@aifabrix/builder 2.53.1 → 2.55.0

package/lib/lifecycle/role-assistant-governance.js

@@ -0,0 +1,181 @@
+/**
+ * Role Assistant lifecycle is not Connected System governance.
+ *
+ * Generated digital-worker datasources do not own scenario packs. Those packs
+ * belong on the Connected System. Missing-pack FAILED must not fail RA prove.
+ */
+
+'use strict';
+
+const { VERDICT } = require('./product-model');
+
+const GOVERNANCE_SCENARIOS_MISSING = 'GOVERNANCE_SCENARIOS_MISSING';
+const GOVERNANCE_NOT_VERIFIED = 'GOVERNANCE_NOT_VERIFIED';
+const OPERATIONS_NOT_VERIFIED = 'OPERATIONS_NOT_VERIFIED';
+const ROLE_ASSISTANT_GOVERNANCE_WARNING = 'ROLE_ASSISTANT_GOVERNANCE_PACKS';
+const ROLE_ASSISTANT_OPERATIONS_WARNING = 'ROLE_ASSISTANT_CS_OPERATIONS';
+
+const VERDICT_RANK = Object.freeze({
+  [VERDICT.FAILED]: 4,
+  [VERDICT.NOT_VERIFIED]: 3,
+  [VERDICT.VERIFIED]: 2,
+  [VERDICT.NOT_APPLICABLE]: 1
+});
+
+function readGovernanceCode(block) {
+  if (!block || typeof block !== 'object') {
+    return '';
+  }
+  return String(block.errorCode || block.message || '').trim();
+}
+
+function governanceIsMissingPack(block) {
+  if (!block || typeof block !== 'object') {
+    return false;
+  }
+  if (String(block.verdict || '').trim() !== VERDICT.FAILED) {
+    return false;
+  }
+  return readGovernanceCode(block) === GOVERNANCE_SCENARIOS_MISSING;
+}
+
+function notApplicableMissingPack(block) {
+  const base = block && typeof block === 'object' ? { ...block } : {};
+  base.verdict = VERDICT.NOT_APPLICABLE;
+  base.errorCode = GOVERNANCE_SCENARIOS_MISSING;
+  return base;
+}
+
+function remapDatasourceRow(row) {
+  if (!row || typeof row !== 'object' || !governanceIsMissingPack(row.governance)) {
+    return { row, remapped: false };
+  }
+  return {
+    row: { ...row, governance: notApplicableMissingPack(row.governance) },
+    remapped: true
+  };
+}
+
+function worseGovernance(left, right) {
+  const leftRank = VERDICT_RANK[left && left.verdict] || 0;
+  const rightRank = VERDICT_RANK[right && right.verdict] || 0;
+  return rightRank > leftRank ? right : left;
+}
+
+function rollupGovernanceFromDatasources(datasources) {
+  let worst = null;
+  for (const row of datasources) {
+    if (row && row.governance) {
+      worst = worseGovernance(worst, row.governance);
+    }
+  }
+  return worst;
+}
+
+function stripCsNotVerified(recommendations) {
+  if (!Array.isArray(recommendations)) {
+    return [];
+  }
+  return recommendations.filter(
+    (rec) =>
+      rec && rec.code !== GOVERNANCE_NOT_VERIFIED && rec.code !== OPERATIONS_NOT_VERIFIED
+  );
+}
+
+function appendRoleAssistantCsWarning(warnings, code, message) {
+  const next = Array.isArray(warnings) ? [...warnings] : [];
+  const exists = next.some((row) => row && row.code === code);
+  if (!exists) {
+    next.push({ code, message });
+  }
+  return next;
+}
+
+function notApplicableCsPillar(block, errorCode) {
+  const base = block && typeof block === 'object' ? { ...block } : {};
+  base.verdict = VERDICT.NOT_APPLICABLE;
+  if (errorCode) {
+    base.errorCode = errorCode;
+  }
+  return base;
+}
+
+function remapCsPillars(next) {
+  let remapped = false;
+  const opsVerdict = String((next.operations && next.operations.verdict) || '');
+  if (opsVerdict === VERDICT.FAILED || opsVerdict === VERDICT.NOT_VERIFIED) {
+    next.operations = notApplicableCsPillar(next.operations, OPERATIONS_NOT_VERIFIED);
+    remapped = true;
+  }
+  const govVerdict = String((next.governance && next.governance.verdict) || '');
+  if (govVerdict === VERDICT.FAILED || govVerdict === VERDICT.NOT_VERIFIED) {
+    next.governance = notApplicableCsPillar(next.governance, GOVERNANCE_NOT_VERIFIED);
+    remapped = true;
+  }
+  return remapped;
+}
+
+function remapMissingPackRows(report, next) {
+  let remapped = false;
+  if (Array.isArray(report.datasources)) {
+    next.datasources = report.datasources.map((row) => {
+      const mapped = remapDatasourceRow(row);
+      if (mapped.remapped) {
+        remapped = true;
+      }
+      return mapped.row;
+    });
+    if (remapped) {
+      next.governance =
+        rollupGovernanceFromDatasources(next.datasources) ||
+        notApplicableMissingPack(report.governance);
+    }
+  }
+  if (governanceIsMissingPack(next.governance)) {
+    next.governance = notApplicableMissingPack(next.governance);
+    remapped = true;
+  }
+  return remapped;
+}
+
+function remapRoleAssistantGovernanceReport(report) {
+  if (!report || typeof report !== 'object') {
+    return report;
+  }
+  const next = { ...report };
+  const remapped = remapMissingPackRows(report, next) || remapCsPillars(next);
+  if (!remapped) {
+    return report;
+  }
+  next.recommendations = stripCsNotVerified(report.recommendations);
+  next.warnings = appendRoleAssistantCsWarning(
+    report.warnings,
+    ROLE_ASSISTANT_GOVERNANCE_WARNING,
+    'Role Assistant datasources do not use Connected System governance packs. ' +
+      'Isolation is Work Hub cases and role-assistant.yaml.'
+  );
+  next.warnings = appendRoleAssistantCsWarning(
+    next.warnings,
+    ROLE_ASSISTANT_OPERATIONS_WARNING,
+    'Role Assistant prove does not require Connected System operations verification.'
+  );
+  return next;
+}
+
+/**
+ * Pillar is satisfied for overall lifecycle (verified or not applicable).
+ * @param {string|undefined} verdict
+ * @returns {boolean}
+ */
+function lifecyclePillarSatisfied(verdict) {
+  return verdict === VERDICT.VERIFIED || verdict === VERDICT.NOT_APPLICABLE;
+}
+
+module.exports = {
+  GOVERNANCE_SCENARIOS_MISSING,
+  ROLE_ASSISTANT_GOVERNANCE_WARNING,
+  ROLE_ASSISTANT_OPERATIONS_WARNING,
+  governanceIsMissingPack,
+  remapRoleAssistantGovernanceReport,
+  lifecyclePillarSatisfied
+};

package/lib/lifecycle/scenario-upload.js

@@ -1,7 +1,7 @@
 /**
  * @fileoverview Upload local governance scenario YAML packs to dataplane (419.0).
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 2.0.0
  */
 
 'use strict';
@@ -17,6 +17,9 @@ const {
 const yaml = require('js-yaml');
 const logger = require('../utils/logger');
 const { getIntegrationPath } = require('../utils/paths');
+const { loadConfigFile } = require('../utils/config-format');
+const { discoverIntegrationFiles } = require('../commands/repair-internal');
+const { parseAccessControlAbac } = require('./access-control-abac');
 const { upsertDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
 const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
 const { shortGovernanceApiError } = require('../governance/governance-cli-errors');
@@ -63,6 +66,158 @@ function loadPackFromFile(filePath) {
   return doc;
 }
 
+/**
+ * @param {string} filePath
+ * @returns {string}
+ */
+function scenarioFileStem(filePath) {
+  return path.basename(filePath).replace(/\.ya?ml$/i, '').trim();
+}
+
+/**
+ * Sidecar and CLI callers historically received a number. Keep both shapes.
+ * @param {unknown} result
+ * @returns {{ uploaded: number, warnings: string[] }}
+ */
+function normalizeGovernanceUploadResult(result) {
+  if (typeof result === 'number') {
+    return { uploaded: result, warnings: [] };
+  }
+  const uploaded = Number(result && result.uploaded);
+  const warnings = result && Array.isArray(result.warnings) ? result.warnings : [];
+  return {
+    uploaded: Number.isFinite(uploaded) ? uploaded : 0,
+    warnings
+  };
+}
+
+/**
+ * @param {string} appPath
+ * @returns {Map<string, Object>}
+ */
+function loadPackageDatasourceMap(appPath) {
+  const map = new Map();
+  if (!existsSync(appPath)) {
+    return map;
+  }
+  const { datasourceFiles } = discoverIntegrationFiles(appPath);
+  for (const name of datasourceFiles) {
+    try {
+      const doc = loadConfigFile(path.join(appPath, name));
+      const key = doc && typeof doc.key === 'string' ? doc.key.trim() : '';
+      if (key) {
+        map.set(key, doc);
+      }
+    } catch {
+      // skip unreadable datasource files
+    }
+  }
+  return map;
+}
+
+/**
+ * @param {string} message
+ * @param {{ silent?: boolean }} opts
+ * @param {string[]} collected
+ */
+function emitWarning(message, opts, collected) {
+  collected.push(message);
+  if (!opts.silent) {
+    logger.log(formatWarningLine(message));
+  }
+}
+
+/**
+ * Owner = YAML stem when it matches a package datasource key.
+ * Otherwise fall back to search.datasourceKeys (legacy filenames).
+ * @param {string} stem
+ * @param {string[]} searchKeys
+ * @param {Set<string>} packageKeys
+ * @returns {{ ownerKeys: string[], warnings: string[], skipped: boolean }}
+ */
+function resolveOwnerTargets(stem, searchKeys, packageKeys) {
+  if (packageKeys.has(stem)) {
+    const warnings = [];
+    if (searchKeys.length > 0 && !searchKeys.includes(stem)) {
+      warnings.push(
+        `${stem}.yaml searches ${searchKeys.join(', ')} — uploading onto ${stem} (carrier search)`
+      );
+    }
+    return { ownerKeys: [stem], warnings, skipped: false };
+  }
+  if (searchKeys.length === 0) {
+    return {
+      ownerKeys: [],
+      warnings: [
+        `Skipping ${stem}.yaml — filename is not a package datasource key and scenarios have no datasourceKeys`
+      ],
+      skipped: true
+    };
+  }
+  return {
+    ownerKeys: searchKeys,
+    warnings: [
+      `${stem}.yaml is not a package datasource key — uploading onto search keys (${searchKeys.join(', ')}). Rename to <datasourceKey>.yaml`
+    ],
+    skipped: false
+  };
+}
+
+/**
+ * @param {Object} ctx
+ * @returns {Promise<number>}
+ */
+async function uploadOneScenarioFile(ctx) {
+  const { filePath, packageKeys, dataplaneUrl, authConfig, opts, warnings, ownerStems } = ctx;
+  const pack = loadPackFromFile(filePath);
+  const searchKeys = datasourceKeysFromPack(pack);
+  const stem = scenarioFileStem(filePath);
+  const resolved = resolveOwnerTargets(stem, searchKeys, packageKeys);
+  for (const warning of resolved.warnings) {
+    emitWarning(warning, opts, warnings);
+  }
+  if (resolved.skipped || resolved.ownerKeys.length === 0) {
+    return 0;
+  }
+  if (packageKeys.has(stem)) {
+    ownerStems.push(stem);
+  }
+  let uploaded = 0;
+  for (const dsKey of resolved.ownerKeys) {
+    await upsertDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey, pack);
+    uploaded += 1;
+    if (!opts.silent) {
+      logger.log(
+        formatSuccessLine(
+          `Governance scenario pack uploaded for ${dsKey} (${path.basename(filePath)})`
+        )
+      );
+    }
+  }
+  return uploaded;
+}
+
+/**
+ * @param {Map<string, Object>} packageMap
+ * @param {string[]} ownerStems
+ * @param {{ silent?: boolean }} opts
+ * @param {string[]} warnings
+ */
+function warnMissingAbacOwnerFiles(packageMap, ownerStems, opts, warnings) {
+  const present = new Set(ownerStems);
+  for (const [key, doc] of packageMap) {
+    const abac = parseAccessControlAbac(doc);
+    if (abac.applicability === 'notApplicable' || present.has(key)) {
+      continue;
+    }
+    emitWarning(
+      `No scenarios/${key}.yaml for ABAC-required datasource ${key}`,
+      opts,
+      warnings
+    );
+  }
+}
+
 /**
  * Upload scenario packs under integration/<systemKey>/scenarios/ to dataplane.
  * @async
@@ -70,40 +225,33 @@ function loadPackFromFile(filePath) {
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
  * @param {{ silent?: boolean }} [opts]
- * @returns {Promise<number>} count of packs uploaded
+ * @returns {Promise<{ uploaded: number, warnings: string[] }>}
  */
 async function uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, opts = {}) {
-  const scenariosDir = path.join(getIntegrationPath(systemKey), 'scenarios');
-  const files = listScenarioYamlFiles(scenariosDir);
-  if (files.length === 0) return 0;
-
+  const appPath = getIntegrationPath(systemKey);
+  const files = listScenarioYamlFiles(path.join(appPath, 'scenarios'));
+  const warnings = [];
+  const packageMap = loadPackageDatasourceMap(appPath);
+  if (files.length === 0) {
+    warnMissingAbacOwnerFiles(packageMap, [], opts, warnings);
+    return { uploaded: 0, warnings };
+  }
+  const packageKeys = new Set(packageMap.keys());
+  const ownerStems = [];
   let uploaded = 0;
   for (const filePath of files) {
-    const pack = loadPackFromFile(filePath);
-    const dsKeys = datasourceKeysFromPack(pack);
-    if (dsKeys.length === 0) {
-      if (!opts.silent) {
-        logger.log(
-          formatWarningLine(
-            `Skipping ${path.basename(filePath)} — no datasourceKeys in scenarios`
-          )
-        );
-      }
-      continue;
-    }
-    for (const dsKey of dsKeys) {
-      await upsertDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey, pack);
-      uploaded += 1;
-      if (!opts.silent) {
-        logger.log(
-          formatSuccessLine(
-            `Governance scenario pack uploaded for ${dsKey} (${path.basename(filePath)})`
-          )
-        );
-      }
-    }
+    uploaded += await uploadOneScenarioFile({
+      filePath,
+      packageKeys,
+      dataplaneUrl,
+      authConfig,
+      opts,
+      warnings,
+      ownerStems
+    });
   }
-  return uploaded;
+  warnMissingAbacOwnerFiles(packageMap, ownerStems, opts, warnings);
+  return { uploaded, warnings };
 }
 
 /**
@@ -185,6 +333,9 @@ module.exports = {
   listScenarioYamlFiles,
   datasourceKeysFromPack,
   loadPackFromFile,
+  scenarioFileStem,
+  resolveOwnerTargets,
+  normalizeGovernanceUploadResult,
   uploadGovernanceScenarioPacks,
   downloadGovernanceScenarioPacks,
   downloadGovernanceScenarioPacksFromManifest

package/lib/programmatic/builder-api-cors.js

@@ -0,0 +1,143 @@
+/**
+ * Browser CORS for builder-api from configured public URL allowlists.
+ *
+ * @fileoverview Reflect Origin only when it matches ALLOWED_ORIGINS
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const CORS_ALLOW_HEADERS = 'Authorization, Content-Type, X-Request-Id, X-Correlation-Id, Idempotency-Key';
+const CORS_ALLOW_METHODS = 'GET, POST, PATCH, OPTIONS';
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string[]}
+ */
+function parseOriginAllowlist(env = process.env) {
+  const raw = [env.ALLOWED_ORIGINS, env.MISO_ALLOWED_ORIGINS]
+    .filter((value) => typeof value === 'string' && value.trim())
+    .join(',');
+  return raw
+    .split(',')
+    .map((part) => part.trim())
+    .filter(Boolean);
+}
+
+/**
+ * @param {string} origin
+ * @param {string} pattern
+ * @returns {boolean}
+ */
+function originMatchesPattern(origin, pattern) {
+  if (!origin || !pattern) {
+    return false;
+  }
+  if (origin === pattern) {
+    return true;
+  }
+  if (!pattern.endsWith(':*')) {
+    return false;
+  }
+  try {
+    const url = new URL(origin);
+    return `${url.protocol}//${url.hostname}` === pattern.slice(0, -2) && Boolean(url.port);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string|null}
+ */
+function allowedOriginForRequest(req, env = process.env) {
+  const origin = req && req.headers && req.headers.origin;
+  if (!origin || typeof origin !== 'string') {
+    return null;
+  }
+  const matched = parseOriginAllowlist(env).some((pattern) => originMatchesPattern(origin, pattern));
+  return matched ? origin : null;
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Record<string, string>}
+ */
+function corsHeadersForRequest(req, env = process.env) {
+  const allowed = allowedOriginForRequest(req, env);
+  if (!allowed) {
+    return {};
+  }
+  return {
+    'Access-Control-Allow-Origin': allowed,
+    Vary: 'Origin',
+    'Access-Control-Allow-Headers': CORS_ALLOW_HEADERS,
+    'Access-Control-Allow-Methods': CORS_ALLOW_METHODS
+  };
+}
+
+/**
+ * Merge CORS onto every writeHead so JSON, problems, and raw bytes stay consistent.
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {NodeJS.ProcessEnv} [env]
+ */
+function applyCorsToResponse(req, res, env = process.env) {
+  const originalWriteHead = res.writeHead.bind(res);
+  res.writeHead = function writeHeadWithCors(statusCode, reasonOrHeaders, maybeHeaders) {
+    const hasMessage = typeof reasonOrHeaders === 'string';
+    const headers = hasMessage ? maybeHeaders : reasonOrHeaders;
+    const merged = { ...corsHeadersForRequest(req, env), ...(headers || {}) };
+    if (hasMessage) {
+      return originalWriteHead(statusCode, reasonOrHeaders, merged);
+    }
+    return originalWriteHead(statusCode, merged);
+  };
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @returns {boolean}
+ */
+function isCorsPreflight(req) {
+  return String((req && req.method) || '').toUpperCase() === 'OPTIONS';
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {string} requestId
+ * @param {string} pathname
+ * @param {Function} logRequestOutcome
+ * @returns {boolean} true when the request was fully handled
+ */
+function handleCorsPreflight(req, res, requestId, pathname, logRequestOutcome) {
+  applyCorsToResponse(req, res);
+  if (!isCorsPreflight(req)) {
+    return false;
+  }
+  res.writeHead(204);
+  res.end();
+  logRequestOutcome({
+    requestId,
+    route: pathname,
+    method: req.method,
+    status: 204,
+    userId: 'anonymous'
+  });
+  return true;
+}
+
+module.exports = {
+  parseOriginAllowlist,
+  originMatchesPattern,
+  allowedOriginForRequest,
+  corsHeadersForRequest,
+  applyCorsToResponse,
+  isCorsPreflight,
+  handleCorsPreflight
+};

package/lib/programmatic/builder-api-request.js

@@ -13,6 +13,8 @@ const { dispatchHandler } = require('./route-handlers');
 const { withWorkspaceLock } = require('./workspace-lock');
 const { getIdempotentResult, setIdempotentResult } = require('./idempotency-cache');
 const { withRequestTimeout } = require('./request-timeout');
+const { isHttpRawResult } = require('./http-raw-response');
+const { publicOriginFromRequest } = require('../channels/vendor-dataplane-url');
 
 /**
  * @param {Object} capability
@@ -140,6 +142,7 @@ async function executeCapabilityRequest(options) {
   const auth = requiresAuth(capability)
     ? await authenticateRequest(req)
     : { userId: 'anonymous', bearerToken: '' };
+  auth.publicOrigin = publicOriginFromRequest(req);
 
   const body = req.method === 'GET' || req.method === 'DELETE' ? {} : await readJsonBody(req);
 
@@ -157,6 +160,9 @@ async function executeCapabilityRequest(options) {
   }
 
   const result = await runHandler(auth, capability, params, body, query);
+  if (isHttpRawResult(result)) {
+    return { httpStatus: 200, raw: result, requestId, userId: auth.userId };
+  }
   return buildSuccessResponse({
     auth,
     idempotencyKey: req.headers['idempotency-key'],