@wildo-ai/platform-infra-providers 1.1.2

package/src/postgres-self/__tests__/postgres-self.infra.module.test.ts

@@ -0,0 +1,344 @@
+/**
+ * Tests for `PostgresSelfInfraProviderModule` (Slice 4.B.2 of
+ * `infra-provider-planner.md`).
+ *
+ * Goals:
+ * - Pin the `plan()` shape so a future regression that drops e.g.
+ *   `PG_ADMIN_PASSWORD` from `secretEnvVars` fails loud.
+ * - Pin the orchestrator-pattern contract: `mintAppCredentials`
+ *   accepts the password via `secretInputs` and returns the
+ *   `connectionUrl` from the admin client — proves the module is
+ *   upsert-only, not generator.
+ * - Pin the per-app database + role naming convention against the
+ *   legacy `platform-infrastructure-manager.service.ts:301-302`
+ *   convention (`wildo_<sanitized>` / `wildo_<sanitized>_user`) so
+ *   a future code change here surfaces as a name diff in this
+ *   test, not as a silent identifier drift on existing apps.
+ * - Pin the optional `applicationConfigInputs.databaseName` override.
+ * - Pin defensive validation of empty `appSlug` and missing
+ *   `secretInputs` keys.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  AppCredentialMintingContext,
+  IPostgresAdminClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { ApplicationRuntimePrincipalKind } from '@wildo-ai/platform-config-lib';
+import { PostgresSelfInfraProviderModule } from '../postgres-self.infra.module';
+
+function makeAdminClientStub(
+  connectionUrl: string = 'postgresql://wildo_wonder_todos_user:secret@postgres:5432/wildo_wonder_todos',
+): IPostgresAdminClient & {
+  upsertApplicationDatabaseSpy: ReturnType<typeof vi.fn>;
+  dropApplicationDatabaseSpy: ReturnType<typeof vi.fn>;
+  upsertTableScopedDatabaseRoleSpy: ReturnType<typeof vi.fn>;
+  dropTableScopedDatabaseRoleSpy: ReturnType<typeof vi.fn>;
+} {
+  const upsertApplicationDatabaseSpy = vi.fn().mockResolvedValue({ connectionUrl });
+  const dropApplicationDatabaseSpy = vi.fn().mockResolvedValue(undefined);
+  const upsertTableScopedDatabaseRoleSpy = vi.fn().mockResolvedValue({
+    connectionUrl: 'postgresql://scoped:secret@postgres:5432/wildo_wonder_todos',
+  });
+  const dropTableScopedDatabaseRoleSpy = vi.fn().mockResolvedValue(undefined);
+  return {
+    upsertApplicationDatabase: upsertApplicationDatabaseSpy,
+    dropApplicationDatabase: dropApplicationDatabaseSpy,
+    upsertTableScopedDatabaseRole: upsertTableScopedDatabaseRoleSpy,
+    dropTableScopedDatabaseRole: dropTableScopedDatabaseRoleSpy,
+    upsertApplicationDatabaseSpy,
+    dropApplicationDatabaseSpy,
+    upsertTableScopedDatabaseRoleSpy,
+    dropTableScopedDatabaseRoleSpy,
+  };
+}
+
+function makeMintContext(
+  adminClient: IPostgresAdminClient,
+  overrides: Partial<AppCredentialMintingContext> = {},
+): AppCredentialMintingContext {
+  return {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '60d21bdf1c4ae5cda1b2c3d4',
+    adminClient,
+    secretInputs: {
+      'database.postgresql.password': 'orchestrator-supplied-password',
+    },
+    ...overrides,
+  };
+}
+
+describe('PostgresSelfInfraProviderModule.plan()', () => {
+  const contribution = PostgresSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'postgresql',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(PostgresSelfInfraProviderModule.provider).toBe(InfraProvider.POSTGRES_SELF);
+    expect(PostgresSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.RELATIONAL_DATABASE,
+    ]);
+  });
+
+  it('contributes the postgres compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['postgres']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/postgres/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares platformAdmin (audience-1) for apps-manager + companion only', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      PG_HOST: 'postgres',
+      PG_PORT: '5432',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual([
+      'PG_ADMIN_USER',
+      'PG_ADMIN_PASSWORD',
+    ]);
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares appRuntime blob paths for the customer-app pod', () => {
+    expect(contribution.appRuntime?.perAppConfigBlobPaths).toEqual({
+      'database.postgresql.host': 'postgres',
+      'database.postgresql.port': 5432,
+    });
+    // Note: NO `database.postgresql.password` path — the password is
+    // embedded in `connectUrl` (Postgres convention), not persisted
+    // separately.
+    expect(contribution.appRuntime?.perAppSecretBlobPaths).toEqual([
+      'database.postgresql.databaseName',
+      'database.postgresql.username',
+      'database.postgresql.connectUrl',
+    ]);
+  });
+});
+
+describe('PostgresSelfInfraProviderModule.mintAppCredentials', () => {
+  it('upserts a per-app database + role using the appSlug-derived names', async () => {
+    const adminClient = makeAdminClientStub();
+    const result = await PostgresSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient),
+    );
+
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledWith({
+      databaseName: 'wildo_wonder_todos',
+      username: 'wildo_wonder_todos_user',
+      password: 'orchestrator-supplied-password',
+    });
+
+    expect(result).toEqual({
+      secretBlobValues: {
+        'database.postgresql.databaseName': 'wildo_wonder_todos',
+        'database.postgresql.username': 'wildo_wonder_todos_user',
+        'database.postgresql.connectUrl':
+          'postgresql://wildo_wonder_todos_user:secret@postgres:5432/wildo_wonder_todos',
+      },
+    });
+  });
+
+  it('honors applicationConfigInputs.databaseName override', async () => {
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient, {
+        applicationConfigInputs: { databaseName: 'authored_override' },
+      }),
+    );
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledWith({
+      databaseName: 'authored_override',
+      username: 'wildo_wonder_todos_user',
+      password: 'orchestrator-supplied-password',
+    });
+  });
+
+  it('sanitizes slugs with hyphens, dots, and uppercase', async () => {
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient, { appSlug: 'My.App-V2' }),
+    );
+    // lowercase + non-alphanumeric→`_` + collapse + trim — matches
+    // legacy `sanitizeForPostgreSQL` in
+    // `platform-infrastructure-manager.service.ts:371-378`.
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledWith({
+      databaseName: 'wildo_my_app_v2',
+      username: 'wildo_my_app_v2_user',
+      password: 'orchestrator-supplied-password',
+    });
+  });
+
+  it('fails loud when secretInputs is missing the password', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      PostgresSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { secretInputs: {} }),
+      ),
+    ).rejects.toThrow(/missing 'database\.postgresql\.password'/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when appSlug is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      PostgresSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { appSlug: '' }),
+      ),
+    ).rejects.toThrow(/appSlug is empty/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('PostgresSelfInfraProviderModule.revokeAppCredentials', () => {
+  it('drops the per-app database + role using the slug-derived names', async () => {
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient),
+    );
+    expect(adminClient.dropApplicationDatabaseSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.dropApplicationDatabaseSpy).toHaveBeenCalledWith({
+      databaseName: 'wildo_wonder_todos',
+      username: 'wildo_wonder_todos_user',
+    });
+  });
+
+  it('honors applicationConfigInputs.databaseName override on drop', async () => {
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient, {
+        applicationConfigInputs: { databaseName: 'authored_override' },
+      }),
+    );
+    expect(adminClient.dropApplicationDatabaseSpy).toHaveBeenCalledWith({
+      databaseName: 'authored_override',
+      username: 'wildo_wonder_todos_user',
+    });
+  });
+
+  it('fails loud when appSlug is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      PostgresSelfInfraProviderModule.revokeAppCredentials!(
+        makeMintContext(adminClient, { appSlug: '' }),
+      ),
+    ).rejects.toThrow(/appSlug is empty/);
+    expect(adminClient.dropApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('PostgresSelfInfraProviderModule audience-2 absence (D-4)', () => {
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(PostgresSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});
+
+
+/**
+ * Step 3 / R1 — a NAMED runtime principal gets a table-scoped role, never the
+ * database-owning one.
+ *
+ * These pins are the PostgreSQL half of the confinement already proven at the
+ * live Mongo, Redis and RabbitMQ services. They are written so that each one
+ * reddens for a DIFFERENT reason: dropping the grant derivation, widening a
+ * verb, falling back to the owner path, or destroying the database on revoke.
+ */
+describe('PostgresSelfInfraProviderModule — per-principal table-scoped role', () => {
+  const minionPrincipal = {
+    kind: ApplicationRuntimePrincipalKind.MINION,
+    name: 'marketingScrapper',
+  } as AppCredentialMintingContext['principal'];
+
+  it('grants ONLY the declared verbs on the declared tables', async () => {
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+      resourceGrants: { read: ['todos'] as never, write: ['events'] as never },
+    }));
+
+    // The owner path must not have been touched at all: reaching it would make
+    // the minion the OWNER of the application's database.
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+    expect(adminClient.upsertTableScopedDatabaseRoleSpy).toHaveBeenCalledTimes(1);
+
+    const call = adminClient.upsertTableScopedDatabaseRoleSpy.mock.calls[0]![0];
+    expect(call.readTables).toEqual(['todos']);
+    // `write` does NOT widen into `read` — the axes stay exactly as declared,
+    // which is the property that makes the authored declaration describe the
+    // outcome. Asserting `readTables` does not contain 'events' is the half
+    // that reddens if somebody "helpfully" merges the axes.
+    expect(call.readTables).not.toContain('events');
+    expect(call.writeTables).toEqual(['events']);
+    expect(call.schemaName).toBe('public');
+  });
+
+  it('REFUSES to mint when the principal declared no resourceAccess (D11/R3)', async () => {
+    // The dangerous alternative is not an exception — it is silently falling
+    // through to `upsertApplicationDatabase`, which would hand the minion
+    // ownership. So the pin asserts BOTH that it throws and that nothing was
+    // provisioned.
+    const adminClient = makeAdminClientStub();
+    await expect(
+      PostgresSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient, {
+        principal: minionPrincipal,
+      })),
+    ).rejects.toThrow(/no resourceGrants/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+    expect(adminClient.upsertTableScopedDatabaseRoleSpy).not.toHaveBeenCalled();
+  });
+
+  it('leaves the APPLICATION BACKEND on the owner path with its legacy name', async () => {
+    // The backend must keep `wildo_<slug>_user` VERBATIM: a renamed owner role
+    // orphans every existing deployment's database.
+    const adminClient = makeAdminClientStub();
+    const result = await PostgresSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient, {
+      principal: {
+        kind: ApplicationRuntimePrincipalKind.APPLICATION_BACKEND,
+      } as AppCredentialMintingContext['principal'],
+    }));
+    expect(adminClient.upsertTableScopedDatabaseRoleSpy).not.toHaveBeenCalled();
+    expect(result!.secretBlobValues['database.postgresql.username']).toBe('wildo_wonder_todos_user');
+  });
+
+  it('revokes a named principal WITHOUT dropping the application database', async () => {
+    // The single most destructive failure available in this file. Before named
+    // principals existed, `revokeAppCredentials` had exactly one path, and it
+    // drops the DATABASE — retiring one minion through it would destroy the
+    // whole application's data while reporting success.
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+    }));
+    expect(adminClient.dropApplicationDatabaseSpy).not.toHaveBeenCalled();
+    expect(adminClient.dropTableScopedDatabaseRoleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('derives the SAME role name on mint and on revoke', async () => {
+    // Fourth service where a divergent derivation would leave an orphaned,
+    // still-valid credential behind. Compared rather than asserted against a
+    // literal, so the pin survives a deliberate naming change and only fails
+    // when the two sides DISAGREE.
+    const adminClient = makeAdminClientStub();
+    await PostgresSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+      resourceGrants: { read: ['todos'] as never, write: [] as never },
+    }));
+    await PostgresSelfInfraProviderModule.revokeAppCredentials!(makeMintContext(adminClient, {
+      principal: minionPrincipal,
+    }));
+    expect(adminClient.dropTableScopedDatabaseRoleSpy.mock.calls[0]![0].username)
+      .toBe(adminClient.upsertTableScopedDatabaseRoleSpy.mock.calls[0]![0].username);
+    // And it must not collide with the backend's owner role.
+    expect(adminClient.upsertTableScopedDatabaseRoleSpy.mock.calls[0]![0].username)
+      .not.toBe('wildo_wonder_todos_user');
+  });
+});