@aifabrix/builder 2.49.2 → 2.51.0

package/lib/commands/repair-datasource-apply.js

@@ -0,0 +1,135 @@
+/**
+ * Datasource repair orchestration (service contract, base/openapi/optional passes).
+ *
+ * @fileoverview Repair datasource file apply orchestration
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { repairOpenapiSection } = require('./repair-datasource-openapi');
+const { repairSyncOperationsFromCapabilities } = require('./repair-datasource-sync-operations');
+const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
+const { repairTestPayload } = require('./repair-datasource-test-payload');
+const { repairComV2Manifest } = require('./repair-datasource-com-v2');
+const {
+  isDeprecatedNoneLlmManifest,
+  repairNoneLlmToServiceContract
+} = require('./repair-datasource-service-contract');
+const {
+  isDeprecatedNoneOpenapiHttpManifest,
+  repairNoneOpenapiHttpToServiceContract,
+  normalizeCipOpenapiRefs
+} = require('./repair-datasource-http-service-contract');
+const {
+  repairWebhookSection,
+  repairSyncBridgeSection,
+  collectWebhookSyncBridgeSystemWarnings
+} = require('./repair-datasource-webhooks-sync-bridge');
+
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldApplyServiceContractRepair(parsed, options) {
+  return (
+    isDeprecatedNoneLlmManifest(parsed) ||
+    isDeprecatedNoneOpenapiHttpManifest(parsed) ||
+    (options.serviceContract && parsed?.resourceType === 'llm')
+  );
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @param {boolean} none
+ * @param {string[]} changes
+ * @param {Object} helpers
+ * @returns {boolean}
+ */
+function applyOptionalDatasourceRepairs(parsed, options, none, changes, helpers) {
+  let updated = false;
+  if (options.operations) {
+    updated = repairSyncOperationsFromCapabilities(parsed, changes) || updated;
+  }
+  if (options.expose) {
+    updated = helpers.repairExposeFromAttributes(parsed, changes) || updated;
+  }
+  if (!none && options.sync) {
+    updated = helpers.repairSyncSection(parsed, changes) || updated;
+  }
+  if (options.test) {
+    helpers.sanitizeTestPayloadTopLevel(parsed, changes);
+    updated = repairTestPayload(parsed, changes) || updated;
+    updated = helpers.sanitizeTestPayloadTopLevel(parsed, changes) || updated;
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {boolean} none
+ * @param {string[]} changes
+ * @param {Object} [options]
+ * @param {Object} helpers
+ * @returns {boolean}
+ */
+function applyBaseDatasourceRepairs(parsed, none, changes, options, helpers) {
+  let updated = repairComV2Manifest(parsed, changes);
+  if (none) return updated;
+  updated = helpers.repairDimensionBindingShape(parsed, changes) || updated;
+  updated = helpers.repairRootDimensionsFromAttributes(parsed, changes) || updated;
+  updated = helpers.repairMetadataSchemaFromAttributes(parsed, changes) || updated;
+  const warnings = Array.isArray(options.warnings) ? options.warnings : [];
+  updated = repairWebhookSection(parsed, changes, warnings) || updated;
+  updated = repairSyncBridgeSection(parsed, changes, warnings) || updated;
+  collectWebhookSyncBridgeSystemWarnings(parsed, options.systemParsed, warnings);
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyOpenapiDatasourceRepairs(parsed, changes) {
+  let updated = false;
+  updated = repairOpenapiSection(parsed, changes) || updated;
+  updated = normalizeAutoRbacOperationKeys(parsed, changes) || updated;
+  return updated;
+}
+
+/**
+ * Runs all requested datasource repairs.
+ *
+ * @param {Object} parsed - Parsed datasource object (mutated)
+ * @param {Object} options - Repair flags
+ * @param {string[]} changes - Change log
+ * @param {Object} helpers - Functions from repair-datasource.js
+ * @returns {{ updated: boolean, changes: string[] }}
+ */
+function runRepairDatasourceFile(parsed, options, changes, helpers) {
+  const out = Array.isArray(changes) ? changes : [];
+  let updated = helpers.stripDeprecatedServiceCategory(parsed, out);
+
+  if (shouldApplyServiceContractRepair(parsed, options)) {
+    updated = repairNoneLlmToServiceContract(parsed, out) || updated;
+    updated = repairNoneOpenapiHttpToServiceContract(parsed, out) || updated;
+  }
+
+  updated = normalizeCipOpenapiRefs(parsed, out) || updated;
+
+  const none = helpers.isNoneEntityType(parsed?.entityType);
+
+  updated = applyBaseDatasourceRepairs(parsed, none, out, options, helpers) || updated;
+  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
+  updated = applyOptionalDatasourceRepairs(parsed, options, none, out, helpers) || updated;
+
+  return { updated, changes: out };
+}
+
+module.exports = {
+  runRepairDatasourceFile
+};

package/lib/commands/repair-datasource-auto-rbac.js

@@ -120,12 +120,71 @@ function renameScenarioOperations(parsed, renameMap) {
   return updated;
 }
 
+/**
+ * @param {unknown} cap
+ * @param {string[]} caps
+ * @param {Object} renameMap
+ * @returns {boolean}
+ */
+function renameStringCapabilityKey(caps, cap, renameMap) {
+  if (typeof cap !== 'string') {
+    return false;
+  }
+  const newKey = renameMap[cap];
+  if (!newKey || newKey === cap) {
+    return false;
+  }
+  const idx = caps.indexOf(cap);
+  if (idx >= 0) {
+    caps[idx] = newKey;
+  }
+  return true;
+}
+
+/**
+ * @param {Object} cap
+ * @param {Object} renameMap
+ * @returns {boolean}
+ */
+function renameObjectCapabilityKey(cap, renameMap) {
+  if (!cap || typeof cap !== 'object') {
+    return false;
+  }
+  const k = safeString(cap.key);
+  if (!k) {
+    return false;
+  }
+  const newKey = renameMap[k];
+  if (!newKey || newKey === k) {
+    return false;
+  }
+  cap.key = newKey;
+  return true;
+}
+
 /**
  * When OpenAPI autoRbac is enabled, ensure operation keys are schema-valid and consistent across:
  * - openapi.operations
  * - execution.cip.operations
  * - testPayload.scenarios[].operation
  */
+function renameCapabilitiesKeys(parsed, renameMap, changes) {
+  const caps = parsed?.capabilities;
+  if (!Array.isArray(caps) || !renameMap || typeof renameMap !== 'object') {
+    return false;
+  }
+  let updated = false;
+  for (const cap of caps) {
+    if (renameStringCapabilityKey(caps, cap, renameMap) || renameObjectCapabilityKey(cap, renameMap)) {
+      updated = true;
+    }
+  }
+  if (updated && Array.isArray(changes)) {
+    changes.push('Aligned capabilities[].key with normalized autoRbac operation keys');
+  }
+  return updated;
+}
+
 function normalizeAutoRbacOperationKeys(parsed, changes) {
   const openapi = parsed?.openapi;
   if (!openapi || typeof openapi !== 'object') return false;
@@ -148,6 +207,7 @@ function normalizeAutoRbacOperationKeys(parsed, changes) {
   updated = renameKeysInObject(wsAllowed, renameMap) || updated;
   // If both alias + canonical exist, merge and drop alias (schema requires canonical camelCase keys).
   updated = mergeAndDeleteAliasKeys(wsAllowed, renameMap) || updated;
+  updated = renameCapabilitiesKeys(parsed, renameMap, changes) || updated;
 
   if (updated && Array.isArray(changes)) {
     const pairs = keysToRename.map((k) => `${k}→${renameMap[k]}`).join(', ');
@@ -161,6 +221,7 @@ function normalizeAutoRbacOperationKeys(parsed, changes) {
 
 module.exports = {
   normalizeAutoRbacOperationKeys,
-  toCamelCaseKey
+  toCamelCaseKey,
+  toKebabAliasKey
 };
 

package/lib/commands/repair-datasource-http-service-contract.js

@@ -0,0 +1,239 @@
+/**
+ * Migrate deprecated entityType none + vendor OpenAPI HTTP manifests to serviceContract (439.2).
+ *
+ * @fileoverview repair-datasource-http-service-contract
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const HTTP_CANONICAL_METADATA_SCHEMA = {
+  type: 'object',
+  properties: {
+    successPayload: {
+      type: 'object',
+      nullable: true,
+      description: 'Normalized success body from upstream HTTP response'
+    },
+    successMessage: {
+      type: 'string',
+      nullable: true,
+      description: 'Human-readable success message when present'
+    },
+    errorCode: {
+      type: 'string',
+      nullable: true,
+      description: 'Provider error code when the operation fails'
+    },
+    errorMessage: {
+      type: 'string',
+      nullable: true,
+      description: 'Human-readable provider error message'
+    }
+  }
+};
+
+const HTTP_CANONICAL_EXPOSED_SCHEMA = {
+  success: {
+    payload: 'metadata.successPayload',
+    message: 'metadata.successMessage'
+  },
+  error: {
+    code: 'metadata.errorCode',
+    message: 'metadata.errorMessage'
+  }
+};
+
+const HTTP_STUB_FIELD_MAPPINGS = {
+  successPayload: { expression: '{{raw.data}}' },
+  successMessage: { expression: '{{raw.message}}' },
+  errorCode: { expression: '{{raw.code}}' },
+  errorMessage: { expression: '{{raw.message}}' }
+};
+
+/**
+ * @param {Object} parsed
+ * @returns {boolean}
+ */
+function hasVendorOpenapiBinding(parsed) {
+  const openapi = parsed?.openapi;
+  if (!openapi || typeof openapi !== 'object' || openapi.enabled === false) {
+    return false;
+  }
+  const operations = openapi.operations;
+  if (operations && typeof operations === 'object' && Object.keys(operations).length > 0) {
+    return true;
+  }
+  const documentKey =
+    typeof openapi.documentKey === 'string' ? openapi.documentKey.trim() : '';
+  return Boolean(documentKey) || openapi.enabled === true;
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {boolean}
+ */
+function isDeprecatedNoneOpenapiHttpManifest(parsed) {
+  if (parsed?.entityType !== 'none') {
+    return false;
+  }
+  if (parsed?.resourceType === 'llm') {
+    return false;
+  }
+  return hasVendorOpenapiBinding(parsed);
+}
+
+/**
+ * @param {*} value
+ * @returns {*}
+ */
+function deepClone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureHttpCipMapSteps(parsed, changes) {
+  const operations = parsed?.execution?.cip?.operations;
+  if (!operations || typeof operations !== 'object') {
+    return false;
+  }
+  let updated = false;
+  for (const [opKey, op] of Object.entries(operations)) {
+    if (!op || !Array.isArray(op.steps)) {
+      continue;
+    }
+    if (op.steps.some((step) => step && step.map)) {
+      continue;
+    }
+    const fetchIdx = op.steps.findIndex((step) => step && step.fetch);
+    if (fetchIdx < 0) {
+      continue;
+    }
+    op.steps.splice(fetchIdx + 1, 0, {
+      map: { useFieldMappings: true, inputPath: '$' }
+    });
+    if (!op.steps.some((step) => step && step.output)) {
+      op.steps.push({ output: { mode: 'records' } });
+    }
+    changes.push(`Inserted map+output steps for CIP operation "${opKey}"`);
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ */
+function ensureHttpFieldMappings(parsed, changes) {
+  if (!parsed.fieldMappings) {
+    parsed.fieldMappings = {};
+  }
+  const attrs = parsed.fieldMappings.attributes;
+  if (!attrs || typeof attrs !== 'object' || Object.keys(attrs).length === 0) {
+    parsed.fieldMappings.attributes = deepClone(HTTP_STUB_FIELD_MAPPINGS);
+    changes.push(
+      'Added stub fieldMappings.attributes — customize {{raw.*}} per operation'
+    );
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ */
+function ensureHttpExposedEnvelope(parsed, changes) {
+  if (!parsed.exposed) {
+    parsed.exposed = {};
+  }
+  if (!parsed.exposed.schema || typeof parsed.exposed.schema !== 'object') {
+    parsed.exposed.schema = deepClone(HTTP_CANONICAL_EXPOSED_SCHEMA);
+    changes.push('Set HTTP serviceContract exposed.schema envelope');
+  }
+  if (parsed.exposed.attributes !== undefined) {
+    delete parsed.exposed.attributes;
+  }
+  if (!parsed.exposed.profiles || typeof parsed.exposed.profiles !== 'object') {
+    parsed.exposed.profiles = { default: ['success', 'error'] };
+    changes.push('Set exposed.profiles default envelope');
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyHttpServiceContractStubs(parsed, changes) {
+  parsed.entityType = 'serviceContract';
+  changes.push('Migrated entityType none → serviceContract (HTTP/OpenAPI facade)');
+
+  parsed.metadataSchema = deepClone(HTTP_CANONICAL_METADATA_SCHEMA);
+  changes.push('Set HTTP serviceContract metadataSchema stub');
+
+  ensureHttpFieldMappings(parsed, changes);
+  ensureHttpExposedEnvelope(parsed, changes);
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairNoneOpenapiHttpToServiceContract(parsed, changes) {
+  if (!isDeprecatedNoneOpenapiHttpManifest(parsed)) {
+    return false;
+  }
+  let updated = applyHttpServiceContractStubs(parsed, changes);
+  updated = ensureHttpCipMapSteps(parsed, changes) || updated;
+  updated = normalizeCipOpenapiRefs(parsed, changes) || updated;
+  return updated;
+}
+
+/**
+ * Align fetch.openapiRef with execution.cip.operations keys (manifest SSOT).
+ *
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function normalizeCipOpenapiRefs(parsed, changes) {
+  const operations = parsed?.execution?.cip?.operations;
+  if (!operations || typeof operations !== 'object') {
+    return false;
+  }
+  let updated = false;
+  for (const [opKey, op] of Object.entries(operations)) {
+    if (!op || !Array.isArray(op.steps)) {
+      continue;
+    }
+    for (const step of op.steps) {
+      const fetch = step?.fetch;
+      if (!fetch || fetch.source !== 'openapi') {
+        continue;
+      }
+      if (fetch.openapiRef !== opKey) {
+        fetch.openapiRef = opKey;
+        changes.push(
+          `Normalized fetch.openapiRef → "${opKey}" for CIP operation "${opKey}"`
+        );
+        updated = true;
+      }
+    }
+  }
+  return updated;
+}
+
+module.exports = {
+  HTTP_CANONICAL_METADATA_SCHEMA,
+  HTTP_CANONICAL_EXPOSED_SCHEMA,
+  isDeprecatedNoneOpenapiHttpManifest,
+  normalizeCipOpenapiRefs,
+  repairNoneOpenapiHttpToServiceContract
+};

package/lib/commands/repair-datasource-operation-security.js

@@ -0,0 +1,180 @@
+/**
+ * Bind openapi.operations.*.security from rbac permissions for COM publish.
+ *
+ * @fileoverview repair-datasource-operation-security
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
+const { resolveRbacPath } = require('../utils/app-config-resolver');
+
+/**
+ * @param {Object} rbac
+ * @returns {Map<string, string[]>}
+ */
+function permissionRoleIndex(rbac) {
+  const index = new Map();
+  const perms = rbac && Array.isArray(rbac.permissions) ? rbac.permissions : [];
+  for (const perm of perms) {
+    if (!perm || typeof perm !== 'object') continue;
+    const name = typeof perm.name === 'string' ? perm.name.trim() : '';
+    if (!name) continue;
+    const roles = Array.isArray(perm.roles)
+      ? perm.roles.filter((r) => typeof r === 'string' && r.trim())
+      : [];
+    if (roles.length) index.set(name, roles);
+  }
+  return index;
+}
+
+/**
+ * @param {Map<string, string[]>} permIndex
+ * @param {string} resourceType
+ * @param {string} opKey
+ * @returns {Object[]|null}
+ */
+function expectedSecurityForOperation(permIndex, resourceType, opKey) {
+  const permName = `${resourceType}:${opKey}`;
+  const roles = permIndex.get(permName) || permIndex.get(permName.toLowerCase());
+  if (!roles || roles.length === 0) {
+    return null;
+  }
+  return roles.map((role) => ({ oauth2: [role] }));
+}
+
+/**
+ * @param {Object} opCfg
+ * @param {Object[]} expectedSecurity
+ * @returns {boolean}
+ */
+function applyOperationSecurity(opCfg, expectedSecurity) {
+  if (JSON.stringify(opCfg.security) === JSON.stringify(expectedSecurity)) {
+    return false;
+  }
+  opCfg.security = expectedSecurity;
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {{ ops: Object, resourceType: string }|null}
+ */
+function openApiOpsForSecurityBind(parsed) {
+  const openapi = parsed && parsed.openapi;
+  if (!openapi || typeof openapi !== 'object' || openapi.autoRbac !== true) {
+    return null;
+  }
+  const ops = openapi.operations;
+  if (!ops || typeof ops !== 'object' || Array.isArray(ops)) {
+    return null;
+  }
+  const resourceType = (typeof parsed.resourceType === 'string' && parsed.resourceType.trim()) || 'document';
+  return { ops, resourceType };
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Map<string, string[]>} permIndex
+ * @param {string[]} changes
+ * @param {string} fileName
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasource(parsed, permIndex, changes, fileName) {
+  const bindCtx = openApiOpsForSecurityBind(parsed);
+  if (!bindCtx) {
+    return false;
+  }
+  const { ops, resourceType } = bindCtx;
+  let updated = false;
+  for (const [opKey, opCfg] of Object.entries(ops)) {
+    if (!opCfg || typeof opCfg !== 'object') {
+      continue;
+    }
+    const expectedSecurity = expectedSecurityForOperation(permIndex, resourceType, opKey);
+    if (!expectedSecurity) {
+      continue;
+    }
+    updated = applyOperationSecurity(opCfg, expectedSecurity) || updated;
+  }
+  if (updated) {
+    changes.push(`${fileName}: Bound openapi.operations.*.security from rbac permissions`);
+  }
+  return updated;
+}
+
+/**
+ * @param {string} appPath
+ * @returns {Map<string, string[]>|null}
+ */
+function loadRbacPermissionIndex(appPath) {
+  const rbacPath = resolveRbacPath(appPath);
+  if (!rbacPath || !fs.existsSync(rbacPath)) {
+    return null;
+  }
+  try {
+    return permissionRoleIndex(loadConfigFile(rbacPath));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object} opts
+ * @returns {boolean}
+ */
+function bindSecurityOnDatasourceFile(opts) {
+  const { appPath, fileName, permIndex, dryRun, changes, backupCtx } = opts;
+  const filePath = path.join(appPath, fileName);
+  if (!fs.existsSync(filePath)) {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = loadConfigFile(filePath);
+  } catch {
+    return false;
+  }
+  const fileUpdated = bindSecurityOnDatasource(parsed, permIndex, changes, fileName);
+  if (!fileUpdated || dryRun) {
+    return fileUpdated;
+  }
+  backupIntegrationFile(filePath, backupCtx);
+  writeConfigFile(filePath, parsed);
+  trackRepairWrite(filePath, backupCtx);
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {boolean} dryRun
+ * @param {string[]} changes
+ * @param {Object} backupCtx
+ * @returns {boolean}
+ */
+function bindOpenApiOperationSecurityFromRbac(appPath, datasourceFiles, dryRun, changes, backupCtx) {
+  const permIndex = loadRbacPermissionIndex(appPath);
+  if (!permIndex || permIndex.size === 0) {
+    return false;
+  }
+
+  let anyUpdated = false;
+  for (const fileName of datasourceFiles || []) {
+    anyUpdated =
+      bindSecurityOnDatasourceFile({ appPath, fileName, permIndex, dryRun, changes, backupCtx }) ||
+      anyUpdated;
+  }
+  return anyUpdated;
+}
+
+module.exports = {
+  bindOpenApiOperationSecurityFromRbac,
+  permissionRoleIndex
+};

package/lib/commands/repair-datasource-run.js

@@ -23,11 +23,13 @@ const { repairDatasourceFile } = require('./repair-datasource');
  * @param {Object} options
  * @param {boolean} dryRun
  * @param {string[]} changes
+ * @param {Object} [context]
  * @returns {boolean}
  */
-function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes) {
+function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes, context = {}) {
   if (!datasourceFiles || datasourceFiles.length === 0) return false;
   let updated = false;
+  const warnings = Array.isArray(context.warnings) ? context.warnings : [];
   for (const fileName of datasourceFiles) {
     const filePath = path.join(appPath, fileName);
     if (!fs.existsSync(filePath)) continue;
@@ -36,7 +38,10 @@ function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes
       const { updated: fileUpdated, changes: fileChanges } = repairDatasourceFile(parsed, {
         expose: options.expose,
         sync: options.sync,
-        test: options.test
+        test: options.test,
+        operations: options.operations,
+        systemParsed: context.systemParsed,
+        warnings
       });
       if (fileUpdated) {
         updated = true;