@aifabrix/builder 2.60.0 → 2.62.0

package/lib/commands/wizard-core.js

@@ -3,28 +3,24 @@
  * @author AI Fabrix Team
  * @version 2.0.0
  */
-/* eslint-disable max-lines */
 
+const path = require('path');
 const chalk = require('chalk');
 const ora = require('ora');
-const path = require('path');
-const fs = require('fs').promises;
 const logger = require('../utils/logger');
 const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../utils/token-manager');
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { normalizeWizardConfigs } = require('./wizard-config-normalizer');
-const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-layout-chalk');
+const { formatSuccessLine } = require('../utils/cli-layout-chalk');
 const {
   createWizardSession,
   updateWizardSession,
   detectType,
   getPlatformConfig,
   generateConfig,
-  validateWizardConfig,
-  getDeploymentDocs,
-  postDeploymentDocs
+  validateWizardConfig
 } = require('../api/wizard.api');
-const { generateWizardFiles } = require('../generator/wizard');
+const { handleFileSaving, validateAndCheckAppDirectory } = require('./wizard-file-saving');
 const {
   parseOpenApiSource,
   testMcpServerConnection,
@@ -44,38 +40,6 @@ const {
 const { validateDatasourceKeysBeforePlatformConfig } = require('../validation/validate-datasource-keys-api');
 const { handleEntitySelection } = require('./wizard-entity-selection');
 
-/**
- * Validate app name and check if directory exists
- * @async
- * @function validateAndCheckAppDirectory
- * @param {string} appName - Application name
- * @param {boolean} [interactive=true] - Whether to prompt for confirmation
- * @returns {Promise<boolean>} True if should continue, false if cancelled
- */
-async function validateAndCheckAppDirectory(appName, interactive = true) {
-  if (!/^[a-z0-9-_]+$/.test(appName)) {
-    throw new Error('Application name must contain only lowercase letters, numbers, hyphens, and underscores');
-  }
-  const appPath = path.join(process.cwd(), 'integration', appName);
-  try {
-    await fs.access(appPath);
-    if (interactive) {
-      const { overwrite } = await require('inquirer').prompt([{
-        type: 'confirm', name: 'overwrite',
-        message: `Directory ${appPath} already exists. Overwrite?`, default: false
-      }]);
-      if (!overwrite) {
-        logger.log(chalk.yellow('Wizard cancelled.')); return false;
-      }
-    } else {
-      logger.log(chalk.yellow(`Warning: Directory ${appPath} exists. Overwriting...`));
-    }
-  } catch (error) {
-    if (error.code !== 'ENOENT') throw error;
-  }
-  return true;
-}
-
 /**
  * Extract session ID from response data
  * @function extractSessionId
@@ -393,7 +357,7 @@ async function handleConfigurationGeneration(dataplaneUrl, authConfig, options)
     }
     const result = extractConfigurationFromResponse(generateResponse);
     const systemConfig = resolveSystemConfigForWizardMode(result.systemConfig, options);
-    const normalized = normalizeWizardConfigs(systemConfig, result.datasourceConfigs);
+    const normalized = normalizeWizardConfigs(systemConfig, result.datasourceConfigs, options.openapiSpec);
     await maybeWriteWizardDebugLog(generateResponse, prefs, options);
     logger.log(formatSuccessLine('Configuration generated successfully'));
     return {
@@ -446,122 +410,6 @@ async function validateWizardConfiguration(dataplaneUrl, authConfig, systemConfi
   }
 }
 
-/**
- * Fetches deployment docs and writes README.md when application config and deploy JSON are available.
- * @async
- * @param {string} appPath - Application path
- * @param {string} appName - Application name
- * @param {string} dataplaneUrl - Dataplane URL
- * @param {Object} authConfig - Authentication configuration
- * @param {string} systemKey - System key
- */
-async function tryUpdateReadmeFromDeploymentDocs(appPath, appName, dataplaneUrl, authConfig, systemKey) {
-  const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
-  const deployPath = path.join(appPath, `${appName}-deploy.json`);
-  let variablesYaml = null;
-  let deployJson = null;
-  try {
-    const configPath = resolveApplicationConfigPath(appPath);
-    variablesYaml = await fs.readFile(configPath, 'utf8');
-  } catch {
-    // optional
-  }
-  try {
-    const deployContent = await fs.readFile(deployPath, 'utf8');
-    deployJson = JSON.parse(deployContent);
-  } catch {
-    // optional
-  }
-  const hasBody = variablesYaml !== null || deployJson !== null;
-  const body = hasBody ? { variablesYaml: variablesYaml || null, deployJson: deployJson || null } : null;
-  const docsResponse = body
-    ? await postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body)
-    : await getDeploymentDocs(dataplaneUrl, authConfig, systemKey);
-  const content = docsResponse?.data?.content ?? docsResponse?.content;
-  // Only overwrite README when the API returns substantial content; otherwise keep the template README
-  const MIN_README_LENGTH = 400;
-  if (content && typeof content === 'string' && content.trim().length >= MIN_README_LENGTH) {
-    const readmePath = path.join(appPath, 'README.md');
-    await fs.writeFile(readmePath, content, 'utf8');
-    logger.log(chalk.gray('  Updated README.md from deployment-docs API (application config + deploy JSON).'));
-  }
-}
-
-/**
- * Writes rbac.yaml / rbac.json from datasource resourceType + capabilities (same as `af repair --rbac`).
- * @param {Object} generatedFiles - Result of generateWizardFiles (appPath, systemFilePath, datasourceFilePaths)
- * @param {string} format - Project format: yaml | json
- */
-function logWizardFileSaveFooter(appName, generatedFiles) {
-  logger.log(formatSuccessParagraph('Wizard completed successfully!'));
-  logger.log(chalk.green(`\nFiles created in: ${generatedFiles.appPath}`));
-  logger.log(chalk.blue('\nNext steps:'));
-  logger.log(chalk.gray(`  1. Review the generated files in integration/${appName}/`));
-  logger.log(chalk.gray('  2. Update env.template with your authentication details'));
-  logger.log(chalk.gray(`  3. Deploy using: node deploy.js or aifabrix deploy ${appName}`));
-}
-
-function mergeRbacAfterWizardFilesWritten(generatedFiles, format) {
-  const { mergeRbacFromDatasources, extractRbacFromSystem } = require('./repair-rbac');
-  const { loadConfigFile } = require('../utils/config-format');
-  const systemParsedForRbac = loadConfigFile(generatedFiles.systemFilePath);
-  const datasourceFileNames = (generatedFiles.datasourceFilePaths || []).map((p) => path.basename(p));
-  const rbacChanges = [];
-  const rbacUpdated = mergeRbacFromDatasources(
-    generatedFiles.appPath,
-    systemParsedForRbac,
-    datasourceFileNames,
-    extractRbacFromSystem,
-    { format: format === 'json' ? 'json' : 'yaml', dryRun: false, changes: rbacChanges }
-  );
-  if (rbacUpdated && rbacChanges.length) {
-    rbacChanges.forEach((c) => logger.log(chalk.gray(`  RBAC: ${c}`)));
-    logger.log(chalk.green('  RBAC file updated from datasource capabilities (enableRBAC).'));
-  }
-}
-
-/**
- * Handle file saving step
- * @async
- * @function handleFileSaving
- * @param {string} appName - Application name
- * @param {Object} systemConfig - System configuration
- * @param {Object[]} datasourceConfigs - Datasource configurations
- * @param {string} systemKey - System key
- * @param {{ dataplaneUrl: string, authConfig: Object, enableRBAC?: boolean }} ctx - Dataplane auth + optional RBAC generation
- * @returns {Promise<Object>} Generated files information
- */
-async function handleFileSaving(appName, systemConfig, datasourceConfigs, systemKey, ctx) {
-  const { dataplaneUrl, authConfig, enableRBAC = false } = ctx || {};
-  logger.log(chalk.blue('\n\uD83D\uDCCB Step 7: Save Files'));
-  const spinner = ora('Saving files...').start();
-  try {
-    const config = require('../core/config');
-    const format = ctx?.format || (await config.getFormat()) || 'yaml';
-    const generatedFiles = await generateWizardFiles(appName, systemConfig, datasourceConfigs, systemKey, { aiGeneratedReadme: null, format });
-    if (enableRBAC && generatedFiles.appPath && generatedFiles.systemFilePath) {
-      try {
-        mergeRbacAfterWizardFilesWritten(generatedFiles, format);
-      } catch (e) {
-        logger.log(chalk.yellow(`  Could not generate RBAC file: ${e.message}`));
-      }
-    }
-    if (systemKey && dataplaneUrl && authConfig && generatedFiles.appPath) {
-      try {
-        await tryUpdateReadmeFromDeploymentDocs(generatedFiles.appPath, appName, dataplaneUrl, authConfig, systemKey);
-      } catch (e) {
-        logger.log(chalk.gray(`  Could not fetch AI-generated README: ${e.message}`));
-      }
-    }
-    spinner.stop();
-    logWizardFileSaveFooter(appName, generatedFiles);
-    return generatedFiles;
-  } catch (error) {
-    spinner.stop();
-    throw error;
-  }
-}
-
 /**
  * Setup dataplane URL and authentication
  * @async

package/lib/commands/wizard-file-saving.js

@@ -0,0 +1,163 @@
+/**
+ * @fileoverview Save wizard artifacts and update their README and RBAC files.
+ * @author AI Fabrix Team
+ */
+
+const chalk = require('chalk');
+const ora = require('ora');
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('../utils/logger');
+const { formatSuccessParagraph } = require('../utils/cli-layout-chalk');
+const { getDeploymentDocs, postDeploymentDocs } = require('../api/wizard.api');
+const { generateWizardFiles } = require('../generator/wizard');
+
+/**
+ * Fetches deployment docs and writes README.md when application config and deploy JSON are available.
+ * @async
+ * @param {string} appPath - Application path
+ * @param {string} appName - Application name
+ * @param {string} dataplaneUrl - Dataplane URL
+ * @param {Object} authConfig - Authentication configuration
+ * @param {string} systemKey - System key
+ */
+async function tryUpdateReadmeFromDeploymentDocs(appPath, appName, dataplaneUrl, authConfig, systemKey) {
+  const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
+  const deployPath = path.join(appPath, `${appName}-deploy.json`);
+  let variablesYaml = null;
+  let deployJson = null;
+  try {
+    const configPath = resolveApplicationConfigPath(appPath);
+    variablesYaml = await fs.readFile(configPath, 'utf8');
+  } catch {
+    // optional
+  }
+  try {
+    const deployContent = await fs.readFile(deployPath, 'utf8');
+    deployJson = JSON.parse(deployContent);
+  } catch {
+    // optional
+  }
+  const hasBody = variablesYaml !== null || deployJson !== null;
+  const body = hasBody ? { variablesYaml: variablesYaml || null, deployJson: deployJson || null } : null;
+  const docsResponse = body
+    ? await postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body)
+    : await getDeploymentDocs(dataplaneUrl, authConfig, systemKey);
+  const content = docsResponse?.data?.content ?? docsResponse?.content;
+  // Only overwrite README when the API returns substantial content; otherwise keep the template README
+  const MIN_README_LENGTH = 400;
+  if (content && typeof content === 'string' && content.trim().length >= MIN_README_LENGTH) {
+    const readmePath = path.join(appPath, 'README.md');
+    await fs.writeFile(readmePath, content, 'utf8');
+    logger.log(chalk.gray('  Updated README.md from deployment-docs API (application config + deploy JSON).'));
+  }
+}
+
+/**
+ * Writes rbac.yaml / rbac.json from datasource resourceType + capabilities (same as `af repair --rbac`).
+ * @param {Object} generatedFiles - Result of generateWizardFiles (appPath, systemFilePath, datasourceFilePaths)
+ * @param {string} format - Project format: yaml | json
+ */
+function logWizardFileSaveFooter(appName, generatedFiles) {
+  logger.log(formatSuccessParagraph('Wizard completed successfully!'));
+  logger.log(chalk.green(`\nFiles created in: ${generatedFiles.appPath}`));
+  logger.log(chalk.blue('\nNext steps:'));
+  logger.log(chalk.gray(`  1. Review the generated files in integration/${appName}/`));
+  logger.log(chalk.gray('  2. Update env.template with your authentication details'));
+  logger.log(chalk.gray(`  3. Deploy using: node deploy.js or aifabrix deploy ${appName}`));
+}
+
+function mergeRbacAfterWizardFilesWritten(generatedFiles, format) {
+  const { mergeRbacFromDatasources, extractRbacFromSystem } = require('./repair-rbac');
+  const { loadConfigFile } = require('../utils/config-format');
+  const systemParsedForRbac = loadConfigFile(generatedFiles.systemFilePath);
+  const datasourceFileNames = (generatedFiles.datasourceFilePaths || []).map((p) => path.basename(p));
+  const rbacChanges = [];
+  const rbacUpdated = mergeRbacFromDatasources(
+    generatedFiles.appPath,
+    systemParsedForRbac,
+    datasourceFileNames,
+    extractRbacFromSystem,
+    { format: format === 'json' ? 'json' : 'yaml', dryRun: false, changes: rbacChanges }
+  );
+  if (rbacUpdated && rbacChanges.length) {
+    rbacChanges.forEach((c) => logger.log(chalk.gray(`  RBAC: ${c}`)));
+    logger.log(chalk.green('  RBAC file updated from datasource capabilities (enableRBAC).'));
+  }
+}
+
+/**
+ * Handle file saving step
+ * @async
+ * @function handleFileSaving
+ * @param {string} appName - Application name
+ * @param {Object} systemConfig - System configuration
+ * @param {Object[]} datasourceConfigs - Datasource configurations
+ * @param {string} systemKey - System key
+ * @param {{ dataplaneUrl: string, authConfig: Object, enableRBAC?: boolean }} ctx - Dataplane auth + optional RBAC generation
+ * @returns {Promise<Object>} Generated files information
+ */
+async function handleFileSaving(appName, systemConfig, datasourceConfigs, systemKey, ctx) {
+  const { dataplaneUrl, authConfig, enableRBAC = false } = ctx || {};
+  logger.log(chalk.blue('\n\uD83D\uDCCB Step 7: Save Files'));
+  const spinner = ora('Saving files...').start();
+  try {
+    const config = require('../core/config');
+    const format = ctx?.format || (await config.getFormat()) || 'yaml';
+    const generatedFiles = await generateWizardFiles(appName, systemConfig, datasourceConfigs, systemKey, { aiGeneratedReadme: null, format });
+    if (enableRBAC && generatedFiles.appPath && generatedFiles.systemFilePath) {
+      try {
+        mergeRbacAfterWizardFilesWritten(generatedFiles, format);
+      } catch (e) {
+        logger.log(chalk.yellow(`  Could not generate RBAC file: ${e.message}`));
+      }
+    }
+    if (systemKey && dataplaneUrl && authConfig && generatedFiles.appPath) {
+      try {
+        await tryUpdateReadmeFromDeploymentDocs(generatedFiles.appPath, appName, dataplaneUrl, authConfig, systemKey);
+      } catch (e) {
+        logger.log(chalk.gray(`  Could not fetch AI-generated README: ${e.message}`));
+      }
+    }
+    spinner.stop();
+    logWizardFileSaveFooter(appName, generatedFiles);
+    return generatedFiles;
+  } catch (error) {
+    spinner.stop();
+    throw error;
+  }
+}
+
+/**
+ * Validate app name and check if directory exists
+ * @async
+ * @function validateAndCheckAppDirectory
+ * @param {string} appName - Application name
+ * @param {boolean} [interactive=true] - Whether to prompt for confirmation
+ * @returns {Promise<boolean>} True if should continue, false if cancelled
+ */
+async function validateAndCheckAppDirectory(appName, interactive = true) {
+  if (!/^[a-z0-9-_]+$/.test(appName)) {
+    throw new Error('Application name must contain only lowercase letters, numbers, hyphens, and underscores');
+  }
+  const appPath = path.join(process.cwd(), 'integration', appName);
+  try {
+    await fs.access(appPath);
+    if (interactive) {
+      const { overwrite } = await require('inquirer').prompt([{
+        type: 'confirm', name: 'overwrite',
+        message: `Directory ${appPath} already exists. Overwrite?`, default: false
+      }]);
+      if (!overwrite) {
+        logger.log(chalk.yellow('Wizard cancelled.')); return false;
+      }
+    } else {
+      logger.log(chalk.yellow(`Warning: Directory ${appPath} exists. Overwriting...`));
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  return true;
+}
+
+module.exports = { handleFileSaving, validateAndCheckAppDirectory };

package/lib/core/admin-secrets-env-overlay.js

@@ -10,9 +10,10 @@
 
 /**
  * @param {Object.<string, string>} adminObj
+ * @param {string} [appName]
  * @returns {Object.<string, string>}
  */
-function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
+function buildPlatformEnvOverlayFromAdminSecrets(adminObj, appName) {
   if (!adminObj || typeof adminObj !== 'object') return {};
   const platformPwd =
     adminObj.PLATFORM_ADMIN_PASSWORD ||
@@ -39,6 +40,9 @@ function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
   if (email) {
     overlay.ONBOARDING_ADMIN_EMAIL = email;
   }
+  if (appName === 'miso-controller' && adminObj.POSTGRES_PASSWORD) {
+    overlay.POSTGRES_ADMIN_PASSWORD = adminObj.POSTGRES_PASSWORD;
+  }
   return overlay;
 }
 
@@ -46,9 +50,10 @@ function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
  * Apply admin-secrets values over resolved app env (admin-secrets wins for platform keys).
  * @param {Object.<string, string>} envMap
  * @param {Object.<string, string>} adminObj
+ * @param {string} [appName]
  */
-function applyAdminSecretsPlatformOverlay(envMap, adminObj) {
-  const overlay = buildPlatformEnvOverlayFromAdminSecrets(adminObj);
+function applyAdminSecretsPlatformOverlay(envMap, adminObj, appName) {
+  const overlay = buildPlatformEnvOverlayFromAdminSecrets(adminObj, appName);
   for (const [key, value] of Object.entries(overlay)) {
     if (value !== undefined && value !== null && String(value).trim() !== '') {
       envMap[key] = String(value);

package/lib/core/env-platform-expand.js

@@ -39,9 +39,13 @@ function expandValue(value, values, key, strict, context = {}) {
     const where = context.resourceGroup
       ? `resource group "${context.resourceGroup}" and environment "${context.environment || ''}"`
       : `environment "${context.environment || ''}" (no resource group, so platform values are unavailable)`;
+    const hint = context.resourceGroup
+      ? ''
+      : ' The environment key comes from --env, or from the current CLI environment' +
+        ' (aifabrix auth set-environment <key>).';
     throw new Error(
       `${key} references {${name}}, which no platform or environment configuration resolves for ` +
-      `${where}. Declare it under environments, or run against a resource group that supplies it.`
+      `${where}. Declare it under environments, or run against a resource group that supplies it.${hint}`
     );
   });
 }

package/lib/core/environment-access-policy.js

@@ -0,0 +1,121 @@
+/**
+ * Who may act on which environment (plan 210.0).
+ *
+ * Cross-environment management is gated by the **signed-in user's** access, never by a
+ * standing service identity. The distinction matters because the bootstrap credential that
+ * makes a silent `dev` install possible would otherwise also reach `pro`: one shared secret
+ * on a developer host would become a route into production, and nothing in the audit trail
+ * would name a person.
+ *
+ * The entitled set therefore has to come from the user's own token. That is a property of
+ * the caller rather than of this module, so the rule is made mechanical: a caller states
+ * where the list came from, and anything other than a signed-in user is refused here rather
+ * than trusted to have checked.
+ *
+ * **A request touching several environments is all-or-nothing, decided before anything
+ * runs.** A partly applied cross-environment operation leaves the installation in a state
+ * nobody asked for, and the exit code does not say which half happened; refusing the whole
+ * request is recoverable, half-doing it is not.
+ *
+ * Pure: no I/O, no token parsing. The caller supplies what it learned.
+ *
+ * @fileoverview Environment entitlement checks for cross-environment commands
+ */
+
+'use strict';
+
+/** The only acceptable provenance for an entitled-environment list. */
+const USER_ACCESS_SOURCE = 'user';
+
+/**
+ * @param {unknown} value - Environment key
+ * @returns {string}
+ */
+function normalizeEnvKey(value) {
+  return String(value ?? '').trim().toLowerCase();
+}
+
+/**
+ * Normalise an entitled-environment list to comparable keys.
+ *
+ * @param {Array<unknown>|null|undefined} entitled - Environments the user may act on
+ * @returns {string[]} Unique, normalised, in the order given
+ */
+function normalizeEntitledEnvironments(entitled) {
+  if (!Array.isArray(entitled)) {
+    return [];
+  }
+  const seen = new Set();
+  const out = [];
+  for (const item of entitled) {
+    const key = normalizeEnvKey(typeof item === 'object' && item ? item.key ?? item.name : item);
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push(key);
+  }
+  return out;
+}
+
+/**
+ * Split a request into what this user may and may not act on.
+ *
+ * @param {Array<unknown>} requested - Environments the command would touch
+ * @param {Array<unknown>} entitled - Environments the user may act on
+ * @returns {{ allowed: string[], refused: string[] }}
+ */
+function partitionByEntitlement(requested, entitled) {
+  const permitted = new Set(normalizeEntitledEnvironments(entitled));
+  const allowed = [];
+  const refused = [];
+  for (const item of Array.isArray(requested) ? requested : [requested]) {
+    const key = normalizeEnvKey(item);
+    if (!key) continue;
+    (permitted.has(key) ? allowed : refused).push(key);
+  }
+  return { allowed, refused };
+}
+
+/**
+ * Refuse a request that reaches an environment this user is not entitled to.
+ *
+ * @param {Array<unknown>|string} requested - Environments the command would touch
+ * @param {Object} access - What the caller learned about the signed-in user
+ * @param {Array<unknown>} access.entitled - Environments the user may act on
+ * @param {string} access.source - Provenance; must be `user`
+ * @returns {string[]} The requested environments, normalised, when every one is permitted
+ * @throws {Error} When the list is not user-scoped, or any environment is not permitted
+ */
+function assertEnvironmentsEntitled(requested, access = {}) {
+  if (normalizeEnvKey(access.source) !== USER_ACCESS_SOURCE) {
+    throw new Error(
+      'Environment access must come from the signed-in user, not a service identity. ' +
+        'Run "aifabrix login" and retry.'
+    );
+  }
+  const entitled = normalizeEntitledEnvironments(access.entitled);
+  const { allowed, refused } = partitionByEntitlement(requested, access.entitled);
+
+  if (entitled.length === 0) {
+    throw new Error(
+      'You are signed in but entitled to no environment. Ask an administrator for access, ' +
+        'or check the controller with: aifabrix env secret list'
+    );
+  }
+  if (refused.length > 0) {
+    // Named in full, and nothing is run. Reporting only the first would hide the rest
+    // behind a retry loop, and running the entitled ones first would half-apply the request.
+    throw new Error(
+      `Not entitled to ${refused.join(', ')}. You may act on ${entitled.join(', ')}.\n` +
+        'Nothing was changed: a request spanning environments is refused as a whole so it ' +
+        'cannot be left half applied.'
+    );
+  }
+  return allowed;
+}
+
+module.exports = {
+  USER_ACCESS_SOURCE,
+  normalizeEntitledEnvironments,
+  partitionByEntitlement,
+  assertEnvironmentsEntitled
+};