@oondemand/oon-core-back 0.6.13 → 0.7.1

package/src/delivery/runtime.js

@@ -4,9 +4,7 @@ const crypto = require("node:crypto");
 const { spawnSync } = require("node:child_process");
 const { kubectl } = require("./command");
 const { validateInfraFromCluster } = require("../deploy/contracts/infra-contract");
-const { resolveMongoCredential } = require("./mongoCredentialLifecycle");
-const { provisionMongo, validateMongoUri, mongoIdentity, recoveryRequired } = require("./mongoProvisioning");
-const { canonicalizeDeliveryContext } = require("./technicalIdentity");
+const { provisionMongo, validateMongoUri } = require("./mongoProvisioning");
 
 const RESOURCE_PROFILES = {
   nano: { cpuRequest: "50m", cpuLimit: "250m", memoryRequest: "96Mi", memoryLimit: "256Mi" },
@@ -33,45 +31,29 @@ function applyYaml(yaml) {
 }
 function readSecret(namespace, name, key) {
   try {
-    const value = kubectl(["-n", namespace, "get", "secret", name, "--ignore-not-found", "-o", `jsonpath={.data.${key}}`], { capture: true });
+    const value = kubectl(["-n", namespace, "get", "secret", name, "-o", `jsonpath={.data.${key}}`], { capture: true });
     return value ? Buffer.from(value, "base64").toString("utf8") : null;
-  } catch { throw recoveryRequired("MONGO_SECRET_READ_FAILED"); }
-}
-
-function canonicalRuntimeContext(context) {
-  return canonicalizeDeliveryContext(context);
-}
-
-function identityLabels(identity) {
-  if (identity.mode !== "canonical") return "";
-  return `\n    oon.runtime/instance-uid: ${identity.instanceUid}\n    oon.runtime/identity-version: \"${identity.version}\"`;
-}
-
-function podIdentityLabels(identity) {
-  if (identity.mode !== "canonical") return "";
-  return `\n        oon.runtime/instance-uid: ${identity.instanceUid}\n        oon.runtime/identity-version: \"${identity.version}\"`;
+  } catch { return null; }
 }
 
 function baselineManifest({ context }) {
-  const normalized = canonicalRuntimeContext(context);
-  const identity = normalized.deliveryTechnicalIdentity;
   return `apiVersion: v1
 kind: Namespace
 metadata:
-  name: ${normalized.namespace}
+  name: ${context.namespace}
   labels:
-    oon.dev/app-code: ${normalized.appCode}
-    oon.dev/environment: ${normalized.environment}
-    app.kubernetes.io/managed-by: oon-platform${identityLabels(identity)}
+    oon.dev/app-code: ${context.appCode}
+    oon.dev/environment: ${context.environment}
+    app.kubernetes.io/managed-by: oon-platform
 ---
 apiVersion: v1
 kind: ServiceAccount
-metadata: { name: ${identity.serviceAccount}, namespace: ${normalized.namespace} }
+metadata: { name: oon-runtime, namespace: ${context.namespace} }
 automountServiceAccountToken: false
 ---
 apiVersion: v1
 kind: LimitRange
-metadata: { name: oon-runtime-defaults, namespace: ${normalized.namespace} }
+metadata: { name: oon-runtime-defaults, namespace: ${context.namespace} }
 spec:
   limits:
     - type: Container
@@ -80,13 +62,13 @@ spec:
 ---
 apiVersion: v1
 kind: ResourceQuota
-metadata: { name: oon-runtime-quota, namespace: ${normalized.namespace} }
+metadata: { name: oon-runtime-quota, namespace: ${context.namespace} }
 spec:
   hard: { requests.cpu: "2", requests.memory: 2Gi, limits.cpu: "4", limits.memory: 4Gi, pods: "20", services: "10" }
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
-metadata: { name: oon-runtime-baseline, namespace: ${normalized.namespace} }
+metadata: { name: oon-runtime-baseline, namespace: ${context.namespace} }
 spec:
   podSelector: {}
   policyTypes: [Ingress, Egress]
@@ -100,37 +82,35 @@ spec:
 }
 
 function runtimeManifest({ context, infra, imageRef, profile = "small" }) {
-  const normalized = canonicalRuntimeContext(context);
-  const identity = normalized.deliveryTechnicalIdentity;
   const resources = RESOURCE_PROFILES[profile] || RESOURCE_PROFILES.small;
-  const releaseLabel = kubernetesLabelValue(normalized.releaseId);
-  const releaseAnnotation = JSON.stringify(String(normalized.releaseId));
+  const releaseLabel = kubernetesLabelValue(context.releaseId);
+  const releaseAnnotation = JSON.stringify(String(context.releaseId));
   return `apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: ${normalized.appCode}
-  namespace: ${normalized.namespace}
+  name: ${context.appCode}
+  namespace: ${context.namespace}
 spec:
   replicas: 1
   selector:
-    matchLabels: { app.kubernetes.io/name: ${normalized.appCode} }
+    matchLabels: { app.kubernetes.io/name: ${context.appCode} }
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: ${normalized.appCode}
+        app.kubernetes.io/name: ${context.appCode}
         app.kubernetes.io/part-of: oon-central
-        oon.dev/release-id: ${releaseLabel}${podIdentityLabels(identity)}
+        oon.dev/release-id: ${releaseLabel}
       annotations:
         oon.dev/release-id: ${releaseAnnotation}
     spec:
-      serviceAccountName: ${identity.serviceAccount}
+      serviceAccountName: oon-runtime
       imagePullSecrets: [{ name: ${infra.REGISTRY_PULL_SECRET_NAME || "ghcr-oon"} }]
       containers:
         - name: central
           image: ${imageRef}
           imagePullPolicy: IfNotPresent
           ports: [{ name: http, containerPort: 8080 }]
-          envFrom: [{ secretRef: { name: ${identity.secret} } }]
+          envFrom: [{ secretRef: { name: oon-runtime } }]
           resources:
             requests: { cpu: ${resources.cpuRequest}, memory: ${resources.memoryRequest} }
             limits: { cpu: ${resources.cpuLimit}, memory: ${resources.memoryLimit} }
@@ -143,28 +123,28 @@ spec:
 ---
 apiVersion: v1
 kind: Service
-metadata: { name: ${normalized.appCode}, namespace: ${normalized.namespace} }
+metadata: { name: ${context.appCode}, namespace: ${context.namespace} }
 spec:
-  selector: { app.kubernetes.io/name: ${normalized.appCode} }
+  selector: { app.kubernetes.io/name: ${context.appCode} }
   ports: [{ name: http, port: 80, targetPort: http }]
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: ${normalized.appCode}
-  namespace: ${normalized.namespace}
+  name: ${context.appCode}
+  namespace: ${context.namespace}
   annotations: { cert-manager.io/cluster-issuer: ${infra.CLUSTER_ISSUER} }
 spec:
   ingressClassName: ${infra.INGRESS_CLASS}
-  tls: [{ hosts: [${normalized.hostname}], secretName: ${identity.tlsSecret} }]
+  tls: [{ hosts: [${context.hostname}], secretName: ${context.appCode}-tls }]
   rules:
-    - host: ${normalized.hostname}
+    - host: ${context.hostname}
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
-              service: { name: ${normalized.appCode}, port: { name: http } }
+              service: { name: ${context.appCode}, port: { name: http } }
 `;
 }
 
@@ -178,41 +158,27 @@ function copyPullSecret(namespace, infra) {
   } catch (error) { if (!/not found/i.test(error.message)) throw error; }
 }
 
-function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {}, record, writeRecord }) {
-  const normalized = canonicalRuntimeContext(context);
-  const identity = normalized.deliveryTechnicalIdentity;
+function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {} }) {
   const literals = {
-    ...extraSecrets,
     MONGO_URI: mongoUri,
     NODE_ENV: "production",
-    APP_ENVIRONMENT: normalized.environment,
-    APP_CODE: normalized.appCode,
-    PUBLIC_APP_URL: normalized.publicUrl,
-    CENTRAL_ATIVACAO_URL: normalized.activationApiUrl,
-    CENTRAL_ATIVACAO_API_URL: normalized.activationApiUrl,
+    APP_ENVIRONMENT: context.environment,
+    APP_CODE: context.appCode,
+    PUBLIC_APP_URL: context.publicUrl,
+    CENTRAL_ATIVACAO_URL: context.activationApiUrl,
+    CENTRAL_ATIVACAO_API_URL: context.activationApiUrl,
     INSTANCE_CREDENTIAL_ENCRYPTION_KEY: encryptionKey,
-    ...(identity.mode === "canonical"
-      ? {
-        OON_INSTANCE_UID: identity.instanceUid,
-        OON_TECHNICAL_IDENTITY_VERSION: String(identity.version),
-      }
-      : {}),
+    ...extraSecrets,
   };
-  writeRecord("replace", {
-    ...record,
-    metadata: { ...record.metadata, annotations: {
-      ...record.metadata.annotations, "oon.runtime/mongo-state": "ready",
-    } },
-    data: { ...record.data, ...Object.fromEntries(Object.entries(literals)
-      .map(([key, value]) => [key, Buffer.from(String(value)).toString("base64")])) },
-  });
+  const args = ["-n", context.namespace, "create", "secret", "generic", "oon-runtime"];
+  for (const [key, value] of Object.entries(literals)) args.push(`--from-literal=${key}=${value}`);
+  args.push("--dry-run=client", "-o", "yaml");
+  applyYaml(kubectl(args, { capture: true }));
 }
 
 async function provisionRuntime({ context, extraSecrets = {} }) {
-  const normalized = canonicalRuntimeContext(context);
-  const identity = normalized.deliveryTechnicalIdentity;
   const infra = validateInfraFromCluster().config;
-  applyYaml(baselineManifest({ context: normalized, infra }));
+  applyYaml(baselineManifest({ context, infra }));
 
   const platformNamespace = infra.PLATFORM_NAMESPACE || "oon-system";
   const adminSecretName = infra.MONGO_ADMIN_SECRET_NAME || "oon-mongo-admin";
@@ -239,77 +205,53 @@ async function provisionRuntime({ context, extraSecrets = {} }) {
     "DIGITALOCEAN_DATABASE_CLUSTER_ID",
   );
 
-  // Read errors are distinct from confirmed absence. Never provision on a failed GET.
-  let record;
-  try {
-    const raw = kubectl(["-n", normalized.namespace, "get", "secret", identity.secret,
-      "--ignore-not-found", "-o", "json"], { capture: true });
-    record = raw ? JSON.parse(raw) : null;
-  } catch { throw recoveryRequired("MONGO_SECRET_READ_FAILED"); }
-  const decode = (key) => record?.data?.[key]
-    ? Buffer.from(record.data[key], "base64").toString("utf8") : null;
-  const encryptionKey = record === null ? randomSecret(48) : decode("INSTANCE_CREDENTIAL_ENCRYPTION_KEY");
-  if (!encryptionKey) throw recoveryRequired("MONGO_ENCRYPTION_KEY_MISSING");
-  const writeRecord = (operation, value) => {
-    // Secrets travel through stdin and captured output, never inherited stderr/argv.
-    const result = spawnSync("kubectl", [operation, "-f", "-", "-o", "json"], {
-      input: JSON.stringify(value), encoding: "utf8", stdio: ["pipe", "pipe", "pipe"],
+  let mongoUri = readSecret(context.namespace, "oon-runtime", "MONGO_URI");
+  let databaseName = "";
+  let credentialRotated = false;
+
+  if (mongoUri) {
+    try {
+      await validateMongoUri(mongoUri);
+    } catch (error) {
+      console.warn(
+        "A credencial MongoDB persistida não passou na validação; " +
+          "ela será reprovisionada.",
+      );
+      mongoUri = null;
+      credentialRotated = true;
+    }
+  }
+
+  if (!mongoUri) {
+    const provisioned = await provisionMongo({
+      adminUri,
+      appCode: context.appCode,
+      environment: context.environment,
+      provisioner: mongoProvisioner,
+      digitalOceanToken,
+      digitalOceanClusterId,
     });
-    if (result.status !== 0) throw recoveryRequired("MONGO_SECRET_WRITE_FAILED");
-    try { record = JSON.parse(result.stdout); }
-    catch { throw recoveryRequired("MONGO_SECRET_RESPONSE_INVALID"); }
-    if (!record?.metadata?.resourceVersion) throw recoveryRequired("MONGO_SECRET_RESPONSE_INVALID");
-  };
-  const mongo = await resolveMongoCredential({
-    identity: mongoIdentity(normalized.appCode, normalized.environment,
-      identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}),
-    read: async () => record === null ? null : { mongoUri: decode("MONGO_URI") },
-    begin: async () => writeRecord("create", {
-      apiVersion: "v1", kind: "Secret", type: "Opaque",
-      metadata: { name: identity.secret, namespace: normalized.namespace,
-        annotations: { "oon.runtime/mongo-state": "provisioning" } },
-      data: { INSTANCE_CREDENTIAL_ENCRYPTION_KEY: Buffer.from(encryptionKey).toString("base64") },
-    }),
-    persist: async (uri) => writeRecord("replace", {
-      ...record,
-      metadata: { ...record.metadata, annotations: {
-        ...record.metadata.annotations, "oon.runtime/mongo-state": "credential-captured",
-      } },
-      data: { ...record.data, MONGO_URI: Buffer.from(uri).toString("base64") },
-    }),
-    provision: (persistCredential) => provisionMongo({
-      adminUri, appCode: normalized.appCode, environment: normalized.environment,
-      ...(identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}),
-      provisioner: mongoProvisioner, digitalOceanToken, digitalOceanClusterId,
-    }, { persistCredential }),
-    validate: validateMongoUri,
-  });
-  const mongoUri = mongo.mongoUri;
-  const databaseName = mongoIdentity(normalized.appCode, normalized.environment,
-    identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}).dbName;
-  const credentialRotated = false;
-  applyRuntimeSecret({ context: normalized, mongoUri, encryptionKey, extraSecrets, record, writeRecord });
-  return {
-    infra,
-    databaseName,
-    credentialRotated,
-    ...(identity.mode === "canonical" ? { technicalIdentity: identity } : {}),
-  };
+    mongoUri = provisioned.mongoUri;
+    databaseName = provisioned.dbName;
+    credentialRotated = true;
+  }
+
+  const encryptionKey =
+    readSecret(
+      context.namespace,
+      "oon-runtime",
+      "INSTANCE_CREDENTIAL_ENCRYPTION_KEY",
+    ) || randomSecret(48);
+  applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets });
+  return { infra, databaseName, credentialRotated };
 }
 
 function deployRuntime({ context, infra, imageDigest, resourceProfile = "small" }) {
-  const normalized = canonicalRuntimeContext(context);
-  copyPullSecret(normalized.namespace, infra);
-  const imageRef = `${normalized.imageRepository}@${imageDigest}`;
-  applyYaml(runtimeManifest({ context: normalized, infra, imageRef, profile: resourceProfile }));
-  kubectl(["-n", normalized.namespace, "rollout", "status", `deployment/${normalized.appCode}`, "--timeout=10m"]);
-  return {
-    infraVersion: infra.INFRA_SCHEMA_VERSION,
-    imageRef,
-    ...(normalized.deliveryTechnicalIdentity.mode === "canonical"
-      ? { technicalIdentity: normalized.deliveryTechnicalIdentity }
-      : {}),
-  };
+  copyPullSecret(context.namespace, infra);
+  const imageRef = `${context.imageRepository}@${imageDigest}`;
+  applyYaml(runtimeManifest({ context, infra, imageRef, profile: resourceProfile }));
+  kubectl(["-n", context.namespace, "rollout", "status", `deployment/${context.appCode}`, "--timeout=10m"]);
+  return { infraVersion: infra.INFRA_SCHEMA_VERSION, imageRef };
 }
 
 async function waitHttp(url, { timeoutMs = 300000, expectedStatus = 200 } = {}) {
@@ -327,20 +269,19 @@ async function waitHttp(url, { timeoutMs = 300000, expectedStatus = 200 } = {})
 }
 
 async function activateMember(context) {
-  const normalized = canonicalRuntimeContext(context);
-  const statusResponse = await waitHttp(`${normalized.publicUrl}/api/ativacao/status`);
+  const statusResponse = await waitHttp(`${context.publicUrl}/api/ativacao/status`);
   const status = await statusResponse.json();
   if (status.status === "ativa") return { alreadyActive: true, instanceId: status.instanceId };
-  if (!normalized.activationCode) throw new Error("Instância não está ativa e não há código de ativação autorizado.");
-  const response = await fetch(`${normalized.publicUrl}/api/ativacao/concluir`, {
+  if (!context.activationCode) throw new Error("Instância não está ativa e não há código de ativação autorizado.");
+  const response = await fetch(`${context.publicUrl}/api/ativacao/concluir`, {
     method: "POST",
-    headers: { "Content-Type": "application/json", "Idempotency-Key": normalized.releaseId },
+    headers: { "Content-Type": "application/json", "Idempotency-Key": context.releaseId },
     body: JSON.stringify({
-      codigoAtivacao: normalized.activationCode,
-      nomeInstancia: `${normalized.appCode} dev`,
+      codigoAtivacao: context.activationCode,
+      nomeInstancia: `${context.appCode} dev`,
       parametrosGlobais: {
-        nomeInstancia: `${normalized.appCode} dev`, ambiente: normalized.environment,
-        urlPublica: normalized.publicUrl, emailAdministrativo: normalized.administrativeEmail,
+        nomeInstancia: `${context.appCode} dev`, ambiente: context.environment,
+        urlPublica: context.publicUrl, emailAdministrativo: context.administrativeEmail,
         idioma: "pt-BR", timezone: "America/Sao_Paulo", moeda: "BRL", pais: "BR", formatoData: "DD/MM/YYYY",
       },
       parametrosAplicacao: {},
@@ -351,20 +292,4 @@ async function activateMember(context) {
   return data;
 }
 
-module.exports = {
-  RESOURCE_PROFILES,
-  randomSecret,
-  dnsLabel,
-  kubernetesLabelValue,
-  canonicalRuntimeContext,
-  provisionMongo,
-  validateMongoUri,
-  baselineManifest,
-  runtimeManifest,
-  provisionRuntime,
-  deployRuntime,
-  // Explicit opt-in for a separately prepared target; never a provisioning fallback.
-  deployPreparedRuntime: require("./preparedRuntime").deployPreparedRuntime,
-  waitHttp,
-  activateMember,
-};
+module.exports = { RESOURCE_PROFILES, randomSecret, dnsLabel, kubernetesLabelValue, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };

package/src/index.js

@@ -10,7 +10,6 @@ const tenancy = require("./core/tenancy");
 const GenericError = require("./core/errors/GenericError");
 const { requirePermission } = require("./core/middlewares/permissions");
 const rbacPolicy = require("./core/rbac/policy");
-const technicalIdentity = require("./core/technicalIdentity");
 const capabilities = require("./capabilities");
 const { operationalRequestHeaders } = require("./core/utils/instanceActivation");
 const appManifest = require("./manifest/appManifest");
@@ -76,15 +75,10 @@ module.exports = {
   drainProcessJobs: processRuntime.drainProcessJobs,
   fields,
   capabilities,
-  technicalIdentity,
   operationalRequestHeaders,
-  licensing: {
-    assertBusinessOperation: require("./core/licensing").assertBusinessOperation,
-    verifyConsumerRequest: require("./core/licensing").verifyConsumerRequest,
-  },
   localDevelopment,
   localExecutionPolicy,
   PdfRenderingError: capabilities.PdfRenderingError,
   TransactionalEmailError: capabilities.TransactionalEmailError,
   GenericError, registry,
-};
+};

package/src/core/licensing.js

@@ -1,71 +0,0 @@
-"use strict";
-
-const axios = require("axios");
-const GenericError = require("./errors/GenericError");
-const { operationalRequestHeaders } = require("./utils/instanceActivation");
-const { getBaseUrl, getAppCode } = require("./utils/activationProvider");
-const { isLocalRuntime } = require("./runtime/localDevelopment");
-
-const BLOCKING_CODES = new Set(["APP_LICENSE_REQUIRED", "APP_LICENSE_NOT_STARTED", "APP_LICENSE_EXPIRED", "APP_LICENSE_SUSPENDED", "APP_LICENSE_CANCELLED", "APP_LICENSE_OVERDUE", "APP_LICENSE_INVALID", "LICENSE_REQUIRED", "LICENSE_INACTIVE", "LICENSE_EXPIRED", "LICENSE_NOT_STARTED", "APP_ENTITLEMENT_INACTIVE", "APP_ENTITLEMENT_REQUIRED", "APP_ENTITLEMENT_OUT_OF_TERM"]);
-const TIMEOUT_MS = 3000;
-
-function unavailable() {
-  return new GenericError("Não foi possível consultar a licença. A operação permanece pendente.", { statusCode: 503, code: "LICENSE_AUTHORITY_UNAVAILABLE" });
-}
-function blocked(code) {
-  return new GenericError("A licença não permite iniciar esta operação. Consulte o responsável pelo contrato.", { statusCode: 423, code });
-}
-
-// No positive cache and no retries. Call immediately before each new business effect.
-async function assertBusinessOperation({ tenantId, correlationId } = {}, dependencies = {}) {
-  if (!tenantId) throw new GenericError("Contexto de tenant obrigatório.", { statusCode: 403, code: "TENANT_CONTEXT_REQUIRED" });
-  const headers = await (dependencies.operationalRequestHeaders || operationalRequestHeaders)({ tenantId, correlationId });
-  const appCode = (dependencies.getAppCode || getAppCode)();
-  const baseUrl = (dependencies.getBaseUrl || getBaseUrl)();
-  let response;
-  try {
-    response = await (dependencies.post || axios.post)(`${baseUrl}/licensing/decision`, {}, {
-      timeout: TIMEOUT_MS, maxRedirects: 0, maxContentLength: 16384, headers,
-    });
-  } catch (error) {
-    const code = error.response?.data?.error?.code || error.response?.data?.code;
-    if (BLOCKING_CODES.has(code) && [402, 403, 409, 423].includes(error.response?.status)) throw blocked(code);
-    throw unavailable();
-  }
-  const result = response?.data;
-  if (result?.schemaVersion !== 1 || result.tenantId !== String(tenantId) || result.appCode !== appCode
-      || !["desenvolvimento", "homologacao", "producao"].includes(result.environment)
-      || result.maxAgeSeconds !== 0 || typeof result.allowed !== "boolean") throw unavailable();
-  if (!result.allowed) {
-    if (BLOCKING_CODES.has(result.code)) throw blocked(result.code);
-    throw unavailable();
-  }
-  if (result.code != null || !Number.isSafeInteger(result.version) || result.version < 1) throw unavailable();
-  return Object.freeze({ ...result });
-}
-
-// An integration service authenticates the originating Deployment at the authority.
-// Forward only this allowlist, never the gateway bearer or arbitrary request headers.
-async function verifyConsumerRequest({ headers: input = {}, requireLicense = true } = {}, dependencies = {}) {
-  if (isLocalRuntime()) throw new GenericError("Identidade operacional indisponível localmente.", { statusCode: 403, code: "LOCAL_OPERATION_NOT_SUPPORTED" });
-  const headers = {};
-  for (const key of ["x-oon-deployment-id", "x-oon-deployment-token", "x-app-code", "x-oon-tenant-id"]) {
-    if (typeof input[key] !== "string" || !input[key] || input[key].length > 512) throw new GenericError("Credencial operacional inválida.", { statusCode: 401, code: "OPERATIONAL_CREDENTIAL_REQUIRED" });
-    headers[key] = input[key];
-  }
-  if (requireLicense) {
-    return assertBusinessOperation({ tenantId: headers["x-oon-tenant-id"] }, { ...dependencies,
-      getAppCode: () => headers["x-app-code"], operationalRequestHeaders: async () => headers });
-  }
-  try {
-    const response = await (dependencies.post || axios.post)(`${(dependencies.getBaseUrl || getBaseUrl)()}/licensing/identity`, {}, { timeout: TIMEOUT_MS, maxRedirects: 0, maxContentLength: 16384, headers });
-    const result = response?.data;
-    if (result?.schemaVersion !== 1 || result.appCode !== headers["x-app-code"] || result.tenantId !== headers["x-oon-tenant-id"] || !["desenvolvimento", "homologacao", "producao"].includes(result.environment) || result.maxAgeSeconds !== 0) throw unavailable();
-    return Object.freeze({ appCode: result.appCode, tenantId: result.tenantId, environment: result.environment });
-  } catch (error) {
-    if ([401, 403].includes(error.response?.status)) throw new GenericError("Credencial operacional inválida.", { statusCode: 401, code: "OPERATIONAL_CREDENTIAL_INVALID" });
-    throw unavailable();
-  }
-}
-
-module.exports = { assertBusinessOperation, verifyConsumerRequest, BLOCKING_CODES, TIMEOUT_MS };

package/src/core/technicalIdentity.js

@@ -1,174 +0,0 @@
-"use strict";
-
-const crypto = require("node:crypto");
-
-const APP_CODE_MAX_LENGTH = 24;
-const APP_CODE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,22}[a-z0-9])?$/;
-const INSTANCE_UID_ALPHABET = "23456789abcdefghjkmnopqrstuvwxyz";
-const INSTANCE_UID_LENGTH = 16;
-const INSTANCE_UID_BYTES = 10;
-const INSTANCE_UID_PATTERN = /^[23456789abcdefghjkmnopqrstuvwxyz]{16}$/;
-
-const ENVIRONMENT_TOKENS = Object.freeze({
-  desenvolvimento: "dev",
-  homologacao: "hml",
-  producao: "prod",
-  dev: "dev",
-  hml: "hml",
-  prod: "prod",
-});
-
-class TechnicalIdentityError extends Error {
-  constructor(message, code, details = {}) {
-    super(message);
-    this.name = "TechnicalIdentityError";
-    this.code = code;
-    this.details = details;
-  }
-}
-
-function assertAppCode(value) {
-  const appCode = typeof value === "string" ? value : "";
-  if (!APP_CODE_PATTERN.test(appCode)) {
-    throw new TechnicalIdentityError(
-      `appCode deve seguir ${APP_CODE_PATTERN} e possuir no máximo ${APP_CODE_MAX_LENGTH} caracteres ASCII.`,
-      "TECHNICAL_APP_CODE_INVALID",
-      { appCode },
-    );
-  }
-  return appCode;
-}
-
-function assertInstanceUid(value) {
-  const instanceUid = typeof value === "string" ? value : "";
-  if (!INSTANCE_UID_PATTERN.test(instanceUid)) {
-    throw new TechnicalIdentityError(
-      `instanceUid deve possuir ${INSTANCE_UID_LENGTH} caracteres no alfabeto canônico.`,
-      "TECHNICAL_INSTANCE_UID_INVALID",
-      { instanceUid },
-    );
-  }
-  return instanceUid;
-}
-
-function environmentToken(value) {
-  const environment = String(value || "").trim().toLowerCase();
-  const hasEnvironment = Object.prototype.hasOwnProperty.call(ENVIRONMENT_TOKENS, environment);
-  const token = hasEnvironment ? ENVIRONMENT_TOKENS[environment] : null;
-  if (!token) {
-    throw new TechnicalIdentityError(
-      "Ambiente técnico inválido.",
-      "TECHNICAL_ENVIRONMENT_INVALID",
-      { environment },
-    );
-  }
-  return token;
-}
-
-function encodeInstanceUid(bytes) {
-  const buffer = Buffer.from(bytes || []);
-  if (buffer.length !== INSTANCE_UID_BYTES) {
-    throw new TechnicalIdentityError(
-      `instanceUid exige exatamente ${INSTANCE_UID_BYTES} bytes aleatórios.`,
-      "TECHNICAL_INSTANCE_UID_RANDOM_BYTES_INVALID",
-      { receivedBytes: buffer.length },
-    );
-  }
-
-  let accumulator = 0;
-  let bits = 0;
-  let output = "";
-  for (const byte of buffer) {
-    accumulator = (accumulator << 8) | byte;
-    bits += 8;
-    while (bits >= 5) {
-      bits -= 5;
-      output += INSTANCE_UID_ALPHABET[(accumulator >> bits) & 31];
-      accumulator &= (1 << bits) - 1;
-    }
-  }
-
-  if (bits !== 0 || output.length !== INSTANCE_UID_LENGTH) {
-    throw new TechnicalIdentityError(
-      "Falha ao codificar instanceUid de 80 bits.",
-      "TECHNICAL_INSTANCE_UID_ENCODING_INVALID",
-    );
-  }
-  return output;
-}
-
-function generateInstanceUid(randomBytes = crypto.randomBytes) {
-  if (typeof randomBytes !== "function") {
-    throw new TypeError("randomBytes deve ser uma função.");
-  }
-  return encodeInstanceUid(randomBytes(INSTANCE_UID_BYTES));
-}
-
-function technicalIdentity({ appCode, instanceUid, environment }) {
-  const canonicalAppCode = assertAppCode(appCode);
-  const canonicalInstanceUid = assertInstanceUid(instanceUid);
-  const env = environmentToken(environment);
-  const base = `${canonicalAppCode}-${canonicalInstanceUid}-${env}`;
-  const database = `${canonicalAppCode}_${canonicalInstanceUid}_${env}`;
-  const mongoUsername = `${base}-rw`;
-  const serviceAccount = `${base}-runtime`;
-  const secret = `${base}-runtime`;
-  const provisionJob = `${base}-provision`;
-  const frontendDnsLabel = base;
-  const backendDnsLabel = `${base}-api`;
-  const tlsSecret = `${base}-tls`;
-
-  const lengths = {
-    base: base.length,
-    database: database.length,
-    mongoUsername: mongoUsername.length,
-    serviceAccount: serviceAccount.length,
-    secret: secret.length,
-    provisionJob: provisionJob.length,
-    frontendDnsLabel: frontendDnsLabel.length,
-    backendDnsLabel: backendDnsLabel.length,
-    tlsSecret: tlsSecret.length,
-  };
-  const invalidLength = Object.entries(lengths).find(([, length]) => length > 63);
-  if (invalidLength) {
-    throw new TechnicalIdentityError(
-      "Identidade técnica excede o orçamento DNS/Kubernetes de 63 caracteres.",
-      "TECHNICAL_IDENTITY_BUDGET_EXCEEDED",
-      { resource: invalidLength[0], length: invalidLength[1] },
-    );
-  }
-
-  return Object.freeze({
-    version: 1,
-    appCode: canonicalAppCode,
-    instanceUid: canonicalInstanceUid,
-    environment: env,
-    resourceBase: base,
-    namespace: base,
-    database,
-    mongoUsername,
-    serviceAccount,
-    secret,
-    provisionJob,
-    frontendDnsLabel,
-    backendDnsLabel,
-    tlsSecret,
-  });
-}
-
-module.exports = Object.freeze({
-  APP_CODE_MAX_LENGTH,
-  APP_CODE_PATTERN,
-  INSTANCE_UID_ALPHABET,
-  INSTANCE_UID_LENGTH,
-  INSTANCE_UID_BYTES,
-  INSTANCE_UID_PATTERN,
-  ENVIRONMENT_TOKENS,
-  TechnicalIdentityError,
-  assertAppCode,
-  assertInstanceUid,
-  environmentToken,
-  encodeInstanceUid,
-  generateInstanceUid,
-  technicalIdentity,
-});