@aifabrix/builder 2.49.2 → 2.51.0

package/lib/commands/repair-rbac-platform-preset.js

@@ -0,0 +1,204 @@
+/**
+ * Platform RBAC preset for orchestration facade external systems (plan 154.7).
+ *
+ * @fileoverview Replace per-system admin/reader with dataplane platform roles
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { CAPABILITIES } = require('../programmatic/capability-registry');
+const { listPlatformRoles, PLATFORM_ROLE_VALUES } = require('../programmatic/platform-rbac-catalog');
+
+const READ_ROLES = Object.freeze([
+  'aifabrix-observer',
+  'aifabrix-external-system-discoverer',
+  'aifabrix-developer',
+  'aifabrix-deployment-admin',
+  'aifabrix-platform-admin'
+]);
+
+const WRITE_ROLES = Object.freeze([
+  'aifabrix-developer',
+  'aifabrix-deployment-admin',
+  'aifabrix-platform-admin'
+]);
+
+const APPLY_ROLES = Object.freeze(['aifabrix-deployment-admin', 'aifabrix-platform-admin']);
+
+const CERTIFY_ROLES = Object.freeze([
+  'aifabrix-security-admin',
+  'aifabrix-compliance-admin',
+  'aifabrix-ai-trust-operator',
+  'aifabrix-platform-admin'
+]);
+
+/** @type {ReadonlyMap<string, string>} */
+const HANDLER_OPERATION_TYPE = (() => {
+  const map = new Map();
+  for (const cap of CAPABILITIES) {
+    map.set(_normalizeOpKey(cap.handlerId), cap.operationType);
+  }
+  return map;
+})();
+
+/**
+ * @param {string} opKey
+ * @returns {string}
+ */
+function _normalizeOpKey(opKey) {
+  const s = String(opKey || '').trim();
+  if (!s) return '';
+  if (/^[a-z][a-zA-Z0-9]*$/.test(s)) return s.toLowerCase();
+  return s
+    .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * @param {string} operationType
+ * @returns {string[]}
+ */
+function rolesForOperationType(operationType) {
+  const t = String(operationType || '');
+  if (t.endsWith('.read') || t === 'help.read' || t === 'infra') return [...READ_ROLES];
+  if (t === 'apply.dev') return [...APPLY_ROLES];
+  if (t.startsWith('certify')) return [...CERTIFY_ROLES];
+  if (t === 'plan' || t === 'template' || t === 'repository') return [...WRITE_ROLES];
+  if (t === 'validate' || t === 'test') return [...WRITE_ROLES];
+  if (t.endsWith('.write')) return [...WRITE_ROLES];
+  return [...WRITE_ROLES];
+}
+
+/**
+ * @param {string} opKey
+ * @param {string} [httpMethod]
+ * @returns {string[]}
+ */
+function rolesForOperationKey(opKey, httpMethod) {
+  const norm = _normalizeOpKey(opKey);
+  const fromRegistry = HANDLER_OPERATION_TYPE.get(norm);
+  if (fromRegistry) return rolesForOperationType(fromRegistry);
+  const method = String(httpMethod || '').toUpperCase();
+  if (method === 'GET' || norm.startsWith('list') || norm.startsWith('get')) return [...READ_ROLES];
+  return [...WRITE_ROLES];
+}
+
+/**
+ * @param {Object} rbac
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensurePlatformRolesOnRbac(rbac, changes) {
+  if (!rbac || typeof rbac !== 'object') return false;
+  const current = Array.isArray(rbac.roles) ? rbac.roles : [];
+  const onlySynthetic =
+    current.length > 0 &&
+    current.every((r) => {
+      const v = r && r.value;
+      return typeof v === 'string' && (v.endsWith('-admin') || v.endsWith('-reader'));
+    });
+  const missingPlatform = current.length === 0 || onlySynthetic;
+  if (!missingPlatform && current.every((r) => PLATFORM_ROLE_VALUES.includes(r.value))) {
+    return false;
+  }
+  rbac.roles = listPlatformRoles();
+  changes.push('Applied platform RBAC roles catalog (dataplane rbac.yaml SSOT)');
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @returns {ReadonlyMap<string, string>}
+ */
+function _loadOpHttpMethods(appPath, datasourceFiles) {
+  const methods = new Map();
+  for (const fileName of datasourceFiles || []) {
+    const filePath = path.join(appPath, fileName);
+    if (!fs.existsSync(filePath)) continue;
+    let parsed;
+    try {
+      parsed = loadConfigFile(filePath);
+    } catch {
+      continue;
+    }
+    const ops = parsed?.openapi?.operations;
+    if (!ops || typeof ops !== 'object') continue;
+    for (const [key, op] of Object.entries(ops)) {
+      const norm = _normalizeOpKey(key);
+      if (norm && op && op.method) methods.set(norm, String(op.method).toUpperCase());
+    }
+  }
+  return methods;
+}
+
+/**
+ * @param {Object} rbac
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyPlatformRolesToPermissions(rbac, appPath, datasourceFiles, changes) {
+  if (!rbac || !Array.isArray(rbac.permissions)) return false;
+  const opMethods = _loadOpHttpMethods(appPath, datasourceFiles);
+  let updated = false;
+  for (const perm of rbac.permissions) {
+    if (!perm || typeof perm.name !== 'string' || !perm.name.includes(':')) continue;
+    const opKey = perm.name.split(':')[1];
+    const roles = rolesForOperationKey(opKey, opMethods.get(_normalizeOpKey(opKey)));
+    const before = JSON.stringify(perm.roles || []);
+    perm.roles = [...roles];
+    if (JSON.stringify(perm.roles) !== before) updated = true;
+  }
+  if (updated) changes.push('Mapped permissions to platform roles by operation class');
+  return updated;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {string[]} changes
+ * @param {Object} [backupCtx]
+ * @returns {boolean}
+ */
+function ensureOrchestrationResourceType(appPath, datasourceFiles, changes, backupCtx) {
+  let updated = false;
+  for (const fileName of datasourceFiles || []) {
+    const filePath = path.join(appPath, fileName);
+    if (!fs.existsSync(filePath)) continue;
+    let parsed;
+    try {
+      parsed = loadConfigFile(filePath);
+    } catch {
+      continue;
+    }
+    if (parsed?.entityType !== 'none') continue;
+    const dsKey = typeof parsed.key === 'string' ? parsed.key.trim() : '';
+    if (dsKey && !dsKey.endsWith('-operations')) continue;
+    if (parsed.resourceType === 'workspace') continue;
+    backupIntegrationFile(filePath, backupCtx);
+    parsed.resourceType = 'workspace';
+    writeConfigFile(filePath, parsed);
+    changes.push(`Set resourceType workspace on orchestration datasource ${fileName}`);
+    updated = true;
+  }
+  return updated;
+}
+
+module.exports = {
+  rolesForOperationKey,
+  rolesForOperationType,
+  ensurePlatformRolesOnRbac,
+  applyPlatformRolesToPermissions,
+  ensureOrchestrationResourceType
+};

package/lib/commands/repair-rbac-reader-roles.js

@@ -0,0 +1,191 @@
+/**
+ * Reader role assignment and permission role defaults for COM oauth scope lint.
+ *
+ * @fileoverview repair-rbac-reader-roles
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { loadConfigFile } = require('../utils/config-format');
+
+const READ_ONLY_HTTP_METHODS = new Set(['GET', 'HEAD']);
+
+function roleValues(rbac) {
+  const roles = Array.isArray(rbac.roles) ? rbac.roles : [];
+  return roles.map((r) => r?.value).filter((v) => typeof v === 'string' && v.trim());
+}
+
+function pickAdminRoleValue(roleValuesList, systemKey) {
+  return (
+    roleValuesList.find((v) => v === `${systemKey}-admin`) ||
+    roleValuesList.find((v) => /-admin$/.test(v)) ||
+    roleValuesList[0] ||
+    null
+  );
+}
+
+function pickReaderRoleValue(roleValuesList, systemKey) {
+  return (
+    roleValuesList.find((v) => v === `${systemKey}-reader`) ||
+    roleValuesList.find((v) => /-reader$/.test(v)) ||
+    null
+  );
+}
+
+function capabilityFromPermissionName(name) {
+  if (typeof name !== 'string' || !name.includes(':')) return null;
+  return name.split(':')[1] || null;
+}
+
+function defaultRolesForCapability(cap, { adminValue, readerValue }) {
+  const roles = [];
+  if ((cap === 'list' || cap === 'get') && readerValue) roles.push(readerValue);
+  if (adminValue) roles.push(adminValue);
+  return roles;
+}
+
+/**
+ * @param {Object|null|undefined} opCfg
+ * @param {string} cap
+ * @returns {boolean}
+ */
+function isReadOnlyOpenApiOperation(opCfg, cap) {
+  if (opCfg && typeof opCfg === 'object' && typeof opCfg.method === 'string') {
+    const method = opCfg.method.trim().toUpperCase();
+    if (READ_ONLY_HTTP_METHODS.has(method)) return true;
+  }
+  return cap === 'list' || cap === 'get';
+}
+
+/**
+ * @param {Object} rbac
+ * @param {string} systemKey
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureNonEmptyPermissionRoles(rbac, systemKey, changes) {
+  const values = roleValues(rbac);
+  if (!Array.isArray(rbac.permissions) || values.length === 0) return false;
+
+  const adminValue = pickAdminRoleValue(values, systemKey);
+  const readerValue = pickReaderRoleValue(values, systemKey);
+  let updated = false;
+
+  for (const perm of rbac.permissions) {
+    if (!perm || typeof perm !== 'object') continue;
+    if (!Array.isArray(perm.roles)) perm.roles = [];
+    if (perm.roles.length > 0) continue;
+
+    const cap = capabilityFromPermissionName(perm.name);
+    const defaults = defaultRolesForCapability(cap, { adminValue, readerValue });
+    for (const rv of defaults) {
+      if (!perm.roles.includes(rv)) perm.roles.push(rv);
+    }
+    if (perm.roles.length > 0) {
+      changes.push(`RBAC: defaulted empty roles for ${perm.name}`);
+      updated = true;
+    }
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} rbac
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {string} systemKey
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureReaderRoleOnReadPermissions(rbac, appPath, datasourceFiles, systemKey, changes) {
+  const values = roleValues(rbac);
+  const readerValue = pickReaderRoleValue(values, systemKey);
+  const adminValue = pickAdminRoleValue(values, systemKey);
+  if (!readerValue || !adminValue) return false;
+  if (!Array.isArray(rbac.permissions) || rbac.permissions.length === 0) return false;
+
+  const permByName = new Map();
+  for (const perm of rbac.permissions) {
+    if (!perm || typeof perm.name !== 'string' || !perm.name.trim()) continue;
+    permByName.set(perm.name.trim(), perm);
+    permByName.set(perm.name.trim().toLowerCase(), perm);
+  }
+
+  let updated = false;
+  for (const fileName of datasourceFiles || []) {
+    updated = _applyReaderOnDatasourceFile(
+      appPath,
+      fileName,
+      permByName,
+      readerValue,
+      changes
+    ) || updated;
+  }
+  return updated;
+}
+
+/**
+ * @param {Map<string, Object>} permByName
+ * @param {string} permName
+ * @param {string} readerValue
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function addReaderRoleToPermission(permByName, permName, readerValue, changes) {
+  const perm = permByName.get(permName) || permByName.get(permName.toLowerCase());
+  if (!perm || !Array.isArray(perm.roles) || perm.roles.includes(readerValue)) {
+    return false;
+  }
+  perm.roles.push(readerValue);
+  changes.push(`RBAC: added reader role for read operation ${permName}`);
+  return true;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string} fileName
+ * @param {Map<string, Object>} permByName
+ * @param {string} readerValue
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function _applyReaderOnDatasourceFile(appPath, fileName, permByName, readerValue, changes) {
+  const filePath = path.join(appPath, fileName);
+  if (!fs.existsSync(filePath)) {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = loadConfigFile(filePath);
+  } catch {
+    return false;
+  }
+  const openapi = parsed && parsed.openapi;
+  const ops = openapi && typeof openapi === 'object' ? openapi.operations : null;
+  if (!ops || typeof ops !== 'object' || Array.isArray(ops)) {
+    return false;
+  }
+  const resourceType =
+    (typeof parsed.resourceType === 'string' && parsed.resourceType.trim()) || 'document';
+
+  let updated = false;
+  for (const [cap, opCfg] of Object.entries(ops)) {
+    if (!isReadOnlyOpenApiOperation(opCfg, cap)) {
+      continue;
+    }
+    const permName = `${resourceType}:${cap}`;
+    updated = addReaderRoleToPermission(permByName, permName, readerValue, changes) || updated;
+  }
+  return updated;
+}
+
+module.exports = {
+  READ_ONLY_HTTP_METHODS,
+  isReadOnlyOpenApiOperation,
+  ensureNonEmptyPermissionRoles,
+  ensureReaderRoleOnReadPermissions
+};