@wildo-ai/platform-infra-providers 1.1.2

package/src/redis-self/__tests__/redis-self.infra.module.test.ts

@@ -0,0 +1,341 @@
+/**
+ * Tests for `RedisSelfInfraProviderModule` (Slice 4.B.1 of
+ * `infra-provider-planner.md`).
+ *
+ * Goals:
+ * - Pin the `plan()` shape so a future regression that drops e.g.
+ *   `REDIS_ADMIN_PASSWORD` from `secretEnvVars` fails loud.
+ * - Pin the orchestrator-pattern contract: `mintAppCredentials`
+ *   accepts the password via `secretInputs` and echoes it back —
+ *   proves the module is upsert-only, not generator.
+ * - Pin the username + keyPattern conventions against the existing
+ *   `wildo-application-lifecycle.service.ts:441, 536` conventions so
+ *   a future code change here surfaces as a diff in this test, not
+ *   as a silent ACL drift.
+ * - Pin the `revokeAppCredentials` upsert-with-persist pairing.
+ * - Pin defensive validation of empty `applicationNamespace` and
+ *   missing `secretInputs` keys.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  AppCredentialMintingContext,
+  IRedisAclClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  ApplicationRuntimePrincipalKind,
+  buildMinionRedisKeyPrefix,
+} from '@wildo-ai/platform-config-lib';
+import { RedisSelfInfraProviderModule } from '../redis-self.infra.module';
+
+function makeAdminClientStub(): IRedisAclClient & {
+  upsertUserSpy: ReturnType<typeof vi.fn>;
+  deleteUserSpy: ReturnType<typeof vi.fn>;
+  persistAclSpy: ReturnType<typeof vi.fn>;
+} {
+  const upsertUserSpy = vi.fn().mockResolvedValue(undefined);
+  const deleteUserSpy = vi.fn().mockResolvedValue(undefined);
+  const persistAclSpy = vi.fn().mockResolvedValue(undefined);
+  return {
+    upsertUser: upsertUserSpy,
+    deleteUser: deleteUserSpy,
+    persistAcl: persistAclSpy,
+    upsertUserSpy,
+    deleteUserSpy,
+    persistAclSpy,
+  };
+}
+
+function makeMintContext(
+  adminClient: IRedisAclClient,
+  overrides: Partial<AppCredentialMintingContext> = {},
+): AppCredentialMintingContext {
+  return {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '60d21bdf1c4ae5cda1b2c3d4',
+    adminClient,
+    secretInputs: {
+      'database.redis.password': 'orchestrator-supplied-password',
+    },
+    ...overrides,
+  };
+}
+
+describe('RedisSelfInfraProviderModule.plan()', () => {
+  const contribution = RedisSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'redis',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(RedisSelfInfraProviderModule.provider).toBe(InfraProvider.REDIS_SELF);
+    expect(RedisSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.CACHE_MANAGER,
+    ]);
+  });
+
+  it('contributes the valkey compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['valkey']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/valkey/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares platformAdmin (audience-1) for apps-manager + companion only', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      REDIS_HOST: 'valkey',
+      REDIS_PORT: '6379',
+      REDIS_DATABASE: '0',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual([
+      'REDIS_ADMIN_PASSWORD',
+    ]);
+    // Audience-1 only — Redis has no audience-2 platform-service-scoped
+    // use case today (D-4 of Slice 4.B locked decisions).
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares appRuntime blob paths for the customer-app pod', () => {
+    expect(contribution.appRuntime?.perAppConfigBlobPaths).toEqual({
+      'database.redis.host': 'valkey',
+      'database.redis.port': 6379,
+      'database.redis.db': 0,
+    });
+    expect(contribution.appRuntime?.perAppSecretBlobPaths).toEqual([
+      'database.redis.username',
+      'database.redis.password',
+    ]);
+  });
+});
+
+describe('RedisSelfInfraProviderModule.mintAppCredentials', () => {
+  it('upserts an ACL user with namespace-derived username and slug-derived keyPattern, then persists the ACL list', async () => {
+    // ACL key/channel namespace split (2026-05-26 fix):
+    //   username        → applicationNamespace  ('wonder-todos-local')
+    //   keyPattern      → appSlug + ':*'        ('wonder-todos:*')
+    //   channel pattern → derived inside upsertUser from the username
+    // The keyPattern uses appSlug because the backend's effective
+    // `dataServices.redis.keyPrefix` defaults to `<appSlug>:` and any
+    // authored override must start with that prefix (validated in
+    // `RedisService.connect()`). Pre-fix, both used namespace, which
+    // produced `NOPERM` for every per-app key access.
+    const adminClient = makeAdminClientStub();
+    const result = await RedisSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient),
+    );
+
+    expect(adminClient.upsertUserSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.upsertUserSpy).toHaveBeenCalledWith({
+      username: 'wonder-todos-local',
+      password: 'orchestrator-supplied-password',
+      keyPattern: 'wonder-todos:*',
+    });
+    expect(adminClient.persistAclSpy).toHaveBeenCalledTimes(1);
+    // upsert MUST come before persist (legacy pairing parity).
+    expect(adminClient.upsertUserSpy.mock.invocationCallOrder[0])
+      .toBeLessThan(adminClient.persistAclSpy.mock.invocationCallOrder[0]);
+
+    expect(result).toEqual({
+      secretBlobValues: {
+        'database.redis.username': 'wonder-todos-local',
+        // Echo of the input password — proves upsert-only, not generator.
+        'database.redis.password': 'orchestrator-supplied-password',
+      },
+    });
+  });
+
+  it('fails loud when secretInputs is missing the password', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      RedisSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { secretInputs: {} }),
+      ),
+    ).rejects.toThrow(/missing 'database\.redis\.password'/);
+    expect(adminClient.upsertUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.persistAclSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when applicationNamespace is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      RedisSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+    expect(adminClient.upsertUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.persistAclSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when appSlug is empty (the ACL key pattern derives from it)', async () => {
+    // ACL key namespace must be slug-rooted; an empty slug would mint
+    // `~:*` which is a near-global grant — guard against it explicitly
+    // instead of letting Valkey accept the malformed pattern.
+    const adminClient = makeAdminClientStub();
+    await expect(
+      RedisSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { appSlug: '' }),
+      ),
+    ).rejects.toThrow(/appSlug is empty/);
+    expect(adminClient.upsertUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.persistAclSpy).not.toHaveBeenCalled();
+  });
+
+  it('keyPattern derives from appSlug independently of applicationNamespace (key/channel split)', async () => {
+    // Confirms the key vs channel namespace split is honored: a slug
+    // that differs from the namespace stem produces the slug-rooted
+    // key pattern, NOT the namespace-rooted one. This is the contract
+    // that the backend's `<appSlug>:` keyPrefix relies on.
+    const adminClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient, {
+        appSlug: 'acme-suite',
+        applicationNamespace: 'acme-suite-staging',
+      }),
+    );
+    expect(adminClient.upsertUserSpy).toHaveBeenCalledWith({
+      username: 'acme-suite-staging',
+      password: 'orchestrator-supplied-password',
+      keyPattern: 'acme-suite:*',
+    });
+  });
+
+  it('does NOT call persistAcl when upsertUser throws (atomicity guard)', async () => {
+    const adminClient = makeAdminClientStub();
+    adminClient.upsertUserSpy.mockRejectedValue(new Error('SETUSER refused'));
+    await expect(
+      RedisSelfInfraProviderModule.mintAppCredentials!(makeMintContext(adminClient)),
+    ).rejects.toThrow(/SETUSER refused/);
+    expect(adminClient.persistAclSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('RedisSelfInfraProviderModule.revokeAppCredentials', () => {
+  it('deletes the per-app ACL user and persists the list', async () => {
+    const adminClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient),
+    );
+
+    expect(adminClient.deleteUserSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.deleteUserSpy).toHaveBeenCalledWith('wonder-todos-local');
+    expect(adminClient.persistAclSpy).toHaveBeenCalledTimes(1);
+    // delete MUST come before persist.
+    expect(adminClient.deleteUserSpy.mock.invocationCallOrder[0])
+      .toBeLessThan(adminClient.persistAclSpy.mock.invocationCallOrder[0]);
+  });
+
+  it('fails loud when applicationNamespace is empty (does not call DELUSER on empty)', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      RedisSelfInfraProviderModule.revokeAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+    expect(adminClient.deleteUserSpy).not.toHaveBeenCalled();
+    expect(adminClient.persistAclSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('RedisSelfInfraProviderModule per-principal ACL users (Step 2 / D17)', () => {
+  const MINION = { kind: ApplicationRuntimePrincipalKind.MINION, name: 'marketingScrapper' } as const;
+
+  it('leaves the APPLICATION BACKEND username exactly where it was', async () => {
+    // Load-bearing: if the backend's ACL username moved, an existing deployment's
+    // user is orphaned on the next sync and a running backend loses Redis. Both
+    // the absent-principal case (every pre-existing call site) and the explicit
+    // backend principal must render the bare namespace.
+    for (const principal of [undefined, { kind: ApplicationRuntimePrincipalKind.APPLICATION_BACKEND }]) {
+      const adminClient = makeAdminClientStub();
+      await RedisSelfInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, principal ? { principal } : {}),
+      );
+      expect(adminClient.upsertUserSpy).toHaveBeenCalledWith(
+        expect.objectContaining({ username: 'wonder-todos-local' }),
+      );
+    }
+  });
+
+  it('gives a named principal its OWN ACL user', async () => {
+    const adminClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient, { principal: MINION }),
+    );
+    expect(adminClient.upsertUserSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ username: 'wonder-todos-local-minion-marketingScrapper' }),
+    );
+  });
+
+  it('confines a MINION to its own key namespace (D20) while the backend keeps the app-wide pattern', async () => {
+    // The ACL pattern and the minion's `REDIS_KEY_PREFIX` are ONE COUPLED PAIR —
+    // a mismatch DENIES every operation the minion performs and the error names
+    // an ACL, not the mismatch. Both sides derive from
+    // `buildMinionRedisKeyPrefix`, so this asserts the CONFINEMENT and the
+    // shared derivation together.
+    const minionClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.mintAppCredentials!(makeMintContext(minionClient, { principal: MINION }));
+    // Asserted BOTH ways on purpose: the literal catches an accidental change to
+    // the namespace shape, and the derived form pins the INVARIANT that the ACL
+    // pattern is exactly the runtime's prefix plus `*`. The CLI writes that same
+    // prefix into the minion's `REDIS_KEY_PREFIX`, so this is the seam where the
+    // two halves of the coupled pair are checked against each other.
+    expect(minionClient.upsertUserSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ keyPattern: 'wonder-todos:minions:marketingScrapper:*' }),
+    );
+    expect(minionClient.upsertUserSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ keyPattern: `${buildMinionRedisKeyPrefix('wonder-todos', 'marketingScrapper')}*` }),
+    );
+
+    // The minion's namespace is a strict EXTENSION of the application's, which
+    // is what keeps `RedisService`'s "authored prefix must start with
+    // `<appSlug>:`" rule true without changing it.
+    expect('wonder-todos:minions:marketingScrapper:*'.startsWith('wonder-todos:')).toBe(true);
+
+    const backendClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.mintAppCredentials!(makeMintContext(backendClient));
+    expect(backendClient.upsertUserSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ keyPattern: 'wonder-todos:*' }),
+    );
+  });
+
+  it('REVOKES the principal\'s own user, never the application backend\'s', async () => {
+    // The site that makes a shared derivation mandatory: a revoke that computed
+    // the username differently would DELUSER the backend's ACL user while
+    // believing it was removing a minion's — an outage caused by a cleanup.
+    const adminClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient, { principal: MINION }),
+    );
+    expect(adminClient.deleteUserSpy).toHaveBeenCalledWith('wonder-todos-local-minion-marketingScrapper');
+    expect(adminClient.deleteUserSpy).not.toHaveBeenCalledWith('wonder-todos-local');
+  });
+
+  it('sanitises a bucket key that is not ACL-safe', async () => {
+    // A `wildo.saas.config.ts` bucket key is a TypeScript object key and may
+    // legally contain characters an ACL username should not carry to the wire.
+    const adminClient = makeAdminClientStub();
+    await RedisSelfInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient, {
+        principal: { kind: ApplicationRuntimePrincipalKind.WORKER, name: 'my_odd$worker' },
+      }),
+    );
+    expect(adminClient.upsertUserSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ username: 'wonder-todos-local-worker-my-odd-worker' }),
+    );
+  });
+});
+
+describe('RedisSelfInfraProviderModule audience-2 absence (D-4)', () => {
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    // Redis has no audience-2 platform-service-scoped use case today
+    // (D-4 of Slice 4.B locked decisions). When/if a real need
+    // surfaces, add the method to the module.
+    expect(RedisSelfInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});