@aifabrix/builder 2.49.2 → 2.51.0

package/lib/commands/repair-rbac.js

@@ -16,6 +16,19 @@ const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { backupIntegrationFile } = require('../utils/integration-file-backup');
 const appConfigResolver = require('../utils/app-config-resolver');
 const { extractRbacFromSystem } = require('./repair-rbac-extract');
+const { toKebabAliasKey } = require('./repair-datasource-auto-rbac');
+const { mergeRbacIntoSystemJson } = require('../generator/external');
+const { bindOpenApiOperationSecurityFromRbac } = require('./repair-datasource-operation-security');
+const {
+  ensureNonEmptyPermissionRoles,
+  ensureReaderRoleOnReadPermissions
+} = require('./repair-rbac-reader-roles');
+const {
+  ensurePlatformRolesOnRbac,
+  applyPlatformRolesToPermissions,
+  ensureOrchestrationResourceType
+} = require('./repair-rbac-platform-preset');
+const { trackRepairWrite } = require('./repair-changed-files');
 
 const DEFAULT_CAPABILITIES = ['list', 'get', 'create', 'update', 'delete'];
 
@@ -26,6 +39,8 @@ function _safeString(v) {
 function _normalizeOperationKey(opKey) {
   const s = _safeString(opKey);
   if (!s) return '';
+  // Match dataplane autoRbac permission names: lowercase schema-valid camelCase keys.
+  if (/^[a-z][a-zA-Z0-9]*$/.test(s)) return s.toLowerCase();
   const withHyphens = s.replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
   const cleaned = withHyphens.replace(/[^a-z0-9-]+/g, '-');
   return cleaned.replace(/-+/g, '-').replace(/^-+|-+$/g, '');
@@ -116,20 +131,39 @@ function _collectManagedResourceTypesFromDatasources(appPath, datasourceFiles) {
   return out;
 }
 
-function _buildDesiredPermissionNames(appPath, datasourceFiles) {
-  const desired = collectPermissionNames(appPath, datasourceFiles);
-  if (desired.size === 0) return { desired, managedResourceTypes: new Set(), aliases: new Map() };
-
-  const managedResourceTypes = _collectManagedResourceTypesFromDatasources(appPath, datasourceFiles);
+function _registerOpAlias(aliases, rt, opKey, canonicalOp, desired) {
+  const canonicalName = `${rt}:${canonicalOp}`;
+  desired.add(canonicalName);
+  const kebabLegacy = toKebabAliasKey(opKey);
+  if (kebabLegacy && kebabLegacy !== canonicalOp) {
+    aliases.set(`${rt}:${kebabLegacy}`, canonicalName);
+  }
+}
 
-  // Build alias map for rename support (kebab-case or case variants -> canonical).
+function _collectOpAliasesFromDatasources(appPath, datasourceFiles, desired) {
   const aliases = new Map();
+  for (const fileName of datasourceFiles || []) {
+    const parsed = _safeLoadDatasource(appPath, fileName);
+    if (!parsed || !_hasAutoRbacOps(parsed)) {
+      continue;
+    }
+    const rt = _safeString(parsed.resourceType) || 'document';
+    for (const opKey of Object.keys(parsed.openapi.operations)) {
+      const canonicalOp = _normalizeOperationKey(opKey) || _safeString(opKey);
+      if (!canonicalOp) {
+        continue;
+      }
+      _registerOpAlias(aliases, rt, opKey, canonicalOp, desired);
+    }
+  }
+  return aliases;
+}
+
+function _addDesiredNameVariants(desired, aliases) {
   for (const name of desired) {
     const [rt, op] = String(name).split(':');
-    if (!rt || !op) continue;
-    const kebab = _normalizeOperationKey(op);
-    if (kebab && `${rt}:${kebab}` !== name) {
-      aliases.set(`${rt}:${kebab}`, name);
+    if (!rt || !op) {
+      continue;
     }
     const lower = `${rt}:${String(op).toLowerCase()}`;
     if (lower !== name) {
@@ -140,6 +174,17 @@ function _buildDesiredPermissionNames(appPath, datasourceFiles) {
       aliases.set(dehyphen, name);
     }
   }
+}
+
+function _buildDesiredPermissionNames(appPath, datasourceFiles) {
+  const desired = collectPermissionNames(appPath, datasourceFiles);
+  if (desired.size === 0) {
+    return { desired, managedResourceTypes: new Set(), aliases: new Map() };
+  }
+
+  const managedResourceTypes = _collectManagedResourceTypesFromDatasources(appPath, datasourceFiles);
+  const aliases = _collectOpAliasesFromDatasources(appPath, datasourceFiles, desired);
+  _addDesiredNameVariants(desired, aliases);
   return { desired, managedResourceTypes, aliases };
 }
 
@@ -253,80 +298,31 @@ function ensureDefaultRoles(rbac, systemKey, displayName, changes) {
   return true;
 }
 
-function _roleValues(rbac) {
-  const roles = Array.isArray(rbac.roles) ? rbac.roles : [];
-  return roles
-    .map(r => r?.value)
-    .filter(v => typeof v === 'string' && v.trim());
-}
-
-function _pickAdminRoleValue(roleValues, systemKey) {
-  return (
-    roleValues.find(v => v === `${systemKey}-admin`) ||
-    roleValues.find(v => /-admin$/.test(v)) ||
-    roleValues[0] ||
-    null
-  );
-}
-
-function _pickReaderRoleValue(roleValues, systemKey) {
-  return (
-    roleValues.find(v => v === `${systemKey}-reader`) ||
-    roleValues.find(v => /-reader$/.test(v)) ||
-    null
-  );
-}
-
-function _capabilityFromPermissionName(name) {
-  if (typeof name !== 'string' || !name.includes(':')) return null;
-  return name.split(':')[1] || null;
-}
-
-function _defaultRolesForCapability(cap, { adminValue, readerValue }) {
-  const roles = [];
-  if ((cap === 'list' || cap === 'get') && readerValue) roles.push(readerValue);
-  if (adminValue) roles.push(adminValue);
-  return roles;
+/**
+ * @param {Object} opts
+ * @returns {boolean}
+ */
+function applyRbacPresetRoles(opts) {
+  const { rbac, rbacPreset, systemKey, displayName, appPath, datasourceFiles, changes } = opts;
+  if (rbacPreset === 'platform') {
+    return (
+      ensurePlatformRolesOnRbac(rbac, changes) ||
+      applyPlatformRolesToPermissions(rbac, appPath, datasourceFiles, changes)
+    );
+  }
+  return ensureDefaultRoles(rbac, systemKey, displayName, changes);
 }
 
 /**
- * Ensures every permission has at least one role assigned.
- *
- * When roles already exist, new permissions may be added with empty roles (invalid for manifest).
- * Apply a safe default:
- * - list/get -> reader + admin when those roles exist
- * - create/update/delete -> admin when it exists (otherwise first available role)
- *
- * Mutates rbac.
- * @param {Object} rbac - RBAC object (mutated)
- * @param {string} systemKey - System key
- * @param {string[]} changes - Array to append to
+ * @param {Object} opts
  * @returns {boolean}
  */
-function ensureNonEmptyPermissionRoles(rbac, systemKey, changes) {
-  const roleValues = _roleValues(rbac);
-  if (!Array.isArray(rbac.permissions) || roleValues.length === 0) return false;
-
-  const adminValue = _pickAdminRoleValue(roleValues, systemKey);
-  const readerValue = _pickReaderRoleValue(roleValues, systemKey);
-
-  let updated = false;
-  for (const p of rbac.permissions) {
-    if (!p || typeof p !== 'object') continue;
-    if (!Array.isArray(p.roles)) p.roles = [];
-    if (p.roles.length > 0) continue;
-
-    const cap = _capabilityFromPermissionName(p.name);
-    const defaults = _defaultRolesForCapability(cap, { adminValue, readerValue });
-    for (const rv of defaults) {
-      if (!p.roles.includes(rv)) p.roles.push(rv);
-    }
-    if (p.roles.length > 0) {
-      changes.push(`RBAC: defaulted empty roles for ${p.name}`);
-      updated = true;
-    }
+function applyReaderRolesIfNeeded(opts) {
+  const { rbac, rbacPreset, appPath, datasourceFiles, systemKey, changes } = opts;
+  if (rbacPreset === 'platform') {
+    return false;
   }
-  return updated;
+  return ensureReaderRoleOnReadPermissions(rbac, appPath, datasourceFiles, systemKey, changes);
 }
 
 /**
@@ -341,18 +337,35 @@ function ensureNonEmptyPermissionRoles(rbac, systemKey, changes) {
  * @returns {boolean} True if rbac was updated (or would be in dry-run)
  */
 function mergeRbacFromDatasources(appPath, systemParsed, datasourceFiles, extractRbacFromSystem, options) {
-  const { format = 'yaml', dryRun, changes, backupCtx } = options;
+  const { format = 'yaml', dryRun, changes, backupCtx, rbacPreset } = options;
   const rbacFormat = format === 'json' ? 'json' : 'yaml';
-  const { desired: permissionNames, managedResourceTypes, aliases } = _buildDesiredPermissionNames(appPath, datasourceFiles);
-  if (permissionNames.size === 0) return false;
+  const { desired: permissionNames, managedResourceTypes, aliases } = _buildDesiredPermissionNames(
+    appPath,
+    datasourceFiles
+  );
+  if (permissionNames.size === 0) {
+    return false;
+  }
   const systemKey = systemParsed?.key || 'system';
   const displayName = systemParsed?.displayName || systemKey;
   const { rbac, rbacPath } = loadOrCreateRbac(appPath, systemParsed, extractRbacFromSystem, rbacFormat);
   let updated = _renameExistingPermissionIfAliasMatches(rbac, aliases, changes);
   updated = addMissingPermissions(rbac, permissionNames, changes) || updated;
   updated = _removeExtraAutoRbacPermissions(rbac, permissionNames, managedResourceTypes, changes) || updated;
-  updated = ensureDefaultRoles(rbac, systemKey, displayName, changes) || updated;
+  updated =
+    applyRbacPresetRoles({
+      rbac,
+      rbacPreset,
+      systemKey,
+      displayName,
+      appPath,
+      datasourceFiles,
+      changes
+    }) || updated;
   updated = ensureNonEmptyPermissionRoles(rbac, systemKey, changes) || updated;
+  updated =
+    applyReaderRolesIfNeeded({ rbac, rbacPreset, appPath, datasourceFiles, systemKey, changes }) ||
+    updated;
   if (updated && !dryRun) {
     backupIntegrationFile(rbacPath, backupCtx);
     writeConfigFile(rbacPath, rbac);
@@ -386,6 +399,44 @@ function createRbacFromSystemIfNeeded(opts) {
   return true;
 }
 
+/**
+ * Copy roles/permissions from rbac file into *-system.json for dataplane COM publish.
+ * @param {string} appPath
+ * @param {string} systemFilePath
+ * @param {Object} systemParsed
+ * @param {boolean} dryRun
+ * @param {string[]} changes
+ * @param {Object} backupCtx
+ * @returns {boolean}
+ */
+function syncRbacFileIntoSystem(appPath, systemFilePath, systemParsed, dryRun, changes, backupCtx) {
+  const rbacPath = appConfigResolver.resolveRbacPath(appPath);
+  if (!rbacPath || !fs.existsSync(rbacPath)) return false;
+  let rbac;
+  try {
+    rbac = loadConfigFile(rbacPath);
+  } catch {
+    return false;
+  }
+  const before = JSON.stringify({
+    roles: systemParsed.roles || [],
+    permissions: systemParsed.permissions || []
+  });
+  mergeRbacIntoSystemJson(systemParsed, rbac);
+  const after = JSON.stringify({
+    roles: systemParsed.roles || [],
+    permissions: systemParsed.permissions || []
+  });
+  if (before === after) return false;
+  if (!dryRun) {
+    backupIntegrationFile(systemFilePath, backupCtx);
+    writeConfigFile(systemFilePath, systemParsed);
+    trackRepairWrite(systemFilePath, backupCtx);
+  }
+  changes.push('Synced roles/permissions from rbac file into system manifest');
+  return true;
+}
+
 /**
  * @param {string} appPath
  * @param {string} systemFilePath
@@ -395,20 +446,46 @@ function createRbacFromSystemIfNeeded(opts) {
  * @returns {{ rbacMigratedFromSystem: boolean, rbacMergeUpdated: boolean }}
  */
 function maybeRepairRbac(appPath, systemFilePath, systemParsed, datasourceFiles, options) {
-  if (!options.rbac) return { rbacMigratedFromSystem: false, rbacMergeUpdated: false };
-  const { dryRun, changes, backupCtx, rbacFmt } = options;
+  if (!options.rbac) {
+    return {
+      rbacMigratedFromSystem: false,
+      rbacMergeUpdated: false,
+      rbacSyncedIntoSystem: false,
+      rbacSecurityBound: false
+    };
+  }
+  const { dryRun, changes, backupCtx, rbacFmt, rbacPreset } = options;
   const rbacMigratedFromSystem = migrateSystemRbacIntoRbacFile(appPath, systemFilePath, systemParsed, {
     dryRun,
     changes,
     backupCtx
   });
+  if (rbacPreset === 'platform' && !dryRun) {
+    ensureOrchestrationResourceType(appPath, datasourceFiles, changes, backupCtx);
+  }
   const rbacMergeUpdated = mergeRbacFromDatasources(appPath, systemParsed, datasourceFiles, extractRbacFromSystem, {
     format: rbacFmt,
     dryRun,
     changes,
-    backupCtx
+    backupCtx,
+    rbacPreset
   });
-  return { rbacMigratedFromSystem, rbacMergeUpdated };
+  const rbacSyncedIntoSystem = syncRbacFileIntoSystem(
+    appPath,
+    systemFilePath,
+    systemParsed,
+    dryRun,
+    changes,
+    backupCtx
+  );
+  const rbacSecurityBound = bindOpenApiOperationSecurityFromRbac(
+    appPath,
+    datasourceFiles,
+    dryRun,
+    changes,
+    backupCtx
+  );
+  return { rbacMigratedFromSystem, rbacMergeUpdated, rbacSyncedIntoSystem, rbacSecurityBound };
 }
 
 module.exports = {

package/lib/commands/repair-steps.js

@@ -20,6 +20,10 @@ const {
   ensureExternalIntegrationBlock,
   removeAuthVarsFromConfiguration
 } = require('./repair-system-alignment');
+const {
+  repairAuthenticationsArray,
+  ensureAuthUsageSlots
+} = require('./repair-authentications-454');
 const {
   isAllowedRepairAuth,
   normalizeRepairAuthOption,
@@ -80,7 +84,8 @@ function persistSystemFileRepair(ctx, flags) {
     flags.authShapeNormalized ||
     flags.systemAuthConfigNormalized ||
     flags.systemDataSourcesAligned ||
-    flags.authVarsRemoved;
+    flags.authVarsRemoved ||
+    flags.authenticationsArrayUpdated;
   if (!systemFileUpdated) {
     return false;
   }
@@ -94,21 +99,60 @@ function persistSystemFileRepair(ctx, flags) {
 
 /**
  * @param {Object} ctx
- * @returns {{ updated: boolean, appKeyFixed: boolean, datasourceKeysFixed: boolean, rbacFileCreated: boolean, envTemplateRepaired: boolean }}
+ * @returns {{ updated: boolean, authenticationsArrayUpdated: boolean }}
  */
-function runRepairSteps(ctx) {
-  const bc = ctx.backupCtx;
-  let updated = ensureExternalIntegrationBlock(
-    ctx.variables, ctx.systemFiles, ctx.datasourceFiles, ctx.changes
-  );
+function applyAuthUsageSlotsRepair(ctx) {
+  if (!ctx.options?.authWebhook && !ctx.options?.authSync) {
+    return { updated: false, authenticationsArrayUpdated: false };
+  }
+  const slotsResult = ensureAuthUsageSlots(ctx.systemParsed, {
+    authWebhook: Boolean(ctx.options.authWebhook),
+    authSync: Boolean(ctx.options.authSync),
+    systemKey: ctx.systemKey
+  });
+  if (slotsResult.warnings.length) {
+    ctx.warnings.push(...slotsResult.warnings);
+    slotsResult.warnings.forEach((msg) => ctx.changes.push(msg));
+  }
+  return {
+    updated: slotsResult.changed,
+    authenticationsArrayUpdated: slotsResult.changed
+  };
+}
+
+/**
+ * @param {Object} ctx
+ * @returns {{ updated: boolean, authReplaced: boolean, authShapeNormalized: boolean, authenticationsArrayUpdated: boolean }}
+ */
+function runAuthRepairSteps(ctx) {
   const authReplaced = applyAuthMethod(ctx);
-  updated = updated || authReplaced;
   const authShapeNormalized = normalizeAuthenticationSchemaShape(
     ctx.systemParsed,
     ctx.systemKey,
     ctx.changes
   );
-  updated = updated || authShapeNormalized;
+  const authArrayResult = repairAuthenticationsArray(ctx.systemParsed);
+  let updated = authReplaced || authShapeNormalized;
+  let authenticationsArrayUpdated = authArrayResult.changed;
+  if (authArrayResult.changed) {
+    ctx.changes.push('Normalized legacy authentication to authentications[]');
+    updated = true;
+  }
+  if (authArrayResult.warnings.length) {
+    ctx.warnings.push(...authArrayResult.warnings);
+  }
+  const slotsResult = applyAuthUsageSlotsRepair(ctx);
+  updated = updated || slotsResult.updated;
+  authenticationsArrayUpdated = authenticationsArrayUpdated || slotsResult.authenticationsArrayUpdated;
+  return { updated, authReplaced, authShapeNormalized, authenticationsArrayUpdated };
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} authFlags
+ * @returns {boolean}
+ */
+function persistAuthSystemFileRepair(ctx, authFlags) {
   const systemAuthConfigNormalized = normalizeSystemFileAuthAndConfig(
     ctx.systemParsed, ctx.systemKey, ctx.changes
   );
@@ -118,14 +162,20 @@ function runRepairSteps(ctx) {
   const authVarsRemoved = removeAuthVarsFromConfiguration(
     ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes
   );
-  const systemFileUpdated = persistSystemFileRepair(ctx, {
-    authReplaced,
-    authShapeNormalized,
+  return persistSystemFileRepair(ctx, {
+    ...authFlags,
     systemAuthConfigNormalized,
     systemDataSourcesAligned,
     authVarsRemoved
   });
-  updated = updated || systemFileUpdated;
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} bc
+ * @returns {{ appKeyFixed: boolean, datasourceKeysFixed: boolean, rbacFileCreated: boolean, envTemplateRepaired: boolean }}
+ */
+function runManifestRepairSteps(ctx, bc) {
   const appKeyFixed = alignAppKeyWithSystem(
     ctx.variables, ctx.systemKey, ctx.systemParsed, ctx.changes
   );
@@ -144,14 +194,29 @@ function runRepairSteps(ctx) {
   const envTemplateRepaired = repairEnvTemplate(
     ctx.appPath, ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes, bc
   );
-  updated = updated || appKeyFixed || datasourceKeysFixed || rbacFileCreated || envTemplateRepaired;
+  return { appKeyFixed, datasourceKeysFixed, rbacFileCreated, envTemplateRepaired };
+}
+
+/**
+ * @param {Object} ctx
+ * @returns {{ updated: boolean, appKeyFixed: boolean, datasourceKeysFixed: boolean, rbacFileCreated: boolean, envTemplateRepaired: boolean }}
+ */
+function runRepairSteps(ctx) {
+  const bc = ctx.backupCtx;
+  let updated = ensureExternalIntegrationBlock(
+    ctx.variables, ctx.systemFiles, ctx.datasourceFiles, ctx.changes
+  );
+  const authResult = runAuthRepairSteps(ctx);
+  updated = updated || authResult.updated;
+  const systemFileUpdated = persistAuthSystemFileRepair(ctx, authResult);
+  updated = updated || systemFileUpdated;
+  const manifestResult = runManifestRepairSteps(ctx, bc);
+  updated = updated || manifestResult.appKeyFixed || manifestResult.datasourceKeysFixed
+    || manifestResult.rbacFileCreated || manifestResult.envTemplateRepaired;
   auditRepairAuthenticationWarnings(ctx.systemParsed, ctx.warnings);
   return {
     updated,
-    appKeyFixed,
-    datasourceKeysFixed,
-    rbacFileCreated,
-    envTemplateRepaired
+    ...manifestResult
   };
 }
 

package/lib/commands/repair-system-permissions.js

@@ -17,6 +17,7 @@ function _safeString(v) {
 function _normalizeOperationKey(opKey) {
   const s = _safeString(opKey);
   if (!s) return '';
+  if (/^[a-z][a-zA-Z0-9]*$/.test(s)) return s.toLowerCase();
   const withHyphens = s.replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
   const cleaned = withHyphens.replace(/[^a-z0-9-]+/g, '-');
   return cleaned.replace(/-+/g, '-').replace(/^-+|-+$/g, '');

package/lib/commands/repair.js

@@ -51,7 +51,7 @@ async function validateAndResolveRepairPaths(appName, options) {
   if (authOption !== undefined && authOption !== null && typeof authOption !== 'string') {
     throw new Error('Option --auth must be a string');
   }
-  const { appPath, isExternal } = await detectAppType(appName);
+  const { appPath, isExternal } = await detectAppType(appName, options);
   if (!isExternal) throw new Error(`App '${appName}' is not an external integration`);
   const configPath = resolveApplicationConfigPath(appPath);
   if (!fs.existsSync(configPath)) throw new Error(`Application config not found: ${configPath}`);