@aifabrix/builder 2.55.0 → 2.55.2

package/templates/applications/miso-controller/env.template

@@ -1,10 +1,24 @@
 # Environment Variables Template
 # Use kv:// references for secrets (resolved from secrets.local.yaml)
 # Use ${VAR} for environment-specific values
+#
+# =============================================================================
+# HOW THIS FILE IS ORGANIZED (plan 220.0)
+# =============================================================================
+# One env.template, three documentation blocks. Every variable below is tagged:
+#
+#   [always]        applies to both hosted onboarding modes and local dev
+#   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
+#   [customerOwned] Azure-in-tenant activation (existing TA wizard)
+#
+# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
+# eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
+# ONBOARDING MODE sections below.
 
 
 # =============================================================================
-# FIRST-TIME ONBOARDING CONFIGURATION
+# FIRST-TIME ONBOARDING CONFIGURATION — [always]
 # =============================================================================
 #
 # Onboarding runs automatically when the database has no controller row (empty DB).
@@ -45,17 +59,21 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 # Optional admin email for onboarding (default: admin@aifabrix.ai)
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
-# Create development environment during onboarding (default: false)
+# [customerOwned] Create development environment during onboarding (default: false)
 # Full platform: create miso, dev, tst, and pro during onboarding (default: false)
 # When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
+# [saasDirect] Keep false in the customer container — extra environments belong to the
+# eSystems deploy path, not the customer wizard.
 ONBOARDING_FULL_PLATFORM=false
 
-# When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
+# [customerOwned] When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
 # Marketplace already provisions infra; TA owns customer env deploy.
+# [saasDirect] Keep false: eSystems already deployed the required runtime services.
 ONBOARDING_CREATE_MISO_ENV=false
 
-# Set to true to create both miso and dev environments during onboarding
+# [customerOwned] Set to true to create both miso and dev environments during onboarding
 # When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
+# [saasDirect] Keep false in the customer container.
 ONBOARDING_CREATE_DEV_ENV=true
 
 # =============================================================================
@@ -148,8 +166,19 @@ KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
 # Password setup for new local users (plan 209.0)
 # email = send invitation email so the user sets their own password (default)
 # admin-reveal = show a one-time temporary password to the admin (labs / no mail)
+# [saasDirect] MUST be `email` — the customer activates its own administrator account from the
+#              Keycloak UPDATE_PASSWORD invitation; eSystems never distributes a password.
+# [customerOwned] `admin-reveal` is allowed only in labs.
 IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
 
+# =============================================================================
+# MANAGED NOTIFICATION EMAIL (Miso -> Mori REST)
+# =============================================================================
+# Both onboarding modes use Mori's AI Fabrix-owned sender. MORI_API_KEY below is the
+# existing installation service key; no notification-specific secret is created.
+NOTIFICATION_BINDING=aifabrixManaged
+MORI_ENVIRONMENT_ID=
+
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
 KEYCLOAK_EVENTS_VERIFY_SIGNATURE=true
@@ -191,8 +220,11 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 CONTROLLER_EVALUATION=
 
 # =============================================================================
-# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
+# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
+# Kept in the shared block because EITHER mode may install Entra later from the plan 219
+# provider catalogue: Azure hosting does not force Entra, and SaaS may choose it.
+#
 # AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
 # Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
 # Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
@@ -205,13 +237,16 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
 # =============================================================================
-# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG
+# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG — [customerOwned]
 # =============================================================================
+# [saasDirect] Omit this block entirely: the SaaS wizard has no Access Model step and
+# creates no LLM resources.
+#
 # Optional JSON array for GET /api/v1/tenant/existing-llm-configurations (and
 # access-model.existingLlmConfigurations). Merge order: env entries first, then
 # entries derived from saved activation LLM (same id in saved overrides).
@@ -223,23 +258,32 @@ ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 # EXISTING_LLM_CONFIGURATIONS=
 
 # =============================================================================
-# AZURE AD PROVIDER CONFIGURATION
+# AZURE AD PROVIDER CONFIGURATION — [always]
 # =============================================================================
+# [customerOwned] These are the customer subscription credentials collected by the TA wizard.
+# [saasDirect] Present on the eSystems HOST controller so eSystems can deploy the hosted
+#              environment. They are never collected from, or shown to, the SaaS customer.
 
 AZURE_SUBSCRIPTION_ID=kv://azure-subscription-idKeyVault
 TENANT_ID=kv://azure-tenant-idKeyVault
 AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
-AZURE_CLIENT_ID=kv://azure-client-idKeyVault
-AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
+# Azure App Service uses managed identity through DefaultAzureCredential.
+# Optional local service-principal overrides may be supplied in the runtime .env:
+# AZURE_CLIENT_ID=
+# AZURE_CLIENT_SECRET=
 
 # When true, environment infrastructure deploy skips the ai.azureOpenAI module (no new Cognitive Services account).
+# [customerOwned] default false — Azure OpenAI is created only when the customer selects it.
+# [saasDirect] leave unset or set true: the minimal SaaS baseline never creates Cognitive Services.
+#              When unset, ONBOARDING_MODE=saasDirect already defaults this to true.
 SKIP_AZURE_OPENAI=false
 
-# When true, environment deploy skips Postgres ARM/KV updates if the flexible server already exists (marketplace redeploy).
+# [customerOwned] When true, environment deploy skips Postgres ARM/KV updates if the flexible server
+# already exists (marketplace redeploy).
 SKIP_DB_REDEPLOY=true
 
 # =============================================================================
-# DEPLOYMENT TYPE
+# DEPLOYMENT TYPE — [always]
 # =============================================================================
 # azure       — Real Azure resources + tenant activation wizard until completed
 # azure-mock  — Mock Azure SDK; dashboard after login (no wizard)
@@ -248,10 +292,28 @@ SKIP_DB_REDEPLOY=true
 #
 # Missing or invalid value defaults to azure (wizard + Azure credentials).
 # Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
+# NOTE: there is no `saas` value. eSystems-hosted SaaS runs DEPLOYMENT=azure with
+# ONBOARDING_MODE=saasDirect (see next section).
 DEPLOYMENT=database
 
+# =============================================================================
+# ONBOARDING MODE — [always]
+# =============================================================================
+# Orthogonal to DEPLOYMENT (Azure SDK vs local). Selects the onboarding step list
+# served by GET /api/v1/tenant/status and rendered by the wizard stepper.
+#
+# customerOwned = Azure-in-tenant wizard
+#                 consent → identity → size → access-model → endpoint → validation
+# saasDirect    = eSystems-hosted activation
+#                 consent → identity → endpoint (domain only) → review
+#                 Omits size, access-model, customer deploy and platform-apps.
+#
+# Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
+ONBOARDING_MODE=customerOwned
+
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
+# [saasDirect] Omit — there is no TA Entra countdown in the SaaS wizard.
 SHOW_TA_COUNT_DOWN=false
 
 # =============================================================================
@@ -269,15 +331,25 @@ BOOTSTRAP_APPKEYS=dataplane,builder-api
 # When false (default), uses local AES-256-GCM encryption with ENCRYPTION_KEY
 KEY_VAULT_ENABLED=false
 
+# Show Settings > System Secrets in the portal (runtime feature flag).
+MISO_APPLICATION_SECRETS_UI_ENABLED=false
+
+# Sliding browser-session idle timeout (30 minutes).
+AUTH_BROWSER_SESSION_TTL_SECONDS=1800
+
 # JWT Configuration (for client token generation)
 JWT_SECRET=kv://miso-controller-jwt-secretKeyVault
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# The key is optional: local environments may set it; Azure may leave it empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 
 # =============================================================================
-# LICENSE CONFIGURATION
+# LICENSE CONFIGURATION — [always]
 # =============================================================================
+# [saasDirect] Must use the Mori flow (never DEVELOPMENT): Mori issues and owns the
+# 30-day STANDARD / M trial, and sales later updates the same subscription.
+#
 # Offline JWT license (optional):
 # - If set, controller validates license offline (RS256) without Mori subscription status call.
 # - Value can be literal JWT or kv:// reference.
@@ -293,8 +365,8 @@ LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
+# …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -309,7 +381,7 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsite
 # only works when a local Mori app is registered and running for this developer.
 # MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
 # (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=https://aifabrix-pro-mori-web-we.azurewebsites.net
+MORI_BASE_URL=https://aifabrix-pro-miso-mori.azurewebsites.net
 MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault

package/templates/applications/miso-controller/rbac.yaml

@@ -34,6 +34,11 @@ roles:
     description: 'Read-only access to monitoring, logs, and compliance reports'
     groups: ['AI-Fabrix-Observers']
 
+  - name: 'AI Fabrix Everyone'
+    value: 'aifabrix-everyone'
+    description: 'Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)'
+    groups: ['AI-Fabrix-Everyone']
+
 permissions:
   # Integration clients (Keycloak OIDC clients + control-plane metadata)
   - name: 'integration-client:create'