@aifabrix/builder 2.53.1 → 2.54.1

package/lib/channels/chatgpt-channel-add.js

@@ -0,0 +1,229 @@
+/**
+ * ChatGPT continuation for channel add: preflight, form values, callback PUT.
+ *
+ * @fileoverview Keep add-channel.js free of ChatGPT-specific continuation logic
+ */
+
+'use strict';
+
+const {
+  printValidating,
+  printRuntimeDeployed,
+  printRuntimeUnavailable,
+  printOAuthConnected,
+  printOAuthNotConnected,
+  printLabeledUrl,
+  printUseLines,
+  printRemainingSteps,
+  printFixThenRerun
+} = require('./channel-add-tty');
+const { CHATGPT_REMAINING_STEPS } = require('./channel-add-remaining');
+const { formatWarningLine } = require('../utils/cli-layout-chalk');
+const logger = require('../utils/logger');
+const { runChatGptPreflight } = require('./chatgpt-preflight');
+const {
+  buildChatGptFormValues,
+  formatChatGptFormValueLines,
+  CHATGPT_APPS_CREATE_URL
+} = require('./chatgpt-setup-values');
+const {
+  registerChatGptCallbackUrls,
+  findChatGptIntegrationClient,
+  chatgptProfileUrl
+} = require('./chatgpt-callback');
+const { CHATGPT_KNOWN_CALLBACK_URIS } = require('./chatgpt-runtime-contract');
+const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
+const { vendorFacingUrlsFromCtx } = require('./vendor-dataplane-url');
+const { loadChannelPackageContext } = require('./channel-discovery');
+
+/**
+ * @param {Error} error
+ * @returns {boolean}
+ */
+function isChatGptOAuthPreflightError(error) {
+  const message = error && error.message ? String(error.message) : '';
+  return /pkce|authorization.server|protected resource/i.test(message);
+}
+
+/**
+ * @param {Object} params
+ * @returns {string}
+ */
+function chatgptResumeCommand(params) {
+  const name =
+    (params.options && params.options.name) ||
+    (params.runtimeValues && (params.runtimeValues.baseName || params.runtimeValues.appName)) ||
+    '';
+  const quoted = name ? `"${name}"` : '"<name>"';
+  return `aifabrix channel add chatgpt --name ${quoted}`;
+}
+
+/**
+ * @param {Object} params
+ * @param {Error} error
+ * @returns {void}
+ */
+function printChatGptPreflightFailure(params, error) {
+  if (isChatGptOAuthPreflightError(error)) {
+    printRuntimeDeployed();
+    printOAuthNotConnected();
+    printFixThenRerun('Fix OAuth discovery', chatgptResumeCommand(params));
+    return;
+  }
+  printRuntimeUnavailable();
+  printFixThenRerun('Fix the Runtime connection', chatgptResumeCommand(params));
+}
+
+/**
+ * Fail-closed MCP/OAuth checks before ChatGPT instructions.
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeAssertChatGptPreflight(params) {
+  if (params.channelTarget !== 'chatgpt') {
+    return null;
+  }
+  printValidating('ChatGPT');
+  try {
+    params.preflight = await runChatGptPreflight(params);
+    printRuntimeDeployed();
+    if (!(params.preflight && params.preflight.skipped)) {
+      printOAuthConnected();
+    }
+    return params.preflight;
+  } catch (error) {
+    printChatGptPreflightFailure(params, error);
+    throw error;
+  }
+}
+
+/**
+ * @param {Object} ctx
+ * @returns {Promise<Object|null>}
+ */
+async function loadChatGptClientOrNull(ctx) {
+  try {
+    return await findChatGptIntegrationClient(ctx);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object} values
+ * @returns {void}
+ */
+function printChatGptFormValues(values) {
+  printLabeledUrl('Open ChatGPT Apps', CHATGPT_APPS_CREATE_URL);
+  printUseLines(formatChatGptFormValueLines(values));
+}
+
+/**
+ * @param {Object} options
+ * @returns {string[]}
+ */
+function callbackUrlsForAdd(options = {}) {
+  const urls = [...CHATGPT_KNOWN_CALLBACK_URIS];
+  const extra = typeof options.callbackUrl === 'string' ? options.callbackUrl.trim() : '';
+  if (extra && !urls.includes(extra)) {
+    urls.push(extra);
+  }
+  return urls;
+}
+
+/**
+ * @param {Object} result
+ * @param {Object} ctx
+ * @returns {void}
+ */
+function printChatGptCallbackResult(result, ctx) {
+  if (!result.fallback) {
+    return;
+  }
+  logger.log(
+    formatWarningLine(
+      `Missing integration-client:update. Add the callback on the ChatGPT profile: ${result.profileUrl || chatgptProfileUrl(ctx)}`
+    )
+  );
+}
+
+/**
+ * Remaining OpenAI-owned steps after AI Fabrix prep.
+ * @returns {void}
+ */
+function printChatGptRemainingSteps() {
+  printRemainingSteps('ChatGPT', CHATGPT_REMAINING_STEPS);
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<void>}
+ */
+async function runChatGptChannelAddContinuation(params) {
+  const preflight = params.preflight || (await runChatGptPreflight(params));
+  const client = await loadChatGptClientOrNull(params.ctx);
+  const values = buildChatGptFormValues({
+    runtimeValues: params.runtimeValues,
+    integrationClient: client,
+    asMetadata: preflight && preflight.asMetadata
+  });
+  printChatGptFormValues(values);
+  const result = await registerChatGptCallbackUrls({
+    ctx: params.ctx,
+    callbackUrls: callbackUrlsForAdd(params.options)
+  });
+  printChatGptCallbackResult(result, params.ctx);
+  printChatGptRemainingSteps();
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<void>}
+ */
+async function maybeRunChatGptContinuation(params) {
+  if (params.channelTarget !== 'chatgpt') {
+    return;
+  }
+  await runChatGptChannelAddContinuation(params);
+}
+
+/**
+ * After callback PUT: re-validate Runtime and OAuth.
+ * @param {Object} ctx
+ * @returns {Promise<void>}
+ */
+async function runChatGptConfigureValidate(ctx) {
+  let packageContext = null;
+  try {
+    packageContext = await loadChannelPackageContext({
+      dataplaneBaseUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      channelTarget: 'chatgpt'
+    });
+  } catch {
+    packageContext = null;
+  }
+  const vendor = vendorFacingUrlsFromCtx(ctx);
+  const runtimeValues = resolveChannelRuntimeValues({
+    dataplaneBaseUrl: vendor.dataplaneBaseUrl,
+    controllerUrl: vendor.controllerUrl,
+    channelTarget: 'chatgpt',
+    appName: 'ChatGPT',
+    environment: ctx.environment,
+    packageContext
+  });
+  await maybeAssertChatGptPreflight({
+    channelTarget: 'chatgpt',
+    runtimeValues,
+    ctx,
+    options: {}
+  });
+}
+
+module.exports = {
+  maybeAssertChatGptPreflight,
+  maybeRunChatGptContinuation,
+  runChatGptChannelAddContinuation,
+  runChatGptConfigureValidate,
+  callbackUrlsForAdd
+};

package/lib/channels/chatgpt-preflight.js

@@ -0,0 +1,396 @@
+/**
+ * Fail-closed ChatGPT channel preflight (MCP + OAuth discovery + PKCE S256).
+ *
+ * @fileoverview Validate Runtime MCP and OAuth before ChatGPT workspace steps
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { fetchWithOptionalDevPlatformTls } = require('../utils/dev-platform-tls');
+const { isRuntimeMcpGatewayReachable } = require('./runtime-tool-catalog');
+const { CHATGPT_RUNTIME_SYSTEM_KEY } = require('./chatgpt-runtime-contract');
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+
+/**
+ * @param {string} message
+ * @returns {Error}
+ */
+function createChatGptPreflightError(message) {
+  const error = new Error(`ChatGPT preflight: ${message}`);
+  error.boundary = 'preflight';
+  return error;
+}
+
+/**
+ * @param {string|undefined} mcpUrl
+ * @returns {URL}
+ */
+function parseRequiredMcpUrl(mcpUrl) {
+  const trimmed = typeof mcpUrl === 'string' ? mcpUrl.trim() : '';
+  if (!trimmed) {
+    throw createChatGptPreflightError('Runtime MCP URL is missing.');
+  }
+  try {
+    return new URL(trimmed);
+  } catch {
+    throw createChatGptPreflightError(`Runtime MCP URL is not a valid URL: ${trimmed}`);
+  }
+}
+
+/**
+ * HTTPS required except localhost HTTP.
+ * @param {URL} parsed
+ * @returns {void}
+ */
+function assertMcpUrlScheme(parsed) {
+  if (parsed.protocol === 'https:') {
+    return;
+  }
+  if (parsed.protocol === 'http:' && LOCAL_HOSTS.has(parsed.hostname)) {
+    return;
+  }
+  throw createChatGptPreflightError(
+    'Runtime MCP URL must be HTTPS (localhost HTTP is allowed).'
+  );
+}
+
+/**
+ * Builder-api runs on Docker DNS. Public Traefik hosts resolve to 127.0.0.1:443
+ * inside the container (ECONNREFUSED). Rewrite same-host dataplane/auth URLs
+ * to in-cluster origins when ctx.dataplaneUrl is already internal.
+ *
+ * @param {string} url
+ * @param {{ dataplaneUrl?: string, publicHostname?: string }} [ctx]
+ * @returns {string}
+ */
+function keycloakInClusterOrigin() {
+  const raw = process.env.KEYCLOAK_INTERNAL_SERVER_URL || 'http://keycloak:8080';
+  try {
+    const parsed = new URL(raw);
+    if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {
+      return 'http://keycloak:8080';
+    }
+    return parsed.origin;
+  } catch {
+    return 'http://keycloak:8080';
+  }
+}
+
+function rewriteDevPlatformPath(target, dp) {
+  const dpPath = (dp.pathname || '').replace(/\/$/, '');
+  if (dpPath && target.pathname.startsWith(`${dpPath}/`)) {
+    return `${dp.origin}${target.pathname}${target.search}`;
+  }
+  if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) {
+    return `${keycloakInClusterOrigin()}${target.pathname}${target.search}`;
+  }
+  return null;
+}
+
+function rewriteUrlForInClusterFetch(url, ctx = {}) {
+  const dataplaneUrl = ctx.dataplaneUrl;
+  if (!dataplaneUrl) {
+    return url;
+  }
+  try {
+    const target = new URL(url);
+    const dp = new URL(dataplaneUrl);
+    if (target.origin === dp.origin) {
+      return url;
+    }
+    const publicHostname = ctx.publicHostname;
+    const hostMatch = Boolean(publicHostname && target.hostname === publicHostname);
+    const inCluster = dp.hostname === 'dataplane' || !dp.hostname.includes('.');
+    if (!hostMatch && !inCluster) {
+      return url;
+    }
+    return rewriteDevPlatformPath(target, dp) || url;
+  } catch {
+    return url;
+  }
+}
+
+/**
+ * @param {{ dataplaneUrl?: string, publicHostname?: string }} [rewriteCtx]
+ * @returns {(url: string) => Promise<Object>}
+ */
+function createDefaultFetchJson(rewriteCtx = {}) {
+  return async function defaultFetchJson(url) {
+    const fetchUrl = rewriteUrlForInClusterFetch(url, rewriteCtx);
+    try {
+      const response = await fetchWithOptionalDevPlatformTls(fetchUrl, {
+        headers: { Accept: 'application/json' }
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status} from ${fetchUrl}`);
+      }
+      return response.json();
+    } catch (error) {
+      const cause = error && error.cause ? error.cause.code || error.cause.message : '';
+      if (error && error.message && error.message.startsWith('HTTP ')) {
+        throw error;
+      }
+      throw new Error(`fetch failed ${fetchUrl}${cause ? ` (${cause})` : ''}`);
+    }
+  };
+}
+
+/**
+ * RFC 9728 well-known URL derived from the MCP resource path.
+ * @param {URL} mcpUrl
+ * @returns {string}
+ */
+function rfc9728ProtectedResourceUrl(mcpUrl) {
+  const pathname = (mcpUrl.pathname || '/').replace(/\/$/, '') || '/';
+  const pathWithQuery = mcpUrl.search ? `${pathname}${mcpUrl.search}` : pathname;
+  return `${mcpUrl.origin}/.well-known/oauth-protected-resource${pathWithQuery}`;
+}
+
+/**
+ * Public dataplane base (origin plus optional vdir such as /data).
+ * @param {URL} mcpUrl
+ * @returns {string}
+ */
+function dataplanePublicBaseFromMcpUrl(mcpUrl) {
+  const path = (mcpUrl.pathname || '').replace(/\/$/, '');
+  const browser = path.match(/^(.*)\/mcp\/v1\/[^/]+$/);
+  if (browser) {
+    return browser[1] ? `${mcpUrl.origin}${browser[1]}` : mcpUrl.origin;
+  }
+  const api = path.match(/^(.*)\/api\/v1\/external\/systems\/[^/]+\/mcp$/);
+  if (api) {
+    return api[1] ? `${mcpUrl.origin}${api[1]}` : mcpUrl.origin;
+  }
+  return mcpUrl.origin;
+}
+
+/**
+ * @param {string} pathname
+ * @returns {string}
+ */
+function runtimeSystemKeyFromMcpPath(pathname) {
+  const path = String(pathname || '').replace(/\/$/, '');
+  const browserMcp = path.match(/\/mcp\/v1\/([^/]+)$/);
+  if (browserMcp) {
+    return browserMcp[1];
+  }
+  const apiMcp = path.match(/\/external\/systems\/([^/]+)\/mcp$/);
+  if (apiMcp) {
+    return apiMcp[1];
+  }
+  return CHATGPT_RUNTIME_SYSTEM_KEY;
+}
+
+/**
+ * Traefik-reachable discovery first; RFC 9728 origin path last (often unrouted).
+ * @param {URL} mcpUrl
+ * @returns {string[]}
+ */
+function protectedResourceCandidateUrls(mcpUrl) {
+  const publicBase = dataplanePublicBaseFromMcpUrl(mcpUrl);
+  const key = runtimeSystemKeyFromMcpPath(mcpUrl.pathname);
+  return [
+    `${publicBase}/api/v1/external/systems/${key}/discovery/oauth-protected-resource`,
+    `${publicBase}/api/v1/external/systems/${key}/.well-known/oauth-protected-resource`,
+    rfc9728ProtectedResourceUrl(mcpUrl)
+  ];
+}
+
+/**
+ * @param {string[]} urls
+ * @param {(url: string) => Promise<Object>} fetchJson
+ * @returns {Promise<Object>}
+ */
+async function fetchFirstJson(urls, fetchJson) {
+  const errors = [];
+  for (const url of urls) {
+    try {
+      const body = await fetchJson(url);
+      if (body && typeof body === 'object') {
+        return body;
+      }
+    } catch (error) {
+      errors.push(`${url}: ${error.message}`);
+    }
+  }
+  throw createChatGptPreflightError(errors.join('; ') || 'No document returned.');
+}
+
+/**
+ * @param {Object} prm
+ * @param {URL} mcpUrl
+ * @returns {void}
+ */
+function assertProtectedResource(prm, mcpUrl) {
+  const resource = typeof prm.resource === 'string' ? prm.resource.trim() : '';
+  if (!resource) {
+    throw createChatGptPreflightError(
+      'OAuth protected-resource metadata is missing a resource/audience.'
+    );
+  }
+  let resourceHost = '';
+  try {
+    resourceHost = new URL(resource).hostname;
+  } catch {
+    resourceHost = '';
+  }
+  if (resourceHost && resourceHost !== mcpUrl.hostname) {
+    throw createChatGptPreflightError(
+      `Protected resource audience host ${resourceHost} does not match MCP host ${mcpUrl.hostname}.`
+    );
+  }
+  if (!Array.isArray(prm.authorization_servers) || prm.authorization_servers.length === 0) {
+    throw createChatGptPreflightError(
+      'OAuth protected-resource metadata is missing authorization_servers.'
+    );
+  }
+}
+
+/**
+ * @param {string} issuer
+ * @returns {string[]}
+ */
+function authorizationServerDiscoveryUrls(issuer) {
+  const base = String(issuer || '').replace(/\/$/, '');
+  return [
+    `${base}/.well-known/oauth-authorization-server`,
+    `${base}/.well-known/openid-configuration`
+  ];
+}
+
+/**
+ * Microsoft Entra is advertised on the same MCP resource for Copilot SSO.
+ * ChatGPT uses the customer OAuth profile, not Entra.
+ * @param {string} issuer
+ * @returns {boolean}
+ */
+function isMicrosoftEntraIssuer(issuer) {
+  try {
+    return new URL(String(issuer)).hostname === 'login.microsoftonline.com';
+  } catch {
+    return /login\.microsoftonline\.com/i.test(String(issuer || ''));
+  }
+}
+
+/**
+ * @param {string[]|undefined} issuers
+ * @returns {string[]}
+ */
+function chatgptAuthorizationServers(issuers) {
+  const list = Array.isArray(issuers)
+    ? issuers.filter((value) => typeof value === 'string' && value.trim())
+    : [];
+  const customerOauth = list.filter((value) => !isMicrosoftEntraIssuer(value));
+  return customerOauth.length ? customerOauth : list;
+}
+
+/**
+ * RFC 8414: grant_types_supported is optional; omitted defaults include
+ * authorization_code when an authorization endpoint is present.
+ * @param {Object} asMetadata
+ * @returns {void}
+ */
+function assertAuthorizationCodePkce(asMetadata) {
+  const grants = Array.isArray(asMetadata.grant_types_supported)
+    ? asMetadata.grant_types_supported
+    : null;
+  const hasAuthorizationEndpoint =
+    typeof asMetadata.authorization_endpoint === 'string' &&
+    asMetadata.authorization_endpoint.trim() !== '';
+  const supportsCode =
+    grants && grants.length > 0
+      ? grants.includes('authorization_code')
+      : hasAuthorizationEndpoint;
+  if (!supportsCode) {
+    throw createChatGptPreflightError(
+      'Authorization server must advertise the authorization_code grant.'
+    );
+  }
+  const methods = Array.isArray(asMetadata.code_challenge_methods_supported)
+    ? asMetadata.code_challenge_methods_supported
+    : [];
+  if (!methods.includes('S256')) {
+    throw createChatGptPreflightError(
+      'Authorization server must advertise PKCE S256.'
+    );
+  }
+}
+
+/**
+ * @param {string[]} issuers
+ * @param {(url: string) => Promise<Object>} fetchJson
+ * @returns {Promise<Object>}
+ */
+async function fetchChatGptAuthorizationServerMetadata(issuers, fetchJson) {
+  const errors = [];
+  for (const issuer of chatgptAuthorizationServers(issuers)) {
+    try {
+      const metadata = await fetchFirstJson(
+        authorizationServerDiscoveryUrls(issuer),
+        fetchJson
+      );
+      assertAuthorizationCodePkce(metadata);
+      return metadata;
+    } catch (error) {
+      errors.push(`${issuer}: ${error.message}`);
+    }
+  }
+  throw createChatGptPreflightError(
+    errors.join('; ') || 'No authorization server metadata returned.'
+  );
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<boolean>}
+ */
+async function defaultMcpReachable(params) {
+  return isRuntimeMcpGatewayReachable(
+    params.ctx && params.ctx.dataplaneUrl,
+    params.ctx && params.ctx.authConfig,
+    CHATGPT_RUNTIME_SYSTEM_KEY
+  );
+}
+
+/**
+ * Live MCP + OAuth discovery. Skipped on --dry-run.
+ * @param {Object} params
+ * @returns {Promise<{ skipped?: boolean, mcpUrl?: string, prm?: Object, asMetadata?: Object }>}
+ */
+async function runChatGptPreflight(params) {
+  if (params.options && params.options.dryRun === true) {
+    return { skipped: true };
+  }
+  const parsed = parseRequiredMcpUrl(params.runtimeValues && params.runtimeValues.mcpUrl);
+  assertMcpUrlScheme(parsed);
+  const reachable = params.mcpReachable || defaultMcpReachable;
+  if (!(await reachable(params))) {
+    throw createChatGptPreflightError('Runtime MCP endpoint is not reachable.');
+  }
+  const fetchJson =
+    params.fetchJson ||
+    createDefaultFetchJson({
+      dataplaneUrl: params.ctx && params.ctx.dataplaneUrl,
+      publicHostname: parsed.hostname
+    });
+  const prm = await fetchFirstJson(protectedResourceCandidateUrls(parsed), fetchJson);
+  assertProtectedResource(prm, parsed);
+  const asMetadata = await fetchChatGptAuthorizationServerMetadata(
+    prm.authorization_servers,
+    fetchJson
+  );
+  return { mcpUrl: parsed.href, prm, asMetadata };
+}
+
+module.exports = {
+  createChatGptPreflightError,
+  parseRequiredMcpUrl,
+  assertMcpUrlScheme,
+  protectedResourceCandidateUrls,
+  chatgptAuthorizationServers,
+  rewriteUrlForInClusterFetch,
+  runChatGptPreflight
+};

package/lib/channels/chatgpt-runtime-contract.js

@@ -13,6 +13,15 @@ const RUNTIME_ORCHESTRATION_SYSTEM_KEY = 'runtime-orchestration';
 const CHATGPT_RUNTIME_SYSTEM_KEY = RUNTIME_ORCHESTRATION_SYSTEM_KEY;
 const CHATGPT_RUNTIME_TRANSPORT = 'streamable-http';
 const CHATGPT_RUNTIME_AUTH_MODE = 'oauth21-authorization-code-pkce-s256';
+const CHATGPT_OAUTH2_PROFILE_ID = 'miso-chatgpt';
+const CHATGPT_OAUTH2_PROFILE_PATH = '/external-access/oauth2-profiles/miso-chatgpt';
+const CHATGPT_INTEGRATION_CLIENT_KEY = 'chatgpt';
+const CHATGPT_APPS_CREATE_URL = 'https://chatgpt.com/admin/apps?tab=drafts';
+const CHATGPT_CATALOG_CALLBACK_URI = 'https://chat.openai.com/aip/oauth/callback';
+const CHATGPT_APPS_CALLBACK_URI = 'https://chatgpt.com/connector/oauth/callback';
+const CHATGPT_KNOWN_CALLBACK_URIS = [CHATGPT_CATALOG_CALLBACK_URI, CHATGPT_APPS_CALLBACK_URI];
+const CHATGPT_CONNECTOR_DESCRIPTION =
+  'Use governed enterprise work tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.';
 
 const COPILOT_RUNTIME_SYSTEM_KEY = RUNTIME_ORCHESTRATION_SYSTEM_KEY;
 const COPILOT_RUNTIME_TRANSPORT = 'streamable-http';
@@ -23,6 +32,14 @@ module.exports = {
   CHATGPT_RUNTIME_SYSTEM_KEY,
   CHATGPT_RUNTIME_TRANSPORT,
   CHATGPT_RUNTIME_AUTH_MODE,
+  CHATGPT_OAUTH2_PROFILE_ID,
+  CHATGPT_OAUTH2_PROFILE_PATH,
+  CHATGPT_INTEGRATION_CLIENT_KEY,
+  CHATGPT_APPS_CREATE_URL,
+  CHATGPT_CATALOG_CALLBACK_URI,
+  CHATGPT_APPS_CALLBACK_URI,
+  CHATGPT_KNOWN_CALLBACK_URIS,
+  CHATGPT_CONNECTOR_DESCRIPTION,
   COPILOT_RUNTIME_SYSTEM_KEY,
   COPILOT_RUNTIME_TRANSPORT,
   COPILOT_RUNTIME_AUTH_MODE