@aifabrix/builder 2.49.2 → 2.50.0

package/lib/commands/repair-datasource-http-service-contract.js

@@ -0,0 +1,239 @@
+/**
+ * Migrate deprecated entityType none + vendor OpenAPI HTTP manifests to serviceContract (439.2).
+ *
+ * @fileoverview repair-datasource-http-service-contract
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const HTTP_CANONICAL_METADATA_SCHEMA = {
+  type: 'object',
+  properties: {
+    successPayload: {
+      type: 'object',
+      nullable: true,
+      description: 'Normalized success body from upstream HTTP response'
+    },
+    successMessage: {
+      type: 'string',
+      nullable: true,
+      description: 'Human-readable success message when present'
+    },
+    errorCode: {
+      type: 'string',
+      nullable: true,
+      description: 'Provider error code when the operation fails'
+    },
+    errorMessage: {
+      type: 'string',
+      nullable: true,
+      description: 'Human-readable provider error message'
+    }
+  }
+};
+
+const HTTP_CANONICAL_EXPOSED_SCHEMA = {
+  success: {
+    payload: 'metadata.successPayload',
+    message: 'metadata.successMessage'
+  },
+  error: {
+    code: 'metadata.errorCode',
+    message: 'metadata.errorMessage'
+  }
+};
+
+const HTTP_STUB_FIELD_MAPPINGS = {
+  successPayload: { expression: '{{raw.data}}' },
+  successMessage: { expression: '{{raw.message}}' },
+  errorCode: { expression: '{{raw.code}}' },
+  errorMessage: { expression: '{{raw.message}}' }
+};
+
+/**
+ * @param {Object} parsed
+ * @returns {boolean}
+ */
+function hasVendorOpenapiBinding(parsed) {
+  const openapi = parsed?.openapi;
+  if (!openapi || typeof openapi !== 'object' || openapi.enabled === false) {
+    return false;
+  }
+  const operations = openapi.operations;
+  if (operations && typeof operations === 'object' && Object.keys(operations).length > 0) {
+    return true;
+  }
+  const documentKey =
+    typeof openapi.documentKey === 'string' ? openapi.documentKey.trim() : '';
+  return Boolean(documentKey) || openapi.enabled === true;
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {boolean}
+ */
+function isDeprecatedNoneOpenapiHttpManifest(parsed) {
+  if (parsed?.entityType !== 'none') {
+    return false;
+  }
+  if (parsed?.resourceType === 'llm') {
+    return false;
+  }
+  return hasVendorOpenapiBinding(parsed);
+}
+
+/**
+ * @param {*} value
+ * @returns {*}
+ */
+function deepClone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureHttpCipMapSteps(parsed, changes) {
+  const operations = parsed?.execution?.cip?.operations;
+  if (!operations || typeof operations !== 'object') {
+    return false;
+  }
+  let updated = false;
+  for (const [opKey, op] of Object.entries(operations)) {
+    if (!op || !Array.isArray(op.steps)) {
+      continue;
+    }
+    if (op.steps.some((step) => step && step.map)) {
+      continue;
+    }
+    const fetchIdx = op.steps.findIndex((step) => step && step.fetch);
+    if (fetchIdx < 0) {
+      continue;
+    }
+    op.steps.splice(fetchIdx + 1, 0, {
+      map: { useFieldMappings: true, inputPath: '$' }
+    });
+    if (!op.steps.some((step) => step && step.output)) {
+      op.steps.push({ output: { mode: 'records' } });
+    }
+    changes.push(`Inserted map+output steps for CIP operation "${opKey}"`);
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ */
+function ensureHttpFieldMappings(parsed, changes) {
+  if (!parsed.fieldMappings) {
+    parsed.fieldMappings = {};
+  }
+  const attrs = parsed.fieldMappings.attributes;
+  if (!attrs || typeof attrs !== 'object' || Object.keys(attrs).length === 0) {
+    parsed.fieldMappings.attributes = deepClone(HTTP_STUB_FIELD_MAPPINGS);
+    changes.push(
+      'Added stub fieldMappings.attributes — customize {{raw.*}} per operation'
+    );
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ */
+function ensureHttpExposedEnvelope(parsed, changes) {
+  if (!parsed.exposed) {
+    parsed.exposed = {};
+  }
+  if (!parsed.exposed.schema || typeof parsed.exposed.schema !== 'object') {
+    parsed.exposed.schema = deepClone(HTTP_CANONICAL_EXPOSED_SCHEMA);
+    changes.push('Set HTTP serviceContract exposed.schema envelope');
+  }
+  if (parsed.exposed.attributes !== undefined) {
+    delete parsed.exposed.attributes;
+  }
+  if (!parsed.exposed.profiles || typeof parsed.exposed.profiles !== 'object') {
+    parsed.exposed.profiles = { default: ['success', 'error'] };
+    changes.push('Set exposed.profiles default envelope');
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyHttpServiceContractStubs(parsed, changes) {
+  parsed.entityType = 'serviceContract';
+  changes.push('Migrated entityType none → serviceContract (HTTP/OpenAPI facade)');
+
+  parsed.metadataSchema = deepClone(HTTP_CANONICAL_METADATA_SCHEMA);
+  changes.push('Set HTTP serviceContract metadataSchema stub');
+
+  ensureHttpFieldMappings(parsed, changes);
+  ensureHttpExposedEnvelope(parsed, changes);
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairNoneOpenapiHttpToServiceContract(parsed, changes) {
+  if (!isDeprecatedNoneOpenapiHttpManifest(parsed)) {
+    return false;
+  }
+  let updated = applyHttpServiceContractStubs(parsed, changes);
+  updated = ensureHttpCipMapSteps(parsed, changes) || updated;
+  updated = normalizeCipOpenapiRefs(parsed, changes) || updated;
+  return updated;
+}
+
+/**
+ * Align fetch.openapiRef with execution.cip.operations keys (manifest SSOT).
+ *
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function normalizeCipOpenapiRefs(parsed, changes) {
+  const operations = parsed?.execution?.cip?.operations;
+  if (!operations || typeof operations !== 'object') {
+    return false;
+  }
+  let updated = false;
+  for (const [opKey, op] of Object.entries(operations)) {
+    if (!op || !Array.isArray(op.steps)) {
+      continue;
+    }
+    for (const step of op.steps) {
+      const fetch = step?.fetch;
+      if (!fetch || fetch.source !== 'openapi') {
+        continue;
+      }
+      if (fetch.openapiRef !== opKey) {
+        fetch.openapiRef = opKey;
+        changes.push(
+          `Normalized fetch.openapiRef → "${opKey}" for CIP operation "${opKey}"`
+        );
+        updated = true;
+      }
+    }
+  }
+  return updated;
+}
+
+module.exports = {
+  HTTP_CANONICAL_METADATA_SCHEMA,
+  HTTP_CANONICAL_EXPOSED_SCHEMA,
+  isDeprecatedNoneOpenapiHttpManifest,
+  normalizeCipOpenapiRefs,
+  repairNoneOpenapiHttpToServiceContract
+};

package/lib/commands/repair-datasource-operation-security.js

@@ -0,0 +1,180 @@
+/**
+ * Bind openapi.operations.*.security from rbac permissions for COM publish.
+ *
+ * @fileoverview repair-datasource-operation-security
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
+const { resolveRbacPath } = require('../utils/app-config-resolver');
+
+/**
+ * @param {Object} rbac
+ * @returns {Map<string, string[]>}
+ */
+function permissionRoleIndex(rbac) {
+  const index = new Map();
+  const perms = rbac && Array.isArray(rbac.permissions) ? rbac.permissions : [];
+  for (const perm of perms) {
+    if (!perm || typeof perm !== 'object') continue;
+    const name = typeof perm.name === 'string' ? perm.name.trim() : '';
+    if (!name) continue;
+    const roles = Array.isArray(perm.roles)
+      ? perm.roles.filter((r) => typeof r === 'string' && r.trim())
+      : [];
+    if (roles.length) index.set(name, roles);
+  }
+  return index;
+}
+
+/**
+ * @param {Map<string, string[]>} permIndex
+ * @param {string} resourceType
+ * @param {string} opKey
+ * @returns {Object[]|null}
+ */
+function expectedSecurityForOperation(permIndex, resourceType, opKey) {
+  const permName = `${resourceType}:${opKey}`;
+  const roles = permIndex.get(permName) || permIndex.get(permName.toLowerCase());
+  if (!roles || roles.length === 0) {
+    return null;
+  }
+  return roles.map((role) => ({ oauth2: [role] }));
+}
+
+/**
+ * @param {Object} opCfg
+ * @param {Object[]} expectedSecurity
+ * @returns {boolean}
+ */
+function applyOperationSecurity(opCfg, expectedSecurity) {
+  if (JSON.stringify(opCfg.security) === JSON.stringify(expectedSecurity)) {
+    return false;
+  }
+  opCfg.security = expectedSecurity;
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {{ ops: Object, resourceType: string }|null}
+ */
+function openApiOpsForSecurityBind(parsed) {
+  const openapi = parsed && parsed.openapi;
+  if (!openapi || typeof openapi !== 'object' || openapi.autoRbac !== true) {
+    return null;
+  }
+  const ops = openapi.operations;
+  if (!ops || typeof ops !== 'object' || Array.isArray(ops)) {
+    return null;
+  }
+  const resourceType = (typeof parsed.resourceType === 'string' && parsed.resourceType.trim()) || 'document';
+  return { ops, resourceType };
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Map<string, string[]>} permIndex
+ * @param {string[]} changes
+ * @param {string} fileName
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasource(parsed, permIndex, changes, fileName) {
+  const bindCtx = openApiOpsForSecurityBind(parsed);
+  if (!bindCtx) {
+    return false;
+  }
+  const { ops, resourceType } = bindCtx;
+  let updated = false;
+  for (const [opKey, opCfg] of Object.entries(ops)) {
+    if (!opCfg || typeof opCfg !== 'object') {
+      continue;
+    }
+    const expectedSecurity = expectedSecurityForOperation(permIndex, resourceType, opKey);
+    if (!expectedSecurity) {
+      continue;
+    }
+    updated = applyOperationSecurity(opCfg, expectedSecurity) || updated;
+  }
+  if (updated) {
+    changes.push(`${fileName}: Bound openapi.operations.*.security from rbac permissions`);
+  }
+  return updated;
+}
+
+/**
+ * @param {string} appPath
+ * @returns {Map<string, string[]>|null}
+ */
+function loadRbacPermissionIndex(appPath) {
+  const rbacPath = resolveRbacPath(appPath);
+  if (!rbacPath || !fs.existsSync(rbacPath)) {
+    return null;
+  }
+  try {
+    return permissionRoleIndex(loadConfigFile(rbacPath));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object} opts
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasourceFile(opts) {
+  const { appPath, fileName, permIndex, dryRun, changes, backupCtx } = opts;
+  const filePath = path.join(appPath, fileName);
+  if (!fs.existsSync(filePath)) {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = loadConfigFile(filePath);
+  } catch {
+    return false;
+  }
+  const fileUpdated = bindSecurityOnDatasource(parsed, permIndex, changes, fileName);
+  if (!fileUpdated || dryRun) {
+    return fileUpdated;
+  }
+  backupIntegrationFile(filePath, backupCtx);
+  writeConfigFile(filePath, parsed);
+  trackRepairWrite(filePath, backupCtx);
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {boolean} dryRun
+ * @param {string[]} changes
+ * @param {Object} backupCtx
+ * @returns {boolean}
+ */
+function bindOpenApiOperationSecurityFromRbac(appPath, datasourceFiles, dryRun, changes, backupCtx) {
+  const permIndex = loadRbacPermissionIndex(appPath);
+  if (!permIndex || permIndex.size === 0) {
+    return false;
+  }
+
+  let anyUpdated = false;
+  for (const fileName of datasourceFiles || []) {
+    anyUpdated =
+      bindSecurityOnDatasourceFile({ appPath, fileName, permIndex, dryRun, changes, backupCtx }) ||
+      anyUpdated;
+  }
+  return anyUpdated;
+}
+
+module.exports = {
+  bindOpenApiOperationSecurityFromRbac,
+  permissionRoleIndex
+};

package/lib/commands/repair-datasource-run.js

@@ -23,11 +23,13 @@ const { repairDatasourceFile } = require('./repair-datasource');
  * @param {Object} options
  * @param {boolean} dryRun
  * @param {string[]} changes
+ * @param {Object} [context]
  * @returns {boolean}
  */
-function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes) {
+function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes, context = {}) {
   if (!datasourceFiles || datasourceFiles.length === 0) return false;
   let updated = false;
+  const warnings = Array.isArray(context.warnings) ? context.warnings : [];
   for (const fileName of datasourceFiles) {
     const filePath = path.join(appPath, fileName);
     if (!fs.existsSync(filePath)) continue;
@@ -36,7 +38,10 @@ function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes
       const { updated: fileUpdated, changes: fileChanges } = repairDatasourceFile(parsed, {
         expose: options.expose,
         sync: options.sync,
-        test: options.test
+        test: options.test,
+        operations: options.operations,
+        systemParsed: context.systemParsed,
+        warnings
       });
       if (fileUpdated) {
         updated = true;

package/lib/commands/repair-datasource-sync-operations.js

@@ -0,0 +1,177 @@
+/**
+ * Sync capabilities[] → openapi.operations → execution.cip.operations (plan 154.7).
+ *
+ * @fileoverview repair-datasource-sync-operations
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { listCapabilityKeys } = require('../datasource/capability/capability-manifest');
+
+const MANIFEST_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isManifestOperationKey(key) {
+  return typeof key === 'string' && MANIFEST_KEY_PATTERN.test(key.trim());
+}
+
+/**
+ * @param {unknown} capabilities
+ * @returns {string[]}
+ */
+function capabilityKeysFromManifest(capabilities) {
+  return listCapabilityKeys(capabilities).filter(isManifestOperationKey);
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @returns {Object|undefined}
+ */
+function openapiOperationEntry(parsed, key) {
+  const ops = parsed?.openapi?.operations;
+  if (!ops || typeof ops !== 'object') {
+    return undefined;
+  }
+  const entry = ops[key];
+  return entry && typeof entry === 'object' ? entry : undefined;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @returns {Object|undefined}
+ */
+function cipOperationEntry(parsed, key) {
+  const ops = parsed?.execution?.cip?.operations;
+  if (!ops || typeof ops !== 'object') {
+    return undefined;
+  }
+  const entry = ops[key];
+  return entry && typeof entry === 'object' ? entry : undefined;
+}
+
+/**
+ * @param {string} key
+ * @param {Object|undefined} openapiEntry
+ * @returns {Object}
+ */
+function buildOpenapiOperationStub(key, openapiEntry) {
+  if (openapiEntry && typeof openapiEntry.operationId === 'string' && openapiEntry.operationId.trim()) {
+    return { operationId: openapiEntry.operationId.trim() };
+  }
+  return { operationId: key };
+}
+
+/**
+ * @param {string} key
+ * @param {Object|undefined} openapiEntry
+ * @returns {Object}
+ */
+function buildCipOperationStub(key, openapiEntry) {
+  const description =
+    (openapiEntry && typeof openapiEntry.summary === 'string' && openapiEntry.summary.trim()) ||
+    `Execute ${key} via OpenAPI passthrough`;
+  return {
+    enabled: true,
+    description,
+    steps: [
+      {
+        fetch: {
+          source: 'openapi',
+          openapiRef: key,
+          query: {}
+        }
+      },
+      { output: { mode: 'records' } }
+    ]
+  };
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {void}
+ */
+function ensureSyncOperationScaffold(parsed) {
+  if (!parsed.openapi || typeof parsed.openapi !== 'object') {
+    parsed.openapi = {};
+  }
+  if (!parsed.openapi.operations || typeof parsed.openapi.operations !== 'object') {
+    parsed.openapi.operations = {};
+  }
+  if (!parsed.execution || typeof parsed.execution !== 'object') {
+    parsed.execution = { engine: 'cip' };
+  }
+  if (!parsed.execution.cip || typeof parsed.execution.cip !== 'object') {
+    parsed.execution.cip = { operations: {} };
+  }
+  if (!parsed.execution.cip.operations || typeof parsed.execution.cip.operations !== 'object') {
+    parsed.execution.cip.operations = {};
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function syncCapabilityOperationKey(parsed, key, changes) {
+  let updated = false;
+  const openapiEntry = openapiOperationEntry(parsed, key);
+  if (!openapiEntry) {
+    parsed.openapi.operations[key] = buildOpenapiOperationStub(key, openapiEntry);
+    changes.push(`Added openapi.operations.${key}`);
+    updated = true;
+  } else if (!openapiEntry.operationId) {
+    parsed.openapi.operations[key] = buildOpenapiOperationStub(key, openapiEntry);
+    changes.push(`Set openapi.operations.${key}.operationId`);
+    updated = true;
+  }
+
+  if (!cipOperationEntry(parsed, key)) {
+    parsed.execution.cip.operations[key] = buildCipOperationStub(key, parsed.openapi.operations[key]);
+    changes.push(`Added execution.cip.operations.${key}`);
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * Ensure openapi.operations and execution.cip.operations mirror capabilities[] keys.
+ *
+ * @param {Object} parsed - Parsed datasource (mutated)
+ * @param {string[]} changes - Change log
+ * @returns {boolean}
+ */
+function repairSyncOperationsFromCapabilities(parsed, changes) {
+  const keys = capabilityKeysFromManifest(parsed?.capabilities);
+  if (keys.length === 0) {
+    return false;
+  }
+
+  ensureSyncOperationScaffold(parsed);
+
+  let updated = false;
+  for (const key of keys) {
+    updated = syncCapabilityOperationKey(parsed, key, changes) || updated;
+  }
+
+  if (updated && parsed.openapi.enabled !== true) {
+    parsed.openapi.enabled = true;
+    changes.push('Set openapi.enabled=true (capabilities synced)');
+  }
+
+  return updated;
+}
+
+module.exports = {
+  repairSyncOperationsFromCapabilities,
+  capabilityKeysFromManifest,
+  isManifestOperationKey
+};