@aifabrix/builder 2.55.2 → 2.57.0

package/templates/applications/miso-controller/env.template

@@ -177,7 +177,7 @@ IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
 # Both onboarding modes use Mori's AI Fabrix-owned sender. MORI_API_KEY below is the
 # existing installation service key; no notification-specific secret is created.
 NOTIFICATION_BINDING=aifabrixManaged
-MORI_ENVIRONMENT_ID=
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
 
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
@@ -213,12 +213,6 @@ MISO_ENVIRONMENT=miso
 MISO_CLIENTID=kv://miso-controller-client-idKeyVault
 MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 
-# Evaluation mode (optional .env override of DB controller.configuration.evaluation):
-# When true (default if DB omits flag), infra deploy may coerce :envKey to `miso` — e2e poll on `dev` can 404.
-# Set false locally to force path envKey to match deploy + GET .../deployments/:id.
-# Unset = use DB only.
-CONTROLLER_EVALUATION=
-
 # =============================================================================
 # ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
@@ -237,7 +231,7 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://dev01.aifabrix.dev/mori/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -323,8 +317,10 @@ SHOW_TA_COUNT_DOWN=false
 # Encryption Key for Database Secrets
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
-# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only)
-BOOTSTRAP_APPKEYS=dataplane,builder-api
+# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
+# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
+# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -347,26 +343,39 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 # =============================================================================
 # LICENSE CONFIGURATION — [always]
 # =============================================================================
-# [saasDirect] Must use the Mori flow (never DEVELOPMENT): Mori issues and owns the
+# [saasDirect] Must use the Mori flow: Mori issues and owns the
 # 30-day STANDARD / M trial, and sales later updates the same subscription.
 #
 # Offline JWT license (optional):
 # - If set, controller validates license offline (RS256) without Mori subscription status call.
 # - Value can be literal JWT or kv:// reference.
-# - If not set, controller falls back to existing Mori subscription validation flow.
-#
-# Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
-#   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
-# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+# - If empty and no stored licence exists, controller runs as Community edition
+#   (DEV environment, size S, shared resources).
+# - Set only to a real signed offline licence JWT. Controlled tests may use the separate
+#   LICENSE_VALIDATION_DISABLED=true switch; do not use it in deployed installations.
 LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
+# Signed licenses require a Mori issuer key trusted independently of the JWT.
+# Provision the SPKI PEM public key and exact issuer during installation, before
+# pasting LICENSE_JWT or using Update license. An embedded JWT publicKey/jwk or Mori URL
+# is not a trust source. For disconnected installs, deliver the key through the
+# authenticated installation package or another operator-verified channel.
+# Azure resolves this from Key Vault using the app's managed identity.
+# Builder Docker resolves the same kv:// catalog key from the installer's local
+# secrets store before starting the container. Provision a trusted Mori public key
+# there first; the empty catalog default is only for unlicensed Community mode.
+MORI_LICENSE_PUBLIC_KEY=kv://mori-license-public-keyKeyVault
+# Plain docker run can instead leave MORI_LICENSE_PUBLIC_KEY unset and use a
+# trusted, read-only PEM mount at this path.
+# MORI_LICENSE_PUBLIC_KEY_FILE=/run/secrets/mori-license-public-key.pem
+MORI_LICENSE_ISSUER=mori-controller
+
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
 # …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-graph-delegated/callback
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -381,12 +390,9 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.
 # only works when a local Mori app is registered and running for this developer.
 # MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
 # (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=https://aifabrix-pro-miso-mori.azurewebsites.net
-MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_BASE_URL=kv://mori-controller-web-server-url
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
-MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
-MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 # =============================================================================
 # LOGGING CONFIGURATION

package/templates/marketplace/createUiDefinition.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+  "handler": "Microsoft.Azure.CreateUIDef",
+  "version": "0.1.2-preview",
+  "parameters": {
+    "config": {
+      "basics": {
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+      }
+    },
+    "basics": [
+      {
+        "name": "adminPassword",
+        "type": "Microsoft.Common.PasswordBox",
+        "label": "Administrator password",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "constraints": {
+          "required": true,
+          "regex": "^.{8,128}$",
+          "validationMessage": "Password must be 8–128 characters."
+        },
+        "options": {
+          "hideConfirmation": false
+        }
+      },
+      {
+        "name": "licenseChoice",
+        "type": "Microsoft.Common.DropDown",
+        "label": "License",
+        "toolTip": "License AI Fabrix requests during tenant activation. Community is permanent. Standard or Enterprise requested by name is a 30-day evaluation. For a purchased plan, choose 'Purchased Marketplace subscription' and enter its subscription ID; the edition is then resolved from the purchased plan.",
+        "defaultValue": "Community",
+        "constraints": {
+          "required": true,
+          "allowedValues": [
+            {
+              "label": "Community",
+              "value": "COMMUNITY"
+            },
+            {
+              "label": "Standard (30-day evaluation)",
+              "value": "STANDARD"
+            },
+            {
+              "label": "Enterprise (30-day evaluation)",
+              "value": "ENTERPRISE"
+            },
+            {
+              "label": "Purchased Marketplace subscription",
+              "value": "SUBSCRIPTION_ID"
+            }
+          ]
+        }
+      },
+      {
+        "name": "licenseSubscriptionKey",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Marketplace subscription ID",
+        "toolTip": "The ID (GUID) of the purchased AI Fabrix Azure Marketplace subscription.",
+        "defaultValue": "",
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
+        }
+      }
+    ],
+    "steps": [],
+    "outputs": {
+      "location": "[location()]",
+      "deploymentEnvironment": "evaluation",
+      "adminPassword": "[basics('adminPassword')]",
+      "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+    }
+  }
+}

package/templates/marketplace/install.parameters.example.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "adminPassword": { "value": "" },
+    "marketplaceSubscriptionId": { "value": "" },
+    "location": { "value": "swedencentral" }
+  }
+}