@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/mcp-client-channel-add.js

@@ -0,0 +1,186 @@
+/**
+ * MCP client continuation for channel add: profile, preflight, Integration Client, mcp.json.
+ *
+ * @fileoverview Keep add-channel.js free of MCP client continuation logic
+ */
+
+'use strict';
+
+const { runChatGptPreflight } = require('./chatgpt-preflight');
+const {
+  printValidating,
+  printRuntimeDeployed,
+  printRuntimeUnavailable,
+  printOAuthConnected,
+  printOAuthNotConnected,
+  printRemainingSteps,
+  printFixThenRerun
+} = require('./channel-add-tty');
+const { requireMcpClientProfile } = require('./mcp-client/profiles');
+const { ensureMcpClientIntegrationClient } = require('./mcp-client/ensure-client');
+const { resolveMcpConfigPath } = require('./mcp-client/paths');
+const { mergeMcpClientConfig } = require('./mcp-client/config-merge');
+
+const REMAINING_STEP = 'Reload the editor.';
+
+/**
+ * @param {string} message
+ * @returns {string}
+ */
+function mcpClientPreflightMessage(message) {
+  return String(message || '').replace(/^ChatGPT preflight:\s*/i, 'MCP client preflight: ');
+}
+
+/**
+ * @param {Object} params
+ * @returns {string}
+ */
+function mcpClientResumeCommand(params) {
+  const profile = params.mcpClientProfile;
+  const profileKey = (profile && profile.key) || '<profile>';
+  const name =
+    (params.options && params.options.name) ||
+    (params.runtimeValues && (params.runtimeValues.baseName || params.runtimeValues.appName)) ||
+    '';
+  const quoted = name ? `"${name}"` : '"<name>"';
+  return `aifabrix channel add mcp-client --target ${profileKey} --name ${quoted}`;
+}
+
+/**
+ * Fail closed when --target / --profile is missing or unknown.
+ * @param {string} channelTarget
+ * @param {Object} options
+ * @returns {Object|null}
+ */
+function maybeAssertMcpClientProfile(channelTarget, options = {}) {
+  if (channelTarget !== 'mcp-client') {
+    return null;
+  }
+  if (options.apiKey || options.auth === 'apiKey' || options.authMode === 'apiKey') {
+    const error = new Error('MCP client does not support API keys. Use OAuth.');
+    error.boundary = 'oauth';
+    throw error;
+  }
+  return requireMcpClientProfile(options);
+}
+
+/**
+ * @param {Object} params
+ * @param {Error} error
+ * @returns {void}
+ */
+function printMcpClientPreflightFailure(params, error) {
+  const message = mcpClientPreflightMessage(error && error.message);
+  if (/pkce|authorization.server|protected resource/i.test(message)) {
+    printRuntimeDeployed();
+    printOAuthNotConnected();
+    printFixThenRerun('Fix OAuth discovery', mcpClientResumeCommand(params));
+    return;
+  }
+  printRuntimeUnavailable();
+  printFixThenRerun('Fix the Runtime connection', mcpClientResumeCommand(params));
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeAssertMcpClientPreflight(params) {
+  if (params.channelTarget !== 'mcp-client') {
+    return null;
+  }
+  const profile = params.mcpClientProfile || requireMcpClientProfile(params.options || {});
+  params.mcpClientProfile = profile;
+  printValidating(profile.displayName);
+  try {
+    params.preflight = await runChatGptPreflight(params);
+    printRuntimeDeployed();
+    if (!(params.preflight && params.preflight.skipped)) {
+      printOAuthConnected();
+    }
+    return params.preflight;
+  } catch (error) {
+    if (error && error.message) {
+      error.message = mcpClientPreflightMessage(error.message);
+    }
+    printMcpClientPreflightFailure(params, error);
+    throw error;
+  }
+}
+
+/**
+ * @param {Object} profile
+ * @param {Object} runtimeValues
+ * @param {string|undefined} clientSecret
+ * @returns {Object}
+ */
+function mcpServerEntry(profile, runtimeValues, clientSecret) {
+  const auth = { CLIENT_ID: profile.oauth.keycloakClientId };
+  if (clientSecret) {
+    auth.CLIENT_SECRET = clientSecret;
+  }
+  return {
+    url: runtimeValues && runtimeValues.mcpUrl,
+    auth
+  };
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function runMcpClientChannelAddContinuation(params) {
+  const profile = params.mcpClientProfile || requireMcpClientProfile(params.options || {});
+  const ensured = await ensureMcpClientIntegrationClient({
+    ctx: params.ctx,
+    profile,
+    deps: params.deps
+  });
+  const filePath = resolveMcpConfigPath(profile, params.pathDeps);
+  const merged = mergeMcpClientConfig({
+    profile,
+    filePath,
+    entry: mcpServerEntry(profile, params.runtimeValues, ensured.clientSecret),
+    deps: params.fsDeps
+  });
+  printRemainingSteps('', [profile.reload.remainingStep || REMAINING_STEP]);
+  return {
+    profileKey: profile.key,
+    configPath: merged.filePath,
+    created: ensured.created,
+    added: ensured.added,
+    recovered: merged.recovered
+  };
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeRunMcpClientContinuation(params) {
+  if (params.channelTarget !== 'mcp-client') {
+    return null;
+  }
+  return runMcpClientChannelAddContinuation(params);
+}
+
+/**
+ * Dry-run TTY: no Integration Client create and no mcp.json write.
+ * @param {Object} params
+ * @returns {void}
+ */
+function printMcpClientDryRunTty(params) {
+  const profile = params.mcpClientProfile || requireMcpClientProfile(params.options || {});
+  printValidating(profile.displayName);
+  printRuntimeDeployed();
+  printRemainingSteps('', [profile.reload.remainingStep || REMAINING_STEP]);
+}
+
+module.exports = {
+  maybeAssertMcpClientProfile,
+  maybeAssertMcpClientPreflight,
+  maybeRunMcpClientContinuation,
+  runMcpClientChannelAddContinuation,
+  printMcpClientDryRunTty,
+  mcpServerEntry
+};

package/lib/channels/microsoft-copilot-channel-add.js

@@ -8,7 +8,9 @@
 
 'use strict';
 
-const { resolveChannelAuthContext } = require('./channel-auth-context');
+const {
+  resolveChannelAuthContext
+} = require('./channel-auth-context');
 const {
   normalizeBaseChannelName,
   resolveChannelDisplayName
@@ -19,7 +21,17 @@ const { loadChannelPackageContext } = require('./channel-discovery');
 const { getInboundMicrosoftEntraIdProvider } = require('../api/token-providers.api');
 const { getKeycloakEntraIdentityProvider } = require('../api/keycloak.api');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
+const { vendorFacingUrlsFromCtx } = require('./vendor-dataplane-url');
 const { assertOauthPluginVaultReferenceId } = require('./microsoft-copilot-entra-sso');
+const {
+  getCopilotPackageSourceDir,
+  readPriorOauthPluginVaultReferenceId
+} = require('./microsoft-copilot-package-prior');
+const { captureCopilotAuthConfigId } = require('./microsoft-provisioning');
+const { ensureCopilotInstallClient } = require('./channel-predefined-client');
+const { ensureCopilotEntraIdentifierUris } = require('./microsoft-copilot-entra-identifier-uris');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-layout-chalk');
+const logger = require('../utils/logger');
 
 /**
  * @param {Object} options
@@ -32,8 +44,25 @@ function hasOauthPluginVaultReference(options) {
   );
 }
 
+/**
+ * Reuse prior package vault reference when the CLI flag is omitted.
+ * @param {Object} options
+ * @returns {void}
+ */
+function applyPriorOauthPluginVaultReference(options) {
+  if (hasOauthPluginVaultReference(options)) {
+    return;
+  }
+  const projectRoot = options.projectRoot || process.cwd();
+  const prior = readPriorOauthPluginVaultReferenceId(getCopilotPackageSourceDir(projectRoot));
+  if (prior) {
+    options.oauthPluginVaultReferenceId = prior;
+  }
+}
+
 /**
  * Load Trust source + Keycloak Entra IdP for Copilot packaging (null on miss/error).
+ * Read-only — audience/scopes are seeded by Miso installer baseline.
  * @param {Object} ctx
  * @returns {Promise<{ entraProvider: Object|null, entraIdentityProvider: Object|null }>}
  */
@@ -77,8 +106,10 @@ async function resolveCopilotFormContextForError(params) {
     packageContext = null;
   }
   const { entraProvider, entraIdentityProvider } = await loadMicrosoftCopilotEntraContext(ctx);
+  const vendor = vendorFacingUrlsFromCtx(ctx);
   return resolveChannelRuntimeValues({
-    dataplaneBaseUrl: ctx.dataplaneUrl,
+    dataplaneBaseUrl: vendor.dataplaneBaseUrl,
+    controllerUrl: vendor.controllerUrl,
     channelTarget: 'microsoft-copilot',
     appName: name,
     baseName,
@@ -91,17 +122,92 @@ async function resolveCopilotFormContextForError(params) {
   });
 }
 
+/**
+ * Capture Teams Entra SSO auth-config via Agents Toolkit when the flag is omitted.
+ * @param {Object} params
+ * @returns {Promise<void>}
+ */
+async function tryCaptureOauthPluginVaultReference(params) {
+  const { options, formContext, ctx } = params;
+  if (options.dryRun === true) {
+    return;
+  }
+  const captured = await captureCopilotAuthConfigId({
+    clientId: formContext && formContext.entraSsoClientId,
+    mcpServerUrl: (formContext && (formContext.mcpUrl || formContext.entraSsoBaseUrl)) || null,
+    expectedTenantId: formContext && formContext.entraTenantId,
+    environment: (ctx && ctx.environment) || (formContext && formContext.environment),
+    projectRoot: options.projectRoot,
+    teamsAppId: formContext && formContext.packageAppId
+  });
+  if (captured && captured.authConfigId) {
+    options.oauthPluginVaultReferenceId = captured.authConfigId;
+  }
+}
+
+/**
+ * @param {Object} options
+ * @param {{ status?: string, reason?: string }|null} result
+ * @returns {void}
+ */
+function logIdentifierUriEnsureResult(options, result) {
+  if (!result || options.quiet === true) {
+    return;
+  }
+  if (result.status === 'updated') {
+    logger.log(formatSuccessLine('Added Teams Entra SSO identifier URI on the Microsoft Entra app'));
+    return;
+  }
+  if (result.status !== 'skipped' || !result.reason || result.reason === 'tests') {
+    return;
+  }
+  if (result.reason === 'missing-inputs' || result.reason === 'dry-run') {
+    return;
+  }
+  logger.log(
+    formatWarningLine(
+      `Entra identifier URIs were not updated automatically (${result.reason}). Use the az command in INSTALL.md.`
+    )
+  );
+}
+
+/**
+ * After vault capture, merge api://auth-{authConfigId}/{clientId} onto the Entra app.
+ * @param {Object} params
+ * @returns {Promise<void>}
+ */
+async function tryEnsureCopilotEntraIdentifierUris(params) {
+  const { options } = params;
+  if (options.dryRun === true || !hasOauthPluginVaultReference(options)) {
+    return;
+  }
+  const formContext = params.formContext || (await resolveCopilotFormContextForError(params));
+  const result = await ensureCopilotEntraIdentifierUris({
+    clientId: formContext && formContext.entraSsoClientId,
+    oauthPluginVaultReferenceId: options.oauthPluginVaultReferenceId,
+    dryRun: options.dryRun === true
+  });
+  logIdentifierUriEnsureResult(options, result);
+}
+
 /**
  * @param {Object} params
  * @throws {Error}
  */
 async function assertMicrosoftCopilotOauthReference(params) {
   const { options } = params;
-  if (hasOauthPluginVaultReference(options)) {
-    return;
+  const vaultFromFlag = hasOauthPluginVaultReference(options);
+  let formContext = params.formContext || null;
+  if (!vaultFromFlag) {
+    formContext = formContext || (await resolveCopilotFormContextForError(params));
+    await tryCaptureOauthPluginVaultReference({ ...params, formContext });
+  }
+  if (!hasOauthPluginVaultReference(options)) {
+    formContext = formContext || (await resolveCopilotFormContextForError(params));
+    assertOauthPluginVaultReferenceId({ ...options, formContext });
   }
-  const formContext = await resolveCopilotFormContextForError(params);
-  assertOauthPluginVaultReferenceId({ ...options, formContext });
+  await ensureCopilotInstallClient(params);
+  await tryEnsureCopilotEntraIdentifierUris({ ...params, formContext });
 }
 
 /**
@@ -113,7 +219,10 @@ async function assertMicrosoftCopilotOauthReferenceBeforeForce(options) {
   if (hasOauthPluginVaultReference(options)) {
     return;
   }
-  const ctx = await resolveChannelAuthContext('microsoft-copilot', { silent: options.quiet });
+  const ctx =
+    options.authContext && typeof options.authContext === 'object'
+      ? options.authContext
+      : await resolveChannelAuthContext('microsoft-copilot', { silent: options.quiet });
   const baseName = normalizeBaseChannelName(options.name);
   const name = resolveChannelDisplayName(baseName, ctx.environment);
   const rawDescription =
@@ -131,6 +240,7 @@ async function assertMicrosoftCopilotOauthReferenceBeforeForce(options) {
 
 module.exports = {
   hasOauthPluginVaultReference,
+  applyPriorOauthPluginVaultReference,
   loadMicrosoftCopilotEntraContext,
   resolveCopilotFormContextForError,
   assertMicrosoftCopilotOauthReference,

package/lib/channels/microsoft-copilot-entra-identifier-uris.js

@@ -0,0 +1,187 @@
+/**
+ * Merge Teams Entra SSO identifier URIs onto the Microsoft Entra app.
+ *
+ * @fileoverview Keep api://{clientId} and add api://auth-{authConfigId}/{clientId}
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const {
+  parseOauthPluginVaultAuthConfigId,
+  buildTeamsWebApplicationInfoResource
+} = require('./microsoft-copilot-entra-sso-form');
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipLiveAz(deps = {}) {
+  if (deps.allowInTests === true) {
+    return false;
+  }
+  return Boolean(process.env.JEST_WORKER_ID);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimNonEmptyString(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+/**
+ * @param {string|null|undefined} clientId
+ * @param {string|null|undefined} oauthPluginVaultReferenceId
+ * @returns {string[]|null}
+ */
+function requiredCopilotIdentifierUris(clientId, oauthPluginVaultReferenceId) {
+  const appId = trimNonEmptyString(clientId);
+  const authConfigId = parseOauthPluginVaultAuthConfigId(oauthPluginVaultReferenceId);
+  const teamsUri = buildTeamsWebApplicationInfoResource(authConfigId, appId);
+  if (!appId || !teamsUri) {
+    return null;
+  }
+  return [`api://${appId}`, teamsUri];
+}
+
+/**
+ * Preserve existing URIs and append any missing required URIs.
+ * @param {unknown} existing
+ * @param {string[]} required
+ * @returns {string[]}
+ */
+function mergeIdentifierUris(existing, required) {
+  const out = [];
+  const seen = new Set();
+  const add = (uri) => {
+    const normalized = trimNonEmptyString(uri);
+    if (!normalized || seen.has(normalized)) {
+      return;
+    }
+    seen.add(normalized);
+    out.push(normalized);
+  };
+  if (Array.isArray(existing)) {
+    existing.forEach(add);
+  }
+  (required || []).forEach(add);
+  return out;
+}
+
+/**
+ * @param {unknown} existing
+ * @param {string[]} required
+ * @returns {boolean}
+ */
+function identifierUrisAlreadyPresent(existing, required) {
+  const set = new Set(
+    Array.isArray(existing) ? existing.map((uri) => trimNonEmptyString(uri)).filter(Boolean) : []
+  );
+  return (required || []).every((uri) => set.has(uri));
+}
+
+/**
+ * @param {string} stdout
+ * @returns {string[]}
+ */
+function parseIdentifierUriJson(stdout) {
+  try {
+    const parsed = JSON.parse(String(stdout || '[]'));
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.map((uri) => trimNonEmptyString(uri)).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * @param {string[]} args
+ * @param {Object} deps
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function runAz(args, deps) {
+  const execFileImpl = deps.execFile || execFileDefault;
+  const result = await execFileImpl('az', args, {
+    timeout: deps.timeout || 60000,
+    maxBuffer: 2 * 1024 * 1024
+  });
+  return {
+    stdout: result && result.stdout ? String(result.stdout) : '',
+    stderr: result && result.stderr ? String(result.stderr) : ''
+  };
+}
+
+/**
+ * @param {Error} error
+ * @returns {string}
+ */
+function azFailureReason(error) {
+  const code = error && error.code;
+  if (code === 'ENOENT') {
+    return 'Azure CLI is not available';
+  }
+  const message = error && error.message ? String(error.message).split('\n')[0] : '';
+  return message ? `Azure CLI: ${message.slice(0, 180)}` : 'Azure CLI update failed';
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ status: string, reason?: string, identifierUris?: string[] }>}
+ */
+async function applyIdentifierUriMerge(params, deps) {
+  const shown = await runAz(
+    ['ad', 'app', 'show', '--id', params.clientId, '--query', 'identifierUris', '-o', 'json'],
+    deps
+  );
+  const current = parseIdentifierUriJson(shown.stdout);
+  if (identifierUrisAlreadyPresent(current, params.required)) {
+    return { status: 'unchanged', identifierUris: current };
+  }
+  const next = mergeIdentifierUris(current, params.required);
+  await runAz(['ad', 'app', 'update', '--id', params.clientId, '--identifier-uris', ...next], deps);
+  return { status: 'updated', identifierUris: next };
+}
+
+/**
+ * Add the Teams auth-config URI without removing existing identifier URIs.
+ * Non-blocking: missing Azure CLI or Graph permission returns skipped.
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ status: string, reason?: string, identifierUris?: string[] }>}
+ */
+async function ensureCopilotEntraIdentifierUris(params = {}, deps = {}) {
+  if (params.dryRun === true) {
+    return { status: 'skipped', reason: 'dry-run' };
+  }
+  if (shouldSkipLiveAz(deps)) {
+    return { status: 'skipped', reason: 'tests' };
+  }
+  const required = requiredCopilotIdentifierUris(
+    params.clientId,
+    params.oauthPluginVaultReferenceId
+  );
+  const clientId = trimNonEmptyString(params.clientId);
+  if (!required || !clientId) {
+    return { status: 'skipped', reason: 'missing-inputs' };
+  }
+  try {
+    return await applyIdentifierUriMerge({ clientId, required }, deps);
+  } catch (error) {
+    return { status: 'skipped', reason: azFailureReason(error) };
+  }
+}
+
+module.exports = {
+  shouldSkipLiveAz,
+  requiredCopilotIdentifierUris,
+  mergeIdentifierUris,
+  identifierUrisAlreadyPresent,
+  parseIdentifierUriJson,
+  ensureCopilotEntraIdentifierUris
+};