biz-a-cli 2.3.80-15296 → 2.3.80-15326

package/bin/app.js

@@ -13,17 +13,39 @@ import {
 import path, { basename } from "node:path";
 import os from "node:os";
 import { env } from "../envs/env.js";
+import {
+	SERVER_MODES,
+	resolveServerLink,
+} from "../envs/serverEndpoints.js";
 import { prepareScript, encryptScript } from "./script.js";
 import { spawn } from "node:child_process";
 import { newMigration, runMigrations } from "./migrate.js";
 import {
 	APP_CONFIG_NAME,
+	buildEnsureConfigTableSql,
+	buildPostgresConfigUpsertSql,
+	buildPostgresApplicationConfigLookupSql,
+	buildPostgresSetAppSql,
 	extractConfigVersion,
 	getChunkedUpsertBlocks,
 	getUpsertBlock,
 	isSemanticVersion,
 	parseConfigForVersion,
+	readConfigRows,
 } from "../engine/domain/appConfig.js";
+import {
+	isPostgresIndex,
+	execPostgres,
+	primeRegistry,
+} from "../engine/domain/dialect.js";
+import { addUser } from "../engine/orm/userAdmin.js";
+import {
+	preservePublishedAdditions,
+	renderApplicationConfig,
+	uploadSourceConfigName,
+} from "../engine/domain/publishedAdditions.js";
+import { validateTenancyDeclaration } from "../engine/orm/tenancyDeclaration.js";
+import { logger } from "../logger.js";
 
 const getKeyFolderPath = () => {
 	const scriptPath =
@@ -68,6 +90,23 @@ const options = {
 		type: "number",
 		demandOption: false,
 	},
+	/*
+	 * ⚠️ NOT the same link as `-s/--server`. `-s` is the FINA/hub URL the bundle is POSTed to;
+	 * this picks the Biz-A server that issues the bundle-encryption key, which `prepareKeys` must
+	 * fetch BEFORE anything is uploaded. It was hard-coded to production, so `biza add` could not
+	 * run against a local stack at all — it died on `ENOTFOUND server.biz-a.id` while every other
+	 * local service was healthy. `choices` + the `.strict()` below are what stop a typo from
+	 * silently falling back to production; see `envs/serverEndpoints.js`.
+	 */
+	serverMode: {
+		alias: "sMode",
+		describe:
+			"Which Biz-A backend issues the bundle encryption key: prod, dev, or local",
+		type: "string",
+		choices: SERVER_MODES,
+		default: "prod",
+		demandOption: false,
+	},
 };
 
 const addCommandOptions = {
@@ -85,6 +124,13 @@ const addCommandOptions = {
 		demandOption: false,
 		default: false,
 	},
+	include: {
+		describe:
+			"Config mode only: additional directories whose DOMAIN configs upload alongside this one's — for a Layer 3 domain package that lives in its own tree (repeatable). An application.js in an included directory is refused, never uploaded: that row belongs to -d.",
+		type: "array",
+		demandOption: false,
+		default: [],
+	},
 	publish: {
 		describe:
 			"Config mode only (directory contains application.js): after saving, publish the domain DDL then the application config — the same as the admin App Config Publish button",
@@ -111,7 +157,7 @@ const removeCommandOptions = {
 	},
 };
 
-const prepareKeys = async () => {
+const prepareKeys = async (serverLink = env.BIZA_SERVER_LINK) => {
 	const data = Buffer.from(
 		JSON.stringify({ issuer: "CLI", acquirer: "Client" }),
 	).toString("base64");
@@ -121,7 +167,7 @@ const prepareKeys = async () => {
 		passphrase: "Biz-A@cli",
 		padding: cryptoConstants.RSA_PKCS1_PSS_PADDING,
 	}).toString("base64");
-	const res = await axios.get(env.BIZA_SERVER_LINK + "/api/issuerKey", {
+	const res = await axios.get(serverLink + "/api/issuerKey", {
 		params: { data, signature },
 	});
 	if (
@@ -408,8 +454,64 @@ const resolveUpsertBlocks = (name, version, content, dbIndex) => {
    WHOLE set before anything is uploaded, so a stray lib or a typo'd metadata can never leave a
    half-applied config in SYS$CONFIG. Every problem is collected and reported at once, each
    naming its file. */
-const collectConfigUploads = ({ workingDir, fileNames = [] }) => {
+/*
+ * ⚠️ ADDITIONAL CONFIG DIRECTORIES (`--include`), for a Layer 3 domain package that lives in its
+ * own tree rather than beside the host's `application.js`.
+ *
+ * Config mode triggers on an `application.js` in the ONE directory `-d` names, so before this a
+ * package like `/biz-a-template/hr/src/config/` had no upload path whatsoever — and registering it in
+ * the host's `domains` map was INERT rather than broken, because the runtime loader skips a named
+ * domain with no row (`if (!row?.data) continue`). A domain that silently is not there is worse than
+ * one that fails loudly.
+ *
+ * ⚠️ AN `application.js` IN AN INCLUDED DIRECTORY IS REFUSED, NOT SKIPPED. Uploading it would
+ * replace the HOST's APPLICATION_CONFIG — its navigation, its domains map — with a package's, and the
+ * only symptom would be a console that lost its menus. Pointing `--include` at a host directory is a
+ * mistake worth being told about.
+ */
+const collectIncludedConfigFiles = (include = []) => {
 	const problems = [];
+	const files = [];
+
+	for (const entry of Array.isArray(include) ? include : [include]) {
+		const dir = String(entry ?? "").trim();
+		if (!dir) continue;
+		const resolved = path.resolve(dir);
+
+		let names;
+		try {
+			if (!fs.statSync(resolved).isDirectory()) {
+				problems.push(`--include ${dir}: not a directory.`);
+				continue;
+			}
+			names = fs.readdirSync(resolved);
+		} catch (error) {
+			problems.push(`--include ${dir}: ${error?.message ?? error}`);
+			continue;
+		}
+
+		const configs = names.filter((name) => name.toLowerCase().endsWith(".js"));
+		if (configs.some((name) => name.toLowerCase() === APPLICATION_CONFIG_FILE)) {
+			problems.push(
+				`--include ${dir}: contains ${APPLICATION_CONFIG_FILE}. An included directory supplies ` +
+					"DOMAIN configs only — the application config belongs to the directory named by -d.",
+			);
+			continue;
+		}
+		for (const name of configs) files.push(path.join(resolved, name));
+	}
+
+	return { files, problems };
+};
+
+/* PURE-ish, continued: `include` names extra directories whose DOMAIN configs join the set. They are
+   folded in BEFORE validation so an included file gets exactly the same checks — and the same
+   "nothing was uploaded" guarantee — as one sitting beside application.js. */
+const collectConfigUploads = ({ workingDir, fileNames = [], include = [] }) => {
+	const problems = [];
+	const included = collectIncludedConfigFiles(include);
+	problems.push(...included.problems);
+	fileNames = [...fileNames, ...included.files];
 	const readConfig = (fileName) =>
 		fs
 			.readFileSync(
@@ -444,6 +546,10 @@ const collectConfigUploads = ({ workingDir, fileNames = [] }) => {
 	}
 
 	const domains = [];
+	/* ⚠️ Kept because the tenancy rule is CROSS-FILE: a scoped entity in one domain may be given its
+	   foreign key by a relationship in another, and `buildTenancyMap` folds them all together at
+	   runtime. Validating file-by-file would refuse a declaration the runtime accepts. */
+	const parsedConfigs = [];
 	const seenNames = new Map();
 	for (const fileName of fileNames) {
 		const baseName = path.basename(String(fileName));
@@ -485,9 +591,16 @@ const collectConfigUploads = ({ workingDir, fileNames = [] }) => {
 			continue;
 		}
 		seenNames.set(name, baseName);
+		parsedConfigs.push(parsed);
 		domains.push({ name, version, content, fileName: baseName });
 	}
 
+	/* Doc 3 §11 — refuse a tenancy declaration the schema does not actually back. This is the last
+	   point where every config is in hand and NOTHING has been written to sys$config, which is what
+	   makes "nothing was uploaded" true. See engine/orm/tenancyDeclaration.js for why it refuses
+	   rather than warns. */
+	problems.push(...validateTenancyDeclaration(parsedConfigs));
+
 	if (problems.length > 0) {
 		throw new Error(
 			`Config upload aborted, nothing was uploaded:\n  - ${problems.join("\n  - ")}`,
@@ -501,19 +614,86 @@ const collectConfigUploads = ({ workingDir, fileNames = [] }) => {
    matches appConfig.service.ts publishEditorConfigs: every domain DDL publish first (sequential),
    then the application-config publish (which regenerates template scaffolding + rebuilds the
    bundle). */
+/*
+ * Fold the publisher's own additions back into the file about to be uploaded.
+ *
+ * Reads through `readConfigRows`, which is already dialect-aware, so this behaves identically on a
+ * Firebird tenant without a line of new SQL. Fails SOFT: if either row cannot be read we upload the
+ * file exactly as before, because preserving on a guess is what caused the earlier incident.
+ */
+const preserveApplicationAdditions = async (application, apiConfig) => {
+	const readParsed = async (name) => {
+		try {
+			const rows = await readConfigRows(name, application.version, apiConfig);
+			const data = rows?.[0]?.data;
+			return data ? parseConfigForVersion(String(data)) : null;
+		} catch {
+			return null;
+		}
+	};
+
+	let fileConfig;
+	try {
+		fileConfig = parseConfigForVersion(application.content);
+	} catch {
+		return { application };
+	}
+
+	const [storedConfig, lastUploadedConfig] = await Promise.all([
+		readParsed(application.name),
+		readParsed(uploadSourceConfigName(application.name)),
+	]);
+
+	const kept = preservePublishedAdditions({ fileConfig, storedConfig, lastUploadedConfig });
+	const keptKeys = Object.keys(kept);
+	if (keptKeys.length === 0) {
+		/* Say WHY nothing was kept when there plainly was something to keep — a silent revert is how
+		   this cost four round-trips before anyone worked out what was happening. */
+		if (storedConfig && !lastUploadedConfig) {
+			logger.info(
+				`[${application.name}] no record of a previous upload, so nothing is preserved; ` +
+					"re-run the application's own publish afterwards to regenerate what it adds.",
+			);
+		}
+		return { application };
+	}
+
+	logger.info(
+		`[${application.name}] keeping ${keptKeys.join(", ")} from the last application publish ` +
+			"(unchanged in application.js); every other key comes from the file.",
+	);
+	return {
+		application: {
+			...application,
+			content: renderApplicationConfig({ ...fileConfig, ...kept }),
+		},
+	};
+};
+
 async function uploadConfigs({
 	workingDir,
 	fileNames,
+	include = [],
 	server,
 	apiPort,
 	dbIndex,
 	sub,
 	publish = false,
 	forceFull = false,
+	serverMode = "prod",
 }) {
+	/* Phase B2: ask biz-a for this tenant's database coordinates before anything reads the
+	   dialect. A deployed CLI has no config/databases.json, so without this the registry
+	   indexes would look like Firebird. No-op when --sub is absent or biz-a is unreachable. */
+	await primeRegistry({
+		subdomain: sub,
+		serverLink: resolveServerLink(serverMode),
+	});
+
 	const { application, domains } = collectConfigUploads({
 		workingDir,
 		fileNames,
+		include,
 	});
 
 	const apiConfig = {
@@ -523,17 +703,51 @@ async function uploadConfigs({
 	};
 
 	const saveOne = async ({ name, version, content }) => {
+		/* A PostgreSQL index writes straight to its pool. No chunking: the block splitting below
+		   exists only because the FINA HTTP body has a size limit, which a direct connection does
+		   not. */
+		if (isPostgresIndex(dbIndex)) {
+			await execPostgres(buildEnsureConfigTableSql(), dbIndex);
+			await execPostgres(
+				buildPostgresConfigUpsertSql(name, version, content, false),
+				dbIndex,
+			);
+			logger.info(`saved ${name}@${version} (postgres db${dbIndex})`);
+			return;
+		}
+
 		const blocks = resolveUpsertBlocks(name, version, content, dbIndex);
 		for (const block of blocks) {
 			await executeConfigBlock(block, { server, apiPort, dbIndex });
 		}
-		console.log(
+		logger.info(
 			`saved ${name}@${version}${blocks.length > 1 ? ` (${blocks.length} chunks)` : ""}`,
 		);
 	};
 
 	if (application) {
-		await saveOne(application);
+		/*
+		 * ⚠️ APPLICATION_CONFIG HAS TWO WRITERS. This one uploads `application.js` verbatim — which
+		 * deliberately ships only the BOOTSTRAP navigation and the hand-authored domains — while the
+		 * APPLICATION's own publish rebuilds the same row with what it GENERATES (injected staff
+		 * consoles, the generated runtime domain). Overwriting it wholesale wiped every app menu until
+		 * someone re-ran the app publish by hand.
+		 *
+		 * ⚠️ The obvious fix is the one that already failed: "prefer whatever is stored" dropped the
+		 * generated domain and made the damage permanent. The publisher owns SOME keys and the author
+		 * owns the rest, so the question is not who wins but whether the AUTHOR touched this key —
+		 * answerable only against the previously uploaded file. See engine/domain/publishedAdditions.js.
+		 */
+		const preserved = await preserveApplicationAdditions(application, apiConfig);
+		await saveOne(preserved.application);
+		/* Record what was uploaded, so the NEXT run can tell an author edit from an untouched key.
+		   Written after the config itself: a failed upload must not leave a source row claiming the
+		   author's file is already stored. */
+		await saveOne({
+			name: uploadSourceConfigName(application.name),
+			version: application.version,
+			content: application.content,
+		});
 	}
 	for (const domain of domains) {
 		await saveOne(domain);
@@ -561,6 +775,10 @@ async function uploadConfigs({
 		port: apiPort,
 		dbindex: dbIndex,
 		subdomain: sub,
+		/* publishApplicationConfig -> publishApp -> addApp re-enters bundle mode and fetches the
+		   issuer key again, so the mode has to survive the round trip or the publish half of
+		   `--publish` still dials production. */
+		serverMode,
 	};
 
 	for (const domain of domains) {
@@ -579,7 +797,7 @@ async function uploadConfigs({
 				`Publish ${domain.name}@${domain.version} failed: ${result?.error ?? "no error message from server"}`,
 			);
 		}
-		console.log(`published ${domain.name}@${domain.version}`);
+		logger.info(`published ${domain.name}@${domain.version}`);
 	}
 
 	if (application) {
@@ -608,7 +826,7 @@ async function uploadConfigs({
 					`Publish ${application.name}@${application.version} failed: ${result?.error ?? "no error message from server"}`,
 				);
 			}
-			console.log(`published ${application.name}@${application.version}`);
+			logger.info(`published ${application.name}@${application.version}`);
 		} finally {
 			process.chdir(previousCwd);
 			fs.rmSync(scratchDir, { force: true, recursive: true });
@@ -657,6 +875,22 @@ const resolveAppDisplayNameFromApplicationConfig = async ({
 	dbIndex,
 	sub,
 }) => {
+	/* A PostgreSQL tenant reads SYS$CONFIG directly. This must not silently return "": the
+	   display name keys the SYS$APPS row, so falling back to the random bundle name would insert
+	   a fresh app row on every publish instead of updating the existing one. */
+	if (isPostgresIndex(dbIndex)) {
+		try {
+			const rows = await execPostgres(
+				buildPostgresApplicationConfigLookupSql(),
+				dbIndex,
+			);
+			const displayName = parseApplicationConfigData(rows?.[0]?.data)?.metadata?.name;
+			return typeof displayName === "string" ? displayName.trim() : "";
+		} catch {
+			return "";
+		}
+	}
+
 	if (typeof axios.request !== "function") {
 		return "";
 	}
@@ -728,6 +962,9 @@ async function addApp({
 	body = null,
 	publish = false,
 	forceFull = false,
+	serverMode = "prod",
+	/* Extra directories whose DOMAIN configs upload alongside this one's (see --include). */
+	include = [],
 } = {}) {
 	const oldCwd = process.cwd();
 
@@ -774,20 +1011,22 @@ async function addApp({
 			return await uploadConfigs({
 				workingDir: process.cwd(),
 				fileNames: mergedSourceFiles,
+				include,
 				server,
 				apiPort,
 				dbIndex,
 				sub,
 				publish,
 				forceFull,
+				serverMode,
 			});
 		}
 
 		if (mergedSourceFiles.length > 0) {
-			const keys = await prepareKeys();
+			const keys = await prepareKeys(resolveServerLink(serverMode));
 			if (!keys) {
 				const msg = "Can not prepare encryption keys";
-				console.error(msg);
+				logger.error(msg);
 				return { success: false, error: msg };
 			}
 
@@ -825,7 +1064,7 @@ async function addApp({
 			}
 			const bundleFile = `${rootFolder}${bundleName}.tgz`;
 			compressIt(bundleFile, bundleFolder);
-			console.log(
+			logger.info(
 				`Finished packing ${processedFile} files into "${bundleFile}" (${((performance.now() - bundlingStart) / 1000).toFixed(2)}s)`,
 			);
 
@@ -853,29 +1092,44 @@ async function addApp({
 			const uploadAppName = normalizeAppName(
 				(useApplicationConfigName ? appDisplayName : "") || bundleName,
 			);
+			/* SYS$APPS is a Biz-A table, not a FINA one, so a PostgreSQL tenant is written
+			   directly — no FINA server in the path at all. On Firebird the FINA stored
+			   procedure TOrmMethod/"setApp" still owns the write. */
+			if (isPostgresIndex(dbIndex)) {
+				await execPostgres(
+					buildPostgresSetAppSql(uploadAppName, data, keys.metadata),
+					dbIndex,
+				);
+				logger.info(
+					`Finished uploading "${bundleFile}" to postgres db${dbIndex} (${((performance.now() - uploadingStart) / 1000).toFixed(2)}s)`,
+				);
+				fs.rmSync(rootFolder, { force: true, recursive: true });
+				return { success: true, data: { appName: uploadAppName } };
+			}
+
 			const param = {
 				_parameters: [dbIndex, uploadAppName, data, keys.metadata],
 			};
 
 			const res = await axios.post(url, param, { headers: headers });
 			if (res.data.success) {
-				console.log(
+				logger.info(
 					`Finished uploading "${bundleFile}" (${((performance.now() - uploadingStart) / 1000).toFixed(2)}s)`,
 				);
 				fs.rmSync(rootFolder, { force: true, recursive: true });
 				return { success: true, data: res.data };
 			}
 
-			console.error(res.data.error);
+			logger.error(res.data.error);
 			return { success: false, error: res.data.error, data: res.data };
 		}
 
 		const msg = "Nothing to upload. Please recheck your app folder.";
-		console.error(msg);
+		logger.error(msg);
 		return { success: false, error: msg };
 	} catch (e) {
 		const errMsg = e.response?.data ? e.response.data : e;
-		console.error(errMsg);
+		logger.error(errMsg);
 		return { success: false, error: errMsg };
 	} finally {
 		process.chdir(oldCwd);
@@ -914,9 +1168,9 @@ async function runUnitTests(options) {
 		});
 
 		child.on("close", async (code) => {
-			console.log("====================");
-			console.log(output);
-			console.log("====================");
+			logger.info("====================");
+			logger.info(output);
+			logger.info("====================");
 			const noTestsFound = output.includes("No tests found");
 			const missingJest =
 				output.includes("missing packages") && output.includes("jest");
@@ -937,9 +1191,10 @@ async function runUnitTests(options) {
 					files: options.files,
 					publish: options.publish,
 					forceFull: options.forceFull,
+					serverMode: options.serverMode,
 				});
 			} else {
-				console.error("Biz-A Add aborted");
+				logger.error("Biz-A Add aborted");
 			}
 			resolve();
 		});
@@ -969,6 +1224,8 @@ const buildCli = () =>
 						files: commandOptions.files,
 						publish: commandOptions.publish,
 						forceFull: commandOptions.forceFull,
+						serverMode: commandOptions.serverMode,
+						include: commandOptions.include,
 					});
 					return;
 				}
@@ -999,7 +1256,7 @@ const buildCli = () =>
 						});
 						if (res.data?.success) {
 							if (deleteApps == "") {
-								console.log("All apps removed");
+								logger.info("All apps removed");
 							} else {
 								const failedList =
 									res.data._f &&
@@ -1012,18 +1269,18 @@ const buildCli = () =>
 										: [];
 								const removeList = deleteApps.split(",");
 								removeList.forEach((app) => {
-									console.log(
+									logger.info(
 										`${app} ${failedList.indexOf(app) == -1 ? "removed" : "not found"}`,
 									);
 								});
 							}
 						} else {
-							console.error(res.data.error);
+							logger.error(res.data.error);
 						}
 						return res;
 					} catch (e) {
 						const errMsg = e.response?.data ? e.response.data : e;
-						console.error(errMsg);
+						logger.error(errMsg);
 						return errMsg;
 					}
 				})();
@@ -1043,6 +1300,85 @@ const buildCli = () =>
 			},
 			(commandOptions) => newMigration(commandOptions),
 		)
+		.command(
+			"user:add",
+			"Create a platform user in SYS$USERS on a PostgreSQL tenant (defaults: supervisor/supervisor)",
+			(yargs) =>
+				yargs
+					.option("u", {
+						alias: "username",
+						describe: "User name (stored upper-cased, as the login expects)",
+						type: "string",
+						default: "supervisor",
+					})
+					.option("w", {
+						alias: "password",
+						describe: "Password. Hashed with scrypt before it is stored",
+						type: "string",
+						default: "supervisor",
+					})
+					.option("fullname", {
+						describe: "Display name (defaults to the user name)",
+						type: "string",
+					})
+					.option("userlevel", {
+						describe: "User level. Anything below 0 cannot log in",
+						type: "number",
+						default: 9,
+					})
+					.option("replace", {
+						describe:
+							"Reset the password if the user already exists. Without it an existing user is left untouched",
+						type: "boolean",
+						default: false,
+					})
+					.option("admin", {
+						describe:
+							"Grant admin (SYS$ADMINISTRATOR). The FIRST user is granted automatically - without one, nobody can reach the admin screens or publish",
+						type: "boolean",
+						default: false,
+					}),
+			async (commandOptions) => {
+				const dbIndex = Number(commandOptions.dbIndex);
+				try {
+					await primeRegistry({
+						subdomain: commandOptions.sub,
+						serverLink: resolveServerLink(
+							commandOptions.serverMode,
+						),
+					});
+					const result = await addUser(
+						{
+							username: commandOptions.username,
+							password: commandOptions.password,
+							fullname: commandOptions.fullname,
+							userlevel: commandOptions.userlevel,
+							replace: commandOptions.replace,
+							admin: commandOptions.admin,
+						},
+						{
+							exec: execPostgres,
+							dbIndex,
+							isPostgres: isPostgresIndex(dbIndex),
+						},
+					);
+					if (result.status === "exists") {
+						logger.info(
+							`user ${result.username} already exists in db${dbIndex} - password left untouched. Use --replace to reset it.` +
+								(result.admin ? " Granted admin." : ""),
+						);
+						return;
+					}
+					logger.info(
+						`user ${result.username} ${result.status} in db${dbIndex}` +
+							(result.admin ? " and granted admin" : ""),
+					);
+				} catch (error) {
+					logger.error(`user:add failed: ${error?.message ?? error}`);
+					process.exitCode = 1;
+				}
+			},
+		)
 		.command(
 			"migrate:run",
 			"Run pending DDL migrations from the /migrations folder",

package/bin/deleteApp.js

@@ -2,6 +2,7 @@
 
 import yargs from "yargs";
 import axios from "axios";
+import { logger } from "../logger.js";
 import { env } from "../envs/env.js"
 
 const options = yargs(process.argv.slice(2))
@@ -52,12 +53,12 @@ const deleteApp = async () => {
         const param = { _parameters: [options.dbindex, deleteApps] }
         const res = await axios.post(url, param, { headers: headers });
         if (res.data.success) {
-            console.log(`${deleteApps=='' ? 'All' : deleteApps} apps removed`)
+            logger.info(`${deleteApps=='' ? 'All' : deleteApps} apps removed`)
         } else {
-            console.error(res.data.error)
+            logger.error(res.data.error)
         }
     } catch (e) {
-        console.error(e.response?.data ? e.response.data : e)
+        logger.error(e.response?.data ? e.response.data : e)
     }
 }