@wildo-ai/platform-infra-providers 1.1.2

package/src/postgres-self/postgres-self.infra.module.ts

@@ -0,0 +1,377 @@
+/**
+ * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`
+ * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B.1 pattern).
+ *
+ * Implements the `POSTGRES_SELF` `InfraProvider` over the
+ * `IPostgresAdminClient` transport (raw `pg` Pool against the
+ * Postgres admin connection, exposed by
+ * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C
+ * policy/transport split). Owns ALL per-app naming policy — the
+ * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,
+ * `wildo_<sanitized>` mirroring the legacy
+ * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `appSlug` — used as the source for the sanitized database +
+ *   user name. Mirrors the legacy convention at
+ *   `platform-infrastructure-manager.service.ts:300-302`
+ *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,
+ *   `databaseName = wildo_${sanitizedName}`,
+ *   `username = wildo_${sanitizedName}_user`).
+ * - `secretInputs['database.postgresql.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['databaseName']` — optional override
+ *   for the derived database name. Mirrors the legacy
+ *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.
+ * - `adminClient` — narrowed to `IPostgresAdminClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4
+ * forward-compat documentation):
+ * - `applicationNamespace` — Postgres per-app DB names use the
+ *   slug-derived sanitized form (env-suffix isolation comes from
+ *   the surrounding env-scoped admin connection). Future modules
+ *   may switch to namespace-scoped naming if cross-env collision
+ *   risk surfaces.
+ * - `wildoApplicationId` — Postgres role names embed the
+ *   sanitized slug, NOT the application id. This is the legacy
+ *   convention; preserved for back-compat with apps already
+ *   provisioned.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide Postgres admin creds. Consumers: `apps-manager`
+ *    (mints per-app DB+role via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app Postgres database +
+ *    role. Result threaded into
+ *    `Wildo_Application_Secrets.database.postgresql.{
+ *    databaseName, username, connectUrl}` via
+ *    `_merge_WildoApplicationSecrets`. Note: the password is
+ *    embedded in `connectUrl` — there is no separate
+ *    `database.postgresql.password` blob path today (matches the
+ *    legacy persistence shape at
+ *    `wildo-application-lifecycle.service.ts:2191-2200`).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Postgres for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+
+import {
+  AppCredentialMintingContext,
+  AppCredentialMintingResult,
+  IPostgresAdminClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+  ApplicationRuntimePrincipal,
+  ApplicationRuntimePrincipalKind,
+  resolveGrantStorageNames,
+} from '@wildo-ai/platform-config-lib';
+
+/**
+ * Default Postgres port (matches `INFRA_DEFAULT_PORTS.POSTGRES` in
+ * the shared platform constants — duplicated as a literal because
+ * the planner output is consumed by the CLI which materializes it
+ * into `Wildo_Application_Config` blob paths).
+ */
+const DEFAULT_POSTGRES_PORT = 5432;
+
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes
+ * through `mintAppCredentials`. Declared once and reused as
+ * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of
+ * `secretBlobValues` in the result, so a refactor that renames a
+ * path fails loudly at one place.
+ *
+ * Note: the password is embedded in `connectUrl` (Postgres
+ * convention); there is no separate `database.postgresql.password`
+ * blob path today. The orchestrator persists `connectUrl`
+ * verbatim into `Wildo_Application_Secrets`.
+ */
+const POSTGRES_DATABASE_NAME_PATH = 'database.postgresql.databaseName';
+const POSTGRES_USERNAME_PATH = 'database.postgresql.username';
+const POSTGRES_CONNECT_URL_PATH = 'database.postgresql.connectUrl';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [
+  POSTGRES_DATABASE_NAME_PATH,
+  POSTGRES_USERNAME_PATH,
+  POSTGRES_CONNECT_URL_PATH,
+];
+
+
+/**
+ * Key the module looks for in `secretInputs` to read the
+ * orchestrator-supplied password.
+ */
+const POSTGRES_PASSWORD_INPUT_KEY = 'database.postgresql.password';
+
+/**
+ * Optional key the module looks for in `applicationConfigInputs`
+ * for an authored database-name override. When omitted, the module
+ * derives the database name from `appSlug` via `sanitizeForPostgreSQL`.
+ */
+const POSTGRES_DATABASE_NAME_INPUT_KEY = 'databaseName';
+
+/**
+ * Sanitize an application slug for Postgres identifier rules.
+ * Mirrors the legacy `sanitizeForPostgreSQL` at
+ * `platform-infrastructure-manager.service.ts:371-378`:
+ * - lowercase
+ * - `[^a-z0-9_]` → `_`
+ * - collapse multiple `_`
+ * - strip leading/trailing `_`
+ * - cap at 50 chars (Postgres identifier limit is 63; leaves room
+ *   for the `wildo_` prefix and `_user` suffix).
+ *
+ * Centralized here so the module owns the convention; if the cap
+ * or escape rules change, one site changes.
+ */
+function sanitizeForPostgres(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9_]/g, '_')
+    .replace(/_+/g, '_')
+    .replace(/^_|_$/g, '')
+    .substring(0, 50);
+}
+
+/**
+ * Compute the per-app database name. Mirrors legacy convention at
+ * `platform-infrastructure-manager.service.ts:301`:
+ *   `wildo_<sanitized>`
+ */
+function buildDatabaseName(appSlug: string): string {
+  return `wildo_${sanitizeForPostgres(appSlug)}`;
+}
+
+/**
+ * Compute the per-app database role. Mirrors legacy convention at
+ * `platform-infrastructure-manager.service.ts:302`:
+ *   `wildo_<sanitized>_user`
+ */
+function buildUsername(appSlug: string): string {
+  return `wildo_${sanitizeForPostgres(appSlug)}_user`;
+}
+
+/**
+ * The schema a per-app database's resource tables live in.
+ *
+ * `public` is what the schema planner targets today. Named as a constant rather
+ * than inlined at the four sites that need it because a grant issued into one
+ * schema and revoked from another is a revocation that silently succeeds while
+ * narrowing nothing.
+ */
+const POSTGRES_APPLICATION_SCHEMA = 'public';
+
+/**
+ * Per-principal Postgres role name — the SAME derivation the revoke path uses.
+ *
+ * Fourth time this shape appears (Redis, RabbitMQ, Mongo, now Postgres), and the
+ * consequence is worse here than anywhere else: a revoke that derived the name
+ * differently would miss the minion's role AND, on the pre-existing
+ * `dropApplicationDatabase` path, take the application's entire database with
+ * it. The application backend keeps `wildo_<slug>_user` VERBATIM so an existing
+ * deployment's owner role is never orphaned.
+ */
+function buildPostgresPrincipalUsername(
+  appSlug: string,
+  principal: ApplicationRuntimePrincipal | undefined,
+): string {
+  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+    return buildUsername(appSlug);
+  }
+  return `wildo_${sanitizeForPostgres(appSlug)}_${sanitizeForPostgres(principal.kind)}_`
+    + `${sanitizeForPostgres(principal.name ?? '')}_user`;
+}
+
+export const PostgresSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.POSTGRES_SELF,
+  supportedCapabilities: [InfraCapability.RELATIONAL_DATABASE],
+  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['postgres'],
+      k8sResources: ['templates/infra/k8s/internal/postgres/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {
+          PG_HOST: 'postgres',
+          PG_PORT: String(DEFAULT_POSTGRES_PORT),
+        },
+        // Admin user + password to provision per-app DBs/roles. The
+        // legacy admin-init code reads these from `PG_ADMIN_USER` /
+        // `PG_ADMIN_PASSWORD`; the planner emits the keys, the
+        // CLI's `env-vars-builder` writes the values at sync time.
+        secretEnvVars: ['PG_ADMIN_USER', 'PG_ADMIN_PASSWORD'],
+        // Audience-1 only (DB-admin access). No audience-2
+        // platform-service-scoped Postgres use case today (D-4).
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      appRuntime: {
+        // Static topology — same for every app in this env. The
+        // per-app values (databaseName, username, connectUrl) flow
+        // through `perAppSecretBlobPaths`.
+        perAppConfigBlobPaths: {
+          'database.postgresql.host': 'postgres',
+          'database.postgresql.port': DEFAULT_POSTGRES_PORT,
+        },
+        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+      },
+    };
+  },
+
+  async mintAppCredentials(
+    context: AppCredentialMintingContext,
+  ): Promise<AppCredentialMintingResult> {
+    const adminClient = context.adminClient as IPostgresAdminClient;
+    const password = context.secretInputs[POSTGRES_PASSWORD_INPUT_KEY];
+    if (!password) {
+      throw new Error(
+        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +
+        `secretInputs is missing '${POSTGRES_PASSWORD_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the Postgres password — modules are upsert-only.`,
+      );
+    }
+    if (!context.appSlug) {
+      throw new Error(
+        `PostgresSelfInfraProviderModule.mintAppCredentials: ` +
+        `appSlug is empty. ` +
+        `The orchestrator MUST supply a non-empty slug.`,
+      );
+    }
+
+    // Allow operator override of the derived database name. Without
+    // an override, derive from `appSlug` via the legacy convention.
+    const databaseName =
+      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]
+      || buildDatabaseName(context.appSlug);
+    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);
+
+    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+      // A named principal gets a TABLE-SCOPED role (Step 3 / R1 / D14): exactly
+      // the verbs its `resourceAccess` derived, on exactly the tables that
+      // declaration names, inside a database it does not own.
+      //
+      // `resourceGrants` is REQUIRED and its absence is an error rather than a
+      // default. Falling through to `upsertApplicationDatabase` would make the
+      // minion the OWNER of the application's database with `ALL PRIVILEGES` —
+      // the exact over-grant this path replaces, arriving silently through a
+      // code path that reads as if it were doing the narrow thing.
+      const grants = context.resourceGrants;
+      if (!grants) {
+        throw new Error(
+          `PostgresSelfInfraProviderModule.mintAppCredentials: `
+          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `
+          + `Refusing to fall back to the database-wide application role — a minion with no declared `
+          + `access must get NO database role at all (D11/R3), which is the orchestrator's decision to make.`,
+        );
+      }
+      const { connectionUrl: principalConnectionUrl } = await adminClient.upsertTableScopedDatabaseRole({
+        databaseName,
+        username,
+        password,
+        schemaName: POSTGRES_APPLICATION_SCHEMA,
+        // Resource types → table names HERE, at the adapter that speaks
+        // Postgres. The grant contract itself stays in the platform vocabulary,
+        // and passes through the SAME translation Mongo uses, so the two
+        // adapters cannot disagree about which rows a resource type addresses.
+        readTables: resolveGrantStorageNames(grants.read),
+        writeTables: resolveGrantStorageNames(grants.write),
+      });
+
+      return {
+        secretBlobValues: {
+          [POSTGRES_DATABASE_NAME_PATH]: databaseName,
+          [POSTGRES_USERNAME_PATH]: username,
+          [POSTGRES_CONNECT_URL_PATH]: principalConnectionUrl,
+        },
+      };
+    }
+
+    // CREATE/ALTER USER + CREATE DATABASE — idempotent upsert. The
+    // admin-client reapplies privileges every time so the call is
+    // safe to repeat.
+    const { connectionUrl } = await adminClient.upsertApplicationDatabase({
+      databaseName,
+      username,
+      password,
+    });
+
+    return {
+      secretBlobValues: {
+        [POSTGRES_DATABASE_NAME_PATH]: databaseName,
+        [POSTGRES_USERNAME_PATH]: username,
+        [POSTGRES_CONNECT_URL_PATH]: connectionUrl,
+      },
+    };
+  },
+
+  /**
+   * Tear down the per-app Postgres database + role. Idempotent: the
+   * underlying admin client treats missing DB / missing user as
+   * no-ops.
+   *
+   * **Caller status** (F6 of 2026-05-06 plan review): no caller
+   * wires this in Slices 1–4.B.2. Method ships as a forward-compat
+   * seam for whichever future slice designs the app-deletion
+   * lifecycle.
+   *
+   * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty
+   * `appSlug` would derive an empty database name; we fail-loud
+   * instead so a bad caller surfaces immediately.
+   */
+  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {
+    if (!context.appSlug) {
+      throw new Error(
+        `PostgresSelfInfraProviderModule.revokeAppCredentials: ` +
+        `appSlug is empty. ` +
+        `The orchestrator MUST supply a non-empty slug.`,
+      );
+    }
+    const adminClient = context.adminClient as IPostgresAdminClient;
+    const databaseName =
+      context.applicationConfigInputs?.[POSTGRES_DATABASE_NAME_INPUT_KEY]
+      || buildDatabaseName(context.appSlug);
+    const username = buildPostgresPrincipalUsername(context.appSlug, context.principal);
+
+    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+      // A named principal owns NOTHING but its own role. Routing it through
+      // `dropApplicationDatabase` — which is what this method did before named
+      // principals existed — would DROP THE APPLICATION'S DATABASE while
+      // believing it was retiring one minion's access.
+      await adminClient.dropTableScopedDatabaseRole({
+        databaseName,
+        username,
+        schemaName: POSTGRES_APPLICATION_SCHEMA,
+      });
+      return;
+    }
+
+    await adminClient.dropApplicationDatabase({ databaseName, username });
+  },
+
+  // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —
+  // audience-2 not applicable to Postgres_Self today).
+};