@oondemand/oon-core-back 0.6.12 → 0.7.0

package/bin/delivery.js

@@ -5,7 +5,6 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { getContextWithPhase, setState, addEvidence } = require("../src/delivery/api");
 const { provisionRuntime, deployRuntime, waitHttp, activateMember } = require("../src/delivery/runtime");
-const { canonicalizeDeliveryContext } = require("../src/delivery/technicalIdentity");
 
 function flag(name, fallback) {
   const args = process.argv.slice(3);
@@ -17,7 +16,6 @@ function flag(name, fallback) {
 }
 function required(value, name) { if (!value) throw new Error(`${name} obrigatório.`); return value; }
 function secret() { return required(process.env.OON_DELIVERY_SHARED_SECRET, "OON_DELIVERY_SHARED_SECRET"); }
-function normalizedContext(value) { return { ...canonicalizeDeliveryContext(value) }; }
 
 async function main() {
   const command = process.argv[2];
@@ -27,8 +25,7 @@ async function main() {
   if (command === "context") {
     const phase = flag("--phase", "build");
     const output = required(flag("--output"), "--output");
-    const fetched = await getContextWithPhase({ apiUrl: required(apiUrl, "--api"), releaseId: required(releaseId, "--release"), token: secret(), phase });
-    const context = normalizedContext(fetched);
+    const context = await getContextWithPhase({ apiUrl: required(apiUrl, "--api"), releaseId: required(releaseId, "--release"), token: secret(), phase });
     fs.writeFileSync(path.resolve(output), JSON.stringify(context, null, 2), { mode: 0o600 });
     return;
   }
@@ -43,7 +40,7 @@ async function main() {
   if (command === "deploy") {
     const contextFile = required(flag("--context"), "--context");
     const imageDigest = required(flag("--image-digest"), "--image-digest");
-    const context = normalizedContext(JSON.parse(fs.readFileSync(path.resolve(contextFile), "utf8")));
+    const context = JSON.parse(fs.readFileSync(path.resolve(contextFile), "utf8"));
     let failureState = "falha_infra";
     try {
       await setState({ apiUrl, releaseId, token: secret(), etapa: "provisionando", imageDigest });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.6.12",
+  "version": "0.7.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/auth.routes.js

@@ -4,7 +4,7 @@ const auth = require("../core/middlewares/auth");
 const ctx = require("../core/context");
 const GenericError = require("../core/errors/GenericError");
 const { asyncHandler, sendResponse } = require("../core/utils/helpers");
-const { ensureInstance, operationalRequestHeaders } = require("../core/utils/instanceActivation");
+const { ensureInstance, operationalRequestHeaders, authenticationRequestHeaders } = require("../core/utils/instanceActivation");
 const { findAccessForUser, audit } = require("../core/rbac/storage");
 const { changeFirstAccessPassword } = require("../core/rbac/identityProvider");
 const { isLocalRuntime } = require("../core/runtime/localDevelopment");
@@ -76,6 +76,7 @@ function tenantForLogin(req, instance) {
     // único tenant elegível ou devolve as opções disponíveis.
     return req.headers[TENANT_HEADER];
   }
+  if (instance.deploymentId) return req.headers[TENANT_HEADER];
   return instance.tenantId;
 }
 
@@ -102,6 +103,7 @@ router.post(
     const appCode = getAppCode();
     const tenantId = tenantForLogin(req, instance);
     try {
+      const runtimeHeaders = await authenticationRequestHeaders({ correlationId: req.headers["x-correlation-id"] }, { ensureInstance: async () => instance });
       const response = await axios.post(
         `${baseUrl}${LOGIN_PATH}`,
         {}, // codigoApp: appCode é enviado no header x-app-code.
@@ -109,6 +111,7 @@ router.post(
           timeout: getTimeout(),
           maxRedirects: 0,
           headers: {
+            ...runtimeHeaders,
             Authorization: authorization,
             "Content-Type": "application/json",
             "x-app-code": appCode,
@@ -240,3 +243,4 @@ router.post(
 );
 
 module.exports = router;
+

package/src/core/middlewares/auth.js

@@ -1,3 +1,5 @@
+const { roleByCode, rolePermissions } = require("../rbac/policy");
+const { authenticationRequestHeaders } = require("../utils/instanceActivation");
 const axios = require("axios");
 const Helpers = require("../utils/helpers");
 const ctx = require("../context");
@@ -31,10 +33,12 @@ async function defaultVerifyToken(token, { req } = {}) {
 
   let response;
   try {
+    const runtimeHeaders = await authenticationRequestHeaders({ correlationId: req?.headers?.["x-correlation-id"] });
     response = await axios.get(`${baseUrl}${PERMISSION_PATH}`, {
       timeout: getTimeout(),
       maxRedirects: 0,
       headers: {
+        ...runtimeHeaders,
         Authorization: `Bearer ${token}`,
         "x-app-code": appCode,
         ...(requestedTenantId ? { [TENANT_HEADER]: requestedTenantId } : {}),
@@ -119,6 +123,20 @@ async function applyEffectiveAccess(usuario) {
       rbacMode: "local-development",
     };
   }
+  if (usuario?.commercialAccess) {
+    const authority = usuario.commercialAccess;
+    const role = roleByCode(authority.roleCode);
+    const cap = authority.functionalPermissions;
+    if (!authority.appLicenseId || !authority.grantId || !role || !Array.isArray(cap)
+      || cap.some(p => typeof p !== "string" || p === "*" || /^(tenant|publications|homologation|production|apps|users|roles)\./.test(p))) {
+      throw Object.assign(Error("Autoridade comercial inválida."), { statusCode: 403, code: "APP_COMMERCIAL_AUTHORITY_INVALID" });
+    }
+    const local = rolePermissions(role);
+    const permissions = [...new Set(cap)].filter(p => local.includes("*") || local.includes(p));
+    return { ...usuario, roleCode: role.code, permissions, accessStatus: "active", mustChangePassword: false,
+      rbacMode: "app-commercial", commercialAccess: { ...authority,
+        roleComplete: !local.includes("*") && local.every(p => permissions.includes(p)) } };
+  }
   const access = await resolveUserAccess(usuario);
   return {
     ...usuario,
@@ -193,3 +211,4 @@ module.exports.localDevelopmentVerifyToken = localDevelopmentVerifyToken;
 module.exports.resolveVerifyToken = resolveVerifyToken;
 module.exports.applyEffectiveAccess = applyEffectiveAccess;
 module.exports.isFirstAccessRoute = isFirstAccessRoute;
+

package/src/core/middlewares/rbac.js

@@ -22,15 +22,20 @@ function normalize(value) {
 }
 
 function effectiveRoles(usuario) {
-  const raw = [usuario?.roleCode, usuario?.tipo, usuario?.perfil]
+  const raw = (usuario?.commercialAccess ? [usuario.roleCode] : [usuario?.roleCode, usuario?.tipo, usuario?.perfil])
     .map(normalize)
     .filter(Boolean);
+  if (usuario?.commercialAccess) return [...new Set(raw)];
   return [...new Set(raw.flatMap((role) => ROLE_ALIASES[role] || [role]))];
 }
 
 function rbac(roles = []) {
   return (req, res, next) => {
     if (!roles.length) return next();
+    if (req.usuario?.commercialAccess && !req.usuario.commercialAccess.roleComplete) {
+      return Helpers.sendErrorResponse({ res, statusCode: 403,
+        code: "APP_COMMERCIAL_PERMISSION_REQUIRED", message: "Esta operação exige permissão explícita." });
+    }
     const allowed = roles.map(normalize);
     const current = effectiveRoles(req.usuario);
 

package/src/core/utils/instanceActivation.js

@@ -517,6 +517,24 @@ async function operationalRequestHeaders(options = {}, dependencies = {}) {
   return headers;
 }
 
+// Authentication carries runtime identity, never an implicit functional tenant.
+// The Central decides whether a selected tenant may use this deployment.
+async function authenticationRequestHeaders(options = {}, dependencies = {}) {
+  try {
+    const instance = await (dependencies.ensureInstance || ensureInstance)();
+    if (!operationalIdentity(instance)) return {};
+    const headers = await operationalRequestHeaders(options, { ...dependencies, ensureInstance: async () => instance });
+    delete headers["x-oon-tenant-id"];
+    return headers;
+  } catch (error) {
+    if (error.statusCode) throw error;
+    throw new GenericError("Não foi possível carregar a credencial operacional do runtime.", {
+      statusCode: 503,
+      code: "OPERATIONAL_CREDENTIAL_UNAVAILABLE",
+    });
+  }
+}
+
 function validateUrl(value) {
   const url = new URL(value);
   if (!["http:", "https:"].includes(url.protocol)) throw new Error();
@@ -616,8 +634,10 @@ module.exports = {
   instanceHeaders,
   operationalIdentity,
   operationalRequestHeaders,
+  authenticationRequestHeaders,
   validateParams,
   providerPost,
   providerPayload,
   event,
 };
+

package/src/delivery/mongoProvisioning.js

@@ -1,11 +1,11 @@
 "use strict";
 
-const defaultMongoClient = () => require("mongoose").mongo.MongoClient;
-const { technicalIdentity } = require("../core/technicalIdentity");
+const { mongo } = require("mongoose");
 
 const DIGITALOCEAN_API = "https://api.digitalocean.com/v2";
 const DIGITALOCEAN_HOST_SUFFIX = ".mongo.ondigitalocean.com";
 const DIGITALOCEAN_RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+const DIGITALOCEAN_SERVER_STATUS = new Set([500, 502, 503, 504]);
 
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -24,76 +24,53 @@ function dnsLabel(value, max = 63) {
     .replace(/-+$/, "");
 }
 
-function mongoIdentity(appCode, environment, { instanceUid } = {}) {
-  if (instanceUid != null) {
-    const identity = technicalIdentity({ appCode, instanceUid, environment });
-    return {
-      mode: "canonical",
-      identityVersion: identity.version,
-      instanceUid: identity.instanceUid,
-      dbName: identity.database,
-      username: identity.mongoUsername,
-    };
-  }
+function mongoIdentity(appCode, environment) {
   return {
-    mode: "legacy",
     dbName: dnsLabel(`${appCode}_${environment}`, 48).replace(/-/g, "_"),
     username: dnsLabel(`${appCode}-${environment}`, 48),
   };
 }
 
-function recoveryRequired(code = "MONGO_RECOVERY_REQUIRED") {
-  const error = new Error(`${code}: recuperação explícita necessária; credenciais preservadas.`);
-  error.code = code;
-  return error;
-}
-
-// WHATWG URL rejects MongoDB seed lists with multiple host:port pairs.
-function parseMongoUri(uri) {
-  const match = typeof uri === "string" && uri.match(/^(mongodb(?:\+srv)?):\/\/([^/?#]+)(?:\/([^?#]*))?(?:\?([^#]*))?$/);
-  if (!match) throw recoveryRequired("MONGO_URI_INVALID");
-  const [, scheme, authority, database = "", query = ""] = match;
-  const at = authority.lastIndexOf("@");
-  const credentials = at < 0 ? "" : authority.slice(0, at);
-  const hosts = authority.slice(at + 1);
-  if (!hosts) throw recoveryRequired("MONGO_URI_INVALID");
-  try {
-    return { scheme, hosts, database: decodeURIComponent(database),
-      username: decodeURIComponent(credentials.split(":")[0]), query: new URLSearchParams(query) };
-  } catch { throw recoveryRequired("MONGO_URI_INVALID"); }
-}
-
 function mongoHost(uri) {
-  const parsed = parseMongoUri(uri);
-  return parsed.hosts.split(",")[0].replace(/:\d+$/, "").toLowerCase();
+  try {
+    return new URL(uri).hostname.toLowerCase();
+  } catch {
+    throw new Error("MONGO_ADMIN_URI inválida.");
+  }
 }
 
 function resolveMongoProvisioner({ adminUri, provisioner = "auto" }) {
   const normalized = String(provisioner || "auto").trim().toLowerCase();
   if (!["auto", "native", "digitalocean"].includes(normalized)) {
-    throw recoveryRequired("MONGO_PROVISIONER_INVALID");
+    throw new Error(
+      `MONGO_PROVISIONER inválido: ${normalized}. Use auto, native ou digitalocean.`,
+    );
   }
   if (normalized !== "auto") return normalized;
-  return mongoHost(adminUri).endsWith(DIGITALOCEAN_HOST_SUFFIX) ? "digitalocean" : "native";
+  return mongoHost(adminUri).endsWith(DIGITALOCEAN_HOST_SUFFIX)
+    ? "digitalocean"
+    : "native";
 }
 
-function buildRuntimeMongoUri({ adminUri, username, password, dbName, authSource }) {
-  const parsed = parseMongoUri(adminUri);
-  parsed.query.set("authSource", authSource);
-  return `${parsed.scheme}://${encodeURIComponent(username)}:${encodeURIComponent(password)}@${parsed.hosts}/${encodeURIComponent(dbName)}?${parsed.query}`;
-}
-
-function assertMongoIdentity(uri, identity) {
-  const parsed = parseMongoUri(uri);
-  if (parsed.username !== identity.username || parsed.database !== identity.dbName) {
-    throw recoveryRequired("MONGO_IDENTITY_MISMATCH");
-  }
+function buildRuntimeMongoUri({
+  adminUri,
+  username,
+  password,
+  dbName,
+  authSource,
+}) {
+  const uri = new URL(adminUri);
+  uri.username = username;
+  uri.password = password;
+  uri.pathname = `/${dbName}`;
+  uri.searchParams.set("authSource", authSource);
+  return uri.toString();
 }
 
 async function validateMongoUri(
   mongoUri,
   {
-    MongoClient = defaultMongoClient(),
+    MongoClient = mongo.MongoClient,
     timeoutMs = 15000,
     writeProbe = true,
   } = {},
@@ -104,16 +81,9 @@ async function validateMongoUri(
     maxPoolSize: 2,
   });
 
+  await client.connect();
   try {
-    await client.connect();
     const db = client.db();
-    const target = parseMongoUri(mongoUri);
-    const status = await db.command({ connectionStatus: 1 });
-    const roles = status?.authInfo?.authenticatedUserRoles;
-    if (!target.database || !Array.isArray(roles) || !roles.length ||
-        roles.some(role => role.role !== "readWrite" || role.db !== target.database)) {
-      throw recoveryRequired("MONGO_RUNTIME_SCOPE_UNSAFE");
-    }
     await db.command({ ping: 1 });
     if (writeProbe) {
       const probe = db.collection("__oon_runtime_probe");
@@ -151,7 +121,7 @@ async function waitForMongoUri(
       }
     }
   }
-  const reason = [13, 18].includes(lastError?.code) ? lastError.code : undefined;
+  const reason = lastError?.codeName || lastError?.code || lastError?.name;
   throw new Error(
     `A credencial derivada do MongoDB não passou no teste de leitura e escrita${
       reason ? ` (${reason})` : ""
@@ -159,23 +129,15 @@ async function waitForMongoUri(
   );
 }
 
-async function provisionNativeMongo({ adminUri, appCode, environment, instanceUid }, deps = {}) {
-  const identity = mongoIdentity(appCode, environment, { instanceUid });
-  const { dbName, username } = identity;
+async function provisionNativeMongo({ adminUri, appCode, environment }) {
+  const { dbName, username } = mongoIdentity(appCode, environment);
   const password = randomSecret(30);
-  const MongoClient = deps.MongoClient || defaultMongoClient();
-  const client = new MongoClient(adminUri, {
-    serverSelectionTimeoutMS: 15000, connectTimeoutMS: 15000, maxPoolSize: 2,
+  const client = new mongo.MongoClient(adminUri, {
+    serverSelectionTimeoutMS: 15000,
   });
+  await client.connect();
   try {
-    await client.connect();
     const db = client.db(dbName);
-    const existing = await db.command({ usersInfo: username });
-    if (!Array.isArray(existing.users) || existing.users.length) throw recoveryRequired();
-    const mongoUri = buildRuntimeMongoUri({ adminUri, username, password, dbName, authSource: dbName });
-    if (typeof deps.persistCredential !== "function") throw recoveryRequired("MONGO_CREDENTIAL_PERSISTENCE_REQUIRED");
-    // Capture before createUser: loss of its response never requires password rotation.
-    await deps.persistCredential(mongoUri);
     try {
       await db.command({
         createUser: username,
@@ -188,7 +150,11 @@ async function provisionNativeMongo({ adminUri, appCode, environment, instanceUi
         error.code === 51003 ||
         /already exists/i.test(error.message);
       if (!alreadyExists) throw error;
-      throw recoveryRequired();
+      await db.command({
+        updateUser: username,
+        pwd: password,
+        roles: [{ role: "readWrite", db: dbName }],
+      });
     }
   } finally {
     await client.close();
@@ -197,9 +163,6 @@ async function provisionNativeMongo({ adminUri, appCode, environment, instanceUi
   return {
     dbName,
     username,
-    ...(identity.mode === "canonical"
-      ? { instanceUid: identity.instanceUid, technicalIdentityVersion: identity.identityVersion }
-      : {}),
     mongoUri: buildRuntimeMongoUri({
       adminUri,
       username,
@@ -228,7 +191,7 @@ async function digitalOceanRequest(
   } = {},
 ) {
   if (!fetchImpl) throw new Error("fetch não disponível para a DigitalOcean API.");
-  const attempts = method === "GET" ? Math.max(1, Number(retryAttempts) || 3) : 1;
+  const attempts = Math.max(1, Number(retryAttempts) || 3);
 
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     const controller = new AbortController();
@@ -246,7 +209,6 @@ async function digitalOceanRequest(
           },
           body: body ? JSON.stringify(body) : undefined,
           signal: controller.signal,
-          redirect: "error",
         },
       );
     } catch (error) {
@@ -257,7 +219,7 @@ async function digitalOceanRequest(
       if (error.name === "AbortError") {
         throw new Error("Timeout ao acessar a DigitalOcean API.");
       }
-      throw recoveryRequired("MONGO_PROVIDER_REQUEST_FAILED");
+      throw new Error(`Falha ao acessar a DigitalOcean API: ${error.message}`);
     } finally {
       clearTimeout(timeout);
     }
@@ -279,8 +241,20 @@ async function digitalOceanRequest(
       continue;
     }
 
-    const error = recoveryRequired(`MONGO_PROVIDER_HTTP_${response.status}`);
+    const providerMessage = String(payload.message || payload.id || "erro")
+      .replace(/[\r\n]+/g, " ")
+      .slice(0, 300);
+    const providerRequestId = String(payload.request_id || "")
+      .replace(/[^A-Za-z0-9_.:-]/g, "")
+      .slice(0, 120);
+    const error = new Error(
+      `DigitalOcean API rejeitou ${method} ${path}: HTTP ${response.status} (${providerMessage})`
+      + (providerRequestId ? ` [requestId: ${providerRequestId}]` : "")
+      + ".",
+    );
     error.status = response.status;
+    error.payload = payload;
+    error.providerRequestId = providerRequestId || undefined;
     throw error;
   }
 
@@ -299,14 +273,19 @@ async function ensureDigitalOceanDatabase(options, deps) {
   } catch (error) {
     if (error.status === 404) {
       exists = false;
+    } else if (DIGITALOCEAN_SERVER_STATUS.has(error.status)) {
+      const listed = await digitalOceanRequest(
+        { ...options, path: "/dbs", expected: [200] },
+        deps,
+      );
+      exists = Array.isArray(listed.payload.dbs)
+        && listed.payload.dbs.some((item) => item?.name === options.dbName);
     } else {
       throw error;
     }
   }
   if (exists) return;
 
-  // Refuse a pre-existing/ambiguous user before creating any database resource.
-  await assertDigitalOceanUserAbsent(options, deps);
   await digitalOceanRequest(
     {
       ...options,
@@ -328,35 +307,70 @@ function digitalOceanUserSettings(dbName) {
   };
 }
 
-async function assertDigitalOceanUserAbsent(options, deps) {
+async function provisionDigitalOceanUser(options, deps) {
+  const userPath = `/users/${encodeURIComponent(options.username)}`;
+  let exists = false;
   try {
     await digitalOceanRequest(
-      { ...options, path: `/users/${encodeURIComponent(options.username)}`, expected: [200] },
+      { ...options, path: userPath, expected: [200] },
       deps,
     );
+    exists = true;
   } catch (error) {
-    if (error.status === 404) return;
-    throw error;
+    if (error.status === 404) {
+      exists = false;
+    } else if (DIGITALOCEAN_SERVER_STATUS.has(error.status)) {
+      const listed = await digitalOceanRequest(
+        { ...options, path: "/users", expected: [200] },
+        deps,
+      );
+      exists = Array.isArray(listed.payload.users)
+        && listed.payload.users.some(
+          (item) => item?.name === options.username,
+        );
+    } else {
+      throw error;
+    }
   }
-  throw recoveryRequired();
-}
 
-async function provisionDigitalOceanUser(options, deps) {
-  // Recheck after database creation: another publisher may have created the user.
-  await assertDigitalOceanUserAbsent(options, deps);
-  const result = await digitalOceanRequest(
-    {
-      ...options,
-      path: "/users",
-      method: "POST",
-      body: { name: options.username, settings: digitalOceanUserSettings(options.dbName) },
-      expected: [201, 202],
-    },
-    deps,
-  );
+  const settings = digitalOceanUserSettings(options.dbName);
+  let result;
+  if (!exists) {
+    result = await digitalOceanRequest(
+      {
+        ...options,
+        path: "/users",
+        method: "POST",
+        body: { name: options.username, settings },
+        expected: [201, 202],
+      },
+      deps,
+    );
+  } else {
+    await digitalOceanRequest(
+      {
+        ...options,
+        path: userPath,
+        method: "PUT",
+        body: { settings },
+        expected: [200, 202],
+      },
+      deps,
+    );
+    result = await digitalOceanRequest(
+      {
+        ...options,
+        path: `${userPath}/reset_auth`,
+        method: "POST",
+        body: {},
+        expected: [200, 201, 202],
+      },
+      deps,
+    );
+  }
 
   const user = result.payload.user;
-  if (user?.name !== options.username || typeof user?.password !== "string" || !user.password) {
+  if (!user?.password) {
     throw new Error(
       "DigitalOcean API não retornou a senha do usuário. O token precisa do escopo database:view_credentials.",
     );
@@ -369,7 +383,6 @@ async function provisionDigitalOceanMongo(
     adminUri,
     appCode,
     environment,
-    instanceUid,
     digitalOceanToken,
     digitalOceanClusterId,
   },
@@ -386,28 +399,23 @@ async function provisionDigitalOceanMongo(
     );
   }
 
-  const identity = mongoIdentity(appCode, environment, { instanceUid });
-  const { dbName, username } = identity;
+  const { dbName, username } = mongoIdentity(appCode, environment);
   const apiOptions = {
     token: digitalOceanToken,
     clusterId: digitalOceanClusterId,
     dbName,
     username,
   };
-  if (typeof deps.persistCredential !== "function") throw recoveryRequired("MONGO_CREDENTIAL_PERSISTENCE_REQUIRED");
-  // Validate URI construction before any provider mutation.
-  buildRuntimeMongoUri({ adminUri, username, password: "preflight", dbName, authSource: "admin" });
   await ensureDigitalOceanDatabase(apiOptions, deps);
   const user = await provisionDigitalOceanUser(apiOptions, deps);
   const mongoUri = buildRuntimeMongoUri({
     adminUri,
-    username,
+    username: user.name || username,
     password: user.password,
     dbName,
     authSource: "admin",
   });
 
-  await deps.persistCredential(mongoUri);
   await waitForMongoUri(mongoUri, {
     validate: deps.validateMongoUri || validateMongoUri,
     attempts: deps.validationAttempts,
@@ -416,10 +424,7 @@ async function provisionDigitalOceanMongo(
 
   return {
     dbName,
-    username,
-    ...(identity.mode === "canonical"
-      ? { instanceUid: identity.instanceUid, technicalIdentityVersion: identity.identityVersion }
-      : {}),
+    username: user.name || username,
     mongoUri,
     provider: "digitalocean",
   };
@@ -430,7 +435,7 @@ async function provisionMongo(options, deps = {}) {
   if (provider === "digitalocean") {
     return provisionDigitalOceanMongo(options, deps);
   }
-  const result = await provisionNativeMongo(options, deps);
+  const result = await provisionNativeMongo(options);
   await waitForMongoUri(result.mongoUri, {
     validate: deps.validateMongoUri || validateMongoUri,
     attempts: deps.validationAttempts,
@@ -440,10 +445,10 @@ async function provisionMongo(options, deps = {}) {
 }
 
 module.exports = {
-  recoveryRequired, parseMongoUri, assertMongoIdentity,
   DIGITALOCEAN_API,
   DIGITALOCEAN_HOST_SUFFIX,
   DIGITALOCEAN_RETRYABLE_STATUS,
+  DIGITALOCEAN_SERVER_STATUS,
   mongoIdentity,
   mongoHost,
   resolveMongoProvisioner,