@aifabrix/builder 2.49.2 → 2.50.0

package/lib/generator/deploy-script.js

@@ -0,0 +1,73 @@
+/**
+ * Generate integration deploy.js from Handlebars template.
+ *
+ * @fileoverview ESLint-clean deploy script for external integrations
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const Handlebars = require('handlebars');
+
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+
+const templatesExternalDir = path.join(__dirname, '..', '..', 'templates', 'external-system');
+
+/**
+ * @param {string} templateName
+ * @param {string} outputPath
+ * @param {Object} context
+ */
+async function writeDeployScriptFromTemplate(templateName, outputPath, context) {
+  const templatePath = path.join(templatesExternalDir, templateName);
+  const content = Handlebars.compile(fs.readFileSync(templatePath, 'utf8'))(context);
+  fs.writeFileSync(outputPath, content, { mode: 0o644, encoding: 'utf8' });
+  logger.log(formatSuccessLine(`Generated ${path.basename(outputPath)}`));
+}
+
+/**
+ * @param {string} appPath
+ * @param {string} systemKey
+ * @param {string} systemFileName
+ * @param {string[]} datasourceFileNames
+ * @returns {Promise<{ deployJsPath: string }>}
+ */
+async function generateDeployScripts(appPath, systemKey, systemFileName, datasourceFileNames) {
+  try {
+    const allJsonFiles = [systemFileName, ...datasourceFileNames];
+    const context = { systemKey, allJsonFiles, datasourceFileNames };
+    const deployJsPath = path.join(appPath, 'deploy.js');
+    await writeDeployScriptFromTemplate('deploy.js.hbs', deployJsPath, context);
+    return { deployJsPath };
+  } catch (error) {
+    throw new Error(`Failed to generate deployment scripts: ${error.message}`);
+  }
+}
+
+/**
+ * Regenerate deploy.js from integration manifest file lists.
+ *
+ * @param {Object} params
+ * @param {string} params.appPath
+ * @param {string} params.systemKey
+ * @param {string[]} params.systemFiles
+ * @param {string[]} params.datasourceFiles
+ * @returns {Promise<{ deployJsPath: string }>}
+ */
+async function regenerateDeployScriptFromIntegration(params) {
+  const { appPath, systemKey, systemFiles, datasourceFiles } = params;
+  if (!systemFiles?.length) {
+    throw new Error('externalIntegration.systems is empty — cannot generate deploy.js');
+  }
+  return generateDeployScripts(appPath, systemKey, systemFiles[0], datasourceFiles || []);
+}
+
+module.exports = {
+  writeDeployScriptFromTemplate,
+  generateDeployScripts,
+  regenerateDeployScriptFromIntegration
+};

package/lib/generator/external.js

@@ -436,6 +436,7 @@ module.exports = {
   splitExternalApplicationSchema,
   loadSystemFile,
   loadDatasourceFiles,
-  loadExternalIntegrationConfig
+  loadExternalIntegrationConfig,
+  mergeRbacIntoSystemJson
 };
 

package/lib/generator/index.js

@@ -302,7 +302,22 @@ async function generateDeployJson(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const { isExternal, appPath, appType } = await detectAppType(appName);
+  let appPath;
+  let isExternal;
+  let appType;
+  if (options.appPath) {
+    appPath = path.resolve(options.appPath);
+    const configPath = resolveApplicationConfigPath(appPath);
+    const { loadConfigFile } = require('../utils/config-format');
+    const variables = loadConfigFile(configPath);
+    appType = variables?.app?.type || 'external';
+    isExternal = appType === 'external';
+  } else {
+    const detected = await detectAppType(appName, options);
+    appPath = detected.appPath;
+    isExternal = detected.isExternal;
+    appType = detected.appType;
+  }
   logOfflinePathWhenType(appPath);
   if (isExternal) {
     return writeExternalDeployJson(appName, appPath, options);
@@ -315,7 +330,7 @@ async function generateDeployJsonWithValidation(appName, options = {}) {
   const jsonContent = fs.readFileSync(jsonPath, 'utf8');
   const deployment = JSON.parse(jsonContent);
 
-  const { isExternal } = await detectAppType(appName);
+  const { isExternal } = await detectAppType(appName, options);
 
   // For external systems, skip deployment JSON validation (they use external system JSON structure)
   if (isExternal) {

package/lib/generator/wizard.js

@@ -11,7 +11,6 @@
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const fs = require('fs').promises;
 const path = require('path');
-const Handlebars = require('handlebars');
 const logger = require('../utils/logger');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
@@ -178,7 +177,8 @@ async function generateConfigFilesForWizard(params) {
 }
 
 async function prepareWizardContext(appName, systemConfig, datasourceConfigs) {
-  const appPath = path.join(process.cwd(), 'integration', appName);
+  const { getIntegrationPath } = require('../utils/paths');
+  const appPath = getIntegrationPath(appName);
   await fs.mkdir(appPath, { recursive: true });
   const finalSystemKey = appName;
   const originalSystemKey = systemConfig.key || finalSystemKey;
@@ -430,40 +430,7 @@ async function _generateEnvTemplate(appPath, systemConfig, finalSystemKey) {
   }
 }
 
-/**
- * Generate deployment script (deploy.js) from template
- * @async
- * @function generateDeployScripts
- * @param {string} appPath - Application directory path
- * @param {string} systemKey - System key
- * @param {string} systemFileName - System file name
- * @param {string[]} datasourceFileNames - Array of datasource file names
- * @returns {Promise<Object>} Object with deployJsPath
- * @throws {Error} If generation fails
- */
-const templatesExternalDir = path.join(__dirname, '..', '..', 'templates', 'external-system');
-
-async function writeDeployScriptFromTemplate(templateName, outputPath, context) {
-  const templatePath = path.join(templatesExternalDir, templateName);
-  const content = Handlebars.compile(await fs.readFile(templatePath, 'utf8'))(context);
-  await fs.writeFile(outputPath, content, 'utf8');
-  logger.log(formatSuccessLine(`Generated ${path.basename(outputPath)}`));
-}
-
-async function generateDeployScripts(appPath, systemKey, systemFileName, datasourceFileNames) {
-  try {
-    const allJsonFiles = [systemFileName, ...datasourceFileNames];
-    const context = { systemKey, allJsonFiles, datasourceFileNames };
-
-    await writeDeployScriptFromTemplate('deploy.js.hbs', path.join(appPath, 'deploy.js'), context);
-
-    return {
-      deployJsPath: path.join(appPath, 'deploy.js')
-    };
-  } catch (error) {
-    throw new Error(`Failed to generate deployment scripts: ${error.message}`);
-  }
-}
+const { generateDeployScripts } = require('./deploy-script');
 
 module.exports = {
   generateWizardFiles,

package/lib/internal/fs-real-sync.js

@@ -118,6 +118,25 @@ function unlinkSync(p) {
   return delegate('unlinkSync', [p]);
 }
 
+/**
+ * @param {string} src
+ * @param {string} dest
+ * @returns {void}
+ */
+function copyFileSync(src, dest) {
+  return delegate('copyFileSync', [src, dest]);
+}
+
+/**
+ * @param {string} p
+ * @param {string|Buffer} data
+ * @param {object|string} [opts]
+ * @returns {void}
+ */
+function appendFileSync(p, data, opts) {
+  return delegate('appendFileSync', opts !== undefined ? [p, data, opts] : [p, data]);
+}
+
 module.exports = {
   existsSync,
   readFileSync,
@@ -128,5 +147,7 @@ module.exports = {
   readdirSync,
   mkdtempSync,
   rmSync,
-  unlinkSync
+  unlinkSync,
+  copyFileSync,
+  appendFileSync
 };

package/lib/internal/node-fs.js

@@ -73,6 +73,7 @@ function buildBoundFs() {
       readdirSync: snap.readdirSync,
       statSync: snap.statSync,
       renameSync: snap.renameSync,
+      copyFileSync: snap.copyFileSync,
       watch: (...args) => live.watch(...args),
       promises: boundPromises
     };
@@ -85,6 +86,7 @@ function buildBoundFs() {
     readdirSync: bindSync(rf, 'readdirSync'),
     statSync: bindSync(rf, 'statSync'),
     renameSync: bindSync(rf, 'renameSync'),
+    copyFileSync: bindSync(rf, 'copyFileSync'),
     watch: (...args) => live.watch(...args),
     promises: boundPromises
   };

package/lib/lifecycle/lifecycle-governance-options.js

@@ -34,7 +34,7 @@ function buildGovernanceOptsFromLifecycle(options, context = {}) {
     env: options.env || 'dev',
     verbose: options.verbose === true,
     debug: options.debug === true,
-    noSync: true,
+    noPublish: true,
     force: options.force === true,
     certificationProfile: options.certificationProfile || 'bronze',
     subjectEmails: options.subjectEmail || options.subjectEmails || [],

package/lib/lifecycle/verify-step-progress.js

@@ -53,7 +53,7 @@ function formatVerifyStepLabel(label) {
  * @returns {Promise<T>}
  */
 async function runWithVerifyStepProgress(label, work, options = {}) {
-  if (!shouldShowVerifyStepProgress(options)) {
+  if (options.quietProgress === true || !shouldShowVerifyStepProgress(options)) {
     return withQuietLogs(() => work({ setLabel: () => {} }));
   }
 

package/lib/programmatic/access-log.js

@@ -0,0 +1,26 @@
+/**
+ * Structured access logging for builder-api requests.
+ *
+ * @fileoverview JSON logs without tokens or manifest bodies
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { redactForLog } = require('./log-redaction');
+
+/**
+ * @param {Object} entry
+ */
+function writeAccessLog(entry) {
+  const payload = redactForLog({
+    timestamp: new Date().toISOString(),
+    ...entry
+  });
+  process.stdout.write(`${JSON.stringify(payload)}\n`);
+}
+
+module.exports = {
+  writeAccessLog
+};

package/lib/programmatic/auth-config.js

@@ -0,0 +1,44 @@
+/**
+ * Bearer auth config for programmatic Dataplane calls.
+ *
+ * @fileoverview Build authConfig from user Bearer token (no device token store)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} bearerToken
+ * @returns {{ type: 'bearer', token: string }}
+ */
+function buildBearerAuthConfig(bearerToken) {
+  if (!bearerToken || typeof bearerToken !== 'string') {
+    throw new Error('Bearer token is required');
+  }
+  const token = bearerToken.startsWith('Bearer ') ? bearerToken.slice(7).trim() : bearerToken.trim();
+  if (!token) {
+    throw new Error('Bearer token is required');
+  }
+  return { type: 'bearer', token };
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {{ authConfig: Object, dataplaneUrl: string, environment: string }}
+ */
+function buildProgrammaticAuthContext(ctx) {
+  if (!ctx.dataplaneUrl) {
+    throw new Error('dataplaneUrl is required on WorkspaceContext');
+  }
+  return {
+    authConfig: buildBearerAuthConfig(ctx.bearerToken),
+    dataplaneUrl: ctx.dataplaneUrl,
+    environment: ctx.environment
+  };
+}
+
+module.exports = {
+  buildBearerAuthConfig,
+  buildProgrammaticAuthContext
+};

package/lib/programmatic/bearer-auth.js

@@ -0,0 +1,176 @@
+/**
+ * Bearer token validation for builder-api via @aifabrix/miso-client (controller-backed).
+ *
+ * @fileoverview Same model as dataplane: registered app client + MISO_CONTROLLER_URL
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @type {import('@aifabrix/miso-client').MisoClient | null} */
+let misoClientSingleton = null;
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @returns {string|null}
+ */
+function extractBearerToken(req) {
+  const auth = req.headers.authorization || req.headers.Authorization;
+  if (!auth || typeof auth !== 'string') {
+    return null;
+  }
+  const match = auth.match(/^Bearer\s+(.+)$/i);
+  return match ? match[1].trim() : null;
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ */
+function assertNoForbiddenAuthHeaders(req) {
+  if (req.headers['x-client-token'] || req.headers['x-client-id']) {
+    const err = new Error('Client credential headers are not supported in builder-api V1');
+    err.statusCode = 401;
+    throw err;
+  }
+}
+
+/**
+ * @returns {string}
+ */
+function resolveControllerUrlFromEnv() {
+  const raw =
+    process.env.MISO_CONTROLLER_URL ||
+    process.env.CONTROLLER_URL ||
+    process.env.MISO_WEB_SERVER_URL ||
+    '';
+  const url = String(raw).trim().replace(/\/$/, '');
+  if (!url) {
+    throw new Error('MISO_CONTROLLER_URL (or CONTROLLER_URL) is required for token validation');
+  }
+  return url;
+}
+
+/**
+ * @returns {import('@aifabrix/miso-client/dist/types/config.types').MisoClientConfig}
+ */
+function buildMisoClientConfigFromEnv() {
+  const clientId = (process.env.MISO_CLIENTID || '').trim();
+  const clientSecret = (process.env.MISO_CLIENTSECRET || '').trim();
+  if (!clientId || !clientSecret) {
+    throw new Error('MISO_CLIENTID and MISO_CLIENTSECRET are required for builder-api auth');
+  }
+  return {
+    clientId,
+    clientSecret,
+    controllerUrl: resolveControllerUrlFromEnv(),
+    logLevel: (process.env.LOG_LEVEL || 'info').toLowerCase()
+  };
+}
+
+/**
+ * Test hook — reset cached MisoClient between Jest cases.
+ */
+function resetMisoClientForTests() {
+  misoClientSingleton = null;
+}
+
+/**
+ * @returns {Promise<import('@aifabrix/miso-client').MisoClient>}
+ */
+async function getMisoClientForAuth() {
+  let MisoClient;
+  try {
+    ({ MisoClient } = require('@aifabrix/miso-client'));
+  } catch {
+    const err = new Error('@aifabrix/miso-client is required for builder-api auth');
+    err.statusCode = 503;
+    throw err;
+  }
+
+  if (!misoClientSingleton) {
+    misoClientSingleton = new MisoClient(buildMisoClientConfigFromEnv());
+  }
+  if (!misoClientSingleton.isInitialized()) {
+    await misoClientSingleton.initialize();
+  }
+  return misoClientSingleton;
+}
+
+/**
+ * @param {import('@aifabrix/miso-client/dist/types/config.types').UserInfo} userInfo
+ * @returns {string}
+ */
+function userIdFromUserInfo(userInfo) {
+  const userId = userInfo?.id || userInfo?.username;
+  if (!userId) {
+    const err = new Error('Token validation returned no user id');
+    err.statusCode = 401;
+    throw err;
+  }
+  return String(userId);
+}
+
+/**
+ * @param {string} token
+ * @param {Object} [opts]
+ * @returns {Promise<{ userId: string, payload: Object }>}
+ */
+async function validateBearerToken(token, opts = {}) {
+  if (!token) {
+    const err = new Error('Missing Bearer token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const client = opts.misoClient || (await getMisoClientForAuth());
+  const valid = await client.validateToken(token, opts.authStrategy);
+  if (!valid) {
+    const err = new Error('Invalid token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const userInfo = await client.getUser(token, opts.authStrategy);
+  if (!userInfo) {
+    const err = new Error('Invalid token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const payload = {
+    sub: userInfo.id,
+    preferredUsername: userInfo.username,
+    email: userInfo.email,
+    roles: userInfo.roles || []
+  };
+  return { userId: userIdFromUserInfo(userInfo), payload };
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {Object} [opts]
+ * @returns {Promise<{ userId: string, bearerToken: string, payload: Object }>}
+ */
+async function authenticateRequest(req, opts = {}) {
+  assertNoForbiddenAuthHeaders(req);
+  const bearerToken = extractBearerToken(req);
+  if (!bearerToken) {
+    const err = new Error('Authorization Bearer token required');
+    err.statusCode = 401;
+    throw err;
+  }
+  const { userId, payload } = await validateBearerToken(bearerToken, opts);
+  return { userId, bearerToken, payload };
+}
+
+module.exports = {
+  extractBearerToken,
+  assertNoForbiddenAuthHeaders,
+  resolveControllerUrlFromEnv,
+  buildMisoClientConfigFromEnv,
+  resetMisoClientForTests,
+  getMisoClientForAuth,
+  validateBearerToken,
+  authenticateRequest
+};

package/lib/programmatic/builder-api-request.js

@@ -0,0 +1,175 @@
+/**
+ * Authenticated capability execution for builder-api HTTP server.
+ *
+ * @fileoverview Idempotency, workspace lock, dispatch
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { authenticateRequest } = require('./bearer-auth');
+const { dispatchHandler } = require('./route-handlers');
+const { withWorkspaceLock } = require('./workspace-lock');
+const { getIdempotentResult, setIdempotentResult } = require('./idempotency-cache');
+const { withRequestTimeout } = require('./request-timeout');
+
+/**
+ * @param {Object} capability
+ * @returns {boolean}
+ */
+function requiresAuth(capability) {
+  return capability.handlerId !== 'health' && capability.handlerId !== 'ready';
+}
+
+/**
+ * @param {Object} capability
+ * @returns {boolean}
+ */
+function isMutating(capability) {
+  return capability.mutating === true;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} body
+ * @returns {string}
+ */
+function resolveIdempotencySystemKey(params, body) {
+  return params.systemKey || body.systemKey || '_workspace';
+}
+
+/**
+ * @param {Object} options
+ * @param {Object} options.auth
+ * @param {string|undefined} options.idempotencyKey
+ * @param {Object} options.capability
+ * @param {string} options.routeKey
+ * @param {Object} options.params
+ * @param {Object} options.body
+ * @param {string} options.requestId
+ * @returns {{ httpStatus: number, body: Object, requestId: string }|null}
+ */
+function lookupIdempotentResponse(options) {
+  const { auth, idempotencyKey, capability, routeKey, params, body, requestId } = options;
+  if (!idempotencyKey || !isMutating(capability)) {
+    return null;
+  }
+  const cached = getIdempotentResult({
+    userId: auth.userId,
+    idempotencyKey: String(idempotencyKey),
+    route: routeKey,
+    systemKey: resolveIdempotencySystemKey(params, body)
+  });
+  if (!cached) {
+    return null;
+  }
+  return { httpStatus: cached.httpStatus, body: cached.body, requestId: cached.correlationId || requestId };
+}
+
+/**
+ * @param {Object} auth
+ * @param {Object} capability
+ * @param {Object} params
+ * @param {Object} body
+ * @param {Object} query
+ * @returns {Promise<*>}
+ */
+async function runHandler(auth, capability, params, body, query) {
+  const run = () =>
+    withRequestTimeout(capability.handlerId, () =>
+      dispatchHandler(capability.handlerId, params, auth, body, query)
+    );
+  const lockKey = params.systemKey || body.systemKey;
+  if (isMutating(capability) && lockKey) {
+    return withWorkspaceLock(auth.userId, lockKey, run);
+  }
+  return run();
+}
+
+/**
+ * @param {Object} options
+ * @param {Object} options.auth
+ * @param {string|undefined} options.idempotencyKey
+ * @param {Object} options.capability
+ * @param {string} options.routeKey
+ * @param {Object} options.params
+ * @param {Object} options.body
+ * @param {string} options.requestId
+ * @param {Object} options.result
+ * @returns {{ httpStatus: number, body: Object, requestId: string, userId: string }}
+ */
+function buildSuccessResponse(options) {
+  const { auth, idempotencyKey, capability, routeKey, params, body, requestId, result } = options;
+  const responseBody = { success: true, data: result, correlationId: requestId };
+  if (idempotencyKey && isMutating(capability)) {
+    setIdempotentResult(
+      {
+        userId: auth.userId,
+        idempotencyKey: String(idempotencyKey),
+        route: routeKey,
+        systemKey: resolveIdempotencySystemKey(params, body)
+      },
+      { httpStatus: 200, body: responseBody, correlationId: requestId }
+    );
+  }
+  return { httpStatus: 200, body: responseBody, requestId, userId: auth.userId };
+}
+
+/**
+ * @typedef {Object} ExecuteCapabilityRequestOptions
+ * @property {import('http').IncomingMessage} req
+ * @property {Object} capability
+ * @property {Object} params
+ * @property {string} routeKey
+ * @property {string} requestId
+ * @property {Function} readJsonBody
+ * @property {Object} query
+ */
+
+/**
+ * @param {ExecuteCapabilityRequestOptions} options
+ * @returns {Promise<{ httpStatus: number, body: Object, requestId: string }>}
+ */
+async function executeCapabilityRequest(options) {
+  const { req, capability, params, routeKey, requestId, readJsonBody, query } = options;
+  const auth = requiresAuth(capability)
+    ? await authenticateRequest(req)
+    : { userId: 'anonymous', bearerToken: '' };
+
+  const body = req.method === 'GET' || req.method === 'DELETE' ? {} : await readJsonBody(req);
+
+  const cached = lookupIdempotentResponse({
+    auth,
+    idempotencyKey: req.headers['idempotency-key'],
+    capability,
+    routeKey,
+    params,
+    body,
+    requestId
+  });
+  if (cached) {
+    return { ...cached, userId: auth.userId };
+  }
+
+  const result = await runHandler(auth, capability, params, body, query);
+  return buildSuccessResponse({
+    auth,
+    idempotencyKey: req.headers['idempotency-key'],
+    capability,
+    routeKey,
+    params,
+    body,
+    requestId,
+    result
+  });
+}
+
+module.exports = {
+  executeCapabilityRequest,
+  requiresAuth,
+  isMutating,
+  lookupIdempotentResponse,
+  buildSuccessResponse,
+  resolveIdempotencySystemKey
+};