@aifabrix/builder 2.59.0 → 2.61.2

package/templates/applications/miso-controller/env.template

@@ -29,11 +29,6 @@
 #
 # =============================================================================
 
-# Skip automatic first-time bootstrap on controller startup (default: false).
-# Bootstrap = DB controller row, Keycloak realm/client, admin user, roles (empty DB only).
-# Keep false for normal dev — this is NOT the Azure tenant-activation UI wizard.
-# Set true only for tests that must not mutate Keycloak/DB on startup.
-SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
 # Prefer SQL/API one-shot: POST /api/v1/controller/force-onboarding (controller:admin) or set
@@ -50,7 +45,8 @@ INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
 
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.
-LOCATION=westeurope
+# Resolved from the platform match; see `platforms` in application.yaml.
+LOCATION={LOCATION}
 
 # Required for admin user creation during onboarding
 # Password for the initial administrator user (username: admin)
@@ -59,23 +55,20 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 # Optional admin email for onboarding (default: admin@aifabrix.ai)
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
-# [customerOwned] Create development environment during onboarding (default: false)
-# Full platform: create miso, dev, tst, and pro during onboarding (default: false)
-# When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
-# [saasDirect] Keep false in the customer container — extra environments belong to the
-# eSystems deploy path, not the customer wizard.
+# Which environments onboarding creates (plan 240.0). This is the only onboarding environment
+# variable: false or unset creates `dev`, true creates `dev`, `tst` and `pro`.
+#
+# `dev` is always created — every edition is entitled to it, and the installation registers its
+# own applications into it. What `dev` *is* follows the licence rather than this flag: in the
+# shared model it runs on the installation stack and needs no infrastructure of its own; in the
+# dedicated model it waits at lifecycle `created` for an administrator.
+#
+# Replaces ONBOARDING_CREATE_DEV_ENV, ONBOARDING_CREATE_MISO_ENV and SKIP_FIRST_TIME_SETUP,
+# which expressed one decision in four places and disagreed about its default. Whether the
+# installation environment is deployed during onboarding now follows ONBOARDING_MODE: a hosted
+# (saasDirect) installation deploys it, a customer-owned one leaves it to the activation wizard.
 ONBOARDING_FULL_PLATFORM=false
 
-# [customerOwned] When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
-# Marketplace already provisions infra; TA owns customer env deploy.
-# [saasDirect] Keep false: eSystems already deployed the required runtime services.
-ONBOARDING_CREATE_MISO_ENV=false
-
-# [customerOwned] Set to true to create both miso and dev environments during onboarding
-# When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
-# [saasDirect] Keep false in the customer container.
-ONBOARDING_CREATE_DEV_ENV=true
-
 # =============================================================================
 # APPLICATION ENVIRONMENT
 # =============================================================================
@@ -200,16 +193,21 @@ WAIT_FOR_KEYCLOAK=true
 # For production: use public domain (e.g., https://miso.example.com)
 # url://public includes front-door path from application.yaml (e.g. /controller).
 MISO_WEB_SERVER_URL=url://public
+# Private service-to-service controller origin; public/browser traffic uses MISO_WEB_SERVER_URL.
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
-ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
+ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private,url://mori-controller-host-public
 # Opt-in: broker/entry/referer under /data keep …/data/auth/callback (do not append /miso). Default off.
 # AUTH_PRESERVE_DATAPLANE_VDIR=true
 
 # MISO Environment Configuration (miso, dev, tst, pro)
 MISO_ENVIRONMENT=miso
 
-# MISO Application Client Credentials (per application)
+# Governed configuration uses per-application client credentials by default. The SDK loads
+# its bootstrap snapshot and refreshes it automatically within two minutes; consumers decide
+# whether a changed key also requires an internal client or resource to be recreated.
+MISO_AUTH_MODE=client-credentials
+# MISO Application Client Credentials (per application; never expose the secret to the browser)
 MISO_CLIENTID=kv://miso-controller-client-idKeyVault
 MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 
@@ -226,12 +224,7 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 #
 # ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
 # Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
-# ENTRA_CALLBACK_STATE_SECRET — Shared HMAC secret (min 16 chars) for OAuth state
-# between controller and Mori callback service; same value on Mori and controller.
-#
-# Delegated Graph (second redirect URI on the same vendor app): see section below.
-ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://dev01.aifabrix.dev/mori/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=url://mori-controller-public/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -285,7 +278,7 @@ SKIP_DB_REDEPLOY=true
 # database    — DB/RBAC only, no Docker from controller; dashboard (default dev)
 #
 # Missing or invalid value defaults to azure (wizard + Azure credentials).
-# Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
+# First-time bootstrap is separate from the activation wizard.
 # NOTE: there is no `saas` value. eSystems-hosted SaaS runs DEPLOYMENT=azure with
 # ONBOARDING_MODE=saasDirect (see next section).
 DEPLOYMENT=database
@@ -375,7 +368,7 @@ MORI_LICENSE_ISSUER=mori-controller
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
 # …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-delegated/callback
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -386,13 +379,21 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-d
 # =============================================================================
 # MORI SERVICE CONFIGURATION
 # =============================================================================
-# Shared Mori (handoff poll + Entra callback). Local `url://mori-controller-public`
-# only works when a local Mori app is registered and running for this developer.
-# MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
-# (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=kv://mori-controller-web-server-url
-MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
+# Shared Mori. Local `url://mori-controller-public` only works when a local Mori app is
+# registered and running for this developer.
+# MORI_API_KEY is per-installation and is minted by POST /marketplace/bootstrap; it is written
+# here by the controller after registration, not provisioned ahead of it.
+MORI_BASE_URL={MORI_BASE_URL}
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
+# Ask Mori for a container-registry credential when the installation was given none.
+# Off by default: the call has a 30s timeout inside credential resolution, so enabling it on an
+# installation whose Mori cannot issue would stall every deployment that reaches that point.
+# Declared here because it was previously read from process.env and set nowhere, so there was no
+# supported way to turn the path on — an installation that pulls vendor images through a
+# Mori-issued token had to have an app setting added by hand. Cross-tenant managed identity
+# cannot grant registry access, so this is the only mechanism that works for a customer
+# installation pulling from the vendor registry.
+MORI_REGISTRY_CREDENTIALS=false
 
 # =============================================================================
 # LOGGING CONFIGURATION
@@ -425,3 +426,28 @@ OTEL_SERVICE_VERSION=
 
 # Mount Volume Configuration
 MOUNT_VOLUME=/mnt/data/
+
+# Image registry this installation deploys from.
+#
+# `pipeline-validation-flow.helper.ts` resolves the deploy registry as ACR_LOGIN_SERVER first, then
+# the controller record's `configuration.imageRegistry`. Azure installations get the record from the
+# installer, so this stays EMPTY there and behaviour is unchanged. A local installation matches no
+# platform (`allowLocalPlatform` is false for the controller) and has no record, so without this key
+# every `aifabrix deploy` fails with "Image registry is not configured on the controller
+# installation".
+#
+# EMPTY on purpose. The controller record is read AFTER this and overwrites it, so an Azure
+# installation ignores whatever stands here; only a local installation consumes it.
+#
+# This briefly shipped as `aifabrixce16.azurecr.io` — one test installation's registry, committed
+# into the product, so every developer who did not override it would have pushed and pulled
+# against ce-16 without being told. A `{ACR_LOGIN_SERVER}` token was tried instead and is worse
+# still: nothing resolves it without a resource group, so it breaks `aifabrix build` outright
+# ("no platform or environment configuration resolves it for environment dev").
+#
+# Empty is the honest third answer. An Azure installation is unaffected, and a local
+# `aifabrix deploy` fails with "Image registry is not configured on the controller installation",
+# which names the missing thing. Its proper home is the Builder run tooling, which already knows
+# the answer (`aifabrix dev print-registry`) and should inject it per developer rather than have
+# Miso ship one installation's registry to everybody.
+ACR_LOGIN_SERVER=

package/templates/applications/miso-controller/rbac.yaml

@@ -176,6 +176,23 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin']
     description: 'Remove applications from environments'
 
+  # External-system catalog (aligned with src/examples/permissions.csv)
+  - name: 'external-system:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-compliance-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'Read external systems'
+
+  - name: 'external-systems:domain-manager'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Manage external-system catalog promotion and role-derived dimension governance'
+
   # Pipeline & Deployment
   - name: 'applications:deploy'
     roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin', 'aifabrix-developer']

package/templates/external-system/external-datasource.yaml.hbs

@@ -122,7 +122,13 @@ openapi:
 # documentStorage:
 #   enabled: true
 #   binaryOperationRef: get
-#   embeddingField: content
+#   responseType: binary
+#   ingestAfterSync: true
+# Keyed retrieval (no list): for a vendor PDF, image or octet-stream response,
+# keep only get in capabilities and end its CIP steps with output.mode: documents.
+# Fetch: { source: openapi, openapiRef: get, responseType: binary }
+# Map response metadata from raw.headers.FileName and raw.params.DocumentId.
+# The wizard and repair infer this shape from the vendor OpenAPI response media type.
 {{/if}}
 {{#if (eq schemaEntityType "vectorStore")}}
 # vectorStore: vector index settings (model id, dimensions, etc. per schema). Uncomment and set to match your embedding deployment.