@oondemand/oon-core-back 0.3.22 → 0.3.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.3.22",
+  "version": "0.3.23",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/delivery/mongoProvisioning.js

@@ -0,0 +1,394 @@
+"use strict";
+
+const { mongo } = require("mongoose");
+
+const DIGITALOCEAN_API = "https://api.digitalocean.com/v2";
+const DIGITALOCEAN_HOST_SUFFIX = ".mongo.ondigitalocean.com";
+
+function randomSecret(bytes = 32) {
+  return require("node:crypto").randomBytes(bytes).toString("base64url");
+}
+
+function dnsLabel(value, max = 63) {
+  return String(value || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, max)
+    .replace(/-+$/, "");
+}
+
+function mongoIdentity(appCode, environment) {
+  return {
+    dbName: dnsLabel(`${appCode}_${environment}`, 48).replace(/-/g, "_"),
+    username: dnsLabel(`${appCode}-${environment}`, 48),
+  };
+}
+
+function mongoHost(uri) {
+  try {
+    return new URL(uri).hostname.toLowerCase();
+  } catch {
+    throw new Error("MONGO_ADMIN_URI inválida.");
+  }
+}
+
+function resolveMongoProvisioner({ adminUri, provisioner = "auto" }) {
+  const normalized = String(provisioner || "auto").trim().toLowerCase();
+  if (!["auto", "native", "digitalocean"].includes(normalized)) {
+    throw new Error(
+      `MONGO_PROVISIONER inválido: ${normalized}. Use auto, native ou digitalocean.`,
+    );
+  }
+  if (normalized !== "auto") return normalized;
+  return mongoHost(adminUri).endsWith(DIGITALOCEAN_HOST_SUFFIX)
+    ? "digitalocean"
+    : "native";
+}
+
+function buildRuntimeMongoUri({
+  adminUri,
+  username,
+  password,
+  dbName,
+  authSource,
+}) {
+  const uri = new URL(adminUri);
+  uri.username = username;
+  uri.password = password;
+  uri.pathname = `/${dbName}`;
+  uri.searchParams.set("authSource", authSource);
+  return uri.toString();
+}
+
+async function validateMongoUri(
+  mongoUri,
+  {
+    MongoClient = mongo.MongoClient,
+    timeoutMs = 15000,
+    writeProbe = true,
+  } = {},
+) {
+  const client = new MongoClient(mongoUri, {
+    serverSelectionTimeoutMS: timeoutMs,
+    connectTimeoutMS: timeoutMs,
+    maxPoolSize: 2,
+  });
+
+  await client.connect();
+  try {
+    const db = client.db();
+    await db.command({ ping: 1 });
+    if (writeProbe) {
+      const probe = db.collection("__oon_runtime_probe");
+      const id = "provisioning";
+      await probe.updateOne(
+        { _id: id },
+        { $set: { checkedAt: new Date() } },
+        { upsert: true },
+      );
+      await probe.deleteOne({ _id: id });
+    }
+  } finally {
+    await client.close();
+  }
+  return true;
+}
+
+async function waitForMongoUri(
+  mongoUri,
+  {
+    validate = validateMongoUri,
+    attempts = 12,
+    delayMs = 5000,
+  } = {},
+) {
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      await validate(mongoUri);
+      return true;
+    } catch (error) {
+      lastError = error;
+      if (attempt < attempts) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+  }
+  const reason = lastError?.codeName || lastError?.code || lastError?.name;
+  throw new Error(
+    `A credencial derivada do MongoDB não passou no teste de leitura e escrita${
+      reason ? ` (${reason})` : ""
+    }.`,
+  );
+}
+
+async function provisionNativeMongo({ adminUri, appCode, environment }) {
+  const { dbName, username } = mongoIdentity(appCode, environment);
+  const password = randomSecret(30);
+  const client = new mongo.MongoClient(adminUri, {
+    serverSelectionTimeoutMS: 15000,
+  });
+  await client.connect();
+  try {
+    const db = client.db(dbName);
+    try {
+      await db.command({
+        createUser: username,
+        pwd: password,
+        roles: [{ role: "readWrite", db: dbName }],
+      });
+    } catch (error) {
+      const alreadyExists =
+        error.codeName === "DuplicateKey" ||
+        error.code === 51003 ||
+        /already exists/i.test(error.message);
+      if (!alreadyExists) throw error;
+      await db.command({
+        updateUser: username,
+        pwd: password,
+        roles: [{ role: "readWrite", db: dbName }],
+      });
+    }
+  } finally {
+    await client.close();
+  }
+
+  return {
+    dbName,
+    username,
+    mongoUri: buildRuntimeMongoUri({
+      adminUri,
+      username,
+      password,
+      dbName,
+      authSource: dbName,
+    }),
+    provider: "native",
+  };
+}
+
+async function digitalOceanRequest(
+  {
+    token,
+    clusterId,
+    path,
+    method = "GET",
+    body,
+    expected = [200],
+  },
+  { fetchImpl = globalThis.fetch } = {},
+) {
+  if (!fetchImpl) throw new Error("fetch não disponível para a DigitalOcean API.");
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 20000);
+  let response;
+  try {
+    response = await fetchImpl(
+      `${DIGITALOCEAN_API}/databases/${encodeURIComponent(clusterId)}${path}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/json",
+          ...(body ? { "Content-Type": "application/json" } : {}),
+        },
+        body: body ? JSON.stringify(body) : undefined,
+        signal: controller.signal,
+      },
+    );
+  } catch (error) {
+    if (error.name === "AbortError") {
+      throw new Error("Timeout ao acessar a DigitalOcean API.");
+    }
+    throw new Error(`Falha ao acessar a DigitalOcean API: ${error.message}`);
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  const payload = await response.json().catch(() => ({}));
+  if (!expected.includes(response.status)) {
+    const error = new Error(
+      `DigitalOcean API rejeitou ${method} ${path}: HTTP ${response.status} (${payload.id || "erro"}).`,
+    );
+    error.status = response.status;
+    error.payload = payload;
+    throw error;
+  }
+  return { status: response.status, payload };
+}
+
+async function ensureDigitalOceanDatabase(options, deps) {
+  const path = `/dbs/${encodeURIComponent(options.dbName)}`;
+  try {
+    await digitalOceanRequest(
+      { ...options, path, expected: [200] },
+      deps,
+    );
+    return;
+  } catch (error) {
+    if (error.status !== 404) throw error;
+  }
+
+  await digitalOceanRequest(
+    {
+      ...options,
+      path: "/dbs",
+      method: "POST",
+      body: { name: options.dbName },
+      expected: [201, 202],
+    },
+    deps,
+  );
+}
+
+function digitalOceanUserSettings(dbName) {
+  return {
+    mongo_user_settings: {
+      databases: [dbName],
+      role: "readWrite",
+    },
+  };
+}
+
+async function provisionDigitalOceanUser(options, deps) {
+  const userPath = `/users/${encodeURIComponent(options.username)}`;
+  let exists = true;
+  try {
+    await digitalOceanRequest(
+      { ...options, path: userPath, expected: [200] },
+      deps,
+    );
+  } catch (error) {
+    if (error.status !== 404) throw error;
+    exists = false;
+  }
+
+  const settings = digitalOceanUserSettings(options.dbName);
+  let result;
+  if (!exists) {
+    result = await digitalOceanRequest(
+      {
+        ...options,
+        path: "/users",
+        method: "POST",
+        body: { name: options.username, settings },
+        expected: [201, 202],
+      },
+      deps,
+    );
+  } else {
+    await digitalOceanRequest(
+      {
+        ...options,
+        path: userPath,
+        method: "PUT",
+        body: { settings },
+        expected: [200, 202],
+      },
+      deps,
+    );
+    result = await digitalOceanRequest(
+      {
+        ...options,
+        path: `${userPath}/reset_auth`,
+        method: "POST",
+        body: {},
+        expected: [200, 201, 202],
+      },
+      deps,
+    );
+  }
+
+  const user = result.payload.user;
+  if (!user?.password) {
+    throw new Error(
+      "DigitalOcean API não retornou a senha do usuário. O token precisa do escopo database:view_credentials.",
+    );
+  }
+  return user;
+}
+
+async function provisionDigitalOceanMongo(
+  {
+    adminUri,
+    appCode,
+    environment,
+    digitalOceanToken,
+    digitalOceanClusterId,
+  },
+  deps = {},
+) {
+  if (!digitalOceanToken) {
+    throw new Error(
+      "DIGITALOCEAN_TOKEN é obrigatório para provisionar usuários no MongoDB gerenciado da DigitalOcean.",
+    );
+  }
+  if (!digitalOceanClusterId) {
+    throw new Error(
+      "DIGITALOCEAN_DATABASE_CLUSTER_ID é obrigatório para provisionar usuários no MongoDB gerenciado da DigitalOcean.",
+    );
+  }
+
+  const { dbName, username } = mongoIdentity(appCode, environment);
+  const apiOptions = {
+    token: digitalOceanToken,
+    clusterId: digitalOceanClusterId,
+    dbName,
+    username,
+  };
+  await ensureDigitalOceanDatabase(apiOptions, deps);
+  const user = await provisionDigitalOceanUser(apiOptions, deps);
+  const mongoUri = buildRuntimeMongoUri({
+    adminUri,
+    username: user.name || username,
+    password: user.password,
+    dbName,
+    authSource: "admin",
+  });
+
+  await waitForMongoUri(mongoUri, {
+    validate: deps.validateMongoUri || validateMongoUri,
+    attempts: deps.validationAttempts,
+    delayMs: deps.validationDelayMs,
+  });
+
+  return {
+    dbName,
+    username: user.name || username,
+    mongoUri,
+    provider: "digitalocean",
+  };
+}
+
+async function provisionMongo(options, deps = {}) {
+  const provider = resolveMongoProvisioner(options);
+  if (provider === "digitalocean") {
+    return provisionDigitalOceanMongo(options, deps);
+  }
+  const result = await provisionNativeMongo(options);
+  await waitForMongoUri(result.mongoUri, {
+    validate: deps.validateMongoUri || validateMongoUri,
+    attempts: deps.validationAttempts,
+    delayMs: deps.validationDelayMs,
+  });
+  return result;
+}
+
+module.exports = {
+  DIGITALOCEAN_API,
+  DIGITALOCEAN_HOST_SUFFIX,
+  mongoIdentity,
+  mongoHost,
+  resolveMongoProvisioner,
+  buildRuntimeMongoUri,
+  validateMongoUri,
+  waitForMongoUri,
+  provisionNativeMongo,
+  digitalOceanRequest,
+  ensureDigitalOceanDatabase,
+  digitalOceanUserSettings,
+  provisionDigitalOceanUser,
+  provisionDigitalOceanMongo,
+  provisionMongo,
+};

package/src/delivery/runtime.js

@@ -1,10 +1,10 @@
 "use strict";
 
 const crypto = require("node:crypto");
-const { mongo } = require("mongoose");
 const { spawnSync } = require("node:child_process");
 const { kubectl } = require("./command");
 const { validateInfraFromCluster } = require("../deploy/contracts/infra-contract");
+const { provisionMongo, validateMongoUri } = require("./mongoProvisioning");
 
 const RESOURCE_PROFILES = {
   nano: { cpuRequest: "50m", cpuLimit: "250m", memoryRequest: "96Mi", memoryLimit: "256Mi" },
@@ -28,28 +28,6 @@ function readSecret(namespace, name, key) {
   } catch { return null; }
 }
 
-async function provisionMongo({ adminUri, appCode, environment }) {
-  const dbName = dnsLabel(`${appCode}_${environment}`, 48).replace(/-/g, "_");
-  const username = dnsLabel(`${appCode}-${environment}`, 48);
-  const password = randomSecret(30);
-  const client = new mongo.MongoClient(adminUri, { serverSelectionTimeoutMS: 15000 });
-  await client.connect();
-  try {
-    const db = client.db(dbName);
-    try { await db.command({ createUser: username, pwd: password, roles: [{ role: "readWrite", db: dbName }] }); }
-    catch (error) {
-      if (error.codeName !== "DuplicateKey" && error.code !== 51003 && !/already exists/i.test(error.message)) throw error;
-      await db.command({ updateUser: username, pwd: password, roles: [{ role: "readWrite", db: dbName }] });
-    }
-  } finally { await client.close(); }
-  const uri = new URL(adminUri);
-  uri.username = username;
-  uri.password = password;
-  uri.pathname = `/${dbName}`;
-  uri.searchParams.set("authSource", dbName);
-  return { dbName, mongoUri: uri.toString() };
-}
-
 function baselineManifest({ context }) {
   return `apiVersion: v1
 kind: Namespace
@@ -189,18 +167,71 @@ function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {
 async function provisionRuntime({ context, extraSecrets = {} }) {
   const infra = validateInfraFromCluster().config;
   applyYaml(baselineManifest({ context, infra }));
+
+  const platformNamespace = infra.PLATFORM_NAMESPACE || "oon-system";
+  const adminSecretName = infra.MONGO_ADMIN_SECRET_NAME || "oon-mongo-admin";
+  const adminUri = readSecret(
+    platformNamespace,
+    adminSecretName,
+    "MONGO_ADMIN_URI",
+  );
+  if (!adminUri) {
+    throw new Error("MongoDB administrativo não configurado na plataforma.");
+  }
+
+  const mongoProvisioner =
+    readSecret(platformNamespace, adminSecretName, "MONGO_PROVISIONER") ||
+    "auto";
+  const digitalOceanToken = readSecret(
+    platformNamespace,
+    adminSecretName,
+    "DIGITALOCEAN_TOKEN",
+  );
+  const digitalOceanClusterId = readSecret(
+    platformNamespace,
+    adminSecretName,
+    "DIGITALOCEAN_DATABASE_CLUSTER_ID",
+  );
+
   let mongoUri = readSecret(context.namespace, "oon-runtime", "MONGO_URI");
   let databaseName = "";
+  let credentialRotated = false;
+
+  if (mongoUri) {
+    try {
+      await validateMongoUri(mongoUri);
+    } catch (error) {
+      console.warn(
+        "A credencial MongoDB persistida não passou na validação; " +
+          "ela será reprovisionada.",
+      );
+      mongoUri = null;
+      credentialRotated = true;
+    }
+  }
+
   if (!mongoUri) {
-    const adminUri = readSecret(infra.PLATFORM_NAMESPACE || "oon-system", infra.MONGO_ADMIN_SECRET_NAME || "oon-mongo-admin", "MONGO_ADMIN_URI");
-    if (!adminUri) throw new Error("MongoDB administrativo não configurado na plataforma.");
-    const provisioned = await provisionMongo({ adminUri, appCode: context.appCode, environment: context.environment });
+    const provisioned = await provisionMongo({
+      adminUri,
+      appCode: context.appCode,
+      environment: context.environment,
+      provisioner: mongoProvisioner,
+      digitalOceanToken,
+      digitalOceanClusterId,
+    });
     mongoUri = provisioned.mongoUri;
     databaseName = provisioned.dbName;
+    credentialRotated = true;
   }
-  const encryptionKey = readSecret(context.namespace, "oon-runtime", "INSTANCE_CREDENTIAL_ENCRYPTION_KEY") || randomSecret(48);
+
+  const encryptionKey =
+    readSecret(
+      context.namespace,
+      "oon-runtime",
+      "INSTANCE_CREDENTIAL_ENCRYPTION_KEY",
+    ) || randomSecret(48);
   applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets });
-  return { infra, databaseName };
+  return { infra, databaseName, credentialRotated };
 }
 
 function deployRuntime({ context, infra, imageDigest, resourceProfile = "small" }) {
@@ -249,4 +280,4 @@ async function activateMember(context) {
   return data;
 }
 
-module.exports = { RESOURCE_PROFILES, randomSecret, dnsLabel, provisionMongo, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };
+module.exports = { RESOURCE_PROFILES, randomSecret, dnsLabel, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };