@wildo-ai/platform-infra-providers 1.1.2

package/src/mongodb-self/__tests__/mongodb-self.infra.module.test.ts

@@ -0,0 +1,419 @@
+/**
+ * Tests for `MongodbSelfInfraProviderModule` (Slice 4.B.3 of
+ * `infra-provider-planner.md`).
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  AppCredentialMintingContext,
+  IMongoSelfAdminClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { ApplicationRuntimePrincipalKind } from '@wildo-ai/platform-config-lib';
+import type { Mock } from 'vitest';
+
+// Derived from the CONTRACT rather than hand-written, so the stub cannot drift from the method it
+// doubles. `ReturnType<typeof vi.fn>` erased both arity and shape, leaving every assertion on the
+// recorded call unchecked.
+type CollectionScopedUpsertCall = Parameters<IMongoSelfAdminClient['upsertCollectionScopedDatabaseUser']>[0];
+type CollectionScopedDropCall = Parameters<IMongoSelfAdminClient['dropCollectionScopedDatabaseUser']>[0];
+
+import { MongodbSelfInfraProviderModule, buildMinionMongodbPrivileges } from '../mongodb-self.infra.module';
+
+function makeAdminClientStub(): IMongoSelfAdminClient & {
+  upsertApplicationDatabaseUserSpy: ReturnType<typeof vi.fn>;
+  deleteApplicationDatabaseUserSpy: ReturnType<typeof vi.fn>;
+  upsertCollectionScopedDatabaseUserSpy: Mock<[CollectionScopedUpsertCall], Promise<undefined>>;
+  dropCollectionScopedDatabaseUserSpy: Mock<[CollectionScopedDropCall], Promise<undefined>>;
+} {
+  const upsertApplicationDatabaseUserSpy = vi.fn().mockResolvedValue(undefined);
+  const deleteApplicationDatabaseUserSpy = vi.fn().mockResolvedValue(undefined);
+  // Declares the one argument production passes, so `mock.calls[0][0]` is a real tuple element.
+  // A zero-arg `vi.fn()` types `calls` as `[]`, and every index into it is a TS2493.
+  const upsertCollectionScopedDatabaseUserSpy = vi.fn((_options: CollectionScopedUpsertCall) => Promise.resolve(undefined));
+  const dropCollectionScopedDatabaseUserSpy = vi.fn((_options: CollectionScopedDropCall) => Promise.resolve(undefined));
+  return {
+    upsertApplicationDatabaseUser: upsertApplicationDatabaseUserSpy,
+    deleteApplicationDatabaseUser: deleteApplicationDatabaseUserSpy,
+    upsertCollectionScopedDatabaseUser: upsertCollectionScopedDatabaseUserSpy,
+    dropCollectionScopedDatabaseUser: dropCollectionScopedDatabaseUserSpy,
+    upsertApplicationDatabaseUserSpy,
+    deleteApplicationDatabaseUserSpy,
+    upsertCollectionScopedDatabaseUserSpy,
+    dropCollectionScopedDatabaseUserSpy,
+  };
+}
+
+function makeMintContext(
+  adminClient: IMongoSelfAdminClient,
+  overrides: Partial<AppCredentialMintingContext> = {},
+): AppCredentialMintingContext {
+  return {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '60d21bdf1c4ae5cda1b2c3d4',
+    adminClient,
+    secretInputs: {
+      'database.mongodb.password': 'orchestrator-supplied-password',
+    },
+    applicationConfigInputs: {
+      databaseName: 'wonder_todos',
+      adminConnectUrl: 'mongodb://admin:adminpw@mongodb:27017/admin?authSource=admin',
+    },
+    ...overrides,
+  };
+}
+
+describe('MongodbSelfInfraProviderModule.plan()', () => {
+  const contribution = MongodbSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'mongodb',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(MongodbSelfInfraProviderModule.provider).toBe(InfraProvider.MONGODB_SELF);
+    expect(MongodbSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.DOCUMENT_DATABASE,
+    ]);
+  });
+
+  it('contributes the mongodb compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['mongodb']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/mongodb/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares platformAdmin (audience-1) for apps-manager + companion', () => {
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual(['MONGO_CONNECT_URL']);
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares the same per-app secret blob paths as the Atlas variant', () => {
+    expect(contribution.appRuntime?.perAppSecretBlobPaths).toEqual([
+      'database.mongodb.username',
+      'database.mongodb.password',
+    ]);
+  });
+});
+
+describe('MongodbSelfInfraProviderModule.mintAppCredentials', () => {
+  it('upserts a self-managed Mongo user and returns the per-app SRV URL', async () => {
+    const adminClient = makeAdminClientStub();
+    const result = await MongodbSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient),
+    );
+
+    expect(adminClient.upsertApplicationDatabaseUserSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.upsertApplicationDatabaseUserSpy).toHaveBeenCalledWith({
+      adminConnectUrl: 'mongodb://admin:adminpw@mongodb:27017/admin?authSource=admin',
+      databaseName: 'wonder_todos',
+      username: 'wonder-todos-local_user',
+      password: 'orchestrator-supplied-password',
+    });
+
+    expect(result.secretBlobValues).toEqual({
+      'database.mongodb.username': 'wonder-todos-local_user',
+      'database.mongodb.password': 'orchestrator-supplied-password',
+    });
+    // Per-app URL derived by swapping admin credentials and DB path.
+    expect(result.runtimeArtifacts?.connectionString).toContain('wonder-todos-local_user');
+    expect(result.runtimeArtifacts?.connectionString).toContain('orchestrator-supplied-password');
+    expect(result.runtimeArtifacts?.connectionString).toContain('/wonder_todos');
+  });
+
+  it('fails loud when secretInputs is missing the password', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { secretInputs: {} }),
+      ),
+    ).rejects.toThrow(/missing 'database\.mongodb\.password'/);
+    expect(adminClient.upsertApplicationDatabaseUserSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when applicationNamespace is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+  });
+
+  it('fails loud when applicationConfigInputs.databaseName is missing', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, {
+          applicationConfigInputs: {
+            adminConnectUrl: 'mongodb://admin:adminpw@mongodb:27017/admin',
+          },
+        }),
+      ),
+    ).rejects.toThrow(/missing 'databaseName'/);
+  });
+
+  it('fails loud when applicationConfigInputs.adminConnectUrl is missing', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, {
+          applicationConfigInputs: { databaseName: 'wonder_todos' },
+        }),
+      ),
+    ).rejects.toThrow(/missing 'adminConnectUrl'/);
+  });
+});
+
+describe('MongodbSelfInfraProviderModule.revokeAppCredentials', () => {
+  it('deletes the per-app database user via admin connection', async () => {
+    const adminClient = makeAdminClientStub();
+    await MongodbSelfInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient),
+    );
+    expect(adminClient.deleteApplicationDatabaseUserSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.deleteApplicationDatabaseUserSpy).toHaveBeenCalledWith({
+      adminConnectUrl: 'mongodb://admin:adminpw@mongodb:27017/admin?authSource=admin',
+      username: 'wonder-todos-local_user',
+    });
+  });
+
+  it('fails loud when applicationNamespace is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.revokeAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+  });
+
+  it('fails loud when applicationConfigInputs.adminConnectUrl is missing', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbSelfInfraProviderModule.revokeAppCredentials!(
+        makeMintContext(adminClient, {
+          applicationConfigInputs: { databaseName: 'wonder_todos' },
+        }),
+      ),
+    ).rejects.toThrow(/missing 'adminConnectUrl'/);
+  });
+});
+
+describe('MongodbSelfInfraProviderModule audience-2 absence (D-4)', () => {
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(MongodbSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});
+
+/**
+ * The MongoDB privilege derivation (Step 3 / R1 / D14).
+ *
+ * These assertions ARE the security semantics — what "read" and "write" mean
+ * once a minion's declaration reaches the database.
+ */
+describe('buildMinionMongodbPrivileges', () => {
+  const DB = 'wonder-todos';
+
+  it('scopes every privilege to ONE named collection', () => {
+    // Never the database resource (`collection: ''`), which is Mongo's "every
+    // collection here" — that would make `resourceAccess` decorative.
+    const privileges = buildMinionMongodbPrivileges({ databaseName: DB, readCollections: ['todos'], writeCollections: [] });
+    expect(privileges).toEqual([{ resource: { db: DB, collection: 'todos' }, actions: ['find'] }]);
+    expect(privileges.every((p) => p.resource.collection.length > 0)).toBe(true);
+  });
+
+  it('grants find for read and NOT find for write', () => {
+    // The platform derivation refuses to widen write into read; re-adding `find`
+    // here would defeat that decision at the last hop.
+    const privileges = buildMinionMongodbPrivileges({ databaseName: DB, readCollections: [], writeCollections: ['todos'] });
+    expect(privileges[0]!.actions).toEqual(['insert', 'update', 'remove']);
+    expect(privileges[0]!.actions).not.toContain('find');
+  });
+
+  it('grants no enumeration action', () => {
+    // A minion granted read on one resource must not be able to discover what
+    // else exists.
+    const privileges = buildMinionMongodbPrivileges({ databaseName: DB, readCollections: ['todos'], writeCollections: ['todos'] });
+    for (const action of privileges.flatMap((p) => p.actions)) {
+      expect(['listCollections', 'listIndexes', 'collStats', 'dbStats', 'listDatabases']).not.toContain(action);
+    }
+  });
+
+  it('NEVER emits dbAdmin or readWrite (D14)', () => {
+    // The two roles the application backend holds on the whole database.
+    // `dbAdmin` is banned outright; `readWrite` is database-WIDE, so granting it
+    // would reach every collection regardless of the declaration.
+    const serialized = JSON.stringify(buildMinionMongodbPrivileges({
+      databaseName: DB, readCollections: ['todos'], writeCollections: ['todos'],
+    }));
+    expect(serialized).not.toMatch(/dbAdmin|readWrite/);
+  });
+
+  it('keeps read and write as SEPARATE entries for a collection granted both', () => {
+    // Mongo unions them identically, but the emitted role then reads back as the
+    // declaration that produced it — so an operator inspecting `db.getRole()`
+    // can check the grant against the config without re-deriving it.
+    const privileges = buildMinionMongodbPrivileges({ databaseName: DB, readCollections: ['todos'], writeCollections: ['todos'] });
+    expect(privileges).toHaveLength(2);
+    expect(privileges.map((p) => p.actions)).toEqual([['find'], ['insert', 'update', 'remove']]);
+  });
+
+  it('produces NO privileges for an empty grant set', () => {
+    // Declared-but-empty is a legitimate statement (a principal with no access).
+    // It must not degrade into "no privileges specified, therefore everything".
+    expect(buildMinionMongodbPrivileges({ databaseName: DB, readCollections: [], writeCollections: [] })).toEqual([]);
+  });
+});
+
+describe('MongodbSelfInfraProviderModule per-principal users (Step 3 / R1 / D14)', () => {
+  const MINION = { kind: ApplicationRuntimePrincipalKind.MINION, name: 'marketingScrapper' } as const;
+  const baseContext = {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder_todos_local',
+    wildoApplicationId: '6a5f02014b25d65f9bfd70b2',
+    secretInputs: { 'database.mongodb.password': 'orchestrator-pw' },
+    applicationConfigInputs: { databaseName: 'wonder-todos', adminConnectUrl: 'mongodb://admin:pw@localhost:27017/admin' },
+  };
+
+  function makeAdmin() {
+    return {
+      upsertApplicationDatabaseUser: vi.fn(async () => {}),
+      upsertCollectionScopedDatabaseUser: vi.fn(async (_options: unknown) => {}),
+      deleteApplicationDatabaseUser: vi.fn(async () => {}),
+    };
+  }
+
+  it('takes the COLLECTION-SCOPED path for a minion, never the database-wide one', async () => {
+    const admin = makeAdmin();
+    await MongodbSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext, adminClient: admin, principal: MINION,
+      resourceGrants: { read: ['todos'], write: ['todos'] },
+    } as never);
+
+    expect(admin.upsertCollectionScopedDatabaseUser).toHaveBeenCalledTimes(1);
+    // The wide path grants `readWrite` + `dbAdmin` on the whole database — it
+    // must not be reachable for a named principal at all.
+    expect(admin.upsertApplicationDatabaseUser).not.toHaveBeenCalled();
+
+    const call = admin.upsertCollectionScopedDatabaseUser.mock.calls[0]![0] as never as {
+      username: string; roleName: string;
+      privileges: Array<{ resource: { collection: string }; actions: string[] }>;
+    };
+    expect(call.username).toBe('wonder_todos_local_minion_marketingScrapper_user');
+    expect(call.roleName).toBe('wonder_todos_local_minion_marketingScrapper_user_role');
+    expect(call.privileges).toEqual([
+      { resource: { db: 'wonder-todos', collection: 'todos' }, actions: ['find'] },
+      { resource: { db: 'wonder-todos', collection: 'todos' }, actions: ['insert', 'update', 'remove'] },
+    ]);
+  });
+
+  it('leaves the APPLICATION BACKEND on the database-wide path, username unmoved', async () => {
+    // Moving it would orphan an existing deployment's user, and the backend
+    // legitimately holds the wide grant today.
+    const admin = makeAdmin();
+    await MongodbSelfInfraProviderModule.mintAppCredentials!({ ...baseContext, adminClient: admin } as never);
+    expect(admin.upsertApplicationDatabaseUser).toHaveBeenCalledWith(
+      expect.objectContaining({ username: 'wonder_todos_local_user' }),
+    );
+    expect(admin.upsertCollectionScopedDatabaseUser).not.toHaveBeenCalled();
+  });
+
+  it('REFUSES a named principal with no grants rather than falling back to the wide user', async () => {
+    // The failure mode this guards: falling back would hand a minion
+    // `readWrite` + `dbAdmin` on the whole database through a code path that
+    // looks like it is doing the narrow thing. Whether to mint nothing at all
+    // is the ORCHESTRATOR's decision (D11/R3), not a default hidden here.
+    const admin = makeAdmin();
+    await expect(MongodbSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext, adminClient: admin, principal: MINION,
+    } as never)).rejects.toThrow(/no resourceGrants/);
+    expect(admin.upsertApplicationDatabaseUser).not.toHaveBeenCalled();
+    expect(admin.upsertCollectionScopedDatabaseUser).not.toHaveBeenCalled();
+  });
+
+  it('emits a role with NO privileges for a declared-but-empty grant set', async () => {
+    // Legitimate: a principal that declared access and asked for nothing. It
+    // must produce a role granting nothing, never "unspecified ⇒ leave it wide".
+    const admin = makeAdmin();
+    await MongodbSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext, adminClient: admin, principal: MINION, resourceGrants: { read: [], write: [] },
+    } as never);
+    expect((admin.upsertCollectionScopedDatabaseUser.mock.calls[0]![0] as never as { privileges: unknown[] }).privileges)
+      .toEqual([]);
+  });
+});
+
+
+/**
+ * Revocation of a NAMED principal (Step 3 / R1).
+ *
+ * These exist because the defect they pin was SHIPPED: `revokeAppCredentials`
+ * derived the username with `buildMongodbUsername(applicationNamespace)`, which
+ * returns the APPLICATION BACKEND's name for every input. Retiring one minion
+ * therefore left that minion's credential live and dropped the backend's
+ * database user — while the mint path a few lines above carried a comment
+ * warning about exactly this. The fix landed at one site of the invariant; these
+ * pins are the other site.
+ */
+describe('MongodbSelfInfraProviderModule.revokeAppCredentials — named principal', () => {
+  const minionPrincipal = {
+    kind: ApplicationRuntimePrincipalKind.MINION,
+    name: 'marketingScrapper',
+  } as AppCredentialMintingContext['principal'];
+
+  it('never touches the APPLICATION BACKEND user when retiring a minion', async () => {
+    const adminClient = makeAdminClientStub();
+    await MongodbSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+    }));
+    // The user-only door is what dropped the backend's user. Asserting it was
+    // not called is the pin that reddens on a regression to the old derivation.
+    expect(adminClient.deleteApplicationDatabaseUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.dropCollectionScopedDatabaseUserSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('drops the custom ROLE as well as the user', async () => {
+    // A role left behind is silently adopted by the next mint of the same name,
+    // carrying privileges nobody re-declared.
+    const adminClient = makeAdminClientStub();
+    await MongodbSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+    }));
+    const call = adminClient.dropCollectionScopedDatabaseUserSpy.mock.calls[0]![0];
+    expect(call.roleName).toBe(`${call.username}_role`);
+    expect(call.databaseName).toBe('wonder_todos');
+  });
+
+  it('derives the SAME username on mint and on revoke', async () => {
+    // Compared to each other rather than to a literal, so the pin survives a
+    // deliberate rename and fails only when the two sides DISAGREE — which is
+    // the failure that actually occurred.
+    const adminClient = makeAdminClientStub();
+    await MongodbSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+      resourceGrants: { read: ['todos'] as never, write: [] as never },
+    }));
+    await MongodbSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+    }));
+    expect(adminClient.dropCollectionScopedDatabaseUserSpy.mock.calls[0]![0].username)
+      .toBe(adminClient.upsertCollectionScopedDatabaseUserSpy.mock.calls[0]![0].username);
+  });
+
+  it('still routes the APPLICATION BACKEND through the user-only door', async () => {
+    const adminClient = makeAdminClientStub();
+    await MongodbSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: { kind: ApplicationRuntimePrincipalKind.APPLICATION_BACKEND } as AppCredentialMintingContext['principal'],
+    }));
+    expect(adminClient.dropCollectionScopedDatabaseUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.deleteApplicationDatabaseUserSpy).toHaveBeenCalledTimes(1);
+  });
+});