@aifabrix/builder 2.49.2 → 2.51.0

package/lib/generator/deploy-script.js

@@ -0,0 +1,73 @@
+/**
+ * Generate integration deploy.js from Handlebars template.
+ *
+ * @fileoverview ESLint-clean deploy script for external integrations
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const Handlebars = require('handlebars');
+
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+
+const templatesExternalDir = path.join(__dirname, '..', '..', 'templates', 'external-system');
+
+/**
+ * @param {string} templateName
+ * @param {string} outputPath
+ * @param {Object} context
+ */
+async function writeDeployScriptFromTemplate(templateName, outputPath, context) {
+  const templatePath = path.join(templatesExternalDir, templateName);
+  const content = Handlebars.compile(fs.readFileSync(templatePath, 'utf8'))(context);
+  fs.writeFileSync(outputPath, content, { mode: 0o644, encoding: 'utf8' });
+  logger.log(formatSuccessLine(`Generated ${path.basename(outputPath)}`));
+}
+
+/**
+ * @param {string} appPath
+ * @param {string} systemKey
+ * @param {string} systemFileName
+ * @param {string[]} datasourceFileNames
+ * @returns {Promise<{ deployJsPath: string }>}
+ */
+async function generateDeployScripts(appPath, systemKey, systemFileName, datasourceFileNames) {
+  try {
+    const allJsonFiles = [systemFileName, ...datasourceFileNames];
+    const context = { systemKey, allJsonFiles, datasourceFileNames };
+    const deployJsPath = path.join(appPath, 'deploy.js');
+    await writeDeployScriptFromTemplate('deploy.js.hbs', deployJsPath, context);
+    return { deployJsPath };
+  } catch (error) {
+    throw new Error(`Failed to generate deployment scripts: ${error.message}`);
+  }
+}
+
+/**
+ * Regenerate deploy.js from integration manifest file lists.
+ *
+ * @param {Object} params
+ * @param {string} params.appPath
+ * @param {string} params.systemKey
+ * @param {string[]} params.systemFiles
+ * @param {string[]} params.datasourceFiles
+ * @returns {Promise<{ deployJsPath: string }>}
+ */
+async function regenerateDeployScriptFromIntegration(params) {
+  const { appPath, systemKey, systemFiles, datasourceFiles } = params;
+  if (!systemFiles?.length) {
+    throw new Error('externalIntegration.systems is empty — cannot generate deploy.js');
+  }
+  return generateDeployScripts(appPath, systemKey, systemFiles[0], datasourceFiles || []);
+}
+
+module.exports = {
+  writeDeployScriptFromTemplate,
+  generateDeployScripts,
+  regenerateDeployScriptFromIntegration
+};

package/lib/generator/external.js

@@ -436,6 +436,7 @@ module.exports = {
   splitExternalApplicationSchema,
   loadSystemFile,
   loadDatasourceFiles,
-  loadExternalIntegrationConfig
+  loadExternalIntegrationConfig,
+  mergeRbacIntoSystemJson
 };
 

package/lib/generator/helpers.js

@@ -156,10 +156,10 @@ function validatePortalInput(portalInput, variableName) {
  * @throws {Error} If portalInput structure is invalid
  */
 /**
- * Creates a map of portalInput configurations from variables config
+ * Creates a map of portal overlay metadata from variables config
  * @function createPortalInputMap
  * @param {Object|null} variablesConfig - Configuration from application.yaml
- * @returns {Map} Map of variable names to portalInput configurations
+ * @returns {Map} Map of variable names to { portalInput, category? }
  */
 function createPortalInputMap(variablesConfig) {
   const portalInputMap = new Map();
@@ -168,7 +168,11 @@ function createPortalInputMap(variablesConfig) {
       if (configItem.name && configItem.portalInput) {
         // Validate portalInput before adding to map
         validatePortalInput(configItem.portalInput, configItem.name);
-        portalInputMap.set(configItem.name, configItem.portalInput);
+        const overlay = { portalInput: configItem.portalInput };
+        if (typeof configItem.category === 'string' && configItem.category.trim().length > 0) {
+          overlay.category = configItem.category.trim();
+        }
+        portalInputMap.set(configItem.name, overlay);
       }
     }
   }
@@ -291,9 +295,13 @@ function createConfigItem(key, value, location, required, portalInputMap, appKey
     required
   };
 
-  // Merge portalInput if it exists in application config
+  // Merge portalInput / category if present in application config
   if (portalInputMap.has(key)) {
-    configItem.portalInput = portalInputMap.get(key);
+    const overlay = portalInputMap.get(key);
+    configItem.portalInput = overlay.portalInput;
+    if (typeof overlay.category === 'string' && overlay.category.length > 0) {
+      configItem.category = overlay.category;
+    }
   }
 
   return configItem;

package/lib/generator/index.js

@@ -302,7 +302,22 @@ async function generateDeployJson(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const { isExternal, appPath, appType } = await detectAppType(appName);
+  let appPath;
+  let isExternal;
+  let appType;
+  if (options.appPath) {
+    appPath = path.resolve(options.appPath);
+    const configPath = resolveApplicationConfigPath(appPath);
+    const { loadConfigFile } = require('../utils/config-format');
+    const variables = loadConfigFile(configPath);
+    appType = variables?.app?.type || 'external';
+    isExternal = appType === 'external';
+  } else {
+    const detected = await detectAppType(appName, options);
+    appPath = detected.appPath;
+    isExternal = detected.isExternal;
+    appType = detected.appType;
+  }
   logOfflinePathWhenType(appPath);
   if (isExternal) {
     return writeExternalDeployJson(appName, appPath, options);
@@ -315,7 +330,7 @@ async function generateDeployJsonWithValidation(appName, options = {}) {
   const jsonContent = fs.readFileSync(jsonPath, 'utf8');
   const deployment = JSON.parse(jsonContent);
 
-  const { isExternal } = await detectAppType(appName);
+  const { isExternal } = await detectAppType(appName, options);
 
   // For external systems, skip deployment JSON validation (they use external system JSON structure)
   if (isExternal) {

package/lib/generator/split-variables.js

@@ -66,15 +66,21 @@ function extractOptionalSections(deployment) {
 }
 
 /**
- * Portal-only configuration for application.yaml (name + portalInput per entry).
+ * Portal-only configuration for application.yaml (name + optional category + portalInput).
  * @param {Array} configuration - Configuration array from deployment JSON
- * @returns {Array<{ name: string, portalInput: Object }>}
+ * @returns {Array<{ name: string, category?: string, portalInput: Object }>}
  */
 function extractPortalInputConfiguration(configuration) {
   if (!Array.isArray(configuration) || configuration.length === 0) return [];
   return configuration
     .filter(item => item && item.portalInput && typeof item.name === 'string')
-    .map(item => ({ name: item.name, portalInput: item.portalInput }));
+    .map(item => {
+      const entry = { name: item.name, portalInput: item.portalInput };
+      if (typeof item.category === 'string' && item.category.trim().length > 0) {
+        entry.category = item.category.trim();
+      }
+      return entry;
+    });
 }
 
 /**

package/lib/generator/wizard.js

@@ -11,7 +11,6 @@
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const fs = require('fs').promises;
 const path = require('path');
-const Handlebars = require('handlebars');
 const logger = require('../utils/logger');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
@@ -178,7 +177,8 @@ async function generateConfigFilesForWizard(params) {
 }
 
 async function prepareWizardContext(appName, systemConfig, datasourceConfigs) {
-  const appPath = path.join(process.cwd(), 'integration', appName);
+  const { getIntegrationPath } = require('../utils/paths');
+  const appPath = getIntegrationPath(appName);
   await fs.mkdir(appPath, { recursive: true });
   const finalSystemKey = appName;
   const originalSystemKey = systemConfig.key || finalSystemKey;
@@ -430,40 +430,7 @@ async function _generateEnvTemplate(appPath, systemConfig, finalSystemKey) {
   }
 }
 
-/**
- * Generate deployment script (deploy.js) from template
- * @async
- * @function generateDeployScripts
- * @param {string} appPath - Application directory path
- * @param {string} systemKey - System key
- * @param {string} systemFileName - System file name
- * @param {string[]} datasourceFileNames - Array of datasource file names
- * @returns {Promise<Object>} Object with deployJsPath
- * @throws {Error} If generation fails
- */
-const templatesExternalDir = path.join(__dirname, '..', '..', 'templates', 'external-system');
-
-async function writeDeployScriptFromTemplate(templateName, outputPath, context) {
-  const templatePath = path.join(templatesExternalDir, templateName);
-  const content = Handlebars.compile(await fs.readFile(templatePath, 'utf8'))(context);
-  await fs.writeFile(outputPath, content, 'utf8');
-  logger.log(formatSuccessLine(`Generated ${path.basename(outputPath)}`));
-}
-
-async function generateDeployScripts(appPath, systemKey, systemFileName, datasourceFileNames) {
-  try {
-    const allJsonFiles = [systemFileName, ...datasourceFileNames];
-    const context = { systemKey, allJsonFiles, datasourceFileNames };
-
-    await writeDeployScriptFromTemplate('deploy.js.hbs', path.join(appPath, 'deploy.js'), context);
-
-    return {
-      deployJsPath: path.join(appPath, 'deploy.js')
-    };
-  } catch (error) {
-    throw new Error(`Failed to generate deployment scripts: ${error.message}`);
-  }
-}
+const { generateDeployScripts } = require('./deploy-script');
 
 module.exports = {
   generateWizardFiles,

package/lib/infrastructure/helpers-docker-check.js

@@ -53,6 +53,12 @@ function formatDockerInfrastructureFailure(detail) {
  */
 async function checkDockerAvailability() {
   await ensureDevCertsIfNeededForRemoteDocker();
+  try {
+    const { ensureDevCertFreshIfDue } = require('../commands/dev-refresh');
+    await ensureDevCertFreshIfDue({ quiet: true });
+  } catch {
+    // Best-effort renew for remote Docker TLS; docker check reports real failures
+  }
   try {
     await dockerUtils.ensureDockerAndCompose();
   } catch (error) {

package/lib/infrastructure/helpers.js

@@ -181,7 +181,7 @@ function generatePgAdminConfig(infraDir, postgresPassword) {
  * @returns {string} Escaped string
  */
 function escapePgString(s) {
-  if (s === null || s === undefined || typeof s !== 'string') return '';
+  if (typeof s !== 'string') return '';
   return s.replace(/'/g, '\'\'');
 }
 

package/lib/internal/fs-real-sync.js

@@ -118,6 +118,25 @@ function unlinkSync(p) {
   return delegate('unlinkSync', [p]);
 }
 
+/**
+ * @param {string} src
+ * @param {string} dest
+ * @returns {void}
+ */
+function copyFileSync(src, dest) {
+  return delegate('copyFileSync', [src, dest]);
+}
+
+/**
+ * @param {string} p
+ * @param {string|Buffer} data
+ * @param {object|string} [opts]
+ * @returns {void}
+ */
+function appendFileSync(p, data, opts) {
+  return delegate('appendFileSync', opts !== undefined ? [p, data, opts] : [p, data]);
+}
+
 module.exports = {
   existsSync,
   readFileSync,
@@ -128,5 +147,7 @@ module.exports = {
   readdirSync,
   mkdtempSync,
   rmSync,
-  unlinkSync
+  unlinkSync,
+  copyFileSync,
+  appendFileSync
 };

package/lib/internal/node-fs.js

@@ -73,6 +73,7 @@ function buildBoundFs() {
       readdirSync: snap.readdirSync,
       statSync: snap.statSync,
       renameSync: snap.renameSync,
+      copyFileSync: snap.copyFileSync,
       watch: (...args) => live.watch(...args),
       promises: boundPromises
     };
@@ -85,6 +86,7 @@ function buildBoundFs() {
     readdirSync: bindSync(rf, 'readdirSync'),
     statSync: bindSync(rf, 'statSync'),
     renameSync: bindSync(rf, 'renameSync'),
+    copyFileSync: bindSync(rf, 'copyFileSync'),
     watch: (...args) => live.watch(...args),
     promises: boundPromises
   };

package/lib/lifecycle/lifecycle-governance-options.js

@@ -34,7 +34,7 @@ function buildGovernanceOptsFromLifecycle(options, context = {}) {
     env: options.env || 'dev',
     verbose: options.verbose === true,
     debug: options.debug === true,
-    noSync: true,
+    noPublish: true,
     force: options.force === true,
     certificationProfile: options.certificationProfile || 'bronze',
     subjectEmails: options.subjectEmail || options.subjectEmails || [],

package/lib/lifecycle/verify-step-progress.js

@@ -53,7 +53,7 @@ function formatVerifyStepLabel(label) {
  * @returns {Promise<T>}
  */
 async function runWithVerifyStepProgress(label, work, options = {}) {
-  if (!shouldShowVerifyStepProgress(options)) {
+  if (options.quietProgress === true || !shouldShowVerifyStepProgress(options)) {
     return withQuietLogs(() => work({ setLabel: () => {} }));
   }
 

package/lib/programmatic/access-log.js

@@ -0,0 +1,26 @@
+/**
+ * Structured access logging for builder-api requests.
+ *
+ * @fileoverview JSON logs without tokens or manifest bodies
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { redactForLog } = require('./log-redaction');
+
+/**
+ * @param {Object} entry
+ */
+function writeAccessLog(entry) {
+  const payload = redactForLog({
+    timestamp: new Date().toISOString(),
+    ...entry
+  });
+  process.stdout.write(`${JSON.stringify(payload)}\n`);
+}
+
+module.exports = {
+  writeAccessLog
+};

package/lib/programmatic/auth-config.js

@@ -0,0 +1,45 @@
+/**
+ * Bearer auth config for programmatic Dataplane calls.
+ *
+ * @fileoverview Build authConfig from user Bearer token (no device token store)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} bearerToken
+ * @returns {{ type: 'bearer', token: string, preserveBearer: true }}
+ */
+function buildBearerAuthConfig(bearerToken) {
+  if (!bearerToken || typeof bearerToken !== 'string') {
+    throw new Error('Bearer token is required');
+  }
+  const token = bearerToken.startsWith('Bearer ') ? bearerToken.slice(7).trim() : bearerToken.trim();
+  if (!token) {
+    throw new Error('Bearer token is required');
+  }
+  // Token-forward: caller JWT must reach dataplane CIP/pipeline unchanged (no API_KEY swap).
+  return { type: 'bearer', token, preserveBearer: true };
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {{ authConfig: Object, dataplaneUrl: string, environment: string }}
+ */
+function buildProgrammaticAuthContext(ctx) {
+  if (!ctx.dataplaneUrl) {
+    throw new Error('dataplaneUrl is required on WorkspaceContext');
+  }
+  return {
+    authConfig: buildBearerAuthConfig(ctx.bearerToken),
+    dataplaneUrl: ctx.dataplaneUrl,
+    environment: ctx.environment
+  };
+}
+
+module.exports = {
+  buildBearerAuthConfig,
+  buildProgrammaticAuthContext
+};

package/lib/programmatic/bearer-auth.js

@@ -0,0 +1,176 @@
+/**
+ * Bearer token validation for builder-api via @aifabrix/miso-client (controller-backed).
+ *
+ * @fileoverview Same model as dataplane: registered app client + MISO_CONTROLLER_URL
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @type {import('@aifabrix/miso-client').MisoClient | null} */
+let misoClientSingleton = null;
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @returns {string|null}
+ */
+function extractBearerToken(req) {
+  const auth = req.headers.authorization || req.headers.Authorization;
+  if (!auth || typeof auth !== 'string') {
+    return null;
+  }
+  const match = auth.match(/^Bearer\s+([^\s]+)\s*$/i);
+  return match ? match[1].trim() : null;
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ */
+function assertNoForbiddenAuthHeaders(req) {
+  if (req.headers['x-client-token'] || req.headers['x-client-id']) {
+    const err = new Error('Client credential headers are not supported in builder-api V1');
+    err.statusCode = 401;
+    throw err;
+  }
+}
+
+/**
+ * @returns {string}
+ */
+function resolveControllerUrlFromEnv() {
+  const raw =
+    process.env.MISO_CONTROLLER_URL ||
+    process.env.CONTROLLER_URL ||
+    process.env.MISO_WEB_SERVER_URL ||
+    '';
+  const url = String(raw).trim().replace(/\/$/, '');
+  if (!url) {
+    throw new Error('MISO_CONTROLLER_URL (or CONTROLLER_URL) is required for token validation');
+  }
+  return url;
+}
+
+/**
+ * @returns {import('@aifabrix/miso-client/dist/types/config.types').MisoClientConfig}
+ */
+function buildMisoClientConfigFromEnv() {
+  const clientId = (process.env.MISO_CLIENTID || '').trim();
+  const clientSecret = (process.env.MISO_CLIENTSECRET || '').trim();
+  if (!clientId || !clientSecret) {
+    throw new Error('MISO_CLIENTID and MISO_CLIENTSECRET are required for builder-api auth');
+  }
+  return {
+    clientId,
+    clientSecret,
+    controllerUrl: resolveControllerUrlFromEnv(),
+    logLevel: (process.env.LOG_LEVEL || 'info').toLowerCase()
+  };
+}
+
+/**
+ * Test hook — reset cached MisoClient between Jest cases.
+ */
+function resetMisoClientForTests() {
+  misoClientSingleton = null;
+}
+
+/**
+ * @returns {Promise<import('@aifabrix/miso-client').MisoClient>}
+ */
+async function getMisoClientForAuth() {
+  let MisoClient;
+  try {
+    ({ MisoClient } = require('@aifabrix/miso-client'));
+  } catch {
+    const err = new Error('@aifabrix/miso-client is required for builder-api auth');
+    err.statusCode = 503;
+    throw err;
+  }
+
+  if (!misoClientSingleton) {
+    misoClientSingleton = new MisoClient(buildMisoClientConfigFromEnv());
+  }
+  if (!misoClientSingleton.isInitialized()) {
+    await misoClientSingleton.initialize();
+  }
+  return misoClientSingleton;
+}
+
+/**
+ * @param {import('@aifabrix/miso-client/dist/types/config.types').UserInfo} userInfo
+ * @returns {string}
+ */
+function userIdFromUserInfo(userInfo) {
+  const userId = userInfo?.id || userInfo?.username;
+  if (!userId) {
+    const err = new Error('Token validation returned no user id');
+    err.statusCode = 401;
+    throw err;
+  }
+  return String(userId);
+}
+
+/**
+ * @param {string} token
+ * @param {Object} [opts]
+ * @returns {Promise<{ userId: string, payload: Object }>}
+ */
+async function validateBearerToken(token, opts = {}) {
+  if (!token) {
+    const err = new Error('Missing Bearer token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const client = opts.misoClient || (await getMisoClientForAuth());
+  const valid = await client.validateToken(token, opts.authStrategy);
+  if (!valid) {
+    const err = new Error('Invalid token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const userInfo = await client.getUser(token, opts.authStrategy);
+  if (!userInfo) {
+    const err = new Error('Invalid token');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const payload = {
+    sub: userInfo.id,
+    preferredUsername: userInfo.username,
+    email: userInfo.email,
+    roles: userInfo.roles || []
+  };
+  return { userId: userIdFromUserInfo(userInfo), payload };
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {Object} [opts]
+ * @returns {Promise<{ userId: string, bearerToken: string, payload: Object }>}
+ */
+async function authenticateRequest(req, opts = {}) {
+  assertNoForbiddenAuthHeaders(req);
+  const bearerToken = extractBearerToken(req);
+  if (!bearerToken) {
+    const err = new Error('Authorization Bearer token required');
+    err.statusCode = 401;
+    throw err;
+  }
+  const { userId, payload } = await validateBearerToken(bearerToken, opts);
+  return { userId, bearerToken, payload };
+}
+
+module.exports = {
+  extractBearerToken,
+  assertNoForbiddenAuthHeaders,
+  resolveControllerUrlFromEnv,
+  buildMisoClientConfigFromEnv,
+  resetMisoClientForTests,
+  getMisoClientForAuth,
+  validateBearerToken,
+  authenticateRequest
+};