@aifabrix/builder 2.9.0 → 2.10.1

package/lib/app-config.js

@@ -46,23 +46,54 @@ async function generateVariablesYamlFile(appPath, appName, config) {
   }
 }
 
+/**
+ * Generates env.template content for external systems based on authentication type
+ * @param {Object} config - Application configuration with authType and systemKey
+ * @param {string} appName - Application name (used as fallback for systemKey)
+ * @returns {string} Environment template content
+ */
+function generateExternalSystemEnvTemplate(config, appName) {
+  const systemKey = config.systemKey || appName;
+  const authType = config.authType || 'apikey';
+  const lines = [
+    `# ${systemKey} ${authType.toUpperCase()} Configuration`,
+    '# These values are set via the Miso Controller interface or Dataplane portal',
+    '# Values are stored in Key Vault automatically by the platform',
+    ''
+  ];
+
+  if (authType === 'oauth2') {
+    lines.push('CLIENTID=kv://' + systemKey + '-clientidKeyVault');
+    lines.push('CLIENTSECRET=kv://' + systemKey + '-clientsecretKeyVault');
+    lines.push('TOKENURL=https://api.example.com/oauth/token');
+    lines.push('REDIRECT_URI=kv://' + systemKey + '-redirect-uriKeyVault');
+  } else if (authType === 'apikey') {
+    lines.push('API_KEY=kv://' + systemKey + '-api-keyKeyVault');
+  } else if (authType === 'basic') {
+    lines.push('USERNAME=kv://' + systemKey + '-usernameKeyVault');
+    lines.push('PASSWORD=kv://' + systemKey + '-passwordKeyVault');
+  }
+
+  return lines.join('\n');
+}
+
 /**
  * Generates env.template file if it doesn't exist
  * @async
  * @param {string} appPath - Path to application directory
+ * @param {string} appName - Application name
  * @param {Object} config - Application configuration
  * @param {Object} existingEnv - Existing environment variables
  */
-async function generateEnvTemplateFile(appPath, config, existingEnv) {
-  // Skip env.template for external type
-  if (config.type === 'external') {
-    return;
-  }
-
+async function generateEnvTemplateFile(appPath, appName, config, existingEnv) {
   const envTemplatePath = path.join(appPath, 'env.template');
   if (!(await fileExists(envTemplatePath))) {
     let envTemplate;
-    if (existingEnv) {
+
+    if (config.type === 'external') {
+      // Generate env.template for external systems based on authType
+      envTemplate = generateExternalSystemEnvTemplate(config, appName);
+    } else if (existingEnv) {
       const envResult = await generateEnvTemplateFromReader(config, existingEnv);
       envTemplate = envResult.template;
 
@@ -155,7 +186,7 @@ async function generateDeployJsonFile(appPath, appName, config) {
 async function generateConfigFiles(appPath, appName, config, existingEnv) {
   try {
     await generateVariablesYamlFile(appPath, appName, config);
-    await generateEnvTemplateFile(appPath, config, existingEnv);
+    await generateEnvTemplateFile(appPath, appName, config, existingEnv);
     await generateRbacYamlFile(appPath, appName, config);
     await generateDeployJsonFile(appPath, appName, config);
     await generateReadmeMdFile(appPath, appName, config);

package/lib/app-register.js

@@ -21,6 +21,7 @@ const { updateEnvTemplate } = require('./utils/env-template');
 const { getOrRefreshDeviceToken } = require('./utils/token-manager');
 const { detectAppType } = require('./utils/paths');
 const { generateEnvFile } = require('./secrets');
+const applicationSchema = require('./schema/application-schema.json');
 
 // Import createApp to auto-generate config if missing
 let createApp;
@@ -30,8 +31,17 @@ try {
   createApp = null;
 }
 
+// Extract valid enum values from application schema
+const validTypes = applicationSchema.properties.type.enum || [];
+const validRegistryModes = applicationSchema.properties.registryMode.enum || [];
+const portConstraints = {
+  minimum: applicationSchema.properties.port?.minimum || 1,
+  maximum: applicationSchema.properties.port?.maximum || 65535
+};
+
 /**
  * Validation schema for application registration
+ * Validates according to application-schema.json
  */
 const registerApplicationSchema = {
   environmentId: (val) => {
@@ -44,10 +54,12 @@ const registerApplicationSchema = {
     if (!val || val.length < 1) {
       throw new Error('Application key is required');
     }
-    if (val.length > 50) {
-      throw new Error('Application key must be at most 50 characters');
+    const keyPattern = applicationSchema.properties.key.pattern;
+    const keyMaxLength = applicationSchema.properties.key.maxLength || 50;
+    if (val.length > keyMaxLength) {
+      throw new Error(`Application key must be at most ${keyMaxLength} characters`);
     }
-    if (!/^[a-z0-9-]+$/.test(val)) {
+    if (keyPattern && !new RegExp(keyPattern).test(val)) {
       throw new Error('Application key must contain only lowercase letters, numbers, and hyphens');
     }
     return val;
@@ -56,25 +68,28 @@ const registerApplicationSchema = {
     if (!val || val.length < 1) {
       throw new Error('Display name is required');
     }
-    if (val.length > 100) {
-      throw new Error('Display name must be at most 100 characters');
+    const displayNameMaxLength = applicationSchema.properties.displayName.maxLength || 100;
+    if (val.length > displayNameMaxLength) {
+      throw new Error(`Display name must be at most ${displayNameMaxLength} characters`);
     }
     return val;
   },
   description: (val) => val || undefined,
   configuration: (val) => {
-    const validTypes = ['webapp', 'api', 'service', 'functionapp'];
-    const validRegistryModes = ['acr', 'external', 'public'];
-
     if (!val || !val.type || !validTypes.includes(val.type)) {
-      throw new Error('Configuration type must be one of: webapp, api, service, functionapp');
+      throw new Error(`Configuration type must be one of: ${validTypes.join(', ')}`);
     }
     if (!val.registryMode || !validRegistryModes.includes(val.registryMode)) {
-      throw new Error('Registry mode must be one of: acr, external, public');
+      throw new Error(`Registry mode must be one of: ${validRegistryModes.join(', ')}`);
     }
-    if (val.port !== undefined) {
-      if (!Number.isInteger(val.port) || val.port < 1 || val.port > 65535) {
-        throw new Error('Port must be an integer between 1 and 65535');
+    // Port validation: skip for external type (external systems don't need ports)
+    // For other types, port is required and must be valid
+    if (val.type !== 'external') {
+      if (val.port === undefined || val.port === null) {
+        throw new Error('Port is required for non-external application types');
+      }
+      if (!Number.isInteger(val.port) || val.port < portConstraints.minimum || val.port > portConstraints.maximum) {
+        throw new Error(`Port must be an integer between ${portConstraints.minimum} and ${portConstraints.maximum}`);
       }
     }
     return val;

package/lib/commands/login.js

@@ -359,7 +359,13 @@ async function handleDeviceCodeLogin(controllerUrl, environment, offline, scope)
     );
 
   } catch (deviceError) {
-    logger.error(chalk.red(`\n❌ Device code flow failed: ${deviceError.message}`));
+    // Display formatted error if available (includes detailed validation info)
+    if (deviceError.formattedError) {
+      logger.error(chalk.red('\n❌ Device code flow failed:'));
+      logger.log(deviceError.formattedError);
+    } else {
+      logger.error(chalk.red(`\n❌ Device code flow failed: ${deviceError.message}`));
+    }
     process.exit(1);
   }
 }

package/lib/schema/env-config.yaml

@@ -11,6 +11,10 @@ environments:
     MISO_PORT: 3000
     KEYCLOAK_HOST: keycloak
     KEYCLOAK_PORT: 8082
+    NODE_ENV: production
+    PYTHONUNBUFFERED: 1
+    PYTHONDONTWRITEBYTECODE: 1
+    PYTHONIOENCODING: utf-8
 
   local:
     DB_HOST: localhost
@@ -20,4 +24,8 @@ environments:
     MISO_HOST: localhost
     MISO_PORT: 3010
     KEYCLOAK_HOST: localhost
-    KEYCLOAK_PORT: 8082
+    KEYCLOAK_PORT: 8082
+    NODE_ENV: development
+    PYTHONUNBUFFERED: 1
+    PYTHONDONTWRITEBYTECODE: 1
+    PYTHONIOENCODING: utf-8

package/lib/templates.js

@@ -20,11 +20,16 @@ function generateVariablesYaml(appName, config) {
 
   // For external type, create minimal variables.yaml
   if (appType === 'external') {
+    // Use config values if provided, otherwise use defaults consistent with prompts
+    const systemKey = config.systemKey || appName;
+    const systemDisplayName = config.systemDisplayName || displayName;
+    const systemDescription = config.systemDescription || `External system integration for ${appName}`;
+
     const variables = {
       app: {
-        key: appName,
-        displayName: displayName,
-        description: `${appName.replace(/-/g, ' ')} external system`,
+        key: systemKey,
+        displayName: systemDisplayName,
+        description: systemDescription,
         type: 'external'
       },
       deployment: {
@@ -134,13 +139,31 @@ function generateVariablesYaml(appName, config) {
  */
 function buildCoreEnv(config) {
   return {
-    'NODE_ENV': 'development',
+    'NODE_ENV': '${NODE_ENV}',
     'PORT': config.port || 3000,
     'APP_NAME': config.appName || 'myapp',
     'LOG_LEVEL': 'info'
   };
 }
 
+/**
+ * Builds Python-specific environment variables
+ * @param {Object} config - Configuration options
+ * @returns {Object} Python environment variables
+ */
+function buildPythonEnv(config) {
+  const language = config.language || 'typescript';
+  if (language !== 'python') {
+    return {};
+  }
+
+  return {
+    'PYTHONUNBUFFERED': '${PYTHONUNBUFFERED}',
+    'PYTHONDONTWRITEBYTECODE': '${PYTHONDONTWRITEBYTECODE}',
+    'PYTHONIOENCODING': '${PYTHONIOENCODING}'
+  };
+}
+
 function buildDatabaseEnv(config) {
   if (!config.database) {
     return {};
@@ -207,8 +230,9 @@ function buildMonitoringEnv(config) {
   return {
     'MISO_CONTROLLER_URL': config.controllerUrl || 'https://controller.aifabrix.ai',
     'MISO_ENVIRONMENT': 'dev',
-    'MISO_CLIENTID': 'kv://miso-clientid',
-    'MISO_CLIENTSECRET': 'kv://miso-clientsecret'
+    'MISO_CLIENTID': 'kv://miso-controller-client-idKeyVault',
+    'MISO_CLIENTSECRET': 'kv://miso-controller-client-secretKeyVault',
+    'MISO_WEB_SERVER_URL': 'kv://miso-controller-web-server-url'
   };
 }
 
@@ -220,10 +244,17 @@ function buildMonitoringEnv(config) {
 function addCoreVariables(lines, envVars) {
   Object.entries(envVars).forEach(([key, value]) => {
     if (key.startsWith('NODE_ENV') || key.startsWith('PORT') ||
-        key.startsWith('APP_NAME') || key.startsWith('LOG_LEVEL')) {
+        key.startsWith('APP_NAME') || key.startsWith('LOG_LEVEL') ||
+        key.startsWith('PYTHON')) {
       lines.push(`${key}=${value}`);
     }
   });
+
+  // Add ALLOWED_ORIGINS and WEB_SERVER_URL after PORT variable
+  // ALLOWED_ORIGINS: My application public address
+  lines.push('ALLOWED_ORIGINS=http://localhost:*,');
+  // WEB_SERVER_URL: Miso public address (uses ${PORT} template variable)
+  lines.push('WEB_SERVER_URL=http://localhost:${PORT},');
 }
 
 function addMonitoringSection(lines, envVars) {
@@ -232,6 +263,10 @@ function addMonitoringSection(lines, envVars) {
   lines.push(`MISO_ENVIRONMENT=${envVars['MISO_ENVIRONMENT']}`);
   lines.push(`MISO_CLIENTID=${envVars['MISO_CLIENTID']}`);
   lines.push(`MISO_CLIENTSECRET=${envVars['MISO_CLIENTSECRET']}`);
+  // MISO_WEB_SERVER_URL: Miso public address
+  if (envVars['MISO_WEB_SERVER_URL']) {
+    lines.push(`MISO_WEB_SERVER_URL=${envVars['MISO_WEB_SERVER_URL']}`);
+  }
 }
 
 function addDatabaseSection(lines, envVars) {
@@ -316,6 +351,7 @@ function addAuthenticationSection(lines, envVars) {
 function generateEnvTemplate(config, existingEnv = {}) {
   const envVars = {
     ...buildCoreEnv(config),
+    ...buildPythonEnv(config),
     ...buildDatabaseEnv(config),
     ...buildRedisEnv(config),
     ...buildStorageEnv(config),

package/lib/utils/api-error-handler.js

@@ -73,13 +73,11 @@ function formatPermissionError(errorData) {
 
   const requiredPerms = extractRequiredPermissions(errorData);
   addPermissionList(lines, requiredPerms, 'Required permissions');
-
   const requestUrl = errorData.instance || errorData.url;
   const method = errorData.method || 'POST';
   if (requestUrl) {
     lines.push(chalk.gray(`Request: ${method} ${requestUrl}`));
   }
-
   if (errorData.correlationId) {
     lines.push(chalk.gray(`Correlation ID: ${errorData.correlationId}`));
   }
@@ -97,18 +95,27 @@ function formatValidationError(errorData) {
   lines.push(chalk.red('❌ Validation Error\n'));
 
   // Handle RFC 7807 Problem Details format
-  // Priority: detail > title > message
+  // Priority: detail > title > errorDescription > message > error
   if (errorData.detail) {
     lines.push(chalk.yellow(errorData.detail));
     lines.push('');
   } else if (errorData.title) {
     lines.push(chalk.yellow(errorData.title));
     lines.push('');
+  } else if (errorData.errorDescription) {
+    // Handle Keycloak-style error format
+    lines.push(chalk.yellow(errorData.errorDescription));
+    if (errorData.error) {
+      lines.push(chalk.gray(`Error code: ${errorData.error}`));
+    }
+    lines.push('');
   } else if (errorData.message) {
     lines.push(chalk.yellow(errorData.message));
     lines.push('');
+  } else if (errorData.error) {
+    lines.push(chalk.yellow(errorData.error));
+    lines.push('');
   }
-
   // Handle errors array - this is the most important part
   if (errorData.errors && Array.isArray(errorData.errors) && errorData.errors.length > 0) {
     lines.push(chalk.yellow('Validation errors:'));
@@ -124,17 +131,14 @@ function formatValidationError(errorData) {
     });
     lines.push('');
   }
-
   // Show instance (endpoint) if available (RFC 7807)
   if (errorData.instance) {
     lines.push(chalk.gray(`Endpoint: ${errorData.instance}`));
   }
-
   // Show correlation ID if available
   if (errorData.correlationId) {
     lines.push(chalk.gray(`Correlation ID: ${errorData.correlationId}`));
   }
-
   return lines.join('\n');
 }
 /**
@@ -145,7 +149,6 @@ function formatValidationError(errorData) {
 function formatAuthenticationError(errorData) {
   const lines = [];
   lines.push(chalk.red('❌ Authentication Failed\n'));
-
   if (errorData.message) {
     lines.push(chalk.yellow(errorData.message));
   } else {
@@ -153,11 +156,9 @@ function formatAuthenticationError(errorData) {
   }
   lines.push('');
   lines.push(chalk.gray('Run: aifabrix login'));
-
   if (errorData.correlationId) {
     lines.push(chalk.gray(`Correlation ID: ${errorData.correlationId}`));
   }
-
   return lines.join('\n');
 }
 /**
@@ -379,7 +380,7 @@ function createErrorResult(type, message, formatted, data) {
  * @returns {string} Error message
  */
 function getErrorMessage(errorData, defaultMessage) {
-  return errorData.detail || errorData.title || errorData.message || defaultMessage;
+  return errorData.detail || errorData.title || errorData.errorDescription || errorData.message || errorData.error || defaultMessage;
 }
 
 /**
@@ -486,7 +487,6 @@ function formatApiError(apiResponse) {
   const parsed = parseErrorResponse(errorResponse, statusCode, isNetworkError);
   return parsed.formatted;
 }
-
 module.exports = {
   parseErrorResponse,
   formatApiError,

package/lib/utils/device-code.js

@@ -140,15 +140,61 @@ function parseTokenResponse(response) {
   };
 }
 
+/**
+ * Creates a validation error with detailed information
+ * @function createValidationError
+ * @param {Object} response - Full API response object
+ * @returns {Error} Validation error with formattedError and errorData attached
+ */
+function createValidationError(response) {
+  const validationError = new Error('Token polling failed: Validation error');
+
+  // Attach formatted error if available (includes detailed validation info with ANSI colors)
+  if (response && response.formattedError) {
+    validationError.formattedError = response.formattedError;
+    validationError.message = `Token polling failed:\n${response.formattedError}`;
+  }
+
+  // Attach error data for programmatic access
+  if (response && response.errorData) {
+    validationError.errorData = response.errorData;
+    validationError.errorType = response.errorType || 'validation';
+
+    // Build detailed message if formattedError not available
+    if (!validationError.formattedError) {
+      const errorData = response.errorData;
+      const detail = errorData.detail || errorData.title || errorData.message || 'Validation error';
+      let errorMsg = `Token polling failed: ${detail}`;
+      // Add validation errors if available
+      if (errorData.errors && Array.isArray(errorData.errors) && errorData.errors.length > 0) {
+        errorMsg += '\n\nValidation errors:';
+        errorData.errors.forEach(err => {
+          const field = err.field || err.path || 'validation';
+          const message = err.message || 'Invalid value';
+          if (field === 'validation' || field === 'unknown') {
+            errorMsg += `\n  • ${message}`;
+          } else {
+            errorMsg += `\n  • ${field}: ${message}`;
+          }
+        });
+      }
+      validationError.message = errorMsg;
+    }
+  }
+
+  return validationError;
+}
+
 /**
  * Handles polling errors
  * @function handlePollingErrors
  * @param {string} error - Error code
  * @param {number} status - HTTP status code
+ * @param {Object} response - Full API response object (for accessing formattedError and errorData)
  * @throws {Error} For fatal errors
  * @returns {boolean} True if should continue polling
  */
-function handlePollingErrors(error, status) {
+function handlePollingErrors(error, status, response) {
   if (error === 'authorization_pending' || status === 202) {
     return true;
   }
@@ -166,6 +212,11 @@ function handlePollingErrors(error, status) {
     return true;
   }
 
+  // Handle validation errors with detailed message
+  if (error === 'validation_error' || status === 400) {
+    throw createValidationError(response);
+  }
+
   throw new Error(`Token polling failed: ${error}`);
 }
 
@@ -187,6 +238,18 @@ async function waitForNextPoll(interval, slowDown) {
  * @returns {string} Error code or 'Unknown error'
  */
 function extractPollingError(response) {
+  // Check for structured error data first (from api-error-handler)
+  if (response.errorData) {
+    const errorData = response.errorData;
+    // For validation errors, return the error type so we can handle it specially
+    if (response.errorType === 'validation') {
+      return 'validation_error';
+    }
+    // Return the error message from structured error
+    return errorData.detail || errorData.title || errorData.message || errorData.error || response.error || 'Unknown error';
+  }
+
+  // Fallback to original extraction logic
   const apiResponse = response.data || {};
   const errorData = typeof apiResponse === 'object' ? apiResponse : {};
   return errorData.error || response.error || 'Unknown error';
@@ -229,7 +292,7 @@ async function processPollingResponse(response, interval) {
   }
 
   const error = extractPollingError(response);
-  const shouldContinue = handlePollingErrors(error, response.status);
+  const shouldContinue = handlePollingErrors(error, response.status, response);
 
   if (shouldContinue) {
     const slowDown = error === 'slow_down';

package/lib/utils/env-template.js

@@ -20,10 +20,11 @@ const logger = require('../utils/logger');
  * @param {string} appKey - Application key
  * @param {string} clientIdKey - Secret key for client ID (e.g., 'myapp-client-idKeyVault')
  * @param {string} clientSecretKey - Secret key for client secret (e.g., 'myapp-client-secretKeyVault')
- * @param {string} controllerUrl - Controller URL (e.g., 'http://localhost:3010' or 'https://controller.aifabrix.ai')
+ * @param {string} _controllerUrl - Controller URL (e.g., 'http://localhost:3010' or 'https://controller.aifabrix.ai')
+ *   Note: This parameter is accepted for compatibility but the template format http://${MISO_HOST}:${MISO_PORT} is used instead
  * @returns {Promise<void>} Resolves when template is updated
  */
-async function updateEnvTemplate(appKey, clientIdKey, clientSecretKey, controllerUrl) {
+async function updateEnvTemplate(appKey, clientIdKey, clientSecretKey, _controllerUrl) {
   const envTemplatePath = path.join(process.cwd(), 'builder', appKey, 'env.template');
 
   if (!fsSync.existsSync(envTemplatePath)) {
@@ -49,7 +50,7 @@ async function updateEnvTemplate(appKey, clientIdKey, clientSecretKey, controlle
     }
 
     if (hasControllerUrl) {
-      content = content.replace(/^MISO_CONTROLLER_URL\s*=.*$/m, `MISO_CONTROLLER_URL=${controllerUrl}`);
+      content = content.replace(/^MISO_CONTROLLER_URL\s*=.*$/m, 'MISO_CONTROLLER_URL=http://${MISO_HOST}:${MISO_PORT}');
     }
 
     // Add missing entries
@@ -62,7 +63,7 @@ async function updateEnvTemplate(appKey, clientIdKey, clientSecretKey, controlle
         missingEntries.push(`MISO_CLIENTSECRET=kv://${clientSecretKey}`);
       }
       if (!hasControllerUrl) {
-        missingEntries.push(`MISO_CONTROLLER_URL=${controllerUrl}`);
+        missingEntries.push('MISO_CONTROLLER_URL=http://${MISO_HOST}:${MISO_PORT}');
       }
 
       const misoSection = `# MISO Application Client Credentials (per application)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.9.0",
+  "version": "2.10.1",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/keycloak/env.template

@@ -26,13 +26,19 @@ KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # =============================================================================
 # DATABASE CONFIGURATION
 # =============================================================================
+
+# MISO Application Client Credentials (per application)
+MISO_CLIENTID=kv://keycloak-client-idKeyVault
+MISO_CLIENTSECRET=kv://keycloak-client-secretKeyVault
+MISO_CONTROLLER_URL=http://${MISO_HOST}:${MISO_PORT}
+MISO_WEB_SERVER_URL=kv://miso-controller-web-server-url
+
 # Connects to postgres service in Docker network (postgres) or localhost (local)
 
 KC_DB=postgres
 KC_DB_URL_HOST=${DB_HOST}
-KC_DB_URL_PORT=5432
+KC_DB_URL_PORT=${DB_PORT}
 KC_DB_URL_DATABASE=keycloak
 KC_DB_USERNAME=keycloak_user
 KC_DB_PASSWORD=kv://databases-keycloak-0-passwordKeyVault
 DB_0_PASSWORD=kv://databases-keycloak-0-passwordKeyVault
-

package/templates/applications/keycloak/variables.yaml

@@ -1,14 +1,14 @@
 # Application Metadata
 app:
   key: keycloak
-  displayName: "AI Fabrix Keycloak"
-  description: "Identity and Access Management"
+  displayName: 'AI Fabrix Keycloak'
+  description: 'Identity and Access Management'
   type: webapp
 
 # Image Configuration
 image:
   name: aifabrix/keycloak
-  tag: "latest"
+  tag: 'latest'
   registry: devflowiseacr.azurecr.io
   registryMode: acr
 

package/templates/applications/miso-controller/env.template

@@ -28,13 +28,21 @@ ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 # APPLICATION ENVIRONMENT
 # =============================================================================
 
-NODE_ENV=development
-PORT=3000
+# NODE_ENV: production for Docker (serves pre-built static files), development for local dev
+# In Docker, this should be production to prevent Vite dev server initialization
+NODE_ENV=${NODE_ENV}
+PORT=${MISO_PORT}
 AUTO_CREATE_TABLES=true
 FAST_STARTUP=false
-ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173
+ALLOWED_ORIGINS=http://localhost:*
 ENABLE_API_DOCS=true
 
+# Rate Limiting Configuration (for local development)
+# Set DISABLE_RATE_LIMIT=true to disable rate limiting entirely (local development only)
+DISABLE_RATE_LIMIT=true
+# RATE_LIMIT_WINDOW_MS=900000  # 15 minutes in milliseconds (default: 900000)
+# RATE_LIMIT_MAX=100           # Max requests per window (default: 100)
+
 # Package Version (auto-set by npm/pnpm, optional override)
 # npm_package_version=1.0.0
 
@@ -72,6 +80,7 @@ REDIS_PERMISSIONS_TTL=900
 
 KEYCLOAK_REALM=aifabrix
 KEYCLOAK_SERVER_URL=kv://keycloak-server-urlKeyVault
+KEYCLOAK_PUBLIC_SERVER_URL=kv://keycloak-public-server-urlKeyVault
 KEYCLOAK_CLIENT_ID=miso-controller
 KEYCLOAK_CLIENT_SECRET=kv://keycloak-client-secretKeyVault
 KEYCLOAK_ADMIN_USERNAME=admin
@@ -96,8 +105,9 @@ AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
 AZURE_CLIENT_ID=kv://azure-client-idKeyVault
 AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
 
-# Mock Mode (set to false for production)
-MOCK=true
+# Mock Mode (defaults to false - set to true only for testing/development)
+# Set MOCK=true to prevent actual Azure resource creation (for testing)
+MOCK=false
 
 # =============================================================================
 # SECURITY & ENCRYPTION
@@ -117,11 +127,14 @@ API_KEY=kv://miso-controller-api-key-secretKeyVault
 # =============================================================================
 
 # MISO Controller URL
-MISO_CONTROLLER_URL=kv://miso-controller-url
-
-# Web Server URL (for OpenAPI documentation server URLs)
-# Used to generate correct server URLs in OpenAPI spec
-WEB_SERVER_URL=kv://miso-controller-web-server-url
+MISO_CONTROLLER_URL=http://${MISO_HOST}:${MISO_PORT}
+
+# Web Server URL (for OpenAPI documentation server URLs and Keycloak callbacks)
+# This is the PUBLIC-FACING URL that browsers/users access (e.g., http://localhost:3100)
+# Used to generate correct server URLs in OpenAPI spec and Keycloak callback URLs
+# For Docker: use localhost with mapped port (e.g., localhost:3100)
+# For production: use public domain (e.g., https://miso.example.com)
+MISO_WEB_SERVER_URL=kv://miso-controller-web-server-url
 
 # MISO Environment Configuration (miso, dev, tst, pro)
 MISO_ENVIRONMENT=miso

package/templates/applications/miso-controller/rbac.yaml

@@ -1,230 +1,280 @@
 roles:
-  - name: "AI Fabrix Platform Admin"
-    value: "aifabrix-platform-admin"
-    description: "Full platform infrastructure management and enterprise controller access"
-    Groups: ["AI-Fabrix-Platform-Admins"]
-  
-  - name: "AI Fabrix Security Admin"
-    value: "aifabrix-security-admin"
-    description: "Security and compliance management for enterprise controller"
-    Groups: ["AI-Fabrix-Security-Admins"]
-  
-  - name: "AI Fabrix Infrastructure Admin"
-    value: "aifabrix-infrastructure-admin"
-    description: "Infrastructure deployment and management across environments"
-    Groups: ["AI-Fabrix-Infrastructure-Admins"]
-  
-  - name: "AI Fabrix Deployment Admin"
-    value: "aifabrix-deployment-admin"
-    description: "Application deployment orchestration and environment management"
-    Groups: ["AI-Fabrix-Deployment-Admins"]
-  
-  - name: "AI Fabrix Compliance Admin"
-    value: "aifabrix-compliance-admin"
-    description: "ISO 27001 compliance monitoring and audit management"
-    Groups: ["AI-Fabrix-Compliance-Admins"]
-  
-  - name: "AI Fabrix Developer"
-    value: "aifabrix-developer"
-    description: "Developer access to deploy applications via GitHub Actions"
-    Groups: ["AI-Fabrix-Developers"]
-  
-  - name: "AI Fabrix Observer"
-    value: "aifabrix-observer"
-    description: "Read-only access to monitoring, logs, and compliance reports"
-    Groups: ["AI-Fabrix-Observers"]
+  - name: 'AI Fabrix Platform Admin'
+    value: 'aifabrix-platform-admin'
+    description: 'Full platform infrastructure management and enterprise controller access'
+    Groups: ['AI-Fabrix-Platform-Admins']
+
+  - name: 'AI Fabrix Security Admin'
+    value: 'aifabrix-security-admin'
+    description: 'Security and compliance management for enterprise controller'
+    Groups: ['AI-Fabrix-Security-Admins']
+
+  - name: 'AI Fabrix Infrastructure Admin'
+    value: 'aifabrix-infrastructure-admin'
+    description: 'Infrastructure deployment and management across environments'
+    Groups: ['AI-Fabrix-Infrastructure-Admins']
+
+  - name: 'AI Fabrix Deployment Admin'
+    value: 'aifabrix-deployment-admin'
+    description: 'Application deployment orchestration and environment management'
+    Groups: ['AI-Fabrix-Deployment-Admins']
+
+  - name: 'AI Fabrix Compliance Admin'
+    value: 'aifabrix-compliance-admin'
+    description: 'ISO 27001 compliance monitoring and audit management'
+    Groups: ['AI-Fabrix-Compliance-Admins']
+
+  - name: 'AI Fabrix Developer'
+    value: 'aifabrix-developer'
+    description: 'Developer access to deploy applications via GitHub Actions'
+    Groups: ['AI-Fabrix-Developers']
+
+  - name: 'AI Fabrix Observer'
+    value: 'aifabrix-observer'
+    description: 'Read-only access to monitoring, logs, and compliance reports'
+    Groups: ['AI-Fabrix-Observers']
 
 permissions:
   # Service User Management
-  - name: "service-user:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Create service users and API clients"
-  
-  - name: "service-user:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
-    description: "View service users and their configurations"
-  
-  - name: "service-user:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Update service user configurations and regenerate secrets"
-  
-  - name: "service-user:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Deactivate service users"
-  
+  - name: 'service-user:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Create service users and API clients'
+
+  - name: 'service-user:read'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-observer']
+    description: 'View service users and their configurations'
+
+  - name: 'service-user:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Update service user configurations and regenerate secrets'
+
+  - name: 'service-user:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Deactivate service users'
+
   # User Management
-  - name: "users:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Create new users"
-  
-  - name: "users:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
-    description: "View user information and profiles"
-  
-  - name: "users:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Update user information and manage group memberships"
-  
-  - name: "users:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Delete users"
-  
+  - name: 'users:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Create new users'
+
+  - name: 'users:read'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-observer']
+    description: 'View user information and profiles'
+
+  - name: 'users:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Update user information and manage group memberships'
+
+  - name: 'users:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete users'
+
   # Group Management
-  - name: "groups:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Create new groups"
-  
-  - name: "groups:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
-    description: "View group information and members"
-  
-  - name: "groups:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Update group information"
-  
-  - name: "groups:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Delete groups"
-  
+  - name: 'groups:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Create new groups'
+
+  - name: 'groups:read'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-observer']
+    description: 'View group information and members'
+
+  - name: 'groups:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Update group information'
+
+  - name: 'groups:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete groups'
+
   # Administrative Permissions
-  - name: "admin:read"
-    roles: ["aifabrix-platform-admin"]
-    description: "Administrative read access to all resources"
-  
-  - name: "admin:write"
-    roles: ["aifabrix-platform-admin"]
-    description: "Administrative write access to all resources"
-  
-  - name: "admin:delete"
-    roles: ["aifabrix-platform-admin"]
-    description: "Administrative delete access to all resources"
-  
+  - name: 'admin:read'
+    roles: ['aifabrix-platform-admin']
+    description: 'Administrative read access to all resources'
+
+  - name: 'admin:write'
+    roles: ['aifabrix-platform-admin']
+    description: 'Administrative write access to all resources'
+
+  - name: 'admin:delete'
+    roles: ['aifabrix-platform-admin']
+    description: 'Administrative delete access to all resources'
+
   # Template Applications (environment = null)
-  - name: "applications:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
-    description: "Register new application templates"
-  
-  - name: "applications:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View application templates"
-  
-  - name: "applications:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
-    description: "Update application templates"
-  
-  - name: "applications:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
-    description: "Remove application templates"
-  
+  - name: 'applications:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin', 'aifabrix-deployment-admin']
+    description: 'Register new application templates'
+
+  - name: 'applications:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-infrastructure-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View application templates'
+
+  - name: 'applications:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin', 'aifabrix-deployment-admin']
+    description: 'Update application templates'
+
+  - name: 'applications:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin']
+    description: 'Remove application templates'
+
   # Environments
-  - name: "environments:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
-    description: "Create new environments (dev, tst, pro, miso)"
-  
-  - name: "environments:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View environments and their status"
-  
-  - name: "environments:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
-    description: "Update environment configuration"
-  
-  - name: "environments:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
-    description: "Delete environments"
-  
+  - name: 'environments:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin']
+    description: 'Create new environments (dev, tst, pro, miso)'
+
+  - name: 'environments:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-infrastructure-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View environments and their status'
+
+  - name: 'environments:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin']
+    description: 'Update environment configuration'
+
+  - name: 'environments:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin']
+    description: 'Delete environments'
+
   # Environment Applications
-  - name: "environments-applications:create"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
-    description: "Create applications within environments"
-  
-  - name: "environments-applications:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View applications within environments"
-  
-  - name: "environments-applications:update"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
-    description: "Update applications within environments"
-  
-  - name: "environments-applications:delete"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin"]
-    description: "Remove applications from environments"
-  
+  - name: 'environments-applications:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin', 'aifabrix-developer']
+    description: 'Create applications within environments'
+
+  - name: 'environments-applications:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View applications within environments'
+
+  - name: 'environments-applications:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin', 'aifabrix-developer']
+    description: 'Update applications within environments'
+
+  - name: 'environments-applications:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin']
+    description: 'Remove applications from environments'
+
   # Pipeline & Deployment
-  - name: "applications:deploy"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer"]
-    description: "Deploy applications to environments"
-  
-  - name: "deployments:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View deployment history and status"
-  
+  - name: 'applications:deploy'
+    roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin', 'aifabrix-developer']
+    description: 'Deploy applications to environments'
+
+  - name: 'deployments:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View deployment history and status'
+
   # Controller Operations
-  - name: "controller:admin"
-    roles: ["aifabrix-platform-admin"]
-    description: "Full administrative access to controller operations"
-  
-  - name: "controller:deploy"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin"]
-    description: "Deploy infrastructure and manage environments"
-  
-  - name: "controller:monitor"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
-    description: "Monitor system health and view logs"
-  
-  - name: "controller:compliance"
-    roles: ["aifabrix-platform-admin", "aifabrix-compliance-admin"]
-    description: "Access compliance reports and audit logs"
-  
+  - name: 'controller:admin'
+    roles: ['aifabrix-platform-admin']
+    description: 'Full administrative access to controller operations'
+
+  - name: 'controller:deploy'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin', 'aifabrix-deployment-admin']
+    description: 'Deploy infrastructure and manage environments'
+
+  - name: 'controller:monitor'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-observer']
+    description: 'Monitor system health and view logs'
+
+  - name: 'controller:compliance'
+    roles: ['aifabrix-platform-admin', 'aifabrix-compliance-admin']
+    description: 'Access compliance reports and audit logs'
+
   # Authentication & Authorization
-  - name: "auth:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View user roles and permissions"
-  
+  - name: 'auth:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View user roles and permissions'
+
   # Logs
-  - name: "logs:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-compliance-admin", "aifabrix-observer"]
-    description: "View application and audit logs"
-  
-  - name: "logs:write"
-    roles: ["aifabrix-platform-admin", "aifabrix-developer"]
-    description: "Write audit and error logs"
-  
-  - name: "logs:export"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-compliance-admin"]
-    description: "Export logs for archival and compliance"
-  
-  - name: "audit:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-compliance-admin"]
-    description: "View audit trail logs"
-  
-  - name: "jobs:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin", "aifabrix-deployment-admin", "aifabrix-observer"]
-    description: "View job and performance logs"
-  
-  - name: "admin:export"
-    roles: ["aifabrix-platform-admin"]
-    description: "Administrative export access to all data"
-  
+  - name: 'logs:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-compliance-admin',
+        'aifabrix-observer'
+      ]
+    description: 'View application and audit logs'
+
+  - name: 'logs:write'
+    roles: ['aifabrix-platform-admin', 'aifabrix-developer']
+    description: 'Write audit and error logs'
+
+  - name: 'logs:export'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-compliance-admin']
+    description: 'Export logs for archival and compliance'
+
+  - name: 'audit:read'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-compliance-admin']
+    description: 'View audit trail logs'
+
+  - name: 'jobs:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-infrastructure-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-observer'
+      ]
+    description: 'View job and performance logs'
+
+  - name: 'admin:export'
+    roles: ['aifabrix-platform-admin']
+    description: 'Administrative export access to all data'
+
   # Admin Operations
-  - name: "admin:sync"
-    roles: ["aifabrix-platform-admin", "aifabrix-infrastructure-admin"]
-    description: "Full system synchronization operations"
-  
-  - name: "admin:keycloak"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin"]
-    description: "Keycloak administration and configuration"
-  
+  - name: 'admin:sync'
+    roles: ['aifabrix-platform-admin', 'aifabrix-infrastructure-admin']
+    description: 'Full system synchronization operations'
+
+  - name: 'admin:keycloak'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Keycloak administration and configuration'
+
   # Cache Management
-  - name: "cache:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-observer"]
-    description: "View cache statistics and performance metrics"
-  
-  - name: "cache:admin"
-    roles: ["aifabrix-platform-admin"]
-    description: "Manage cache (clear, invalidate patterns)"
-  
+  - name: 'cache:read'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-observer']
+    description: 'View cache statistics and performance metrics'
+
+  - name: 'cache:admin'
+    roles: ['aifabrix-platform-admin']
+    description: 'Manage cache (clear, invalidate patterns)'
+
   # Dashboard
-  - name: "dashboard:read"
-    roles: ["aifabrix-platform-admin", "aifabrix-deployment-admin", "aifabrix-developer", "aifabrix-observer"]
-    description: "View dashboard summaries and aggregates"
+  - name: 'dashboard:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View dashboard summaries and aggregates'

package/templates/applications/miso-controller/variables.yaml

@@ -1,8 +1,8 @@
 # Application Metadata
 app:
   key: miso-controller
-  displayName: "Miso Controller"
-  description: "AI Fabrix Miso Controller - Backend API and orchestration service"
+  displayName: 'Miso Controller'
+  description: 'AI Fabrix Miso Controller - Backend API and orchestration service'
   type: webapp
 
 # Image Configuration
@@ -34,7 +34,7 @@ healthCheck:
 
 # Authentication
 authentication:
-  type: local
+  type: keycloak
   enableSSO: true
   requiredRoles:
     - aifabrix-user