@oondemand/oon-core-back 0.6.9 → 0.6.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/delivery/mongoCredentialLifecycle.js

@@ -0,0 +1,33 @@
+"use strict";
+
+const { assertMongoIdentity, recoveryRequired } = require("./mongoProvisioning");
+
+// The store must create the intent exclusively, then replace it by resourceVersion.
+// A present record without a credential is an interrupted operation, never absence.
+async function resolveMongoCredential({ identity, read, begin, persist, provision, validate }) {
+  const record = await read();
+  if (record !== null) {
+    if (!record.mongoUri) throw recoveryRequired("MONGO_CREDENTIAL_MISSING");
+    assertMongoIdentity(record.mongoUri, identity);
+    try { await validate(record.mongoUri); }
+    catch { throw recoveryRequired("MONGO_PERSISTED_CREDENTIAL_INVALID"); }
+    return { mongoUri: record.mongoUri, created: false };
+  }
+
+  await begin();
+  let captured;
+  try {
+    const result = await provision(async (uri) => {
+      assertMongoIdentity(uri, identity);
+      await persist(uri);
+      captured = uri;
+    });
+    if (!captured || result.mongoUri !== captured) throw recoveryRequired();
+    return { mongoUri: captured, created: true };
+  } catch {
+    // Do not serialize driver/provider errors, URIs, tokens or creation responses.
+    throw recoveryRequired("MONGO_PROVISIONING_INCOMPLETE");
+  }
+}
+
+module.exports = { resolveMongoCredential };

package/src/delivery/mongoProvisioning.js

@@ -1,12 +1,11 @@
 "use strict";
 
-const { mongo } = require("mongoose");
+const defaultMongoClient = () => require("mongoose").mongo.MongoClient;
 const { technicalIdentity } = require("../core/technicalIdentity");
 
 const DIGITALOCEAN_API = "https://api.digitalocean.com/v2";
 const DIGITALOCEAN_HOST_SUFFIX = ".mongo.ondigitalocean.com";
 const DIGITALOCEAN_RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
-const DIGITALOCEAN_SERVER_STATUS = new Set([500, 502, 503, 504]);
 
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -43,46 +42,58 @@ function mongoIdentity(appCode, environment, { instanceUid } = {}) {
   };
 }
 
-function mongoHost(uri) {
+function recoveryRequired(code = "MONGO_RECOVERY_REQUIRED") {
+  const error = new Error(`${code}: recuperação explícita necessária; credenciais preservadas.`);
+  error.code = code;
+  return error;
+}
+
+// WHATWG URL rejects MongoDB seed lists with multiple host:port pairs.
+function parseMongoUri(uri) {
+  const match = typeof uri === "string" && uri.match(/^(mongodb(?:\+srv)?):\/\/([^/?#]+)(?:\/([^?#]*))?(?:\?([^#]*))?$/);
+  if (!match) throw recoveryRequired("MONGO_URI_INVALID");
+  const [, scheme, authority, database = "", query = ""] = match;
+  const at = authority.lastIndexOf("@");
+  const credentials = at < 0 ? "" : authority.slice(0, at);
+  const hosts = authority.slice(at + 1);
+  if (!hosts) throw recoveryRequired("MONGO_URI_INVALID");
   try {
-    return new URL(uri).hostname.toLowerCase();
-  } catch {
-    throw new Error("MONGO_ADMIN_URI inválida.");
-  }
+    return { scheme, hosts, database: decodeURIComponent(database),
+      username: decodeURIComponent(credentials.split(":")[0]), query: new URLSearchParams(query) };
+  } catch { throw recoveryRequired("MONGO_URI_INVALID"); }
+}
+
+function mongoHost(uri) {
+  const parsed = parseMongoUri(uri);
+  return parsed.hosts.split(",")[0].replace(/:\d+$/, "").toLowerCase();
 }
 
 function resolveMongoProvisioner({ adminUri, provisioner = "auto" }) {
   const normalized = String(provisioner || "auto").trim().toLowerCase();
   if (!["auto", "native", "digitalocean"].includes(normalized)) {
-    throw new Error(
-      `MONGO_PROVISIONER inválido: ${normalized}. Use auto, native ou digitalocean.`,
-    );
+    throw recoveryRequired("MONGO_PROVISIONER_INVALID");
   }
   if (normalized !== "auto") return normalized;
-  return mongoHost(adminUri).endsWith(DIGITALOCEAN_HOST_SUFFIX)
-    ? "digitalocean"
-    : "native";
+  return mongoHost(adminUri).endsWith(DIGITALOCEAN_HOST_SUFFIX) ? "digitalocean" : "native";
 }
 
-function buildRuntimeMongoUri({
-  adminUri,
-  username,
-  password,
-  dbName,
-  authSource,
-}) {
-  const uri = new URL(adminUri);
-  uri.username = username;
-  uri.password = password;
-  uri.pathname = `/${dbName}`;
-  uri.searchParams.set("authSource", authSource);
-  return uri.toString();
+function buildRuntimeMongoUri({ adminUri, username, password, dbName, authSource }) {
+  const parsed = parseMongoUri(adminUri);
+  parsed.query.set("authSource", authSource);
+  return `${parsed.scheme}://${encodeURIComponent(username)}:${encodeURIComponent(password)}@${parsed.hosts}/${encodeURIComponent(dbName)}?${parsed.query}`;
+}
+
+function assertMongoIdentity(uri, identity) {
+  const parsed = parseMongoUri(uri);
+  if (parsed.username !== identity.username || parsed.database !== identity.dbName) {
+    throw recoveryRequired("MONGO_IDENTITY_MISMATCH");
+  }
 }
 
 async function validateMongoUri(
   mongoUri,
   {
-    MongoClient = mongo.MongoClient,
+    MongoClient = defaultMongoClient(),
     timeoutMs = 15000,
     writeProbe = true,
   } = {},
@@ -93,9 +104,16 @@ async function validateMongoUri(
     maxPoolSize: 2,
   });
 
-  await client.connect();
   try {
+    await client.connect();
     const db = client.db();
+    const target = parseMongoUri(mongoUri);
+    const status = await db.command({ connectionStatus: 1 });
+    const roles = status?.authInfo?.authenticatedUserRoles;
+    if (!target.database || !Array.isArray(roles) || !roles.length ||
+        roles.some(role => role.role !== "readWrite" || role.db !== target.database)) {
+      throw recoveryRequired("MONGO_RUNTIME_SCOPE_UNSAFE");
+    }
     await db.command({ ping: 1 });
     if (writeProbe) {
       const probe = db.collection("__oon_runtime_probe");
@@ -133,7 +151,7 @@ async function waitForMongoUri(
       }
     }
   }
-  const reason = lastError?.codeName || lastError?.code || lastError?.name;
+  const reason = [13, 18].includes(lastError?.code) ? lastError.code : undefined;
   throw new Error(
     `A credencial derivada do MongoDB não passou no teste de leitura e escrita${
       reason ? ` (${reason})` : ""
@@ -141,16 +159,23 @@ async function waitForMongoUri(
   );
 }
 
-async function provisionNativeMongo({ adminUri, appCode, environment, instanceUid }) {
+async function provisionNativeMongo({ adminUri, appCode, environment, instanceUid }, deps = {}) {
   const identity = mongoIdentity(appCode, environment, { instanceUid });
   const { dbName, username } = identity;
   const password = randomSecret(30);
-  const client = new mongo.MongoClient(adminUri, {
-    serverSelectionTimeoutMS: 15000,
+  const MongoClient = deps.MongoClient || defaultMongoClient();
+  const client = new MongoClient(adminUri, {
+    serverSelectionTimeoutMS: 15000, connectTimeoutMS: 15000, maxPoolSize: 2,
   });
-  await client.connect();
   try {
+    await client.connect();
     const db = client.db(dbName);
+    const existing = await db.command({ usersInfo: username });
+    if (!Array.isArray(existing.users) || existing.users.length) throw recoveryRequired();
+    const mongoUri = buildRuntimeMongoUri({ adminUri, username, password, dbName, authSource: dbName });
+    if (typeof deps.persistCredential !== "function") throw recoveryRequired("MONGO_CREDENTIAL_PERSISTENCE_REQUIRED");
+    // Capture before createUser: loss of its response never requires password rotation.
+    await deps.persistCredential(mongoUri);
     try {
       await db.command({
         createUser: username,
@@ -163,11 +188,7 @@ async function provisionNativeMongo({ adminUri, appCode, environment, instanceUi
         error.code === 51003 ||
         /already exists/i.test(error.message);
       if (!alreadyExists) throw error;
-      await db.command({
-        updateUser: username,
-        pwd: password,
-        roles: [{ role: "readWrite", db: dbName }],
-      });
+      throw recoveryRequired();
     }
   } finally {
     await client.close();
@@ -207,7 +228,7 @@ async function digitalOceanRequest(
   } = {},
 ) {
   if (!fetchImpl) throw new Error("fetch não disponível para a DigitalOcean API.");
-  const attempts = Math.max(1, Number(retryAttempts) || 3);
+  const attempts = method === "GET" ? Math.max(1, Number(retryAttempts) || 3) : 1;
 
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     const controller = new AbortController();
@@ -225,6 +246,7 @@ async function digitalOceanRequest(
           },
           body: body ? JSON.stringify(body) : undefined,
           signal: controller.signal,
+          redirect: "error",
         },
       );
     } catch (error) {
@@ -235,7 +257,7 @@ async function digitalOceanRequest(
       if (error.name === "AbortError") {
         throw new Error("Timeout ao acessar a DigitalOcean API.");
       }
-      throw new Error(`Falha ao acessar a DigitalOcean API: ${error.message}`);
+      throw recoveryRequired("MONGO_PROVIDER_REQUEST_FAILED");
     } finally {
       clearTimeout(timeout);
     }
@@ -257,20 +279,8 @@ async function digitalOceanRequest(
       continue;
     }
 
-    const providerMessage = String(payload.message || payload.id || "erro")
-      .replace(/[\r\n]+/g, " ")
-      .slice(0, 300);
-    const providerRequestId = String(payload.request_id || "")
-      .replace(/[^A-Za-z0-9_.:-]/g, "")
-      .slice(0, 120);
-    const error = new Error(
-      `DigitalOcean API rejeitou ${method} ${path}: HTTP ${response.status} (${providerMessage})`
-      + (providerRequestId ? ` [requestId: ${providerRequestId}]` : "")
-      + ".",
-    );
+    const error = recoveryRequired(`MONGO_PROVIDER_HTTP_${response.status}`);
     error.status = response.status;
-    error.payload = payload;
-    error.providerRequestId = providerRequestId || undefined;
     throw error;
   }
 
@@ -289,19 +299,14 @@ async function ensureDigitalOceanDatabase(options, deps) {
   } catch (error) {
     if (error.status === 404) {
       exists = false;
-    } else if (DIGITALOCEAN_SERVER_STATUS.has(error.status)) {
-      const listed = await digitalOceanRequest(
-        { ...options, path: "/dbs", expected: [200] },
-        deps,
-      );
-      exists = Array.isArray(listed.payload.dbs)
-        && listed.payload.dbs.some((item) => item?.name === options.dbName);
     } else {
       throw error;
     }
   }
   if (exists) return;
 
+  // Refuse a pre-existing/ambiguous user before creating any database resource.
+  await assertDigitalOceanUserAbsent(options, deps);
   await digitalOceanRequest(
     {
       ...options,
@@ -323,70 +328,35 @@ function digitalOceanUserSettings(dbName) {
   };
 }
 
-async function provisionDigitalOceanUser(options, deps) {
-  const userPath = `/users/${encodeURIComponent(options.username)}`;
-  let exists = false;
+async function assertDigitalOceanUserAbsent(options, deps) {
   try {
     await digitalOceanRequest(
-      { ...options, path: userPath, expected: [200] },
+      { ...options, path: `/users/${encodeURIComponent(options.username)}`, expected: [200] },
       deps,
     );
-    exists = true;
   } catch (error) {
-    if (error.status === 404) {
-      exists = false;
-    } else if (DIGITALOCEAN_SERVER_STATUS.has(error.status)) {
-      const listed = await digitalOceanRequest(
-        { ...options, path: "/users", expected: [200] },
-        deps,
-      );
-      exists = Array.isArray(listed.payload.users)
-        && listed.payload.users.some(
-          (item) => item?.name === options.username,
-        );
-    } else {
-      throw error;
-    }
+    if (error.status === 404) return;
+    throw error;
   }
+  throw recoveryRequired();
+}
 
-  const settings = digitalOceanUserSettings(options.dbName);
-  let result;
-  if (!exists) {
-    result = await digitalOceanRequest(
-      {
-        ...options,
-        path: "/users",
-        method: "POST",
-        body: { name: options.username, settings },
-        expected: [201, 202],
-      },
-      deps,
-    );
-  } else {
-    await digitalOceanRequest(
-      {
-        ...options,
-        path: userPath,
-        method: "PUT",
-        body: { settings },
-        expected: [200, 202],
-      },
-      deps,
-    );
-    result = await digitalOceanRequest(
-      {
-        ...options,
-        path: `${userPath}/reset_auth`,
-        method: "POST",
-        body: {},
-        expected: [200, 201, 202],
-      },
-      deps,
-    );
-  }
+async function provisionDigitalOceanUser(options, deps) {
+  // Recheck after database creation: another publisher may have created the user.
+  await assertDigitalOceanUserAbsent(options, deps);
+  const result = await digitalOceanRequest(
+    {
+      ...options,
+      path: "/users",
+      method: "POST",
+      body: { name: options.username, settings: digitalOceanUserSettings(options.dbName) },
+      expected: [201, 202],
+    },
+    deps,
+  );
 
   const user = result.payload.user;
-  if (!user?.password) {
+  if (user?.name !== options.username || typeof user?.password !== "string" || !user.password) {
     throw new Error(
       "DigitalOcean API não retornou a senha do usuário. O token precisa do escopo database:view_credentials.",
     );
@@ -424,16 +394,20 @@ async function provisionDigitalOceanMongo(
     dbName,
     username,
   };
+  if (typeof deps.persistCredential !== "function") throw recoveryRequired("MONGO_CREDENTIAL_PERSISTENCE_REQUIRED");
+  // Validate URI construction before any provider mutation.
+  buildRuntimeMongoUri({ adminUri, username, password: "preflight", dbName, authSource: "admin" });
   await ensureDigitalOceanDatabase(apiOptions, deps);
   const user = await provisionDigitalOceanUser(apiOptions, deps);
   const mongoUri = buildRuntimeMongoUri({
     adminUri,
-    username: user.name || username,
+    username,
     password: user.password,
     dbName,
     authSource: "admin",
   });
 
+  await deps.persistCredential(mongoUri);
   await waitForMongoUri(mongoUri, {
     validate: deps.validateMongoUri || validateMongoUri,
     attempts: deps.validationAttempts,
@@ -442,7 +416,7 @@ async function provisionDigitalOceanMongo(
 
   return {
     dbName,
-    username: user.name || username,
+    username,
     ...(identity.mode === "canonical"
       ? { instanceUid: identity.instanceUid, technicalIdentityVersion: identity.identityVersion }
       : {}),
@@ -456,7 +430,7 @@ async function provisionMongo(options, deps = {}) {
   if (provider === "digitalocean") {
     return provisionDigitalOceanMongo(options, deps);
   }
-  const result = await provisionNativeMongo(options);
+  const result = await provisionNativeMongo(options, deps);
   await waitForMongoUri(result.mongoUri, {
     validate: deps.validateMongoUri || validateMongoUri,
     attempts: deps.validationAttempts,
@@ -466,10 +440,10 @@ async function provisionMongo(options, deps = {}) {
 }
 
 module.exports = {
+  recoveryRequired, parseMongoUri, assertMongoIdentity,
   DIGITALOCEAN_API,
   DIGITALOCEAN_HOST_SUFFIX,
   DIGITALOCEAN_RETRYABLE_STATUS,
-  DIGITALOCEAN_SERVER_STATUS,
   mongoIdentity,
   mongoHost,
   resolveMongoProvisioner,
@@ -483,4 +457,4 @@ module.exports = {
   provisionDigitalOceanUser,
   provisionDigitalOceanMongo,
   provisionMongo,
-};
+};

package/src/delivery/runtime.js

@@ -4,7 +4,8 @@ const crypto = require("node:crypto");
 const { spawnSync } = require("node:child_process");
 const { kubectl } = require("./command");
 const { validateInfraFromCluster } = require("../deploy/contracts/infra-contract");
-const { provisionMongo, validateMongoUri } = require("./mongoProvisioning");
+const { resolveMongoCredential } = require("./mongoCredentialLifecycle");
+const { provisionMongo, validateMongoUri, mongoIdentity, recoveryRequired } = require("./mongoProvisioning");
 const { canonicalizeDeliveryContext } = require("./technicalIdentity");
 
 const RESOURCE_PROFILES = {
@@ -32,9 +33,9 @@ function applyYaml(yaml) {
 }
 function readSecret(namespace, name, key) {
   try {
-    const value = kubectl(["-n", namespace, "get", "secret", name, "-o", `jsonpath={.data.${key}}`], { capture: true });
+    const value = kubectl(["-n", namespace, "get", "secret", name, "--ignore-not-found", "-o", `jsonpath={.data.${key}}`], { capture: true });
     return value ? Buffer.from(value, "base64").toString("utf8") : null;
-  } catch { return null; }
+  } catch { throw recoveryRequired("MONGO_SECRET_READ_FAILED"); }
 }
 
 function canonicalRuntimeContext(context) {
@@ -177,10 +178,11 @@ function copyPullSecret(namespace, infra) {
   } catch (error) { if (!/not found/i.test(error.message)) throw error; }
 }
 
-function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {} }) {
+function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {}, record, writeRecord }) {
   const normalized = canonicalRuntimeContext(context);
   const identity = normalized.deliveryTechnicalIdentity;
   const literals = {
+    ...extraSecrets,
     MONGO_URI: mongoUri,
     NODE_ENV: "production",
     APP_ENVIRONMENT: normalized.environment,
@@ -195,12 +197,15 @@ function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {
         OON_TECHNICAL_IDENTITY_VERSION: String(identity.version),
       }
       : {}),
-    ...extraSecrets,
   };
-  const args = ["-n", normalized.namespace, "create", "secret", "generic", identity.secret];
-  for (const [key, value] of Object.entries(literals)) args.push(`--from-literal=${key}=${value}`);
-  args.push("--dry-run=client", "-o", "yaml");
-  applyYaml(kubectl(args, { capture: true }));
+  writeRecord("replace", {
+    ...record,
+    metadata: { ...record.metadata, annotations: {
+      ...record.metadata.annotations, "oon.runtime/mongo-state": "ready",
+    } },
+    data: { ...record.data, ...Object.fromEntries(Object.entries(literals)
+      .map(([key, value]) => [key, Buffer.from(String(value)).toString("base64")])) },
+  });
 }
 
 async function provisionRuntime({ context, extraSecrets = {} }) {
@@ -234,45 +239,56 @@ async function provisionRuntime({ context, extraSecrets = {} }) {
     "DIGITALOCEAN_DATABASE_CLUSTER_ID",
   );
 
-  let mongoUri = readSecret(normalized.namespace, identity.secret, "MONGO_URI");
-  let databaseName = "";
-  let credentialRotated = false;
-
-  if (mongoUri) {
-    try {
-      await validateMongoUri(mongoUri);
-    } catch (error) {
-      console.warn(
-        "A credencial MongoDB persistida não passou na validação; " +
-          "ela será reprovisionada.",
-      );
-      mongoUri = null;
-      credentialRotated = true;
-    }
-  }
-
-  if (!mongoUri) {
-    const provisioned = await provisionMongo({
-      adminUri,
-      appCode: normalized.appCode,
-      environment: normalized.environment,
-      ...(identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}),
-      provisioner: mongoProvisioner,
-      digitalOceanToken,
-      digitalOceanClusterId,
+  // Read errors are distinct from confirmed absence. Never provision on a failed GET.
+  let record;
+  try {
+    const raw = kubectl(["-n", normalized.namespace, "get", "secret", identity.secret,
+      "--ignore-not-found", "-o", "json"], { capture: true });
+    record = raw ? JSON.parse(raw) : null;
+  } catch { throw recoveryRequired("MONGO_SECRET_READ_FAILED"); }
+  const decode = (key) => record?.data?.[key]
+    ? Buffer.from(record.data[key], "base64").toString("utf8") : null;
+  const encryptionKey = record === null ? randomSecret(48) : decode("INSTANCE_CREDENTIAL_ENCRYPTION_KEY");
+  if (!encryptionKey) throw recoveryRequired("MONGO_ENCRYPTION_KEY_MISSING");
+  const writeRecord = (operation, value) => {
+    // Secrets travel through stdin and captured output, never inherited stderr/argv.
+    const result = spawnSync("kubectl", [operation, "-f", "-", "-o", "json"], {
+      input: JSON.stringify(value), encoding: "utf8", stdio: ["pipe", "pipe", "pipe"],
     });
-    mongoUri = provisioned.mongoUri;
-    databaseName = provisioned.dbName;
-    credentialRotated = true;
-  }
-
-  const encryptionKey =
-    readSecret(
-      normalized.namespace,
-      identity.secret,
-      "INSTANCE_CREDENTIAL_ENCRYPTION_KEY",
-    ) || randomSecret(48);
-  applyRuntimeSecret({ context: normalized, mongoUri, encryptionKey, extraSecrets });
+    if (result.status !== 0) throw recoveryRequired("MONGO_SECRET_WRITE_FAILED");
+    try { record = JSON.parse(result.stdout); }
+    catch { throw recoveryRequired("MONGO_SECRET_RESPONSE_INVALID"); }
+    if (!record?.metadata?.resourceVersion) throw recoveryRequired("MONGO_SECRET_RESPONSE_INVALID");
+  };
+  const mongo = await resolveMongoCredential({
+    identity: mongoIdentity(normalized.appCode, normalized.environment,
+      identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}),
+    read: async () => record === null ? null : { mongoUri: decode("MONGO_URI") },
+    begin: async () => writeRecord("create", {
+      apiVersion: "v1", kind: "Secret", type: "Opaque",
+      metadata: { name: identity.secret, namespace: normalized.namespace,
+        annotations: { "oon.runtime/mongo-state": "provisioning" } },
+      data: { INSTANCE_CREDENTIAL_ENCRYPTION_KEY: Buffer.from(encryptionKey).toString("base64") },
+    }),
+    persist: async (uri) => writeRecord("replace", {
+      ...record,
+      metadata: { ...record.metadata, annotations: {
+        ...record.metadata.annotations, "oon.runtime/mongo-state": "credential-captured",
+      } },
+      data: { ...record.data, MONGO_URI: Buffer.from(uri).toString("base64") },
+    }),
+    provision: (persistCredential) => provisionMongo({
+      adminUri, appCode: normalized.appCode, environment: normalized.environment,
+      ...(identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}),
+      provisioner: mongoProvisioner, digitalOceanToken, digitalOceanClusterId,
+    }, { persistCredential }),
+    validate: validateMongoUri,
+  });
+  const mongoUri = mongo.mongoUri;
+  const databaseName = mongoIdentity(normalized.appCode, normalized.environment,
+    identity.mode === "canonical" ? { instanceUid: identity.instanceUid } : {}).dbName;
+  const credentialRotated = false;
+  applyRuntimeSecret({ context: normalized, mongoUri, encryptionKey, extraSecrets, record, writeRecord });
   return {
     infra,
     databaseName,
@@ -349,4 +365,4 @@ module.exports = {
   deployRuntime,
   waitHttp,
   activateMember,
-};
+};