@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/microsoft-provisioning/login-portal-teams.js

@@ -0,0 +1,193 @@
+/**
+ * Portal Microsoft login for Teams Bot via `teams login --device-code`.
+ *
+ * @fileoverview Copilot ATK MSAL is not a Teams Developer CLI session
+ */
+
+'use strict';
+
+const { spawn } = require('child_process');
+const { parseMicrosoftLoginOutput } = require('./login-portal-parse');
+const { microsoftProvisioningError } = require('./errors');
+const { resolveTeamsBinary, isTeamsCliLoggedIn } = require('./teams-cli');
+const { shouldSkipLiveToolkit } = require('./cli');
+const { atkInstallEnv } = require('./install-atk');
+
+/**
+ * @param {string} message
+ * @returns {Error}
+ */
+function deviceCodeStartError(message) {
+  const error = microsoftProvisioningError(message, 'TEAMS_CLI');
+  error.statusCode = 409;
+  return error;
+}
+
+/**
+ * @param {import('child_process').ChildProcess} child
+ * @param {Map} inflight
+ * @param {string} key
+ * @returns {Promise<void>}
+ */
+function tokenPromiseFromChild(child, inflight, key) {
+  return new Promise((resolve, reject) => {
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        const job = inflight.get(key);
+        if (job) {
+          job.authenticated = true;
+        }
+        resolve();
+        return;
+      }
+      reject(new Error('Microsoft sign-in did not finish.'));
+    });
+  });
+}
+
+/**
+ * @param {Object} state
+ * @param {string} chunk
+ * @returns {{ waiting: boolean, loginUrl?: string, userCode?: string|null, authenticated?: boolean }|null}
+ */
+function consumeTeamsLoginChunk(state, chunk) {
+  state.buf += String(chunk);
+  if (/already logged in/i.test(state.buf)) {
+    return { waiting: false, authenticated: true };
+  }
+  const parsed = parseMicrosoftLoginOutput(state.buf);
+  if (!parsed.loginUrl) {
+    return null;
+  }
+  return { waiting: true, loginUrl: parsed.loginUrl, userCode: parsed.userCode };
+}
+
+/**
+ * @param {Map} inflight
+ * @param {string} key
+ * @param {Object} child
+ * @param {Promise<void>} tokenPromise
+ * @param {Object} parsed
+ * @returns {Object}
+ */
+function rememberTeamsLoginJob(inflight, key, child, tokenPromise, parsed) {
+  inflight.set(key, {
+    cli: 'teams',
+    child,
+    tokenPromise,
+    authenticated: parsed.authenticated === true,
+    loginUrl: parsed.loginUrl,
+    userCode: parsed.userCode
+  });
+  return parsed;
+}
+
+/**
+ * @param {Object} child
+ * @param {Object} ctx
+ * @returns {void}
+ */
+function bindTeamsLoginStreams(child, ctx) {
+  const onData = (chunk) => {
+    const parsed = consumeTeamsLoginChunk(ctx.state, chunk);
+    if (parsed) {
+      ctx.finish(parsed);
+    }
+  };
+  if (child.stdout) {
+    child.stdout.on('data', onData);
+  }
+  if (child.stderr) {
+    child.stderr.on('data', onData);
+  }
+  child.on('error', (err) => {
+    if (!ctx.state.settled) {
+      ctx.state.settled = true;
+      clearTimeout(ctx.timer);
+      ctx.reject(err);
+    }
+  });
+}
+
+/**
+ * @param {Object} params
+ * @param {string} key
+ * @param {Map} inflight
+ * @param {string} bin
+ * @returns {Promise<Object>}
+ */
+function startTeamsCliDeviceLogin(params, key, inflight, bin) {
+  const deps = params.deps || {};
+  const spawnImpl = deps.spawnImpl || spawn;
+  return new Promise((resolve, reject) => {
+    const child = spawnImpl(bin, ['login', '--device-code'], {
+      env: { ...atkInstallEnv(deps.env || process.env), TEAMS_NO_INTERACTIVE: '1' },
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    const tokenPromise = tokenPromiseFromChild(child, inflight, key);
+    tokenPromise.catch(() => undefined);
+    const state = { buf: '', settled: false };
+    const timer = setTimeout(() => {
+      if (!state.settled) {
+        state.settled = true;
+        child.kill();
+        reject(deviceCodeStartError(
+          'Microsoft sign-in timed out before a device code was issued. Use Get a new code.'
+        ));
+      }
+    }, 20000);
+    bindTeamsLoginStreams(child, {
+      state,
+      timer,
+      reject,
+      finish: (parsed) => {
+        if (state.settled) {
+          return;
+        }
+        state.settled = true;
+        clearTimeout(timer);
+        resolve(rememberTeamsLoginJob(inflight, key, child, tokenPromise, parsed));
+      }
+    });
+  });
+}
+
+/**
+ * @param {Object} params
+ * @param {string} key
+ * @param {Map} inflight
+ * @returns {Promise<Object>}
+ */
+async function startTeamsPortalLogin(params, key, inflight) {
+  const deps = params.deps || {};
+  if (params.retryLogin !== true && await isTeamsCliLoggedIn(deps)) {
+    inflight.set(key, { cli: 'teams', authenticated: true });
+    return { waiting: false, authenticated: true };
+  }
+  if (shouldSkipLiveToolkit(deps)) {
+    return { waiting: true };
+  }
+  const bin = await resolveTeamsBinary(deps);
+  if (!bin) {
+    return { waiting: true };
+  }
+  return startTeamsCliDeviceLogin(params, key, inflight, bin);
+}
+
+/**
+ * @param {Object} params
+ * @param {Object|null} job
+ * @returns {boolean}
+ */
+function loginJobMatches(params, job) {
+  const want = params.loginCli === 'teams' ? 'teams' : 'atk';
+  const got = job && job.cli === 'teams' ? 'teams' : 'atk';
+  return want === got;
+}
+
+module.exports = {
+  startTeamsPortalLogin,
+  startTeamsCliDeviceLogin,
+  loginJobMatches
+};

package/lib/channels/microsoft-provisioning/login-portal.js

@@ -0,0 +1,230 @@
+/**
+ * Portal Microsoft login: device-code URL for the UI; keep MSAL polling alive.
+ *
+ * @fileoverview Remote browsers cannot complete Toolkit localhost redirects
+ */
+
+'use strict';
+
+const { ensureMicrosoftSession } = require('./auth');
+const { resolveAtkBinary, shouldSkipLiveToolkit } = require('./cli');
+const { findOrInstallAtkBinary } = require('./install-atk');
+const {
+  parseMicrosoftLoginOutput,
+  isMicrosoftLoginUrl,
+  isLoopbackAuthorizeUrl
+} = require('./login-portal-parse');
+const { startMsalDeviceCode } = require('./login-portal-device');
+const { startTeamsPortalLogin, loginJobMatches } = require('./login-portal-teams');
+
+const inflight = new Map();
+
+/**
+ * @param {string} key
+ * @returns {void}
+ */
+function stopPortalMicrosoftLogin(key) {
+  const job = inflight.get(key);
+  if (!job) {
+    return;
+  }
+  inflight.delete(key);
+  if (job.request && typeof job.request === 'object') {
+    job.request.cancel = true;
+  }
+  if (job.child && typeof job.child.kill === 'function') {
+    try {
+      job.child.kill();
+    } catch {
+      // best-effort
+    }
+  }
+}
+
+/**
+ * @param {string} key
+ * @returns {{ loginUrl?: string, userCode?: string|null, authenticated?: boolean }|null}
+ */
+function peekPortalMicrosoftLogin(key) {
+  const job = inflight.get(String(key || '').trim());
+  if (!job) {
+    return null;
+  }
+  return {
+    loginUrl: job.loginUrl,
+    userCode: job.userCode || null,
+    authenticated: job.authenticated === true
+  };
+}
+
+/**
+ * @param {Object} job
+ * @param {number} timeoutMs
+ * @returns {Promise<'ok'|'none'|'timeout'|'error'>}
+ */
+function settleTokenPromise(job, timeoutMs) {
+  if (job.authenticated === true) {
+    return Promise.resolve('ok');
+  }
+  if (!job.tokenPromise || typeof job.tokenPromise.then !== 'function') {
+    return Promise.resolve('none');
+  }
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve('timeout'), timeoutMs);
+    job.tokenPromise.then(
+      () => {
+        clearTimeout(timer);
+        resolve('ok');
+      },
+      () => {
+        clearTimeout(timer);
+        resolve('error');
+      }
+    );
+  });
+}
+
+/**
+ * Wait for an in-flight device-code poll. Does not issue a new code.
+ * @param {string} key
+ * @param {number} [timeoutMs]
+ * @returns {Promise<{ loginUrl?: string, userCode?: string|null, authenticated?: boolean }|null>}
+ */
+async function awaitPortalMicrosoftLogin(key, timeoutMs = 120000) {
+  const normalized = String(key || '').trim();
+  const job = inflight.get(normalized);
+  if (!job) {
+    return null;
+  }
+  const settled = await settleTokenPromise(job, timeoutMs);
+  if (settled === 'ok') {
+    job.authenticated = true;
+  }
+  return peekPortalMicrosoftLogin(normalized);
+}
+
+/**
+ * @param {string} key
+ * @param {Object|null} result
+ * @returns {void}
+ */
+function rememberInflightLogin(key, result) {
+  if (!key || !result) {
+    return;
+  }
+  const existing = inflight.get(key) || {};
+  inflight.set(key, {
+    ...existing,
+    cli: result.cli || existing.cli,
+    loginUrl: result.loginUrl || existing.loginUrl,
+    userCode: result.userCode || existing.userCode,
+    authenticated: result.authenticated === true || existing.authenticated === true
+  });
+}
+
+/**
+ * @param {Object} deps
+ * @returns {Promise<string|null>}
+ */
+async function resolvePortalLoginBinary(deps) {
+  try {
+    return (await findOrInstallAtkBinary(deps)) || (await resolveAtkBinary(deps));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Probe an existing Toolkit session. Missing tenant means "not signed in yet".
+ * @param {string|undefined} expectedTenantId
+ * @param {Object} deps
+ * @returns {Promise<{ binary: string, tenantId: string }|null>}
+ */
+async function existingMicrosoftSession(expectedTenantId, deps) {
+  try {
+    return await ensureMicrosoftSession(expectedTenantId, deps);
+  } catch (err) {
+    if (err && err.code === 'TENANT') {
+      return null;
+    }
+    throw err;
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {string} key
+ * @returns {Promise<{ waiting: boolean, authenticated?: boolean, loginUrl?: string, userCode?: string|null }>}
+ */
+async function startFreshLogin(params, key) {
+  const deps = params.deps || {};
+  if (typeof deps.startLoginImpl === 'function') {
+    return deps.startLoginImpl(params);
+  }
+  if (params.loginCli === 'teams') {
+    return startTeamsPortalLogin(params, key, inflight);
+  }
+  if (params.retryLogin !== true) {
+    const session = await existingMicrosoftSession(params.expectedTenantId, deps);
+    if (session && session.tenantId) {
+      const authenticated = { waiting: false, authenticated: true, cli: 'atk' };
+      rememberInflightLogin(key, authenticated);
+      return authenticated;
+    }
+  }
+  if (shouldSkipLiveToolkit(deps)) {
+    return { waiting: true };
+  }
+  const binary = await resolvePortalLoginBinary(deps);
+  if (!binary) {
+    return { waiting: true };
+  }
+  return startMsalDeviceCode({ ...params, atkBinary: binary }, key, inflight);
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<{ waiting: boolean, authenticated?: boolean, loginUrl?: string, userCode?: string|null }>}
+ */
+async function reuseOrStartLogin(params) {
+  const key = String(params.installationKey || '').trim();
+  if (params.retryLogin === true && key) {
+    stopPortalMicrosoftLogin(key);
+  }
+  const existing = key ? inflight.get(key) : null;
+  if (existing && !loginJobMatches(params, existing)) {
+    stopPortalMicrosoftLogin(key);
+    return startFreshLogin(params, key);
+  }
+  if (existing && existing.authenticated === true) {
+    return {
+      waiting: false,
+      authenticated: true,
+      loginUrl: existing.loginUrl,
+      userCode: existing.userCode
+    };
+  }
+  if (existing && existing.loginUrl && !isLoopbackAuthorizeUrl(existing.loginUrl)) {
+    return { waiting: true, loginUrl: existing.loginUrl, userCode: existing.userCode };
+  }
+  return startFreshLogin(params, key);
+}
+
+/**
+ * Start or reuse Microsoft login for a portal install. Does not persist tokens.
+ * @param {Object} params
+ * @returns {Promise<{ waiting: boolean, authenticated?: boolean, loginUrl?: string, userCode?: string|null }>}
+ */
+async function startPortalMicrosoftLogin(params = {}) {
+  return reuseOrStartLogin(params);
+}
+
+module.exports = {
+  parseMicrosoftLoginOutput,
+  isMicrosoftLoginUrl,
+  isLoopbackAuthorizeUrl,
+  stopPortalMicrosoftLogin,
+  startPortalMicrosoftLogin,
+  peekPortalMicrosoftLogin,
+  awaitPortalMicrosoftLogin
+};

package/lib/channels/microsoft-provisioning/persist.js

@@ -0,0 +1,110 @@
+/**
+ * Persist non-secret Microsoft Copilot correlation IDs only.
+ *
+ * @fileoverview Auth-config id + Application ID URI; never tokens
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const { STATE_FILE, STATE_KIND, SECRET_KEY_RE } = require('./constants');
+const { microsoftProvisioningError } = require('./errors');
+
+/**
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+function provisioningStatePath(projectRoot) {
+  const root = projectRoot || process.cwd();
+  return path.join(root, 'dist', 'channels', 'microsoft-copilot', STATE_FILE);
+}
+
+/**
+ * @param {Object} record
+ * @returns {void}
+ */
+function assertNoSecrets(record) {
+  const keys = record && typeof record === 'object' ? Object.keys(record) : [];
+  const hit = keys.find((key) => SECRET_KEY_RE.test(key));
+  if (hit) {
+    throw microsoftProvisioningError(
+      `Refusing to persist Microsoft secret field "${hit}".`,
+      'SECRET'
+    );
+  }
+}
+
+/**
+ * @param {string} projectRoot
+ * @returns {Object|null}
+ */
+function readProvisioningState(projectRoot) {
+  const filePath = provisioningStatePath(projectRoot);
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!parsed || parsed.kind !== STATE_KIND) {
+      return null;
+    }
+    assertNoSecrets(parsed);
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object} current
+ * @param {Object} next
+ * @returns {boolean}
+ */
+function isReusableAuthConfig(current, next) {
+  if (!current || typeof current.authConfigId !== 'string' || !current.authConfigId.trim()) {
+    return false;
+  }
+  if (current.environment !== next.environment || current.mcpServerUrl !== next.mcpServerUrl) {
+    return false;
+  }
+  if (next.teamsAppId) {
+    const bound = typeof current.teamsAppId === 'string' ? current.teamsAppId.trim() : '';
+    if (bound.toLowerCase() !== String(next.teamsAppId).trim().toLowerCase()) {
+      return false;
+    }
+  }
+  if (current.tenantId && next.tenantId) {
+    return String(current.tenantId).toLowerCase() === String(next.tenantId).toLowerCase();
+  }
+  return true;
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {Object} state
+ * @returns {void}
+ */
+function writeProvisioningState(projectRoot, state) {
+  const record = {
+    kind: STATE_KIND,
+    environment: state.environment,
+    tenantId: state.tenantId,
+    mcpServerUrl: state.mcpServerUrl,
+    teamsAppId: state.teamsAppId || null,
+    authConfigId: state.authConfigId,
+    applicationIdUri: state.applicationIdUri || null
+  };
+  assertNoSecrets(record);
+  const filePath = provisioningStatePath(projectRoot);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
+
+module.exports = {
+  provisioningStatePath,
+  readProvisioningState,
+  writeProvisioningState,
+  isReusableAuthConfig,
+  assertNoSecrets
+};

package/lib/channels/microsoft-provisioning/teams-bot-args.js

@@ -0,0 +1,119 @@
+/**
+ * Build Teams Developer CLI argv for Azure-managed bots.
+ *
+ * @fileoverview Never scaffold a Teams SDK project; always --azure + existing endpoint
+ */
+
+'use strict';
+
+const { microsoftProvisioningError } = require('./errors');
+
+/**
+ * @param {string} [value]
+ * @returns {string}
+ */
+function trimFlag(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+/**
+ * @param {string[]} args
+ * @returns {void}
+ */
+function assertNoScaffoldArgs(args) {
+  const list = Array.isArray(args) ? args : [];
+  if (/\bproject\s+new\b/.test(list.join(' '))) {
+    throw microsoftProvisioningError(
+      'Teams Bot provisioning must not run teams project new or scaffold a bot.',
+      'SCAFFOLD'
+    );
+  }
+  if (list.includes('--teams-managed')) {
+    throw microsoftProvisioningError(
+      'Teams-managed bot is not supported. Azure-managed is required for OAuth/SSO.',
+      'TEAMS_MANAGED'
+    );
+  }
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {{ subscription: string, resourceGroup: string }}
+ */
+function resolveAzureFlags(options = {}) {
+  return {
+    subscription: trimFlag(options.azureSubscription),
+    resourceGroup: trimFlag(options.azureResourceGroup)
+  };
+}
+
+/**
+ * @param {{ subscription: string, resourceGroup: string }} flags
+ * @returns {void}
+ */
+function requireAzureFlags(flags) {
+  if (!flags || !flags.subscription || !flags.resourceGroup) {
+    throw microsoftProvisioningError(
+      'Azure subscription and resource group were not found on the controller environment. ' +
+        'Deploy the environment first.',
+      'MISSING_AZURE'
+    );
+  }
+}
+
+/**
+ * @param {string} [url]
+ * @returns {void}
+ */
+function assertHttpsEndpoint(url) {
+  const endpoint = trimFlag(url);
+  if (!endpoint) {
+    throw microsoftProvisioningError('Teams Bot messages URL is missing.', 'ENDPOINT');
+  }
+  if (!/^https:\/\//i.test(endpoint)) {
+    throw microsoftProvisioningError(
+      'Teams Bot messaging endpoint must be a public HTTPS URL.',
+      'ENDPOINT'
+    );
+  }
+}
+
+/**
+ * @param {Object} params
+ * @returns {string[]}
+ */
+function buildAppCreateArgs(params) {
+  const args = [
+    'app',
+    'create',
+    '--azure',
+    '--name',
+    trimFlag(params.name) || 'AI Fabrix',
+    '--endpoint',
+    trimFlag(params.endpoint),
+    '--subscription',
+    trimFlag(params.subscription),
+    '--resource-group',
+    trimFlag(params.resourceGroup),
+    '--env',
+    trimFlag(params.envPath),
+    '--json'
+  ];
+  assertNoScaffoldArgs(args);
+  if (!args.includes('--azure') || !args.includes('--endpoint')) {
+    throw microsoftProvisioningError(
+      'Teams app create must pass --azure and --endpoint.',
+      'TEAMS_CLI'
+    );
+  }
+  return args;
+}
+
+module.exports = {
+  trimFlag,
+  assertNoScaffoldArgs,
+  resolveAzureFlags,
+  requireAzureFlags,
+  assertHttpsEndpoint,
+  buildAppCreateArgs
+};