@oondemand/oon-core-back 0.6.7 → 0.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/core/technicalIdentity.js

@@ -0,0 +1,162 @@
+"use strict";
+
+const crypto = require("node:crypto");
+
+const APP_CODE_MAX_LENGTH = 24;
+const APP_CODE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,22}[a-z0-9])?$/;
+const INSTANCE_UID_ALPHABET = "23456789abcdefghjkmnopqrstuvwxyz";
+const INSTANCE_UID_LENGTH = 16;
+const INSTANCE_UID_BYTES = 10;
+const INSTANCE_UID_PATTERN = /^[23456789abcdefghjkmnopqrstuvwxyz]{16}$/;
+
+const ENVIRONMENT_TOKENS = Object.freeze({
+  desenvolvimento: "dev",
+  homologacao: "hml",
+  producao: "prod",
+  dev: "dev",
+  hml: "hml",
+  prod: "prod",
+});
+
+class TechnicalIdentityError extends Error {
+  constructor(message, code, details = {}) {
+    super(message);
+    this.name = "TechnicalIdentityError";
+    this.code = code;
+    this.details = details;
+  }
+}
+
+function assertAppCode(value) {
+  const appCode = typeof value === "string" ? value : "";
+  if (!APP_CODE_PATTERN.test(appCode)) {
+    throw new TechnicalIdentityError(
+      `appCode deve seguir ${APP_CODE_PATTERN} e possuir no máximo ${APP_CODE_MAX_LENGTH} caracteres ASCII.`,
+      "TECHNICAL_APP_CODE_INVALID",
+      { appCode },
+    );
+  }
+  return appCode;
+}
+
+function assertInstanceUid(value) {
+  const instanceUid = typeof value === "string" ? value : "";
+  if (!INSTANCE_UID_PATTERN.test(instanceUid)) {
+    throw new TechnicalIdentityError(
+      `instanceUid deve possuir ${INSTANCE_UID_LENGTH} caracteres no alfabeto canônico.`,
+      "TECHNICAL_INSTANCE_UID_INVALID",
+      { instanceUid },
+    );
+  }
+  return instanceUid;
+}
+
+function environmentToken(value) {
+  const environment = String(value || "").trim().toLowerCase();
+  const hasEnvironment = Object.prototype.hasOwnProperty.call(ENVIRONMENT_TOKENS, environment);
+  const token = hasEnvironment ? ENVIRONMENT_TOKENS[environment] : null;
+  if (!token) {
+    throw new TechnicalIdentityError(
+      "Ambiente técnico inválido.",
+      "TECHNICAL_ENVIRONMENT_INVALID",
+      { environment },
+    );
+  }
+  return token;
+}
+
+function encodeInstanceUid(bytes) {
+  const buffer = Buffer.from(bytes || []);
+  if (buffer.length !== INSTANCE_UID_BYTES) {
+    throw new TechnicalIdentityError(
+      `instanceUid exige exatamente ${INSTANCE_UID_BYTES} bytes aleatórios.`,
+      "TECHNICAL_INSTANCE_UID_RANDOM_BYTES_INVALID",
+      { receivedBytes: buffer.length },
+    );
+  }
+
+  let accumulator = 0;
+  let bits = 0;
+  let output = "";
+  for (const byte of buffer) {
+    accumulator = (accumulator << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      output += INSTANCE_UID_ALPHABET[(accumulator >> bits) & 31];
+      accumulator &= (1 << bits) - 1;
+    }
+  }
+
+  if (bits !== 0 || output.length !== INSTANCE_UID_LENGTH) {
+    throw new TechnicalIdentityError(
+      "Falha ao codificar instanceUid de 80 bits.",
+      "TECHNICAL_INSTANCE_UID_ENCODING_INVALID",
+    );
+  }
+  return output;
+}
+
+function generateInstanceUid(randomBytes = crypto.randomBytes) {
+  if (typeof randomBytes !== "function") {
+    throw new TypeError("randomBytes deve ser uma função.");
+  }
+  return encodeInstanceUid(randomBytes(INSTANCE_UID_BYTES));
+}
+
+function technicalIdentity({ appCode, instanceUid, environment }) {
+  const canonicalAppCode = assertAppCode(appCode);
+  const canonicalInstanceUid = assertInstanceUid(instanceUid);
+  const env = environmentToken(environment);
+  const base = `${canonicalAppCode}-${canonicalInstanceUid}-${env}`;
+  const database = `${canonicalAppCode}_${canonicalInstanceUid}_${env}`;
+  const mongoUsername = `${base}-rw`;
+  const serviceAccount = `${base}-runtime`;
+  const secret = `${base}-runtime`;
+
+  const lengths = {
+    base: base.length,
+    database: database.length,
+    mongoUsername: mongoUsername.length,
+    serviceAccount: serviceAccount.length,
+    secret: secret.length,
+  };
+  const invalidLength = Object.entries(lengths).find(([, length]) => length > 63);
+  if (invalidLength) {
+    throw new TechnicalIdentityError(
+      "Identidade técnica excede o orçamento DNS/Kubernetes de 63 caracteres.",
+      "TECHNICAL_IDENTITY_BUDGET_EXCEEDED",
+      { resource: invalidLength[0], length: invalidLength[1] },
+    );
+  }
+
+  return Object.freeze({
+    version: 1,
+    appCode: canonicalAppCode,
+    instanceUid: canonicalInstanceUid,
+    environment: env,
+    resourceBase: base,
+    namespace: base,
+    database,
+    mongoUsername,
+    serviceAccount,
+    secret,
+  });
+}
+
+module.exports = Object.freeze({
+  APP_CODE_MAX_LENGTH,
+  APP_CODE_PATTERN,
+  INSTANCE_UID_ALPHABET,
+  INSTANCE_UID_LENGTH,
+  INSTANCE_UID_BYTES,
+  INSTANCE_UID_PATTERN,
+  ENVIRONMENT_TOKENS,
+  TechnicalIdentityError,
+  assertAppCode,
+  assertInstanceUid,
+  environmentToken,
+  encodeInstanceUid,
+  generateInstanceUid,
+  technicalIdentity,
+});

package/src/index.js

@@ -10,6 +10,7 @@ const tenancy = require("./core/tenancy");
 const GenericError = require("./core/errors/GenericError");
 const { requirePermission } = require("./core/middlewares/permissions");
 const rbacPolicy = require("./core/rbac/policy");
+const technicalIdentity = require("./core/technicalIdentity");
 const capabilities = require("./capabilities");
 const { operationalRequestHeaders } = require("./core/utils/instanceActivation");
 const appManifest = require("./manifest/appManifest");
@@ -75,6 +76,7 @@ module.exports = {
   drainProcessJobs: processRuntime.drainProcessJobs,
   fields,
   capabilities,
+  technicalIdentity,
   operationalRequestHeaders,
   licensing: {
     assertBusinessOperation: require("./core/licensing").assertBusinessOperation,
@@ -85,4 +87,4 @@ module.exports = {
   PdfRenderingError: capabilities.PdfRenderingError,
   TransactionalEmailError: capabilities.TransactionalEmailError,
   GenericError, registry,
-};
+};