@wildo-ai/platform-infra-providers 1.1.2

package/src/rabbitmq-self/rabbitmq-self.infra.module.ts

@@ -0,0 +1,531 @@
+/**
+ * `RabbitmqSelfInfraProviderModule` — first concrete `InfraProviderModule`
+ * (Slices 1–2.5 of `infra-provider-planner.md`).
+ *
+ * Implements the `RABBITMQ_SELF` `InfraProvider` over the
+ * `IRabbitMQManagementClient` transport (raw HTTP `PUT /api/users` etc.,
+ * exposed by `RabbitMQConnectionManagerService` after the 5C policy/
+ * transport split). Owns ALL per-app and per-platform-service
+ * permission policy — the regex shapes, the broader-permission
+ * special case for `crontabs-batches-manager`, the per-app username
+ * convention, the optional vhost activation.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the rabbit username
+ *   (`<appSlug>-<envId>`, the legacy convention from
+ *   `wildo-application-lifecycle.service.ts`).
+ * - `wildoApplicationId` — used as the permission-regex disambiguator
+ *   (matches `^wildo\.(queue|reply)\.<id>\..*`).
+ * - `secretInputs['database.rabbitmq.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['vhost']` — optional per-app vhost
+ *   for true vhost-level isolation (Slice 2.5c-3).
+ * - `adminClient` — narrowed to `IRabbitMQManagementClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4):
+ * - `appSlug` — RabbitMQ resources are namespace-scoped, not slug-
+ *   scoped. Future modules (MongoDB DB name, etc.) WILL use `appSlug`.
+ *   This is documented forward-compat for module authors: not every
+ *   module reads every context field; each declares which it consumes.
+ *
+ * **Three audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide management-API creds (`RABBITMQ_ADMIN_USERNAME` /
+ *    `RABBITMQ_ADMIN_PASSWORD`). Consumers: `apps-manager`,
+ *    `companion`. Delivered through process.env (the CLI's
+ *    `env-vars-builder` writes them per-env). No method.
+ *
+ * 2. **Audience-2 (platform-service-scoped, via
+ *    `mintPlatformServiceCredentials`)**: per-platform-service broker
+ *    users for inter-service messaging (`apps-manager`,
+ *    `crontabs-batches-manager`, `file-generator`). Username =
+ *    `serviceName`; permission regex is service-namespaced
+ *    (`^wildo\.platform\.<slug>\..*`); crontabs gets the broader
+ *    `^wildo\.(queue|reply|platform)\..*` per the legacy override.
+ *
+ *    **Slice 2.5 behavior-parity note**: the legacy code paths
+ *    `provisionServiceCredentials` and `ensureAppsManagerCredentials`
+ *    produced slightly different topic-permission regexes for the
+ *    same apps-manager user (`wildo\.platform\.apps_manager\..*` vs
+ *    `wildo.platform.apps_manager.*`). User permissions were therefore
+ *    order-dependent. This module unifies on the dot-escaped variant.
+ *    Functionally equivalent for real queue names; tighter spec.
+ *
+ *    **Slice 4.A.2 / M2 design note**: the legacy
+ *    `getDefaultRabbitMQPermissions.read` field declared a BROADER
+ *    regex than `configure`/`write` (included
+ *    `wildo.platform.broadcast.*`) — but that widening NEVER reached
+ *    the broker (the legacy `upsertTenantUserPermissions` ignored
+ *    the `read` arg and used `resourceNameRegex` for both
+ *    `configure` and `read`). This module preserves that behavior:
+ *    `read === configure`. If platform services need a broadcast
+ *    namespace in the future, extend `mintPlatformServiceCredentials`
+ *    with an explicit broadcast-read regex.
+ *
+ * 3. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app broker user. Username
+ *    = `applicationNamespace`; permission regex disambiguates by
+ *    `wildoApplicationId` (Mongo ObjectId — globally unique). Result
+ *    threaded into `Wildo_Application_Secrets.database.rabbitmq.{
+ *    username, password}` via `_merge_WildoApplicationSecrets`.
+ *
+ * **Vhost activation (Slice 2.5c-3, opt-in)**: when the operator
+ * authors `backingServices.rabbitmq.vhost` in
+ * `wildo.infra.<envName>.config.ts`, the CLI emits `RABBITMQ_VHOST`
+ * into apps-manager's process.env; the lifecycle service threads it
+ * via `applicationConfigInputs.vhost`; this module
+ * `ensureVhost`-then-permissions-on-it. Without the field, the
+ * module falls back to `/` (legacy permission-regex isolation).
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+
+import {
+  AppCredentialMintingContext,
+  AppCredentialMintingResult,
+  IRabbitMQManagementClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+  PlatformServiceCredentialMintingContext,
+  PlatformServiceCredentialMintingResult,
+  ApplicationRuntimePrincipalKind,
+  buildRuntimePrincipalQueueSegment,
+  type ApplicationRuntimePrincipal,
+} from '@wildo-ai/platform-config-lib';
+
+/**
+ * Default vhost — apps share `/` with regex-based per-user permission
+ * isolation. Per-app vhost is intentionally NOT modeled (engine has no
+ * `RABBITMQ_VHOST` consumer; isolation comes from the permission regex
+ * on the per-app user, not from a per-app vhost).
+ *
+ * **No `ensureVhost(DEFAULT_VHOST)` call** is needed: vhost `/` is
+ * created by RabbitMQ at server boot. Any future module variant that
+ * uses a non-default vhost MUST call `adminClient.ensureVhost(...)`
+ * before user/permissions setup.
+ */
+const DEFAULT_VHOST = '/';
+
+/**
+ * Topic exchange used by every Wildo runtime publisher / consumer.
+ * Matches the value already in use at
+ * `wildo-application-lifecycle.service.ts:568` and
+ * `platform-infrastructure-manager.service.ts:485`.
+ */
+const TOPIC_EXCHANGE = 'amq.topic';
+
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes through
+ * `mintAppCredentials`. Declared once and reused as
+ * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of
+ * `secretBlobValues` in the result, so a refactor that renames a path
+ * fails loudly at one place instead of drifting silently.
+ */
+const RABBITMQ_USERNAME_PATH = 'database.rabbitmq.username';
+const RABBITMQ_PASSWORD_PATH = 'database.rabbitmq.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [RABBITMQ_USERNAME_PATH, RABBITMQ_PASSWORD_PATH];
+
+
+/**
+ * Key the module looks for in
+ * `AppCredentialMintingContext.applicationConfigInputs` to read the
+ * optional per-app virtual host. Documented here as the public
+ * contract: the orchestrator supplies the vhost via this key, the
+ * module reads it via this key. Slice 2.5c-3 of
+ * `infra-provider-planner.md`.
+ */
+const VHOST_INPUT_KEY = 'vhost';
+
+/**
+ * Key the module looks for in
+ * `PlatformServiceCredentialMintingContext.secretInputs` to read the
+ * orchestrator-supplied platform-service password. Slice 4.A.2 / M5
+ * of `infra-provider-planner.md` — extracted as a constant for
+ * symmetry with `RABBITMQ_PASSWORD_PATH` (used by `mintAppCredentials`),
+ * so a future rename touches one site instead of drifting silently.
+ */
+const PLATFORM_SERVICE_PASSWORD_INPUT_KEY = 'password';
+
+/**
+ * Compute the per-app rabbit username. Mirrors the existing convention
+ * at `wildo-application-lifecycle.service.ts:434, 440` — username is
+ * the application namespace (`<appSlug>-<environmentId>` per
+ * `buildApplicationNamespace`), NOT the raw slug. Centralized here so
+ * future changes touch one site.
+ */
+function buildRabbitUsername(applicationNamespace: string): string {
+  return applicationNamespace;
+}
+
+/**
+ * Identifier of the platform-crontabs-batches-manager service. The
+ * crontabs special case (broader permissions covering all per-app
+ * queue/reply names so it can fan out scheduled jobs) lives here so
+ * the legacy hard-coded check at
+ * `platform-infrastructure-manager.service.ts:466-475` becomes a
+ * module-internal concern.
+ *
+ * Hardcoded as a string literal rather than imported from
+ * `PlatformApplicationType` because that enum lives in saas-models
+ * and importing it here would couple the module to that enum's
+ * runtime shape — the value `'platform_crontabs_batches_manager'` is
+ * stable and small.
+ */
+const PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME = 'platform_crontabs_batches_manager';
+
+/**
+ * Compute the per-platform-service permission regex.
+ *
+ * Default policy (apps-manager, file-generator, …): the service can
+ * configure / write / read on `^wildo\.platform\.<serviceSlug>\..*`
+ * where `serviceSlug = serviceName.replace('platform_', '')`. Mirrors
+ * the legacy `getDefaultRabbitMQPermissions` at
+ * `credentials-provisioner.service.ts:267-275`.
+ *
+ * Crontabs-batches-manager override: broader regex
+ * `^wildo\.(queue|reply|platform)\..*` so the crontab can publish
+ * scheduled jobs onto every per-app queue and read replies. Mirrors
+ * the legacy inline override at
+ * `platform-infrastructure-manager.service.ts:466-475`.
+ */
+function buildPlatformServiceRegex(serviceName: string): string {
+  if (serviceName === PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME) {
+    return '^wildo\\.(queue|reply|platform)\\..*';
+  }
+  const serviceSlug = serviceName.replace('platform_', '');
+  return `^wildo\\.platform\\.${serviceSlug}\\..*`;
+}
+
+/**
+ * Compute the per-app permission regex. Matches the convention at
+ * `wildo-application-lifecycle.service.ts:552`:
+ *   `^wildo\.(queue|reply)\.${wildoApplicationId}\..*`
+ * The disambiguator is the application ID, NOT the slug — slugs could
+ * theoretically be reassigned; the id is forever-stable. The `^` and
+ * `\.` escaping is required by the RabbitMQ regex evaluator.
+ */
+function buildPermissionRegex(wildoApplicationId: string): string {
+  // Escape regex metacharacters that may appear in application ids
+  // (today they're Mongo ObjectId hex strings — no specials — but the
+  // contract only commits to "stable opaque string", so guard).
+  const escapedId = wildoApplicationId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return `^wildo\\.(queue|reply)\\.${escapedId}\\..*`;
+}
+
+/**
+ * The queues a MINION may CONSUME from — its own tick queue only.
+ *
+ * ## Why only `read` narrows, measured rather than assumed
+ *
+ * A minion runs the full backend pipeline headless, so the three RabbitMQ
+ * permission axes are not interchangeable here:
+ *
+ * - **`read`** governs CONSUMING. Narrowing it is the containment that matters:
+ *   without it a minion can drain the application backend's job queue, consume
+ *   another minion's ticks, or read RPC replies addressed to the backend.
+ * - **`configure`** governs DECLARE. The tick consumer declares its own queue
+ *   (`channel.assertQueue`) — but the delayed-publish path can declare a delay
+ *   queue too, so narrowing this risks breaking a legitimate publish.
+ * - **`write`** governs PUBLISHING. A minion legitimately enqueues jobs and
+ *   sends RPC replies into the application's namespace; `publish` calls
+ *   `sendToQueue` WITHOUT asserting (verified in
+ *   `rabbitmq-adapter.backend.service.ts`), so it needs `write` on the app
+ *   namespace and nothing more.
+ *
+ * **What this therefore does NOT prevent, stated plainly:** a minion can still
+ * PUBLISH anywhere in its application's queue namespace — it could enqueue a job
+ * the backend will run. Constraining that is a different control (who may
+ * request what work), not a broker permission, and pretending otherwise would
+ * overstate the boundary.
+ *
+ * The trailing `(\..*)?$` admits the tick queue itself and any suffixed
+ * variant, while the anchored `$` stops it matching a SIBLING whose name merely
+ * starts with this one's.
+ */
+/**
+ * Per-principal broker username — the SAME derivation `revokeAppCredentials`
+ * must use.
+ *
+ * The application backend keeps `applicationNamespace` VERBATIM so an existing
+ * deployment's user is never orphaned. A revoke that derived this differently
+ * would delete the BACKEND's broker user while believing it was removing a
+ * minion's — the identical trap already caught on the Redis side.
+ */
+function buildRabbitPrincipalUsername(
+  applicationNamespace: string,
+  principal: ApplicationRuntimePrincipal | undefined,
+): string {
+  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+    return buildRabbitUsername(applicationNamespace);
+  }
+  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  return `${applicationNamespace}-${principal.kind}-${sanitizedName}`;
+}
+
+function buildMinionConsumeRegex(wildoApplicationId: string, minionName: string): string {
+  const escape = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const appId = escape(wildoApplicationId);
+  const name = escape(minionName);
+  // Two alternatives, and nothing else:
+  //   its tick queue      — wildo.queue.<appId>.minion-tick.<name>
+  //   its OWN reply queue — wildo.reply.<appId>.<segment>.<podId>
+  // The reply segment is IMPORTED from the same builder the minion's own AMQP
+  // adapter uses, not reproduced here. It used to be hand-written as
+  // `minion-<name>` with a comment saying it "mirrors" what the adapter emits —
+  // which agreed only while every minion name survived sanitisation unchanged.
+  // The application backend gets no segment at all (the builder returns
+  // undefined for it), keeping the historical layout, so this cannot match its
+  // replies.
+  const replySegment = escape(
+    buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, minionName) ?? '',
+  );
+  return `^(wildo\\.queue\\.${appId}\\.minion-tick\\.${name}(\\..*)?`
+    + `|wildo\\.reply\\.${appId}\\.${replySegment}\\..*)$`;
+}
+
+export const RabbitmqSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.RABBITMQ_SELF,
+  supportedCapabilities: [InfraCapability.QUEUING_SYSTEM],
+  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['rabbitmq'],
+      k8sResources: ['templates/infra/k8s/internal/rabbitmq/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {
+          RABBITMQ_HOST: 'rabbitmq',
+          RABBITMQ_PORT: '5672',
+          RABBITMQ_MANAGEMENT_PORT: '15672',
+        },
+        secretEnvVars: ['RABBITMQ_ADMIN_USERNAME', 'RABBITMQ_ADMIN_PASSWORD'],
+        // Audience-1 only (management-API access). audience-2 platform-
+        // service-scoped consumers (apps-manager / crontabs / file-
+        // generator publish-consume creds via `provisionAllPlatformServices`)
+        // are LD-8 territory, deferred to Slice 2.5 — they get their
+        // own `mintPlatformServiceCredentials` method then.
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      appRuntime: {
+        // Declared for forward-compat with Slice 2.5's
+        // `_merge_WildoApplicationConfig` integration. Not consumed by
+        // any planner path in Slice 2 — the existing hard-coded values
+        // at `wildo-application-lifecycle.service.ts:1796-1799` stay in
+        // effect (host: 'localhost', port: 5672) until the planner
+        // wires this slice's contribution.
+        perAppConfigBlobPaths: {
+          'database.rabbitmq.host': 'rabbitmq',
+          'database.rabbitmq.port': 5672,
+        },
+        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+      },
+    };
+  },
+
+  async mintAppCredentials(
+    context: AppCredentialMintingContext,
+  ): Promise<AppCredentialMintingResult> {
+    const adminClient = context.adminClient as IRabbitMQManagementClient;
+    const password = context.secretInputs[RABBITMQ_PASSWORD_PATH];
+    if (!password) {
+      throw new Error(
+        `RabbitmqSelfInfraProviderModule.mintAppCredentials: ` +
+        `secretInputs is missing '${RABBITMQ_PASSWORD_PATH}'. ` +
+        `The orchestrator MUST supply the rabbit password — modules are upsert-only.`,
+      );
+    }
+
+    const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);
+    const permissionRegex = buildPermissionRegex(context.wildoApplicationId);
+    // A MINION consumes exactly two things: its own tick queue, and its own RPC
+    // REPLY queue. Both are admitted; everything else in the application's
+    // namespace is refused.
+    //
+    // The reply half is why an earlier attempt at this failed. Reply queues used
+    // to be `wildo.reply.<appId>.<podId>`, and `podId` is a per-PROCESS token
+    // carrying no principal — so no regex could admit a minion's replies while
+    // refusing the backend's, and narrowing `read` crash-looped the minion on
+    // its own replies. `buildReplyQueueName` now embeds the owning runtime,
+    // which is what makes this expressible at all.
+    const readRegex = context.principal?.kind === ApplicationRuntimePrincipalKind.MINION && context.principal.name
+      ? buildMinionConsumeRegex(context.wildoApplicationId, context.principal.name)
+      : permissionRegex;
+
+    // Slice 2.5c-3: optional per-app vhost. When the orchestrator
+    // supplies a non-empty `applicationConfigInputs.vhost`, the module
+    // ensures the vhost exists and sets permissions ON THAT vhost
+    // (provides true vhost-level isolation). When omitted, the module
+    // falls back to the default vhost `/` (legacy Slice 2 behavior:
+    // permission-regex isolation only). This is the opt-in seam — apps
+    // without an authored `backingServices.rabbitmq.vhost` continue to
+    // share `/`.
+    const vhost = context.applicationConfigInputs?.[VHOST_INPUT_KEY] || DEFAULT_VHOST;
+    if (vhost !== DEFAULT_VHOST) {
+      await adminClient.ensureVhost(vhost);
+    }
+
+    // PUT /api/users — idempotent upsert (replaces password + tags on conflict).
+    await adminClient.putUser(username, password, []);
+
+    // PUT /api/permissions — `configure` and `read` use the per-app
+    // queue/reply regex; `write` widens to allow `amq.default` (the
+    // default exchange RabbitMQ uses for direct routing) and the empty
+    // string (broker-internal). Mirrors the legacy
+    // `upsertTenantUserPermissions` write-regex shape so the Wonder
+    // Todos behavior is unchanged.
+    const writeRegex = `(^$|amq\\.default|${permissionRegex})`;
+    await adminClient.setPermissions(vhost, username, {
+      configure: permissionRegex,
+      write: writeRegex,
+      read: readRegex,
+    });
+
+    // PUT /api/topic-permissions — same regex on the topic exchange.
+    await adminClient.setTopicPermissions(vhost, username, {
+      exchange: TOPIC_EXCHANGE,
+      write: permissionRegex,
+      read: readRegex,
+    });
+
+    // Per-app-vhost cron delivery (`.claude/plans/crontab-publisher-vhost-gap.md`).
+    //
+    // A per-app vhost is a HARD broker isolation boundary: the platform
+    // cron/minion publisher (`platform_crontabs_batches_manager`) — a single
+    // global user that fans scheduled jobs into every app — cannot reach THIS
+    // app's queues until granted access on THIS vhost. On the default vhost `/`
+    // it already holds a broad publish grant (see `mintPlatformServiceCredentials`),
+    // so the grant is only needed for a non-default per-app vhost.
+    //
+    // Scope it to this app's own queue namespace (`^wildo\.(queue|reply)\.<appId>\..*`)
+    // — the publisher gets exactly the reach it needs and no more, TIGHTER than
+    // its broad default-vhost grant. It is PUBLISH-ONLY: `configure` for the
+    // passive `checkQueue` existence probe the publisher runs before sending +
+    // any declare, `write` (`amq.default`) for `basic.publish`; NO `read` (never
+    // consumes) and NO topic permissions (uses the default exchange, not
+    // `amq.topic`). The crontabs user is provisioned before any app
+    // (apps-manager INIT Phase 4 < Phase 5), so it reliably exists here, and
+    // `setPermissions` is an idempotent PUT — a re-init safely re-applies it.
+    if (vhost !== DEFAULT_VHOST) {
+      await adminClient.setPermissions(vhost, PLATFORM_CRONTABS_BATCHES_MANAGER_SERVICE_NAME, {
+        configure: permissionRegex,
+        write: writeRegex,
+        read: '',
+      });
+    }
+
+    return {
+      secretBlobValues: {
+        [RABBITMQ_USERNAME_PATH]: username,
+        // Echo the orchestrator-supplied password — proves the module
+        // is upsert-only, not generator. The orchestrator persists
+        // this exact value into `Wildo_Application_Secrets`.
+        [RABBITMQ_PASSWORD_PATH]: password,
+      },
+    };
+  },
+
+  /**
+   * Tear down the per-app rabbit user. RabbitMQ users are global, so
+   * `deleteUser` removes the user (and its permissions on every vhost
+   * it had access to) atomically.
+   *
+   * **Vhost retention** (Slice 4.A.2 / M6): when `mintAppCredentials`
+   * provisioned a per-app vhost (Slice 2.5c-3), `revokeAppCredentials`
+   * does NOT delete the vhost. Reasoning: vhost deletion drops every
+   * queue and exchange inside it, which would destroy in-flight
+   * messages mid-flight if a redeploy or restart is happening
+   * concurrently. The user-deletion alone is sufficient to revoke
+   * access; the empty vhost lingers as a paper trail. A future
+   * "app-deletion lifecycle" slice can layer vhost cleanup with
+   * proper drain semantics.
+   *
+   * **Caller status** (F6 of 2026-05-06 plan review): no caller wires
+   * this in Slices 1–2.5. `wildo-application-lifecycle.service.ts`
+   * has no app-deletion ceremony to invoke it from. Method ships as a
+   * forward-compat seam for whichever future slice designs the
+   * app-deletion lifecycle.
+   *
+   * **Defensive validation** (Slice 4.A.2 / L4): empty
+   * `applicationNamespace` would call `DELETE /api/users/` and
+   * silently 404; we fail-loud instead so a bad caller surfaces
+   * immediately.
+   */
+  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {
+    if (!context.applicationNamespace) {
+      throw new Error(
+        `RabbitmqSelfInfraProviderModule.revokeAppCredentials: ` +
+        `applicationNamespace is empty. ` +
+        `The orchestrator MUST supply a non-empty namespace.`,
+      );
+    }
+    const adminClient = context.adminClient as IRabbitMQManagementClient;
+    const username = buildRabbitPrincipalUsername(context.applicationNamespace, context.principal);
+    await adminClient.deleteUser(username);
+  },
+
+  async mintPlatformServiceCredentials(
+    context: PlatformServiceCredentialMintingContext,
+  ): Promise<PlatformServiceCredentialMintingResult> {
+    const adminClient = context.adminClient as IRabbitMQManagementClient;
+    const password = context.secretInputs[PLATFORM_SERVICE_PASSWORD_INPUT_KEY];
+    if (!password) {
+      throw new Error(
+        `RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials: ` +
+        `secretInputs is missing '${PLATFORM_SERVICE_PASSWORD_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the platform-service password — modules are upsert-only.`,
+      );
+    }
+
+    // Username is the platform service identifier verbatim — preserves
+    // the legacy convention from
+    // `PlatformInfrastructureManagerService.provisionServiceCredentials`
+    // (line 478: `username: serviceName`).
+    const username = context.serviceName;
+    const permissionRegex = buildPlatformServiceRegex(context.serviceName);
+
+    // PUT /api/users — idempotent upsert.
+    await adminClient.putUser(username, password, []);
+
+    // Permissions: configure/read use the per-service regex; write
+    // widens to allow `amq.default` + empty string (broker-internal),
+    // matching the `upsertTenantUserPermissions` write-regex shape so
+    // post-Slice-2.5 broker permissions match pre-Slice-2.5.
+    const writeRegex = `(^$|amq\\.default|${permissionRegex})`;
+    await adminClient.setPermissions(DEFAULT_VHOST, username, {
+      configure: permissionRegex,
+      write: writeRegex,
+      read: permissionRegex,
+    });
+
+    // Topic permissions: same dot-escaped regex on amq.topic. The
+    // legacy two-caller divergence (one path stripped the `^` and
+    // produced `wildo\.platform\.<slug>\..*`; the other produced
+    // `wildo.platform.<slug>.*` with literal dots) is unified here on
+    // the dot-escaped variant — see module JSDoc behavior-parity note.
+    await adminClient.setTopicPermissions(DEFAULT_VHOST, username, {
+      exchange: TOPIC_EXCHANGE,
+      write: permissionRegex,
+      read: permissionRegex,
+    });
+
+    return { username };
+  },
+};