@aifabrix/builder 2.61.2 → 2.63.0

package/lib/schema/infra.parameter.yaml

@@ -593,31 +593,31 @@ parameters:
     azure:
       notes: Not a typical Key Vault name; local optional pypi token.
 
-  # Default client id for controller app in local multi-service layout; override after register if needed.
+  # Miso Controller ↔ controller OAuth. The Controller issues both values at registration;
+  # local infrastructure must leave them empty until application resolution retrieves them.
   - key: miso-controller-client-idKeyVault
     ownerAppKey: miso-controller
     scope: app
     sensitive: false
     generator:
-      type: literal
-      value: 'miso-controller-miso-miso-controller'
-    ensureOn: [upInfra, resolveApp]
+      type: emptyString
+    ensureOn: [resolveApp]
     azure:
       legacyVaultSecretNames:
         - '{serviceName}-miso-clientIdKeyVault'
       notes: >-
-        Per-app OAuth client id from controller registration; literal default matches local Keycloak client naming.
+        Per-app OAuth client id issued when miso-controller is registered with Miso.
 
   - key: miso-controller-client-secretKeyVault
     ownerAppKey: miso-controller
     scope: app
     generator:
-      type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
+      type: emptyString
+    ensureOn: [resolveApp]
     azure:
       notes: >-
-        Per-app OAuth client secret used by miso-controller for service-to-service auth (MISO_CLIENTSECRET).
-        Generated on first ensure for local bootstrap.
+        Per-app OAuth client secret issued when miso-controller is registered with Miso and used
+        for service-to-service auth (MISO_CLIENTSECRET). Never generated by local infrastructure.
 
   # Builder API ↔ controller OAuth. These are explicit declarations rather than catch-all
   # matches so the backup catalog records the owner and canonical names unambiguously.
@@ -644,28 +644,41 @@ parameters:
       notes: Per-app OAuth client secret issued when builder-api is registered with Miso.
 
   # Dataplane ↔ controller OAuth (builder/dataplane env.template MISO_CLIENTID / MISO_CLIENTSECRET).
+  # Plan 265.0: issued by the Controller at registration, so the catalog must not produce a
+  # value for it. The previous `literal` on the `upInfra` hook meant Builder generated an id
+  # the Controller owns — and the literal was `miso-controller-dev-dataplane`, with `dev`
+  # baked into an entry that is not dev-specific. `emptyString` on `resolveApp` is the shape
+  # `builder-api-client-idKeyVault` already uses for the same relationship.
   - key: dataplane-client-idKeyVault
     ownerAppKey: dataplane
     scope: app
     sensitive: false
     generator:
-      type: literal
-      value: 'miso-controller-dev-dataplane'
-    ensureOn: [upInfra, resolveApp]
+      type: emptyString
+    ensureOn: [resolveApp]
     azure:
       notes: >-
-        Per-app OAuth client id from controller registration; literal default matches local Keycloak client naming
-        (override for environments such as miso-controller-dev-dataplane).
-
+        Per-app OAuth client id issued when dataplane is registered with Miso. Not generated
+        locally: the Controller owns it, and a locally invented id is one the Controller has
+        never seen.
+
+  # Plan 265.0: the Controller issues this secret, so a `randomBytes32` generator on the
+  # `upInfra` hook had Builder inventing an OAuth secret the Controller owns. That invented
+  # value is what defeated the "credentials missing locally" guard and surfaced as a
+  # misleading auth error rather than a clear one. Matches
+  # `builder-api-client-secretKeyVault`.
   - key: dataplane-client-secretKeyVault
     ownerAppKey: dataplane
     scope: app
     generator:
-      type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
+      type: emptyString
+    ensureOn: [resolveApp]
     azure:
       vaultSecretName: dataplane-client-secretKeyVault
-      notes: Per-app OAuth client secret for dataplane; generated on first ensure.
+      notes: >-
+        Per-app OAuth client secret issued when dataplane is registered with Miso. Never
+        generated locally; it is fetched from the Controller, which is the only party that
+        can issue one it will accept.
 
   # Mori / telemetry is optional for an unlicensed Community installation.
   - key: mori-controller-api-keyKeyVault
@@ -706,10 +719,17 @@ parameters:
     #
     # Rotating an installation that already holds a value here means clearing BOTH halves
     # together — the generator is get-or-create, so replacing one alone leaves a mismatched pair.
+    # Supplied, never generated. Mori owns this pair and keeps the private half; an installation
+    # that minted it would hold the private half of the key it verifies against and could sign a
+    # licence it would then accept. Builder refuses these pairs (aifabrix-builder 211.0 /
+    # 5bfeb06d); `rsaKeyPair` here made Miso mint them anyway, because catalog-resolver runs the
+    # generator unconditionally and never consults valueSource. `emptyAllowed` is what stops it:
+    # the materializer skips isEmptyByDesign rows, so Miso no longer writes this secret at all.
+    # It arrives instead as a deploy parameter -- packages.json -> main.bicep ->
+    # 08_keyvault-secrets.bicep -> the installation vault -- which is also the only writer that
+    # can hold Mori's real key rather than a locally invented one.
     generator:
-      type: rsaKeyPair
-      pairId: mori-license-signing
-      part: public
+      type: emptyAllowed
     ensureOn: [upInfra, resolveApp]
     azure:
       vaultSecretName: mori-license-public-keyKeyVault
@@ -817,10 +837,17 @@ parameters:
     ownerAppKey: mori-controller
     scope: app
     sensitive: true
+    # Supplied, never generated. Mori owns this pair and keeps the private half; an installation
+    # that minted it would hold the private half of the key it verifies against and could sign a
+    # licence it would then accept. Builder refuses these pairs (aifabrix-builder 211.0 /
+    # 5bfeb06d); `rsaKeyPair` here made Miso mint them anyway, because catalog-resolver runs the
+    # generator unconditionally and never consults valueSource. `emptyAllowed` is what stops it:
+    # the materializer skips isEmptyByDesign rows, so Miso no longer writes this secret at all.
+    # It arrives instead as a deploy parameter -- packages.json -> main.bicep ->
+    # 08_keyvault-secrets.bicep -> the installation vault -- which is also the only writer that
+    # can hold Mori's real key rather than a locally invented one.
     generator:
-      type: rsaKeyPair
-      pairId: mori-policy-signing
-      part: private
+      type: emptyAllowed
     ensureOn: [resolveApp]
     azure:
       vaultSecretName: secrets-policyPrivateKeyVault
@@ -857,10 +884,17 @@ parameters:
     # Mori and the dataplane must not share a signing identity. Sharing one means the dataplane
     # holds a key that mints licences, and the two services have completely different blast
     # radii. Mori is the licence server; the dataplane runs customer workloads.
+    # Supplied, never generated. Mori owns this pair and keeps the private half; an installation
+    # that minted it would hold the private half of the key it verifies against and could sign a
+    # licence it would then accept. Builder refuses these pairs (aifabrix-builder 211.0 /
+    # 5bfeb06d); `rsaKeyPair` here made Miso mint them anyway, because catalog-resolver runs the
+    # generator unconditionally and never consults valueSource. `emptyAllowed` is what stops it:
+    # the materializer skips isEmptyByDesign rows, so Miso no longer writes this secret at all.
+    # It arrives instead as a deploy parameter -- packages.json -> main.bicep ->
+    # 08_keyvault-secrets.bicep -> the installation vault -- which is also the only writer that
+    # can hold Mori's real key rather than a locally invented one.
     generator:
-      type: rsaKeyPair
-      pairId: mori-license-signing
-      part: private
+      type: emptyAllowed
     ensureOn: [resolveApp]
     azure:
       vaultSecretName: secrets-licensePrivateKeyVault