@wildo-ai/platform-infra-providers 1.1.2

package/src/mongodb-self/mongodb-self.infra.module.ts

@@ -0,0 +1,384 @@
+/**
+ * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the
+ * pattern to self-managed MongoDB).
+ *
+ * Implements the `MONGODB_SELF` `InfraProvider` over the
+ * `IMongoSelfAdminClient` transport (admin-side mongoose connection,
+ * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C
+ * policy/transport split). Owns ALL per-app naming policy +
+ * URL-derivation policy — the per-app username convention
+ * (`<applicationNamespace>_user`, mirroring the Atlas variant) and
+ * the per-app SRV URL derivation by swapping admin credentials
+ * with per-app credentials in the authored
+ * `BASE_MONGO_SERVER_URL`-derived admin connect URL.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required.
+ * - `applicationConfigInputs['adminConnectUrl']` — required, the
+ *   admin-scoped MongoDB connect URL the orchestrator reads from
+ *   `MONGO_CONNECT_URL` env at app-init time.
+ * - `adminClient` — narrowed to `IMongoSelfAdminClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin
+ *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`
+ *    (mints per-app users via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Mongo database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the per-app connect URL
+ *    returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations.
+ *
+ * **NOT served (D-4)**: audience-2 not applicable.
+ */
+
+import {
+  AppCredentialMintingContext,
+  AppCredentialMintingResult,
+  IMongoSelfAdminClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+  ApplicationRuntimePrincipalKind,
+  resolveGrantStorageNames,
+  type ApplicationRuntimePrincipal,
+} from '@wildo-ai/platform-config-lib';
+
+const MONGODB_USERNAME_PATH = 'database.mongodb.username';
+const MONGODB_PASSWORD_PATH = 'database.mongodb.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];
+
+
+const MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';
+
+const DATABASE_NAME_INPUT_KEY = 'databaseName';
+const ADMIN_CONNECT_URL_INPUT_KEY = 'adminConnectUrl';
+
+const CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';
+
+/**
+ * Compute the per-app username. Mirrors the Atlas module's
+ * convention (`${ns}_user`) so the persistence shape is identical
+ * regardless of provider.
+ */
+function buildMongodbUsername(applicationNamespace: string): string {
+  return `${applicationNamespace}_user`;
+}
+
+/**
+ * MongoDB privilege ACTIONS, per grant axis.
+ *
+ * Named here rather than inlined because these ARE the security semantics: what
+ * "read" and "write" mean once they reach the database. Mongo's action
+ * vocabulary is an external one, so it lives at this adapter — the module that
+ * speaks Mongo — and never leaks into the platform's grant model.
+ *
+ * `find` alone for read: no `listCollections`, no `collStats`, nothing that
+ * enumerates. A minion granted read on one resource should not be able to
+ * discover what else exists.
+ *
+ * `insert`/`update`/`remove` for write, and deliberately NOT `find`. The
+ * platform-level derivation refuses to widen write into read, and re-adding it
+ * here would defeat that decision at the last hop — see
+ * `deriveMinionResourceGrants`.
+ */
+const MONGODB_READ_ACTIONS: readonly string[] = ['find'];
+const MONGODB_WRITE_ACTIONS: readonly string[] = ['insert', 'update', 'remove'];
+
+/** One `createRole`/`updateRole` privilege entry. */
+export interface MongodbCollectionPrivilege {
+  readonly resource: { readonly db: string; readonly collection: string };
+  readonly actions: readonly string[];
+}
+
+/**
+ * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).
+ *
+ * ## What this deliberately never produces
+ *
+ * No `dbAdmin` and no `readWrite` — the two roles the application backend
+ * currently holds on the whole database. `dbAdmin` is banned outright by D14;
+ * `readWrite` is database-WIDE, so granting it to a minion would make every
+ * collection reachable regardless of what `resourceAccess` declared, which is
+ * the containment this exists to create.
+ *
+ * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which
+ * is Mongo's way of saying "every collection in this database". Every entry
+ * names one collection explicitly.
+ *
+ * ## Read and write are separate entries on purpose
+ *
+ * A collection granted both axes yields TWO privilege entries rather than one
+ * merged action list. Mongo unions them identically, but the emitted role then
+ * reads back as the declaration that produced it — which is what makes an
+ * operator inspecting `db.getRole()` able to check the grant against the config
+ * without re-deriving it.
+ */
+export function buildMinionMongodbPrivileges(input: {
+  databaseName: string;
+  readCollections: readonly string[];
+  writeCollections: readonly string[];
+}): MongodbCollectionPrivilege[] {
+  const privileges: MongodbCollectionPrivilege[] = [];
+  for (const collection of input.readCollections) {
+    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_READ_ACTIONS] });
+  }
+  for (const collection of input.writeCollections) {
+    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });
+  }
+  return privileges;
+}
+
+/**
+ * Derive the per-app connect URL by swapping admin credentials and
+ * the database path in the authored `adminConnectUrl`. Mirrors the
+ * legacy logic at
+ * `wildo-application-lifecycle.service.ts:469-479`:
+ *
+ *   const parsed = new URL(adminConnectUrl);
+ *   parsed.username = perAppUsername;
+ *   parsed.password = perAppPassword;
+ *   parsed.pathname = '/' + databaseName;
+ *
+ * URL-encoding handled automatically by the WHATWG URL class.
+ */
+function buildPerAppConnectUrl(
+  adminConnectUrl: string,
+  databaseName: string,
+  username: string,
+  password: string,
+): string {
+  const parsed = new URL(adminConnectUrl);
+  parsed.username = encodeURIComponent(username);
+  parsed.password = encodeURIComponent(password);
+  parsed.pathname = '/' + databaseName;
+  return parsed.toString();
+}
+
+/**
+ * Per-principal Mongo username — the SAME derivation the revoke path must use.
+ *
+ * The application backend keeps `<namespace>_user` VERBATIM so an existing
+ * deployment's user is never orphaned. Third time this shape appears (Redis,
+ * RabbitMQ, now Mongo): a revoke deriving it differently deletes the BACKEND's
+ * database user while believing it is removing a minion's.
+ */
+function buildMongodbPrincipalUsername(
+  applicationNamespace: string,
+  principal: ApplicationRuntimePrincipal | undefined,
+): string {
+  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+    return buildMongodbUsername(applicationNamespace);
+  }
+  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+  return `${applicationNamespace}_${principal.kind}_${sanitizedName}_user`;
+}
+
+export const MongodbSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.MONGODB_SELF,
+  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],
+  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['mongodb'],
+      k8sResources: ['templates/infra/k8s/internal/mongodb/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {},
+        // The single MONGO_CONNECT_URL secret carries the admin
+        // credentials embedded; legacy field name preserved.
+        secretEnvVars: ['MONGO_CONNECT_URL'],
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      appRuntime: {
+        // Same persistence shape as Atlas — per-app username +
+        // password go into secrets; the host/protocol/options come
+        // from `_merge_WildoApplicationConfig` which derives them
+        // from env-config (BASE_MONGO_SERVER_URL).
+        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+      },
+    };
+  },
+
+  async mintAppCredentials(
+    context: AppCredentialMintingContext,
+  ): Promise<AppCredentialMintingResult> {
+    const adminClient = context.adminClient as IMongoSelfAdminClient;
+    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];
+    if (!password) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,
+      );
+    }
+    if (!context.applicationNamespace) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+        `applicationNamespace is empty. ` +
+        `The orchestrator MUST supply a non-empty namespace.`,
+      );
+    }
+    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+    if (!databaseName) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the per-app database name.`,
+      );
+    }
+    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];
+    if (!adminConnectUrl) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the admin Mongo connect URL.`,
+      );
+    }
+
+    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);
+
+    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+      // A named principal gets a COLLECTION-SCOPED user (Step 3 / R1 / D14):
+      // one custom role carrying exactly the privileges its `resourceAccess`
+      // derived, and nothing inherited.
+      //
+      // `resourceGrants` is REQUIRED here and its absence is an error rather
+      // than a default. Falling back to the app-wide upsert would hand a minion
+      // `readWrite` + `dbAdmin` on the whole database — the exact over-grant
+      // this path exists to replace, arriving silently through a code path that
+      // looks like it is doing the narrow thing.
+      const grants = context.resourceGrants;
+      if (!grants) {
+        throw new Error(
+          `MongodbSelfInfraProviderModule.mintAppCredentials: `
+          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `
+          + `Refusing to fall back to the database-wide application user — a minion with no declared `
+          + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`,
+        );
+      }
+      await adminClient.upsertCollectionScopedDatabaseUser({
+        adminConnectUrl,
+        databaseName,
+        username,
+        password,
+        roleName: `${username}_role`,
+        // Resource types → collection names HERE, at the adapter that speaks
+        // Mongo. The grant contract itself stays in the platform vocabulary.
+        privileges: buildMinionMongodbPrivileges({
+          databaseName,
+          readCollections: resolveGrantStorageNames(grants.read),
+          writeCollections: resolveGrantStorageNames(grants.write),
+        }),
+      });
+    } else {
+      // createUser-or-updateUser over an admin-scoped mongoose
+      // connection — idempotent upsert.
+      await adminClient.upsertApplicationDatabaseUser({
+        adminConnectUrl,
+        databaseName,
+        username,
+        password,
+      });
+    }
+
+    // Derive the per-app SRV URL by swapping credentials + db path
+    // in the authored admin URL. The orchestrator uses this for
+    // transient app-init seeding; not persisted.
+    const connectionString = buildPerAppConnectUrl(
+      adminConnectUrl,
+      databaseName,
+      username,
+      password,
+    );
+
+    return {
+      secretBlobValues: {
+        [MONGODB_USERNAME_PATH]: username,
+        [MONGODB_PASSWORD_PATH]: password,
+      },
+      runtimeArtifacts: {
+        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,
+      },
+    };
+  },
+
+  /**
+   * Tear down the per-app Mongo database user.
+   *
+   * **Caller status**: no caller wires this in Slices 1–4.B.3.
+   * Forward-compat seam.
+   */
+  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {
+    if (!context.applicationNamespace) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +
+        `applicationNamespace is empty. ` +
+        `The orchestrator MUST supply a non-empty namespace.`,
+      );
+    }
+    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];
+    if (!adminConnectUrl) {
+      throw new Error(
+        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +
+        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the admin Mongo connect URL.`,
+      );
+    }
+    const adminClient = context.adminClient as IMongoSelfAdminClient;
+    // Derived through the SAME function the mint uses. Deriving it independently
+    // here — which is what this line did before named principals existed — meant
+    // revoking a minion left its credential live AND dropped the APPLICATION
+    // BACKEND's database user, because the backend's name is what
+    // `buildMongodbUsername` returns for every input.
+    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);
+
+    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+      // A scoped principal owns a user AND a custom role. Routing it through the
+      // user-only door would leave a privileged role behind that the next mint
+      // adopts without anybody declaring it.
+      const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+      if (!databaseName) {
+        throw new Error(
+          `MongodbSelfInfraProviderModule.revokeAppCredentials: `
+          + `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}' for principal `
+          + `'${context.principal.kind}:${context.principal.name}'. The role to drop lives IN that `
+          + `database — revoking without it would drop the user and silently orphan its privileges.`,
+        );
+      }
+      await adminClient.dropCollectionScopedDatabaseUser({
+        adminConnectUrl,
+        databaseName,
+        username,
+        roleName: `${username}_role`,
+      });
+      return;
+    }
+
+    await adminClient.deleteApplicationDatabaseUser({ adminConnectUrl, username });
+  },
+
+  // No `mintPlatformServiceCredentials` (D-4).
+};