`;
+  const roles = permIndex.get(permName) || permIndex.get(permName.toLowerCase());
+  if (!roles || roles.length === 0) {
+    return null;
+  }
+  return roles.map((role) => ({ oauth2: [role] }));
+}
+
+/**
+ * @param {Object} opCfg
+ * @param {Object[]} expectedSecurity
+ * @returns {boolean}
+ */
+function applyOperationSecurity(opCfg, expectedSecurity) {
+  if (JSON.stringify(opCfg.security) === JSON.stringify(expectedSecurity)) {
+    return false;
+  }
+  opCfg.security = expectedSecurity;
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {{ ops: Object, resourceType: string }|null}
+ */
+function openApiOpsForSecurityBind(parsed) {
+  const openapi = parsed && parsed.openapi;
+  if (!openapi || typeof openapi !== 'object' || openapi.autoRbac !== true) {
+    return null;
+  }
+  const ops = openapi.operations;
+  if (!ops || typeof ops !== 'object' || Array.isArray(ops)) {
+    return null;
+  }
+  const resourceType = (typeof parsed.resourceType === 'string' && parsed.resourceType.trim()) || 'document';
+  return { ops, resourceType };
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Map<string, string[]>} permIndex
+ * @param {string[]} changes
+ * @param {string} fileName
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasource(parsed, permIndex, changes, fileName) {
+  const bindCtx = openApiOpsForSecurityBind(parsed);
+  if (!bindCtx) {
+    return false;
+  }
+  const { ops, resourceType } = bindCtx;
+  let updated = false;
+  for (const [opKey, opCfg] of Object.entries(ops)) {
+    if (!opCfg || typeof opCfg !== 'object') {
+      continue;
+    }
+    const expectedSecurity = expectedSecurityForOperation(permIndex, resourceType, opKey);
+    if (!expectedSecurity) {
+      continue;
+    }
+    updated = applyOperationSecurity(opCfg, expectedSecurity) || updated;
+  }
+  if (updated) {
+    changes.push(`${fileName}: Bound openapi.operations.*.security from rbac permissions`);
+  }
+  return updated;
+}
+
+/**
+ * @param {string} appPath
+ * @returns {Map<string, string[]>|null}
+ */
+function loadRbacPermissionIndex(appPath) {
+  const rbacPath = resolveRbacPath(appPath);
+  if (!rbacPath || !fs.existsSync(rbacPath)) {
+    return null;
+  }
+  try {
+    return permissionRoleIndex(loadConfigFile(rbacPath));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object} opts
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasourceFile(opts) {
+  const { appPath, fileName, permIndex, dryRun, changes, backupCtx } = opts;
+  const filePath = path.join(appPath, fileName);
+  if (!fs.existsSync(filePath)) {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = loadConfigFile(filePath);
+  } catch {
+    return false;
+  }
+  const fileUpdated = bindSecurityOnDatasource(parsed, permIndex, changes, fileName);
+  if (!fileUpdated || dryRun) {
+    return fileUpdated;
+  }
+  backupIntegrationFile(filePath, backupCtx);
+  writeConfigFile(filePath, parsed);
+  trackRepairWrite(filePath, backupCtx);
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {boolean} dryRun
+ * @param {string[]} changes
+ * @param {Object} backupCtx
+ * @returns {boolean}
+ */
+function bindOpenApiOperationSecurityFromRbac(appPath, datasourceFiles, dryRun, changes, backupCtx) {
+  const permIndex = loadRbacPermissionIndex(appPath);
+  if (!permIndex || permIndex.size === 0) {
+    return false;
+  }
+
+  let anyUpdated = false;
+  for (const fileName of datasourceFiles || []) {
+    anyUpdated =
+      bindSecurityOnDatasourceFile({ appPath, fileName, permIndex, dryRun, changes, backupCtx }) ||
+      anyUpdated;
+  }
+  return anyUpdated;
+}
+
+module.exports = {
+  bindOpenApiOperationSecurityFromRbac,
+  permissionRoleIndex
+};

package/lib/commands/repair-datasource-run.js

@@ -23,11 +23,13 @@ const { repairDatasourceFile } = require('./repair-datasource');
  * @param {Object} options
  * @param {boolean} dryRun
  * @param {string[]} changes
+ * @param {Object} [context]
  * @returns {boolean}
  */
-function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes) {
+function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes, context = {}) {
   if (!datasourceFiles || datasourceFiles.length === 0) return false;
   let updated = false;
+  const warnings = Array.isArray(context.warnings) ? context.warnings : [];
   for (const fileName of datasourceFiles) {
     const filePath = path.join(appPath, fileName);
     if (!fs.existsSync(filePath)) continue;
@@ -36,7 +38,10 @@ function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes
       const { updated: fileUpdated, changes: fileChanges } = repairDatasourceFile(parsed, {
         expose: options.expose,
         sync: options.sync,
-        test: options.test
+        test: options.test,
+        operations: options.operations,
+        systemParsed: context.systemParsed,
+        warnings
       });
       if (fileUpdated) {
         updated = true;

package/lib/commands/repair-datasource-sync-operations.js

@@ -0,0 +1,177 @@
+/**
+ * Sync capabilities[] → openapi.operations → execution.cip.operations (plan 154.7).
+ *
+ * @fileoverview repair-datasource-sync-operations
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { listCapabilityKeys } = require('../datasource/capability/capability-manifest');
+
+const MANIFEST_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isManifestOperationKey(key) {
+  return typeof key === 'string' && MANIFEST_KEY_PATTERN.test(key.trim());
+}
+
+/**
+ * @param {unknown} capabilities
+ * @returns {string[]}
+ */
+function capabilityKeysFromManifest(capabilities) {
+  return listCapabilityKeys(capabilities).filter(isManifestOperationKey);
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @returns {Object|undefined}
+ */
+function openapiOperationEntry(parsed, key) {
+  const ops = parsed?.openapi?.operations;
+  if (!ops || typeof ops !== 'object') {
+    return undefined;
+  }
+  const entry = ops[key];
+  return entry && typeof entry === 'object' ? entry : undefined;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @returns {Object|undefined}
+ */
+function cipOperationEntry(parsed, key) {
+  const ops = parsed?.execution?.cip?.operations;
+  if (!ops || typeof ops !== 'object') {
+    return undefined;
+  }
+  const entry = ops[key];
+  return entry && typeof entry === 'object' ? entry : undefined;
+}
+
+/**
+ * @param {string} key
+ * @param {Object|undefined} openapiEntry
+ * @returns {Object}
+ */
+function buildOpenapiOperationStub(key, openapiEntry) {
+  if (openapiEntry && typeof openapiEntry.operationId === 'string' && openapiEntry.operationId.trim()) {
+    return { operationId: openapiEntry.operationId.trim() };
+  }
+  return { operationId: key };
+}
+
+/**
+ * @param {string} key
+ * @param {Object|undefined} openapiEntry
+ * @returns {Object}
+ */
+function buildCipOperationStub(key, openapiEntry) {
+  const description =
+    (openapiEntry && typeof openapiEntry.summary === 'string' && openapiEntry.summary.trim()) ||
+    `Execute ${key} via OpenAPI passthrough`;
+  return {
+    enabled: true,
+    description,
+    steps: [
+      {
+        fetch: {
+          source: 'openapi',
+          openapiRef: key,
+          query: {}
+        }
+      },
+      { output: { mode: 'records' } }
+    ]
+  };
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {void}
+ */
+function ensureSyncOperationScaffold(parsed) {
+  if (!parsed.openapi || typeof parsed.openapi !== 'object') {
+    parsed.openapi = {};
+  }
+  if (!parsed.openapi.operations || typeof parsed.openapi.operations !== 'object') {
+    parsed.openapi.operations = {};
+  }
+  if (!parsed.execution || typeof parsed.execution !== 'object') {
+    parsed.execution = { engine: 'cip' };
+  }
+  if (!parsed.execution.cip || typeof parsed.execution.cip !== 'object') {
+    parsed.execution.cip = { operations: {} };
+  }
+  if (!parsed.execution.cip.operations || typeof parsed.execution.cip.operations !== 'object') {
+    parsed.execution.cip.operations = {};
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function syncCapabilityOperationKey(parsed, key, changes) {
+  let updated = false;
+  const openapiEntry = openapiOperationEntry(parsed, key);
+  if (!openapiEntry) {
+    parsed.openapi.operations[key] = buildOpenapiOperationStub(key, openapiEntry);
+    changes.push(`Added openapi.operations.${key}`);
+    updated = true;
+  } else if (!openapiEntry.operationId) {
+    parsed.openapi.operations[key] = buildOpenapiOperationStub(key, openapiEntry);
+    changes.push(`Set openapi.operations.${key}.operationId`);
+    updated = true;
+  }
+
+  if (!cipOperationEntry(parsed, key)) {
+    parsed.execution.cip.operations[key] = buildCipOperationStub(key, parsed.openapi.operations[key]);
+    changes.push(`Added execution.cip.operations.${key}`);
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * Ensure openapi.operations and execution.cip.operations mirror capabilities[] keys.
+ *
+ * @param {Object} parsed - Parsed datasource (mutated)
+ * @param {string[]} changes - Change log
+ * @returns {boolean}
+ */
+function repairSyncOperationsFromCapabilities(parsed, changes) {
+  const keys = capabilityKeysFromManifest(parsed?.capabilities);
+  if (keys.length === 0) {
+    return false;
+  }
+
+  ensureSyncOperationScaffold(parsed);
+
+  let updated = false;
+  for (const key of keys) {
+    updated = syncCapabilityOperationKey(parsed, key, changes) || updated;
+  }
+
+  if (updated && parsed.openapi.enabled !== true) {
+    parsed.openapi.enabled = true;
+    changes.push('Set openapi.enabled=true (capabilities synced)');
+  }
+
+  return updated;
+}
+
+module.exports = {
+  repairSyncOperationsFromCapabilities,
+  capabilityKeysFromManifest,
+  isManifestOperationKey
+};

package/lib/commands/repair-datasource-webhooks-sync-bridge.js

@@ -0,0 +1,133 @@
+/**
+ * Datasource repair helpers for webhook and syncBridge manifest sections.
+ *
+ * @fileoverview Align webhook defaults and syncBridge metadata warnings (454.11)
+ */
+
+'use strict';
+
+const AUTH_USAGE_WEBHOOK_INBOUND = 'webhookInbound';
+
+/**
+ * @param {object|null|undefined} systemParsed
+ * @returns {boolean}
+ */
+function systemHasWebhookInboundAuth(systemParsed) {
+  if (!systemParsed || typeof systemParsed !== 'object') {
+    return false;
+  }
+  const rows = systemParsed.authentications;
+  if (Array.isArray(rows)) {
+    return rows.some((row) => row && row.usage === AUTH_USAGE_WEBHOOK_INBOUND);
+  }
+  return false;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @param {string[]} warnings
+ * @returns {boolean}
+ */
+function repairWebhookSection(parsed, changes, warnings) {
+  if (!parsed?.webhook || typeof parsed.webhook !== 'object') {
+    return false;
+  }
+  const webhook = parsed.webhook;
+  let updated = false;
+
+  if (webhook.enabled === true) {
+    if (!webhook.idPath || !String(webhook.idPath).trim()) {
+      warnings.push(
+        'webhook.enabled is true but idPath is missing — set idPath (for example $.objectId) before upload.'
+      );
+    }
+    if (!Array.isArray(webhook.events) || webhook.events.length === 0) {
+      warnings.push('webhook.enabled is true but events[] is empty — add vendor event names.');
+    }
+  }
+
+  if (webhook.enabled === true && !webhook.endpointMode) {
+    webhook.endpointMode = 'datasource';
+    changes.push('Set webhook.endpointMode default datasource');
+    updated = true;
+  }
+
+  return updated;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @param {string[]} warnings
+ * @returns {boolean}
+ */
+function ensureSyncBridgeExternalIdMetadata(parsed, changes) {
+  const mode = parsed?.syncBridge || 'disabled';
+  if (mode === 'disabled') {
+    return false;
+  }
+  if (!parsed.metadataSchema || typeof parsed.metadataSchema !== 'object') {
+    parsed.metadataSchema = { type: 'object', additionalProperties: true, properties: {} };
+  }
+  if (!parsed.metadataSchema.properties || typeof parsed.metadataSchema.properties !== 'object') {
+    parsed.metadataSchema.properties = {};
+  }
+  const ext = parsed.metadataSchema.properties.externalId;
+  const ok =
+    ext && typeof ext === 'object' && ext.type === 'string' && ext.index === true;
+  if (ok) {
+    return false;
+  }
+  parsed.metadataSchema.properties.externalId = {
+    ...(typeof ext === 'object' && ext !== null ? ext : {}),
+    type: 'string',
+    index: true
+  };
+  changes.push('Ensured metadataSchema.properties.externalId for syncBridge participation');
+  return true;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @param {string[]} warnings
+ * @returns {boolean}
+ */
+function repairSyncBridgeSection(parsed, changes, warnings) {
+  const mode = parsed?.syncBridge || 'disabled';
+  if (mode === 'disabled') {
+    return false;
+  }
+  if (mode === 'master' && !parsed.resourceType) {
+    warnings.push('syncBridge=master requires resourceType for propagation grouping.');
+  }
+  return ensureSyncBridgeExternalIdMetadata(parsed, changes);
+}
+
+/**
+ * @param {object} parsed
+ * @param {object|null|undefined} systemParsed
+ * @param {string[]} warnings
+ * @returns {void}
+ */
+function collectWebhookSyncBridgeSystemWarnings(parsed, systemParsed, warnings) {
+  if (!parsed?.webhook?.enabled) {
+    return;
+  }
+  if (systemHasWebhookInboundAuth(systemParsed)) {
+    return;
+  }
+  const dsKey = parsed.key || parsed.datasourceKey || 'datasource';
+  warnings.push(
+    `${dsKey}: webhook.enabled but system lacks authentications[usage=webhookInbound]. ` +
+      'Run: aifabrix repair <systemKey> --auth-webhook'
+  );
+}
+
+module.exports = {
+  repairWebhookSection,
+  repairSyncBridgeSection,
+  collectWebhookSyncBridgeSystemWarnings,
+  systemHasWebhookInboundAuth
+};

package/lib/commands/repair-datasource.js

@@ -10,9 +10,7 @@
 'use strict';
 
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
-const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
 const { repairTestPayload } = require('./repair-datasource-test-payload');
-const { repairComV2Manifest } = require('./repair-datasource-com-v2');
 const {
   isDeprecatedNoneLlmManifest,
   repairNoneLlmToServiceContract,
@@ -386,80 +384,26 @@ function sanitizeTestPayloadTopLevel(parsed, changes) {
   return true;
 }
 
-/**
- * @param {Object} parsed
- * @param {Object} options
- * @returns {boolean}
- */
-function shouldApplyServiceContractRepair(parsed, options) {
-  return (
-    isDeprecatedNoneLlmManifest(parsed) ||
-    (options.serviceContract && parsed?.resourceType === 'llm')
-  );
-}
-
-/**
- * @param {Object} parsed
- * @param {Object} options
- * @param {boolean} none
- * @param {string[]} changes
- * @returns {boolean}
- */
-function applyOptionalDatasourceRepairs(parsed, options, none, changes) {
-  let updated = false;
-  if (options.expose) {
-    updated = repairExposeFromAttributes(parsed, changes) || updated;
-  }
-  if (!none && options.sync) {
-    updated = repairSyncSection(parsed, changes) || updated;
-  }
-  if (options.test) {
-    sanitizeTestPayloadTopLevel(parsed, changes);
-    updated = repairTestPayload(parsed, changes) || updated;
-    updated = sanitizeTestPayloadTopLevel(parsed, changes) || updated;
-  }
-  return updated;
-}
-
 /**
  * Runs all requested datasource repairs.
  *
  * @param {Object} parsed - Parsed datasource object (mutated)
- * @param {Object} options - { expose?: boolean, sync?: boolean, test?: boolean }
+ * @param {Object} options - { expose?: boolean, sync?: boolean, test?: boolean, operations?: boolean }
  * @param {string[]} [changes] - Optional array to append change descriptions to
  * @returns {{ updated: boolean, changes: string[] }}
  */
 function repairDatasourceFile(parsed, options = {}, changes = []) {
-  const out = Array.isArray(changes) ? changes : [];
-  let updated = stripDeprecatedServiceCategory(parsed, out);
-
-  if (shouldApplyServiceContractRepair(parsed, options)) {
-    updated = repairNoneLlmToServiceContract(parsed, out) || updated;
-  }
-
-  const none = isNoneEntityType(parsed?.entityType);
-
-  updated = applyBaseDatasourceRepairs(parsed, none, out) || updated;
-  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
-  updated = applyOptionalDatasourceRepairs(parsed, options, none, out) || updated;
-
-  return { updated, changes: out };
-}
-
-function applyBaseDatasourceRepairs(parsed, none, changes) {
-  let updated = repairComV2Manifest(parsed, changes);
-  if (none) return updated;
-  updated = repairDimensionBindingShape(parsed, changes) || updated;
-  updated = repairRootDimensionsFromAttributes(parsed, changes) || updated;
-  updated = repairMetadataSchemaFromAttributes(parsed, changes) || updated;
-  return updated;
-}
-
-function applyOpenapiDatasourceRepairs(parsed, changes) {
-  let updated = false;
-  updated = repairOpenapiSection(parsed, changes) || updated;
-  updated = normalizeAutoRbacOperationKeys(parsed, changes) || updated;
-  return updated;
+  const { runRepairDatasourceFile } = require('./repair-datasource-apply');
+  return runRepairDatasourceFile(parsed, options, changes, {
+    stripDeprecatedServiceCategory,
+    isNoneEntityType,
+    repairDimensionBindingShape,
+    repairRootDimensionsFromAttributes,
+    repairMetadataSchemaFromAttributes,
+    repairExposeFromAttributes,
+    repairSyncSection,
+    sanitizeTestPayloadTopLevel
+  });
 }
 
 module.exports = {

package/lib/commands/repair-env-template.js

@@ -15,6 +15,10 @@ const { systemKeyToKvPrefix, kvEnvKeyToPath, securityKeyToVar } = require('../ut
 const { extractEnvTemplate } = require('../generator/split');
 const { generateExternalEnvTemplateContent } = require('../utils/external-env-template');
 const { commentOrphanKvEnvLines } = require('../utils/env-kv-orphan-lines');
+const {
+  addFromAuthenticationsArray,
+  normalizeAuthenticationsSecurity
+} = require('../utils/authentication-env-template');
 
 /**
  * Normalizes a keyvault config entry to canonical KV_* name and path-style value.
@@ -114,7 +118,12 @@ function buildEffectiveConfiguration(systemParsed, systemKey) {
   const seenNames = new Set();
   const config = Array.isArray(systemParsed.configuration) ? systemParsed.configuration : [];
   addFromConfiguration(effective, config, prefix, seenNames, systemKey);
-  addFromAuthSecurity(effective, systemParsed, prefix, seenNames, systemKey);
+  addFromAuthenticationsArray(effective, systemParsed, prefix, seenNames, systemKey);
+  const hasAuthSlots =
+    Array.isArray(systemParsed.authentications) && systemParsed.authentications.length > 0;
+  if (!hasAuthSlots) {
+    addFromAuthSecurity(effective, systemParsed, prefix, seenNames, systemKey);
+  }
   return effective;
 }
 
@@ -394,6 +403,7 @@ function normalizeSystemFileAuthAndConfig(systemParsed, systemKey, changes) {
   const credential = getAuthCredentialTemplate(systemParsed.authentication);
   const security = credential?.security ?? systemParsed.authentication?.security;
   let updated = (security && typeof security === 'object' && normalizeSecuritySection(security, prefix, systemKey, changes));
+  updated = normalizeAuthenticationsSecurity(systemParsed, systemKey, changes) || updated;
   const config = systemParsed.configuration;
   if (Array.isArray(config)) {
     updated = normalizeConfigurationSection(config, prefix, systemKey, changes) || updated;