@aifabrix/builder 2.61.2 → 2.63.0

package/lib/utils/registry-auth-sources.js

@@ -0,0 +1,154 @@
+/**
+ * Where a registry credential comes from when none is stored.
+ *
+ * Builder is registry-agnostic: Docker Hub, GHCR and ACR are all a host, a username and a
+ * password, and an individual identity, a registry token and an admin key all fit that
+ * shape. The only special case is that an `*.azurecr.io` host can also be authenticated by
+ * the Azure CLI, which is worth trying before asking a person to paste a secret.
+ *
+ * Order: the stored pair (handled by the caller), then `az acr login` for ACR, then a
+ * prompt. A non-interactive run never prompts — it fails naming the host and how to
+ * configure it, because a hung prompt in CI is worse than a clear failure.
+ *
+ * @fileoverview Credential source strategy for registries without a stored pair
+ */
+
+'use strict';
+
+/** Azure Container Registry login server suffix. */
+const ACR_HOST_SUFFIX = '.azurecr.io';
+
+/**
+ * @param {string} host - Registry host
+ * @returns {boolean} True for an Azure Container Registry login server
+ */
+function isAzureContainerRegistryHost(host) {
+  return String(host || '').trim().toLowerCase().endsWith(ACR_HOST_SUFFIX);
+}
+
+/**
+ * Message for a run that cannot ask for credentials.
+ *
+ * @param {string} host - Registry host
+ * @returns {string}
+ */
+function nonInteractiveCredentialMessage(host) {
+  const acrHint = isAzureContainerRegistryHost(host)
+    ? ` For Azure Container Registry you can instead run "az login" so "az acr login --name ${String(host).split('.')[0]}" succeeds.`
+    : '';
+  return (
+    `No credentials for ${host} and nothing to ask: this run is not interactive. ` +
+    `Store a pair with "aifabrix dev set-registry ${host} --username <username> --password-stdin".${acrHint}`
+  );
+}
+
+/**
+ * Build the fallback `ensureRegistryLogin` uses when no pair is stored.
+ *
+ * Dependencies are injected so the chain can be tested without a terminal, an Azure CLI or
+ * a Docker daemon.
+ *
+ * @param {Object} [deps] - Injectable dependencies
+ * @param {boolean} [deps.interactive] - Whether a person can be asked; defaults to TTY
+ * @param {Function} [deps.acrLogin] - async (host) => void, defaults to `az acr login`
+ * @param {Function} [deps.promptCredentials] - async (host) => { username, password }
+ * @param {Function} [deps.saveCredentials] - async (host, username, password) => void
+ * @param {Function} [deps.dockerLogin] - async (host, username, password) => void
+ * @returns {(host: string) => Promise<'acr'|'prompt'>} Fallback for ensureRegistryLogin
+ */
+/**
+ * An error that names the host it is about.
+ *
+ * Callers read `registryHost` off it to report which registry refused, so the property is
+ * attached in one place rather than at each throw.
+ *
+ * @param {string} message - Message
+ * @param {string} host - Registry host
+ * @returns {Error}
+ */
+function hostError(message, host) {
+  const err = new Error(message);
+  err.registryHost = host;
+  return err;
+}
+
+function buildRegistryAuthFallback(deps = {}) {
+  const interactive = deps.interactive === undefined
+    ? Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    : Boolean(deps.interactive);
+
+  /**
+   * Try `az acr login` for an ACR host.
+   *
+   * Extracted so the fallback itself stays readable. A failure here is deliberately not
+   * fatal when a prompt is still possible: an expired or absent `az login` is an ordinary
+   * state, and a stored pair or an answered prompt can still authenticate the host.
+   *
+   * @param {string} host - Registry host
+   * @returns {Promise<boolean>} True when ACR login succeeded
+   */
+  async function tryAcrLogin(host) {
+    if (!isAzureContainerRegistryHost(host)) {
+      return false;
+    }
+    const acrLogin = deps.acrLogin
+      || ((target) => require('../deployment/push').authenticateACR(target));
+    try {
+      await acrLogin(host);
+      return true;
+    } catch (error) {
+      if (!interactive) {
+        throw hostError(`${nonInteractiveCredentialMessage(host)} (az acr login failed: ${error.message})`, host);
+      }
+      return false;
+    }
+  }
+
+  return async function registryAuthFallback(host) {
+    if (await tryAcrLogin(host)) {
+      return 'acr';
+    }
+    if (!interactive) {
+      throw hostError(nonInteractiveCredentialMessage(host), host);
+    }
+
+    const promptCredentials = deps.promptCredentials || promptForRegistryCredentials;
+    const { username, password } = await promptCredentials(host);
+    if (!username || !password) {
+      throw new Error(`Registry credentials for ${host} are required: both a username and a password.`);
+    }
+
+    const saveCredentials = deps.saveCredentials
+      || ((target, user, pass) => require('./registry-credentials').saveRegistryCredentials(target, user, pass));
+    // Store before logging in, so the answer is not asked for again on the next command
+    // even if the login itself fails for an unrelated reason.
+    await saveCredentials(host, username, password);
+
+    const dockerLogin = deps.dockerLogin
+      || ((target, user, pass) => require('../deployment/push').authenticateExternalRegistry(target, user, pass));
+    await dockerLogin(host, username, password);
+    return 'prompt';
+  };
+}
+
+/**
+ * Ask for a registry username and password. The password is never echoed.
+ *
+ * @param {string} host - Registry host
+ * @returns {Promise<{ username: string, password: string }>}
+ */
+async function promptForRegistryCredentials(host) {
+  const inquirer = require('inquirer');
+  return inquirer.prompt([
+    { type: 'input', name: 'username', message: `Username for ${host}:` },
+    { type: 'password', name: 'password', mask: '*', message: `Password or token for ${host}:` }
+  ]);
+}
+
+module.exports = {
+  ACR_HOST_SUFFIX,
+  isAzureContainerRegistryHost,
+  nonInteractiveCredentialMessage,
+  buildRegistryAuthFallback,
+  promptForRegistryCredentials
+};

package/lib/utils/registry-credentials.js

@@ -1,9 +1,19 @@
 /**
  * Host-scoped container registry credentials in the primary user secrets file.
  *
- * Keys are exactly `<registry>-username` and `<registry>-password` in the user's
- * `secrets.local.yaml` (never the shared store). Values are encrypted through the existing
- * local-secret writer and reach Docker only via `docker login --password-stdin`.
+ * Keys are `registry-<slug>-username` and `registry-<slug>-password` in the user's
+ * `secrets.local.yaml` (never the shared store), where the slug is the host with every
+ * character outside `[a-z0-9]` replaced by `-`. The vault naming contract accepts
+ * alphanumerics and dashes only, so the earlier `<host>-username` form — which keeps the
+ * dots of `myreg.azurecr.io` — was local-only by accident rather than by design. The
+ * `registry-` prefix keeps a host that begins with an application key distinguishable from
+ * that application's own secrets in the same flat file.
+ *
+ * Pairs written under the old keys are still read, so an existing `dev set-registry` does
+ * not silently stop working, and removal clears both forms.
+ *
+ * Values are encrypted through the existing local-secret writer and reach Docker only via
+ * `docker login --password-stdin`.
  *
  * @fileoverview Registry credential storage, lookup, removal, and per-command Docker login
  * @author AI Fabrix Team
@@ -25,12 +35,41 @@ const { normalizeRegistryHost } = require('./config-registry-preference');
 const authenticatedHosts = new Set();
 
 /**
+ * Host reduced to the vault naming charset: lowercase alphanumerics and dashes.
+ *
+ * @param {string} host - Normalized registry host
+ * @returns {string} Slug safe for a secret key
+ */
+function registryKeySlug(host) {
+  return String(host)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * Secret keys for a registry, including the previous form so an existing pair still loads.
+ *
+ * `hostKey` records which host owns the slug. Two hosts can normalise to one slug
+ * (`a.b-c` and `a-b.c` both give `a-b-c`), and silently reusing another registry's
+ * credentials is worse than refusing, so a write compares against it.
+ *
  * @param {string} registry - Registry host
- * @returns {{ host: string, usernameKey: string, passwordKey: string }}
+ * @returns {{ host: string, slug: string, usernameKey: string, passwordKey: string,
+ *   hostKey: string, legacyUsernameKey: string, legacyPasswordKey: string }}
  */
 function registryCredentialKeys(registry) {
   const host = normalizeRegistryHost(registry);
-  return { host, usernameKey: `${host}-username`, passwordKey: `${host}-password` };
+  const slug = registryKeySlug(host);
+  return {
+    host,
+    slug,
+    usernameKey: `registry-${slug}-username`,
+    passwordKey: `registry-${slug}-password`,
+    hostKey: `registry-${slug}-host`,
+    legacyUsernameKey: `${host}-username`,
+    legacyPasswordKey: `${host}-password`
+  };
 }
 
 function hasValue(value) {
@@ -40,7 +79,18 @@ function hasValue(value) {
 function readRawPair(keys) {
   const file = pathsUtil.getPrimaryUserSecretsLocalPath();
   const raw = loadExistingSecrets(file);
-  return { file, username: raw[keys.usernameKey], password: raw[keys.passwordKey] };
+  const current = { username: raw[keys.usernameKey], password: raw[keys.passwordKey] };
+  if (hasValue(current.username) || hasValue(current.password)) {
+    return { file, ...current, legacy: false, owner: raw[keys.hostKey] };
+  }
+  // Written before the keys were namespaced; read it rather than prompting again.
+  return {
+    file,
+    username: raw[keys.legacyUsernameKey],
+    password: raw[keys.legacyPasswordKey],
+    legacy: true,
+    owner: undefined
+  };
 }
 
 function partialPairError(keys) {
@@ -106,13 +156,36 @@ function removeKeysFromFile(file, keyNames) {
   return true;
 }
 
+/**
+ * Refuse to overwrite a different host's credentials when two hosts share a slug.
+ *
+ * @param {Object} keys - From {@link registryCredentialKeys}
+ * @param {Object} snapshot - From readRawPair
+ * @throws {Error} When the slug already belongs to another host
+ */
+function assertNoSlugCollision(keys, snapshot) {
+  const owner = typeof snapshot.owner === 'string' ? snapshot.owner.trim() : '';
+  if (!owner || owner === keys.host) {
+    return;
+  }
+  throw new Error(
+    `Registry key collision: "${keys.host}" and "${owner}" both reduce to "${keys.slug}", ` +
+    `so storing this pair would overwrite the credentials for ${owner}. ` +
+    `Remove the other registry first with "aifabrix dev set-registry ${owner} --clear-credentials".`
+  );
+}
+
 function restorePair(keys, snapshot) {
+  // Always clear what a save writes, then put back what the snapshot actually held — which
+  // may be under the old keys, since a pair written before namespacing is read from there.
   const restore = {};
-  const remove = [];
-  for (const [key, value] of [[keys.usernameKey, snapshot.username], [keys.passwordKey, snapshot.password]]) {
-    if (value === undefined) remove.push(key);
-    else restore[key] = value;
-  }
+  const [usernameKey, passwordKey] = snapshot.legacy
+    ? [keys.legacyUsernameKey, keys.legacyPasswordKey]
+    : [keys.usernameKey, keys.passwordKey];
+  if (snapshot.username !== undefined) restore[usernameKey] = snapshot.username;
+  if (snapshot.password !== undefined) restore[passwordKey] = snapshot.password;
+  const remove = [keys.usernameKey, keys.passwordKey, keys.hostKey]
+    .filter((key) => !Object.prototype.hasOwnProperty.call(restore, key));
   removeKeysFromFile(snapshot.file, remove);
   mergeSecretsIntoFile(snapshot.file, restore);
 }
@@ -130,14 +203,21 @@ async function saveRegistryCredentials(registry, username, password) {
     throw new Error('Registry username and password must both be non-empty');
   }
   const snapshot = readRawPair(keys);
+  assertNoSlugCollision(keys, snapshot);
   await config.ensureSecretsEncryptionKey();
   try {
     await saveLocalSecret(keys.usernameKey, String(username));
     await saveLocalSecret(keys.passwordKey, String(password));
+    // Plain, not through saveLocalSecret: the host is not a secret, and encrypting it would
+    // make every later read compare a ciphertext against the host and report a collision.
+    mergeSecretsIntoFile(snapshot.file, { [keys.hostKey]: keys.host });
   } catch (error) {
     restorePair(keys, snapshot);
     throw new Error(`Could not save registry credentials for ${keys.host}; previous values were restored (${error.message})`);
   }
+  // The pair now lives under the namespaced keys; leaving the old one behind would keep a
+  // stale password readable and let a later read pick whichever it found first.
+  removeKeysFromFile(snapshot.file, [keys.legacyUsernameKey, keys.legacyPasswordKey]);
   authenticatedHosts.delete(keys.host);
   return { host: keys.host, rollback: () => restorePair(keys, snapshot) };
 }
@@ -150,12 +230,24 @@ async function saveRegistryCredentials(registry, username, password) {
 function removeRegistryCredentials(registry) {
   const keys = registryCredentialKeys(registry);
   authenticatedHosts.delete(keys.host);
-  return removeKeysFromFile(pathsUtil.getPrimaryUserSecretsLocalPath(), [keys.usernameKey, keys.passwordKey]);
+  return removeKeysFromFile(pathsUtil.getPrimaryUserSecretsLocalPath(), [
+    keys.usernameKey,
+    keys.passwordKey,
+    keys.hostKey,
+    keys.legacyUsernameKey,
+    keys.legacyPasswordKey
+  ]);
 }
 
 /**
- * Authenticates Docker to the registry once per process: stored pair first, then the optional
- * fallback (for example Azure CLI for ACR). The password is sent only on stdin.
+ * Authenticates Docker to the registry once per process: stored pair first, then the
+ * optional fallback. The password is sent only on stdin.
+ *
+ * There is deliberately no default fallback. Most pulls are of public images and must stay
+ * anonymous; asking for a credential there would prompt for something the pull does not
+ * need. A caller that genuinely requires a credential passes one — see
+ * {@link ensureRegistryLoginWithSources}.
+ *
  * @param {string} registry - Registry host
  * @param {Object} [options] - Options
  * @param {Function} [options.fallback] - async (host) => void when no pair is stored
@@ -180,6 +272,29 @@ async function ensureRegistryLogin(registry, options = {}) {
   return 'none';
 }
 
+/**
+ * Authenticate a registry that a command cannot proceed without.
+ *
+ * Adds the credential-source chain on top of {@link ensureRegistryLogin}: the stored pair,
+ * then `az acr login` for an `*.azurecr.io` host, then a prompt. A non-interactive run
+ * fails naming the host instead of hanging on a question nobody can answer.
+ *
+ * @param {string} registry - Registry host
+ * @param {Object} [sources] - Overrides for {@link buildRegistryAuthFallback}
+ * @returns {Promise<'cached'|'credentials'|'acr'|'prompt'>}
+ */
+async function ensureRegistryLoginWithSources(registry, sources = {}) {
+  const { buildRegistryAuthFallback } = require('./registry-auth-sources');
+  const fallback = buildRegistryAuthFallback(sources);
+  let outcome = null;
+  const result = await ensureRegistryLogin(registry, {
+    fallback: async(host) => {
+      outcome = await fallback(host);
+    }
+  });
+  return result === 'fallback' ? outcome : result;
+}
+
 /**
  * Registry host of an image reference, or '' for Docker Hub style refs.
  * @param {string} imageRef - Image reference (`host/repo:tag`, `repo:tag`, ...)
@@ -224,12 +339,14 @@ function resetRegistryLoginCache(registry) {
 }
 
 module.exports = {
+  registryKeySlug,
   registryCredentialKeys,
   getRegistryCredentialStatus,
   loadRegistryCredentials,
   saveRegistryCredentials,
   removeRegistryCredentials,
   ensureRegistryLogin,
+  ensureRegistryLoginWithSources,
   ensureLoginForImageRefs,
   registryHostFromImageRef,
   resetRegistryLoginCache

package/lib/utils/secrets-generator.js

@@ -16,6 +16,7 @@ const yaml = require('js-yaml');
 const crypto = require('crypto');
 const logger = require('./logger');
 const pathsUtil = require('./paths');
+const { generateRsaSecretValues } = require('../parameters/rsa-secret-values');
 const { mergeFlatSecretsYamlPreservingComments } = require('./secrets-yaml-preserve');
 const {
   generateDatabasePasswordValueForKey,
@@ -165,32 +166,40 @@ function generateDbUrlValue(key) {
  * @param {Record<string, string>|undefined} placeholderContext - Merged infra.parameter.yaml defaults + CLI overrides
  * @returns {string|undefined} Value if catalog handled key; undefined to use legacy rules
  */
-function tryGenerateSecretValueFromCatalog(key, placeholderContext) {
-  let catalogEntry;
+/** Generators whose value comes straight from the catalog entry. */
+const CATALOG_DIRECT_GENERATORS = Object.freeze([
+  'randomBytes32', 'randomAlphanumeric', 'password', 'emptyString', 'emptyAllowed', 'literal'
+]);
+
+/**
+ * The catalog entry for a key, or nothing when the catalog cannot be read.
+ *
+ * @param {string} key - Secret key
+ * @returns {Object|undefined}
+ */
+function catalogEntryForKey(key) {
   try {
-    catalogEntry = infraParameterCatalogModule().getInfraParameterCatalog().findEntryForKey(key);
+    return infraParameterCatalogModule().getInfraParameterCatalog().findEntryForKey(key);
   } catch (err) {
     logger.warn(`infra parameter catalog unavailable (${err.message}); using legacy generators.`);
     return undefined;
   }
+}
+
+function tryGenerateSecretValueFromCatalog(key, placeholderContext) {
+  const catalogEntry = catalogEntryForKey(key);
   if (!catalogEntry || !catalogEntry.generator) return undefined;
   const g = catalogEntry.generator.type;
+  if (g === 'rsaKeyPair') {
+    return require('../parameters/rsa-secret-values').generateRsaValueFromCatalog(key, catalogEntry);
+  }
   if (g === 'databasePassword') {
-    const v = generateDbPasswordValue(key);
-    return v !== null ? v : undefined;
+    return generateDbPasswordValue(key) ?? undefined;
   }
   if (g === 'databaseUrl') {
-    const v = generateDbUrlValue(key);
-    return v !== null ? v : undefined;
-  }
-  if (
-    g === 'randomBytes32' ||
-    g === 'randomAlphanumeric' ||
-    g === 'password' ||
-    g === 'emptyString' ||
-    g === 'emptyAllowed' ||
-    g === 'literal'
-  ) {
+    return generateDbUrlValue(key) ?? undefined;
+  }
+  if (CATALOG_DIRECT_GENERATORS.includes(g)) {
     return infraParameterCatalogModule().generateValueFromCatalogEntry(key, catalogEntry, crypto, placeholderContext);
   }
   return undefined;
@@ -411,15 +420,16 @@ async function generateMissingSecrets(envTemplate, secretsPath) {
     return [];
   }
 
-  const newSecrets = {};
+  const newSecrets = generateRsaSecretValues(missingKeys, existingSecrets);
   for (const key of missingKeys) {
-    newSecrets[key] = generateSecretValue(key);
+    if (!(key in newSecrets)) newSecrets[key] = generateSecretValue(key);
   }
 
   appendSecretsToFile(resolvedPath, newSecrets);
 
-  logger.log(`✔ Generated ${missingKeys.length} missing secret key(s): ${missingKeys.join(', ')}`);
-  return missingKeys;
+  const generatedKeys = Object.keys(newSecrets);
+  logger.log(`✔ Generated ${generatedKeys.length} missing secret key(s): ${generatedKeys.join(', ')}`);
+  return generatedKeys;
 }
 
 /**
@@ -479,4 +489,3 @@ module.exports = {
   generateMissingSecrets,
   createDefaultSecrets
 };
-

package/lib/utils/secrets-helpers.js

@@ -136,7 +136,7 @@ function getValueByPath(secrets, pathStr) {
   return getValueByNestedPath(secrets, pathStr.split('/'));
 }
 
-const { getValueByPathWithEnvScope, mergeSecretsWithPrefixedCopies } =
+const { getValueByPathWithEnvScope, mergeSecretsWithPrefixedCopies, prepareScopedKv } =
   require('./secrets-kv-scope').createScopedKvHelpers(getValueByPath);
 
 function resolveKvRefValue(secretsMap, pathStr, envKey, effective) {
@@ -155,8 +155,7 @@ function resolveKvRefValue(secretsMap, pathStr, envKey, effective) {
  * @returns {string[]} Array of missing kv://<path> references (unique)
  */
 function collectMissingSecrets(content, secrets, scopedKv = null) {
-  const effective = Boolean(scopedKv && scopedKv.effective && scopedKv.envKey);
-  const secretsMap = effective ? mergeSecretsWithPrefixedCopies(secrets, scopedKv.envKey) : secrets;
+  const { secretsMap, envKey, effective } = prepareScopedKv(secrets, scopedKv);
   const seen = new Set();
   const missing = [];
   for (const line of content.split('\n')) {
@@ -168,7 +167,7 @@ function collectMissingSecrets(content, secrets, scopedKv = null) {
       const pathStr = match[1];
       if (seen.has(pathStr)) continue;
       seen.add(pathStr);
-      const value = resolveKvRefValue(secretsMap, pathStr, scopedKv?.envKey, effective);
+      const value = resolveKvRefValue(secretsMap, pathStr, envKey, effective);
       if ((value === undefined || value === null) && !isKvKeyAllowedEmptyWhenAbsent(pathStr)) {
         missing.push(`kv://${pathStr}`);
       }
@@ -216,8 +215,7 @@ function formatMissingSecretsFileInfo(secretsFilePaths) {
  * @returns {string} Content with kv:// references replaced
  */
 function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
-  const effective = Boolean(scopedKv && scopedKv.effective && scopedKv.envKey);
-  const secretsMap = effective ? mergeSecretsWithPrefixedCopies(secrets, scopedKv.envKey) : secrets;
+  const { secretsMap, envKey, effective } = prepareScopedKv(secrets, scopedKv);
   const lines = content.split('\n');
   const result = lines.map(line => {
     if (isCommentOrEmptyLine(line)) return line;
@@ -225,7 +223,7 @@ function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
     if (!scanLine.trim()) return line;
     const suffix = line.slice(scanLine.length);
     const replaced = scanLine.replace(KV_REF_PATTERN, (match, pathStr) => {
-      let value = resolveKvRefValue(secretsMap, pathStr, scopedKv?.envKey, effective);
+      let value = resolveKvRefValue(secretsMap, pathStr, envKey, effective);
       if ((value === undefined || value === null) && isKvKeyAllowedEmptyWhenAbsent(pathStr)) {
         value = '';
       }