@aifabrix/builder 2.61.2 → 2.63.0

package/lib/utils/compose-generator.js

@@ -22,7 +22,8 @@ const { isVectorDatabaseName } = require('./compose-vector-helper');
 const { resolveMisoEnvironment } = require('./compose-miso-env');
 const {
   buildScopedLocalContainerName,
-  composeTraefikServiceKey
+  composeTraefikServiceKey,
+  isScopeActiveForOptions
 } = require('./environment-scoped-resources');
 const {
   derivePathFromPattern,
@@ -308,9 +309,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
   const hostPort = port;
   const useTraefikScope =
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst');
+    isScopeActiveForOptions(scopeOpts);
   const composeAppKey = useTraefikScope
     ? composeTraefikServiceKey(appName, scopeOpts.runEnvKey)
     : null;
@@ -380,9 +379,7 @@ function buildNetworkAndContainerNames(appName, devId, idNum, scopeOpts = null)
   let containerName;
   if (
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst')
+    isScopeActiveForOptions(scopeOpts)
   ) {
     containerName = buildScopedLocalContainerName(appName, devId, idNum, scopeOpts.runEnvKey);
   } else {

package/lib/utils/compose-miso-env.js

@@ -8,11 +8,11 @@
 
 /**
  * @param {Object} options - Run options
- * @returns {'dev'|'tst'|'pro'}
+ * @returns {'miso'|'dev'|'tst'|'pro'}
  */
 function resolveMisoEnvironment(options) {
   const env = (options.env && typeof options.env === 'string') ? options.env.toLowerCase() : 'dev';
-  return (env === 'tst' || env === 'pro') ? env : 'dev';
+  return (env === 'miso' || env === 'tst' || env === 'pro') ? env : 'dev';
 }
 
 module.exports = { resolveMisoEnvironment };

package/lib/utils/compose-traefik-ingress-base.js

@@ -7,7 +7,8 @@
  */
 
 const {
-  buildEnvScopedTraefikPath
+  buildEnvScopedTraefikPath,
+  isScopeActiveForOptions
 } = require('./environment-scoped-resources');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
 const {
@@ -122,9 +123,7 @@ function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, develop
   let pathOut = basePath;
   if (
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst')
+    isScopeActiveForOptions(scopeOpts)
   ) {
     pathOut = buildEnvScopedTraefikPath(basePath, scopeOpts.runEnvKey);
   }

package/lib/utils/dataplane-dimension-abac-setting.js

@@ -0,0 +1,120 @@
+/**
+ * Resolve and materialize the Dataplane Dimension ABAC installer setting.
+ *
+ * @fileoverview Strict non-secret Dimension ABAC setting helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const SETTING_NAME = 'DIMENSION_ABAC_ENFORCEMENT_ENABLED';
+const CONFIG_KEY = 'dimensionAbacEnforcementEnabled';
+const DATAPLANE_APP = 'dataplane';
+
+function settingError(message) {
+  const error = new Error(message);
+  error.code = 'DIMENSION_ABAC_SETTING_INVALID';
+  return error;
+}
+
+function parseDimensionAbacOption(raw) {
+  if (raw === undefined || raw === null) return undefined;
+  if (raw === true || raw === false) return raw;
+  const value = String(raw).trim().toLowerCase();
+  if (value === 'on') return true;
+  if (value === 'off') return false;
+  throw settingError('Invalid --dimension-abac value. Use on or off.');
+}
+
+function readStoredValue(userConfig) {
+  const applications = userConfig && userConfig.applications;
+  if (applications === undefined || applications === null) return undefined;
+  if (typeof applications !== 'object' || Array.isArray(applications)) {
+    throw settingError('Invalid applications configuration; expected an object.');
+  }
+  const entry = applications[DATAPLANE_APP];
+  if (entry === undefined || entry === null) return undefined;
+  if (typeof entry !== 'object' || Array.isArray(entry)) {
+    throw settingError('Invalid applications.dataplane configuration; expected an object.');
+  }
+  if (!Object.prototype.hasOwnProperty.call(entry, CONFIG_KEY)) return undefined;
+  if (typeof entry[CONFIG_KEY] !== 'boolean') {
+    throw settingError(`Invalid applications.dataplane.${CONFIG_KEY}; expected a boolean.`);
+  }
+  return entry[CONFIG_KEY];
+}
+
+function resolveDimensionAbacSetting(userConfig, explicitValue) {
+  const stored = readStoredValue(userConfig);
+  if (explicitValue !== undefined && typeof explicitValue !== 'boolean') {
+    throw settingError('Explicit Dimension ABAC selection must be a boolean.');
+  }
+  if (explicitValue !== undefined) return { value: explicitValue, source: 'explicit' };
+  if (stored !== undefined) return { value: stored, source: 'stored' };
+  return { value: false, source: 'default' };
+}
+
+async function persistExplicitDimensionAbacSetting(configApi, value) {
+  if (value === undefined) return undefined;
+  if (!configApi || typeof configApi.getConfig !== 'function' || typeof configApi.saveConfig !== 'function') {
+    throw settingError('Configuration API is unavailable.');
+  }
+  if (typeof value !== 'boolean') {
+    throw settingError('Persisted Dimension ABAC selection must be a boolean.');
+  }
+  const userConfig = await configApi.getConfig();
+  readStoredValue(userConfig);
+  const applications = { ...(userConfig.applications || {}) };
+  const dataplane = { ...(applications[DATAPLANE_APP] || {}), [CONFIG_KEY]: value };
+  const nextConfig = { ...userConfig, applications: { ...applications, [DATAPLANE_APP]: dataplane } };
+  await configApi.saveConfig(nextConfig);
+  return nextConfig;
+}
+
+function toDimensionAbacEnvValue(value) {
+  if (typeof value !== 'boolean') {
+    throw settingError('Dimension ABAC value must be a boolean.');
+  }
+  return value ? 'true' : 'false';
+}
+
+function applyDimensionAbacToEnvMap(appName, envMap, value) {
+  if (appName !== DATAPLANE_APP) return envMap;
+  if (!envMap || typeof envMap !== 'object' || Array.isArray(envMap)) {
+    throw settingError('Dataplane environment map must be an object.');
+  }
+  envMap[SETTING_NAME] = toDimensionAbacEnvValue(value);
+  return envMap;
+}
+
+function applyDimensionAbacToConfiguration(appName, configuration, value) {
+  if (appName !== DATAPLANE_APP) return configuration;
+  if (!Array.isArray(configuration)) {
+    throw settingError('Dataplane deployment configuration must be an array.');
+  }
+  const matches = configuration.filter(item => item && item.name === SETTING_NAME);
+  if (matches.length > 1) {
+    throw settingError(`Dataplane deployment configuration contains duplicate ${SETTING_NAME} entries.`);
+  }
+  const entry = {
+    name: SETTING_NAME,
+    value: toDimensionAbacEnvValue(value),
+    location: 'variable',
+    required: false
+  };
+  if (matches.length === 0) configuration.push(entry);
+  else Object.assign(matches[0], entry);
+  return configuration;
+}
+
+module.exports = {
+  SETTING_NAME,
+  CONFIG_KEY,
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting,
+  toDimensionAbacEnvValue,
+  applyDimensionAbacToEnvMap,
+  applyDimensionAbacToConfiguration
+};

package/lib/utils/declarative-url-ports.js

@@ -59,6 +59,9 @@ function dataplaneDockerHostPort(appPort, developerIdNum, environmentKey = 'dev'
   if (env === 'tst') {
     return baseHostPort + 20;
   }
+  if (env === 'pro') {
+    return baseHostPort + 30;
+  }
   return id === 0 ? appPort : baseHostPort;
 }
 

package/lib/utils/env-environment-file-paths.js

@@ -0,0 +1,105 @@
+/**
+ * Per-environment env file names (plan 210.0).
+ *
+ * One host runs several environments, so the env file an environment is given has to be its
+ * own. The suffix order is **environment before profile**:
+ *
+ * ```text
+ * .env            .env.local            dev
+ * .env.tst        .env.tst.local        tst
+ * .env.pro        .env.pro.local        pro
+ * ```
+ *
+ * Two properties make that ordering the right one. `dev` keeps the names it has, so nothing
+ * existing is renamed and no tooling that looks for `.env` stops finding it. And `.local`
+ * stays the last segment, so the rule "a `.local` file is host-only and is never mounted
+ * into a container" is still readable from the name alone — `.env.local.tst` would have
+ * quietly broken that, since the profile would no longer be where every existing check looks
+ * for it.
+ *
+ * Pure: no filesystem access. The environment comes from the caller.
+ *
+ * @fileoverview Environment-suffixed env and env.local file paths
+ */
+
+'use strict';
+
+const path = require('path');
+const { isPromotionOnlyEnvironment } = require('../core/environment-mode-policy');
+
+/** The host-only profile suffix, which must stay last. */
+const LOCAL_PROFILE_SUFFIX = '.local';
+
+/**
+ * The environment segment for an env file name.
+ *
+ * Empty for `dev` and for an absent environment, which is what keeps `.env` meaning what it
+ * has always meant.
+ *
+ * @param {string} [envKey] - Environment key
+ * @returns {string} `''`, `.tst` or `.pro`
+ */
+function environmentEnvFileSegment(envKey) {
+  return isPromotionOnlyEnvironment(envKey) ? `.${String(envKey).trim().toLowerCase()}` : '';
+}
+
+/**
+ * The env file an environment is given.
+ *
+ * @param {string} envOutputPath - Resolved path ending in `.env`
+ * @param {string} [envKey] - Environment key
+ * @returns {string} Path ending in `.env`, `.env.tst` or `.env.pro`
+ * @throws {Error} When no base path is given
+ */
+function resolveEnvOutputPathForEnvironment(envOutputPath, envKey) {
+  const base = typeof envOutputPath === 'string' ? envOutputPath.trim() : '';
+  if (!base) {
+    throw new Error('envOutputPath is required to resolve an environment env file');
+  }
+  const segment = environmentEnvFileSegment(envKey);
+  if (!segment || base.endsWith(segment)) {
+    return base;
+  }
+  return `${base}${segment}`;
+}
+
+/**
+ * The host-only sibling of an environment's env file.
+ *
+ * Built from the environment path so the profile suffix is always last, whichever
+ * environment it belongs to.
+ *
+ * @param {string} envOutputPath - Resolved path ending in `.env`
+ * @param {string} [envKey] - Environment key
+ * @returns {string} Path ending in `.local`
+ * @throws {Error} When no base path is given
+ */
+function resolveEnvLocalOutputPathForEnvironment(envOutputPath, envKey) {
+  const base = typeof envOutputPath === 'string' ? envOutputPath.trim() : '';
+  if (!base) {
+    throw new Error('envOutputPath is required to resolve an environment .local env file');
+  }
+  const withoutProfile = base.endsWith(LOCAL_PROFILE_SUFFIX)
+    ? base.slice(0, -LOCAL_PROFILE_SUFFIX.length)
+    : base;
+  const forEnvironment = resolveEnvOutputPathForEnvironment(withoutProfile, envKey);
+  return `${forEnvironment}${LOCAL_PROFILE_SUFFIX}`;
+}
+
+/**
+ * Whether a file name is the host-only profile, for any environment.
+ *
+ * @param {string} filePath - Path or file name
+ * @returns {boolean}
+ */
+function isHostOnlyEnvFile(filePath) {
+  return path.basename(String(filePath ?? '')).endsWith(LOCAL_PROFILE_SUFFIX);
+}
+
+module.exports = {
+  LOCAL_PROFILE_SUFFIX,
+  environmentEnvFileSegment,
+  resolveEnvOutputPathForEnvironment,
+  resolveEnvLocalOutputPathForEnvironment,
+  isHostOnlyEnvFile
+};

package/lib/utils/environment-scoped-resources.js

@@ -1,6 +1,6 @@
 /**
  * Environment-scoped resource naming (shared infra: dev/tst on same Postgres/Redis/Docker).
- * Effective only when user gate AND app flag AND run env is dev|tst.
+ * Effective only when user gate AND app flag AND run env is dev|tst|pro.
  *
  * @fileoverview environmentScopedResources + useEnvironmentScopedResources helpers
  * @author AI Fabrix Team
@@ -10,14 +10,44 @@
 'use strict';
 
 /**
- * Run/env keys that participate in resource prefixing (not pro).
+ * Run/env keys that participate in resource prefixing.
+ *
+ * `pro` is included (plan 210.0). It was excluded while `tst` was the only promotion target,
+ * which left `/pro/data` ungenerated and every pro resource sharing dev's name, Redis index
+ * and port. On a shared developer host that is a collision, not an absence.
+ *
+ * Callers must use this predicate rather than comparing keys inline: the same `dev || tst`
+ * test was written out in five other modules, and every one of them had to be found to add
+ * a single environment.
+ */
+const SCOPED_RUN_ENVIRONMENTS = Object.freeze(['dev', 'tst', 'pro']);
+
+/** Redis logical DB per environment on one shared instance. Distinct by construction. */
+const REDIS_DB_INDEX_BY_ENV = Object.freeze({ dev: 0, tst: 1, pro: 2 });
+
+/**
  * @param {string} envKey - Normalized lowercase env key
  * @returns {boolean}
  */
 function isScopedRunEnvironmentKey(envKey) {
   if (!envKey || typeof envKey !== 'string') return false;
-  const k = envKey.toLowerCase();
-  return k === 'dev' || k === 'tst';
+  return SCOPED_RUN_ENVIRONMENTS.includes(envKey.toLowerCase());
+}
+
+/**
+ * Whether a scope context carries both the gate and a scopable environment.
+ *
+ * The five call sites that need this each combined `effectiveEnvironmentScopedResources`
+ * with their own copy of the environment test; this is that combination, once.
+ *
+ * @param {{ effectiveEnvironmentScopedResources?: boolean, runEnvKey?: string }|null} scopeOpts
+ * @returns {boolean}
+ */
+function isScopeActiveForOptions(scopeOpts) {
+  if (!scopeOpts || !scopeOpts.effectiveEnvironmentScopedResources) {
+    return false;
+  }
+  return isScopedRunEnvironmentKey(scopeOpts.runEnvKey);
 }
 
 /**
@@ -42,17 +72,18 @@ function computeEffectiveEnvironmentScopedResources(
 
 /**
  * Redis logical DB index when env-scoped resources are effective.
- * dev → 0, tst → 1 (single shared Redis instance).
+ * dev → 0, tst → 1, pro → 2 (single shared Redis instance).
+ *
+ * Returning null for a scoped environment would put it on DB 0 alongside dev, so this must
+ * cover every key in {@link SCOPED_RUN_ENVIRONMENTS}.
  *
- * @param {string} runEnvKey - dev | tst
+ * @param {string} runEnvKey - dev | tst | pro
  * @returns {number|null} Index or null if not applicable
  */
 function redisDbIndexForScopedRunEnv(runEnvKey) {
   if (!runEnvKey || typeof runEnvKey !== 'string') return null;
-  const k = runEnvKey.toLowerCase();
-  if (k === 'dev') return 0;
-  if (k === 'tst') return 1;
-  return null;
+  const index = REDIS_DB_INDEX_BY_ENV[runEnvKey.toLowerCase()];
+  return index === undefined ? null : index;
 }
 
 /**
@@ -61,7 +92,7 @@ function redisDbIndexForScopedRunEnv(runEnvKey) {
  * @param {string} appName - Application key
  * @param {string|number} devId - Developer id
  * @param {number} idNum - Parsed numeric developer id
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function buildScopedLocalContainerName(appName, devId, idNum, envKey) {
@@ -93,7 +124,7 @@ function buildDefaultLocalContainerName(appName, devId, idNum) {
  * @param {string} appName - Application key
  * @param {string|number} developerId - Developer id
  * @param {boolean} effectiveScoped - From {@link computeEffectiveEnvironmentScopedResources}
- * @param {string} [runEnvKey] - dev | tst (required when effectiveScoped)
+ * @param {string} [runEnvKey] - dev | tst | pro (required when effectiveScoped)
  * @returns {string}
  */
 function resolveRunContainerName(appName, developerId, effectiveScoped, runEnvKey) {
@@ -108,7 +139,7 @@ function resolveRunContainerName(appName, developerId, effectiveScoped, runEnvKe
  * Traefik PathPrefix: prefix /{envKey} before pattern base (e.g. /api → /dev/api).
  *
  * @param {string} basePath - From derivePathFromPattern
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function buildEnvScopedTraefikPath(basePath, envKey) {
@@ -125,7 +156,7 @@ function buildEnvScopedTraefikPath(basePath, envKey) {
  * Compose service + Traefik router key when env-scoped (unique per env on shared host).
  *
  * @param {string} appName - Application key
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function composeTraefikServiceKey(appName, envKey) {
@@ -133,7 +164,10 @@ function composeTraefikServiceKey(appName, envKey) {
 }
 
 module.exports = {
+  SCOPED_RUN_ENVIRONMENTS,
+  REDIS_DB_INDEX_BY_ENV,
   isScopedRunEnvironmentKey,
+  isScopeActiveForOptions,
   computeEffectiveEnvironmentScopedResources,
   redisDbIndexForScopedRunEnv,
   buildScopedLocalContainerName,

package/lib/utils/log-redaction.js

@@ -13,6 +13,9 @@
 /** Env key patterns that indicate a secret (mask value) — same rules as aifabrix logs <app>. */
 const SECRET_KEY_PATTERN = /password|secret|token|credential|api[_-]?key/i;
 
+/** Bounded encryption/master-key names; avoids treating every `key` variable as secret. */
+const ENCRYPTION_KEY_PATTERN = /(?:^|[_-])(?:encryption|master)[_-]?key(?:$|[_-])/i;
+
 /** Prefixes to strip before checking key (avoids masking KEYCLOAK_SERVER_URL etc.) */
 const KEY_PREFIXES_TO_STRIP = /^KEYCLOAK_|^KEY_VAULT_/;
 
@@ -50,7 +53,7 @@ function maskEnvLine(line) {
   const value = line.slice(eq + 1);
 
   const keyForCheck = key.replace(KEY_PREFIXES_TO_STRIP, '');
-  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck);
+  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck) || ENCRYPTION_KEY_PATTERN.test(keyForCheck);
 
   const maskedValue = maskUrlEmbeddedCredentials(value);
   const hasUrlCredentials = maskedValue !== value;

package/lib/utils/paths-system-builder-keys.js

@@ -8,7 +8,13 @@
 
 'use strict';
 
-const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze([
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+]);
 
 /**
  * @param {string} appName

package/lib/utils/paths.js

@@ -473,7 +473,13 @@ function getBuilderRoot() {
  * {@link getSystemBuilderRoot} (= {@link getAppsMaterializationParent}`/builder`), never the global CLI package tree.
  * @readonly
  */
-const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze([
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+]);
 
 /**
  * @param {string} appName
@@ -1156,4 +1162,3 @@ module.exports = {
   resolveAppWorkspace: require('./app-path-resolve').resolveAppWorkspace,
   resolveExternalSystemPath: require('./app-path-resolve').resolveExternalSystemPath
 };
-

package/lib/utils/postgres-platform-bootstrap.js

@@ -164,6 +164,35 @@ async function ensurePlatformDatabaseSlot(container, slot, secrets, adminPasswor
   return slot.dbName;
 }
 
+/**
+ * Databases this server already has.
+ *
+ * Read before anything is created, so an environment can adopt a database an older
+ * installation left behind instead of renaming it — a rename here means dropping and
+ * recreating, which means losing the data.
+ *
+ * @async
+ * @param {string} container - Postgres container name
+ * @param {string} adminPassword - Superuser password
+ * @returns {Promise<string[]>} Database names, empty when the server cannot be listed
+ */
+async function listExistingDatabaseNames(container, adminPassword) {
+  try {
+    const result = await dockerExec.execWithDockerEnv(
+      `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "SELECT datname FROM pg_database WHERE datistemplate = false"`,
+      { env: { PGPASSWORD: adminPassword } }
+    );
+    return String((result && result.stdout) || '')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean);
+  } catch {
+    // An unreadable server adopts nothing and creates under the contract name. Failing here
+    // would block a fresh install, where there is nothing to list in the first place.
+    return [];
+  }
+}
+
 /**
  * @async
  * @returns {Promise<{ container: string, adminPassword: string, secrets: Object }>}
@@ -202,5 +231,10 @@ module.exports = {
   PLATFORM_DATABASE_SLOTS,
   bootstrapPlatformPostgresDatabases,
   pgRoleName,
-  extractPasswordFromUrlOrValue
+  extractPasswordFromUrlOrValue,
+  // Reused by the local environment stage, which needs the same primitives under
+  // environment-scoped names rather than the unprefixed defaults this module creates.
+  resolveBootstrapContext,
+  listExistingDatabaseNames,
+  ensureRoleAndDatabase
 };

package/lib/utils/redis-env-scope.js

@@ -59,4 +59,24 @@ function applyRedisDbIndexToEnvContent(content, dbIndex) {
   return out.join('\n');
 }
 
-module.exports = { applyRedisDbIndexToEnvContent, setRedisUrlDbIndex };
+/**
+ * Point a scoped environment at its own Redis logical database.
+ *
+ * Here rather than at the call site because this module already owns the rewrite, and the
+ * caller is a 500-line file whose budget this would spend. Separating it is honest anyway:
+ * it is the only step that rewrites a resolved value instead of resolving one.
+ *
+ * @param {string} content - Resolved env content
+ * @param {string} runEnvKey - Run environment key
+ * @param {boolean} effective - Whether env-scoped resources apply
+ * @returns {string} Content, unchanged when scoping does not apply
+ */
+function applyScopedRedisDbIndex(content, runEnvKey, effective) {
+  if (!effective) {
+    return content;
+  }
+  const { redisDbIndexForScopedRunEnv } = require('./environment-scoped-resources');
+  return applyRedisDbIndexToEnvContent(content, redisDbIndexForScopedRunEnv(runEnvKey));
+}
+
+module.exports = { applyRedisDbIndexToEnvContent, setRedisUrlDbIndex, applyScopedRedisDbIndex };