@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/microsoft-provisioning/teams-bot-controller.js

@@ -0,0 +1,123 @@
+/**
+ * Read Azure subscription / resource group and Entra tenant from Miso Controller.
+ *
+ * @fileoverview Same controller sources as Copilot Entra SSO — not operator CLI flags
+ */
+
+'use strict';
+
+const { getEnvironment } = require('../../api/environments.api');
+const { getKeycloakEntraIdentityProvider } = require('../../api/keycloak.api');
+const { trimFlag } = require('./teams-bot-args');
+
+/**
+ * @param {unknown} response
+ * @returns {Object|null}
+ */
+function unwrapEnvironment(response) {
+  if (!response || typeof response !== 'object') {
+    return null;
+  }
+  const first = response.data !== undefined ? response.data : response;
+  if (first && first.configuration) {
+    return first;
+  }
+  if (first && first.data && first.data.configuration) {
+    return first.data;
+  }
+  return first && typeof first === 'object' ? first : null;
+}
+
+/**
+ * Azure IDs live on environment.configuration (JSON). Do not use Environment.subscriptionId —
+ * that field is the Miso Subscription foreign key.
+ * @param {Object|null} env
+ * @returns {{ subscription: string, resourceGroup: string }}
+ */
+function extractAzureFromEnvironment(env) {
+  const cfg = (env && env.configuration) || {};
+  return {
+    subscription: trimFlag(cfg.subscriptionId),
+    resourceGroup: trimFlag(cfg.resourceGroupName || cfg.resourceGroup)
+  };
+}
+
+/**
+ * @param {Object|null} idp
+ * @returns {string}
+ */
+function extractTenantFromIdp(idp) {
+  return trimFlag(idp && idp.tenantId);
+}
+
+/**
+ * @param {{ subscription?: string, resourceGroup?: string }|null} current
+ * @param {{ subscription?: string, resourceGroup?: string }} next
+ * @returns {{ subscription: string, resourceGroup: string }}
+ */
+function mergeAzure(current, next) {
+  return {
+    subscription: trimFlag(current && current.subscription) || trimFlag(next.subscription),
+    resourceGroup: trimFlag(current && current.resourceGroup) || trimFlag(next.resourceGroup)
+  };
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} [deps]
+ * @returns {Promise<{ azure: { subscription: string, resourceGroup: string }, tenantId: string }>}
+ */
+async function loadTeamsBotControllerContext(ctx, deps = {}) {
+  let azure = mergeAzure(deps.azure, { subscription: '', resourceGroup: '' });
+  let tenantId = trimFlag(deps.expectedTenantId);
+  if (!ctx || !ctx.controllerUrl) {
+    return { azure, tenantId };
+  }
+  azure = await fillAzureFromEnvironment(ctx, azure, deps);
+  if (!tenantId) {
+    tenantId = await loadEntraTenantId(ctx, deps);
+  }
+  return { azure, tenantId };
+}
+
+/**
+ * @param {Object} ctx
+ * @param {{ subscription: string, resourceGroup: string }} azure
+ * @param {Object} deps
+ * @returns {Promise<{ subscription: string, resourceGroup: string }>}
+ */
+async function fillAzureFromEnvironment(ctx, azure, deps) {
+  if (azure.subscription && azure.resourceGroup) {
+    return azure;
+  }
+  const getEnv = deps.getEnvironment || getEnvironment;
+  try {
+    const env = unwrapEnvironment(
+      await getEnv(ctx.controllerUrl, ctx.environment || 'dev', ctx.authConfig)
+    );
+    return mergeAzure(azure, extractAzureFromEnvironment(env));
+  } catch {
+    return azure;
+  }
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} deps
+ * @returns {Promise<string>}
+ */
+async function loadEntraTenantId(ctx, deps) {
+  const getIdp = deps.getKeycloakEntraIdentityProvider || getKeycloakEntraIdentityProvider;
+  try {
+    return extractTenantFromIdp(await getIdp(ctx.controllerUrl, ctx.authConfig));
+  } catch {
+    return '';
+  }
+}
+
+module.exports = {
+  unwrapEnvironment,
+  extractAzureFromEnvironment,
+  extractTenantFromIdp,
+  loadTeamsBotControllerContext
+};

package/lib/channels/microsoft-provisioning/teams-bot-parse.js

@@ -0,0 +1,134 @@
+/**
+ * Parse Teams Developer CLI credentials without logging secrets.
+ *
+ * @fileoverview CLIENT_ID / CLIENT_SECRET / TENANT_ID from --env or --json only
+ */
+
+'use strict';
+
+const { microsoftProvisioningError } = require('./errors');
+const { extractTenantId, assertExpectedTenant } = require('./auth');
+
+/**
+ * @param {string} [content]
+ * @returns {Object.<string, string>}
+ */
+function parseEnvMap(content) {
+  const map = {};
+  for (const line of String(content || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const eq = trimmed.indexOf('=');
+    if (eq > 0) {
+      map[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1).trim();
+    }
+  }
+  return map;
+}
+
+/**
+ * @param {string} [stdout]
+ * @returns {Object|null}
+ */
+function parseJsonCreateResult(stdout) {
+  const text = String(stdout || '').trim();
+  if (!text) {
+    return null;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object|null} result
+ * @param {Object.<string, string>} envMap
+ * @returns {Object}
+ */
+function firstValue(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+  }
+  return undefined;
+}
+
+/**
+ * @param {Object|null} result
+ * @param {Object.<string, string>} envMap
+ * @returns {Object}
+ */
+function credentialsFromCreate(result, envMap) {
+  const creds = (result && result.credentials) || {};
+  const map = envMap || {};
+  return {
+    clientId: firstValue(map.CLIENT_ID, map.clientId, creds.CLIENT_ID, creds.clientId),
+    clientSecret: firstValue(map.CLIENT_SECRET, map.clientSecret, creds.CLIENT_SECRET),
+    tenantId: extractTenantId(
+      firstValue(map.TENANT_ID, map.tenantId, creds.TENANT_ID, result && result.tenantId) || ''
+    ),
+    teamsAppId: result && (result.teamsAppId || result.appId),
+    botId: result && result.botId,
+    botLocation: result && result.botLocation,
+    installLink: result && result.installLink
+  };
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {void}
+ */
+function assertAzureManaged(parsed) {
+  const loc = String((parsed && parsed.botLocation) || '').toLowerCase();
+  if (!loc) {
+    return;
+  }
+  if (loc.includes('teams-managed') || loc === 'teams') {
+    throw microsoftProvisioningError(
+      'Teams-managed bot is not supported. Azure-managed is required for OAuth/SSO.',
+      'TEAMS_MANAGED'
+    );
+  }
+  if (!loc.includes('azure')) {
+    throw microsoftProvisioningError(
+      `Unexpected bot location "${parsed.botLocation}". Azure-managed is required.`,
+      'TEAMS_MANAGED'
+    );
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} [expectedTenant]
+ * @returns {void}
+ */
+function assertParsedCredentials(parsed, expectedTenant) {
+  if (!parsed || !parsed.clientId || !parsed.clientSecret) {
+    throw microsoftProvisioningError(
+      'Teams CLI did not return CLIENT_ID and CLIENT_SECRET.',
+      'CREDENTIALS'
+    );
+  }
+  if (expectedTenant && !parsed.tenantId) {
+    throw microsoftProvisioningError(
+      'Could not determine the Microsoft tenant from Teams CLI output.',
+      'TENANT'
+    );
+  }
+  if (expectedTenant) {
+    assertExpectedTenant(expectedTenant, parsed.tenantId);
+  }
+}
+
+module.exports = {
+  parseEnvMap,
+  parseJsonCreateResult,
+  credentialsFromCreate,
+  assertAzureManaged,
+  assertParsedCredentials
+};

package/lib/channels/microsoft-provisioning/teams-bot-persist.js

@@ -0,0 +1,113 @@
+/**
+ * Persist non-secret Teams Bot correlation IDs only.
+ *
+ * @fileoverview Azure-managed app ids; never CLIENT_SECRET
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const {
+  TEAMS_BOT_STATE_FILE,
+  TEAMS_BOT_STATE_KIND,
+  SECRET_KEY_RE
+} = require('./constants');
+const { microsoftProvisioningError } = require('./errors');
+
+/**
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+function teamsBotStatePath(projectRoot) {
+  const root = projectRoot || process.cwd();
+  return path.join(root, 'dist', 'channels', 'teams-bot', TEAMS_BOT_STATE_FILE);
+}
+
+/**
+ * @param {Object} record
+ * @returns {void}
+ */
+function assertNoSecrets(record) {
+  const keys = record && typeof record === 'object' ? Object.keys(record) : [];
+  const hit = keys.find((key) => SECRET_KEY_RE.test(key));
+  if (hit) {
+    throw microsoftProvisioningError(
+      `Refusing to persist Microsoft secret field "${hit}".`,
+      'SECRET'
+    );
+  }
+}
+
+/**
+ * @param {string} projectRoot
+ * @returns {Object|null}
+ */
+function readTeamsBotState(projectRoot) {
+  const filePath = teamsBotStatePath(projectRoot);
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!parsed || parsed.kind !== TEAMS_BOT_STATE_KIND) {
+      return null;
+    }
+    assertNoSecrets(parsed);
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object|null} current
+ * @param {Object} next
+ * @returns {boolean}
+ */
+function isReusableTeamsBot(current, next) {
+  if (!current || current.azureManaged !== true) {
+    return false;
+  }
+  if (typeof current.teamsAppId !== 'string' || !current.teamsAppId.trim()) {
+    return false;
+  }
+  if (current.environment !== next.environment) {
+    return false;
+  }
+  if (current.tenantId && next.tenantId) {
+    return String(current.tenantId).toLowerCase() === String(next.tenantId).toLowerCase();
+  }
+  return true;
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {Object} state
+ * @returns {void}
+ */
+function writeTeamsBotState(projectRoot, state) {
+  const record = {
+    kind: TEAMS_BOT_STATE_KIND,
+    environment: state.environment,
+    tenantId: state.tenantId || null,
+    endpoint: state.endpoint || null,
+    teamsAppId: state.teamsAppId,
+    azureManaged: true,
+    subscriptionId: state.subscriptionId || null,
+    resourceGroup: state.resourceGroup || null,
+    stored: state.stored === true
+  };
+  assertNoSecrets(record);
+  const filePath = teamsBotStatePath(projectRoot);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
+
+module.exports = {
+  teamsBotStatePath,
+  readTeamsBotState,
+  writeTeamsBotState,
+  isReusableTeamsBot,
+  assertNoSecrets
+};

package/lib/channels/microsoft-provisioning/teams-bot-provision.js

@@ -0,0 +1,234 @@
+/**
+ * Provision an Azure-managed Teams Bot around the existing Runtime webhook.
+ *
+ * @fileoverview teams app create --azure; reuse per environment × tenant
+ */
+
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const { TEAMS_OPEN_URL, TEAMS_POLICY_REMAINING, TEAMS_CLI_MISSING_REMAINING } = require('./constants');
+const { wrapTeamsCliError } = require('./errors');
+const { resolveTeamsBinary, runTeams, isTeamsCliLoggedIn } = require('./teams-cli');
+const {
+  assertHttpsEndpoint,
+  buildAppCreateArgs,
+  requireAzureFlags,
+  resolveAzureFlags,
+  trimFlag
+} = require('./teams-bot-args');
+const {
+  assertAzureManaged,
+  assertParsedCredentials,
+  credentialsFromCreate,
+  parseEnvMap,
+  parseJsonCreateResult
+} = require('./teams-bot-parse');
+const { isReusableTeamsBot, readTeamsBotState, writeTeamsBotState } = require('./teams-bot-persist');
+const { storeTeamsBotSecrets } = require('./teams-bot-secrets');
+const { loadTeamsBotControllerContext } = require('./teams-bot-controller');
+
+/**
+ * @returns {Object}
+ */
+function skipClosedMissingCli() {
+  return {
+    connected: false,
+    skipped: true,
+    remaining: TEAMS_CLI_MISSING_REMAINING
+  };
+}
+
+/**
+ * @returns {Object}
+ */
+function skipClosedNotLoggedIn() {
+  return {
+    connected: false,
+    skipped: true,
+    remaining: ['Sign in with Microsoft, then continue after sign-in']
+  };
+}
+
+/**
+ * @param {Object} existing
+ * @returns {Object}
+ */
+function reusedConnected(existing) {
+  return {
+    connected: true,
+    reused: true,
+    remaining: [TEAMS_POLICY_REMAINING],
+    openUrl: TEAMS_OPEN_URL,
+    teamsAppId: existing.teamsAppId,
+    azureManaged: true
+  };
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Object}
+ */
+function provisionContext(params) {
+  const messagesUrl = params.runtimeValues && params.runtimeValues.messagesUrl;
+  assertHttpsEndpoint(messagesUrl);
+  const options = params.options || {};
+  return {
+    messagesUrl,
+    azure: resolveAzureFlags(options),
+    environment:
+      params.environment || (params.runtimeValues && params.runtimeValues.environment) || 'dev',
+    expectedTenant: trimFlag(options.expectedTenantId),
+    appName: (params.runtimeValues && params.runtimeValues.appName) || 'AI Fabrix',
+    projectRoot: params.projectRoot,
+    ctx: params.ctx
+  };
+}
+
+/**
+ * @param {string} envPath
+ * @returns {Object.<string, string>}
+ */
+function readEnvMap(envPath) {
+  if (!envPath || !fs.existsSync(envPath)) {
+    return {};
+  }
+  return parseEnvMap(fs.readFileSync(envPath, 'utf8'));
+}
+
+/**
+ * @param {string} envPath
+ * @returns {void}
+ */
+function unlinkQuiet(envPath) {
+  try {
+    if (envPath && fs.existsSync(envPath)) {
+      fs.unlinkSync(envPath);
+    }
+  } catch {
+    // best-effort: temp credentials file must not remain in dist/
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function createAzureManagedBot(params, deps = {}) {
+  const envPath =
+    params.envPath || path.join(os.tmpdir(), `aifabrix-teams-bot-${process.pid}.env`);
+  const args = buildAppCreateArgs({ ...params, envPath });
+  try {
+    const result = await runTeams(params.bin, args, { timeout: 180000 }, deps);
+    const parsed = credentialsFromCreate(parseJsonCreateResult(result.stdout), readEnvMap(envPath));
+    assertAzureManaged(parsed);
+    assertParsedCredentials(parsed, params.expectedTenantId);
+    return parsed;
+  } catch (error) {
+    const code = error && error.code;
+    if (code === 'WRONG_TENANT' || code === 'TEAMS_MANAGED' || code === 'CREDENTIALS' || code === 'TENANT' || code === 'SCAFFOLD') {
+      throw error;
+    }
+    throw wrapTeamsCliError(error);
+  } finally {
+    unlinkQuiet(envPath);
+  }
+}
+
+/**
+ * @param {Object} context
+ * @param {Object} created
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function persistCreatedBot(context, created, deps = {}) {
+  await storeTeamsBotSecrets(context.ctx, created, deps);
+  const write = deps.writeState || writeTeamsBotState;
+  write(context.projectRoot, {
+    environment: context.environment,
+    tenantId: created.tenantId || null,
+    endpoint: context.messagesUrl,
+    teamsAppId: created.teamsAppId || created.clientId,
+    azureManaged: true,
+    subscriptionId: context.azure.subscription,
+    resourceGroup: context.azure.resourceGroup,
+    stored: true
+  });
+}
+
+/**
+ * @param {Object} created
+ * @returns {Object}
+ */
+function connectedResult(created) {
+  return {
+    connected: true,
+    remaining: [TEAMS_POLICY_REMAINING],
+    openUrl: created.installLink || TEAMS_OPEN_URL,
+    teamsAppId: created.teamsAppId || created.clientId,
+    azureManaged: true
+  };
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function applyControllerContext(context, deps = {}) {
+  const controller = await loadTeamsBotControllerContext(context.ctx, {
+    ...deps,
+    azure: context.azure,
+    expectedTenantId: context.expectedTenant
+  });
+  context.azure = controller.azure;
+  context.expectedTenant = controller.tenantId || context.expectedTenant;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function provisionTeamsBot(params, deps = {}) {
+  const context = provisionContext(params);
+  const read = deps.readState || readTeamsBotState;
+  const existing = read(context.projectRoot);
+  if (isReusableTeamsBot(existing, { environment: context.environment, tenantId: context.expectedTenant })) {
+    return reusedConnected(existing);
+  }
+  const bin = await resolveTeamsBinary(deps);
+  if (!bin) {
+    return skipClosedMissingCli();
+  }
+  if (!(await isTeamsCliLoggedIn({ ...deps, teamsBinary: bin }))) {
+    return skipClosedNotLoggedIn();
+  }
+  await applyControllerContext(context, deps);
+  requireAzureFlags(context.azure);
+  const created = await createAzureManagedBot(
+    {
+      bin,
+      name: context.appName,
+      endpoint: context.messagesUrl,
+      subscription: context.azure.subscription,
+      resourceGroup: context.azure.resourceGroup,
+      expectedTenantId: context.expectedTenant
+    },
+    deps
+  );
+  await persistCreatedBot(context, created, deps);
+  return connectedResult(created);
+}
+
+module.exports = {
+  TEAMS_CLI_MISSING_REMAINING,
+  skipClosedMissingCli,
+  provisionTeamsBot,
+  buildAppCreateArgs,
+  isReusableTeamsBot
+};

package/lib/channels/microsoft-provisioning/teams-bot-secrets.js

@@ -0,0 +1,45 @@
+/**
+ * Store Teams Bot App ID + secret via existing dataplane credential APIs.
+ *
+ * @fileoverview Never log or persist secret values in dist /
+ */
+
+'use strict';
+
+const { storeCredentialSecrets } = require('../../api/credential.api');
+const { KV_TEAMS_BOT_APP_ID, KV_TEAMS_BOT_APP_SECRET } = require('./constants');
+
+/**
+ * @param {string} [value]
+ * @returns {boolean}
+ */
+function hasSecretValue(value) {
+  return typeof value === 'string' && Boolean(value.trim());
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Object} parsed
+ * @param {Object} [deps]
+ * @returns {Promise<{ stored: boolean }>}
+ */
+async function storeTeamsBotSecrets(ctx, parsed, deps = {}) {
+  const items = [];
+  if (hasSecretValue(parsed && parsed.clientId)) {
+    items.push({ key: KV_TEAMS_BOT_APP_ID, value: String(parsed.clientId).trim() });
+  }
+  if (hasSecretValue(parsed && parsed.clientSecret)) {
+    items.push({ key: KV_TEAMS_BOT_APP_SECRET, value: String(parsed.clientSecret).trim() });
+  }
+  if (items.length === 0) {
+    return { stored: false };
+  }
+  const store = deps.storeCredentialSecrets || storeCredentialSecrets;
+  await store(ctx.dataplaneUrl, ctx.authConfig, items);
+  return { stored: true };
+}
+
+module.exports = {
+  hasSecretValue,
+  storeTeamsBotSecrets
+};