@wildo-ai/platform-infra-providers 1.1.2

package/dist/esm/mongodb-self/mongodb-self.infra.module.d.ts

@@ -0,0 +1,81 @@
+/**
+ * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the
+ * pattern to self-managed MongoDB).
+ *
+ * Implements the `MONGODB_SELF` `InfraProvider` over the
+ * `IMongoSelfAdminClient` transport (admin-side mongoose connection,
+ * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C
+ * policy/transport split). Owns ALL per-app naming policy +
+ * URL-derivation policy — the per-app username convention
+ * (`<applicationNamespace>_user`, mirroring the Atlas variant) and
+ * the per-app SRV URL derivation by swapping admin credentials
+ * with per-app credentials in the authored
+ * `BASE_MONGO_SERVER_URL`-derived admin connect URL.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required.
+ * - `applicationConfigInputs['adminConnectUrl']` — required, the
+ *   admin-scoped MongoDB connect URL the orchestrator reads from
+ *   `MONGO_CONNECT_URL` env at app-init time.
+ * - `adminClient` — narrowed to `IMongoSelfAdminClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin
+ *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`
+ *    (mints per-app users via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Mongo database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the per-app connect URL
+ *    returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations.
+ *
+ * **NOT served (D-4)**: audience-2 not applicable.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+/** One `createRole`/`updateRole` privilege entry. */
+export interface MongodbCollectionPrivilege {
+    readonly resource: {
+        readonly db: string;
+        readonly collection: string;
+    };
+    readonly actions: readonly string[];
+}
+/**
+ * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).
+ *
+ * ## What this deliberately never produces
+ *
+ * No `dbAdmin` and no `readWrite` — the two roles the application backend
+ * currently holds on the whole database. `dbAdmin` is banned outright by D14;
+ * `readWrite` is database-WIDE, so granting it to a minion would make every
+ * collection reachable regardless of what `resourceAccess` declared, which is
+ * the containment this exists to create.
+ *
+ * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which
+ * is Mongo's way of saying "every collection in this database". Every entry
+ * names one collection explicitly.
+ *
+ * ## Read and write are separate entries on purpose
+ *
+ * A collection granted both axes yields TWO privilege entries rather than one
+ * merged action list. Mongo unions them identically, but the emitted role then
+ * reads back as the declaration that produced it — which is what makes an
+ * operator inspecting `db.getRole()` able to check the grant against the config
+ * without re-deriving it.
+ */
+export declare function buildMinionMongodbPrivileges(input: {
+    databaseName: string;
+    readCollections: readonly string[];
+    writeCollections: readonly string[];
+}): MongodbCollectionPrivilege[];
+export declare const MongodbSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=mongodb-self.infra.module.d.ts.map

package/dist/esm/mongodb-self/mongodb-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AAmDvC,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,0BAA0B,EAAE,CAS/B;AA+CD,eAAO,MAAM,8BAA8B,EAAE,mBA4L5C,CAAC"}

package/dist/esm/mongodb-self/mongodb-self.infra.module.js

@@ -0,0 +1,311 @@
+/**
+ * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the
+ * pattern to self-managed MongoDB).
+ *
+ * Implements the `MONGODB_SELF` `InfraProvider` over the
+ * `IMongoSelfAdminClient` transport (admin-side mongoose connection,
+ * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C
+ * policy/transport split). Owns ALL per-app naming policy +
+ * URL-derivation policy — the per-app username convention
+ * (`<applicationNamespace>_user`, mirroring the Atlas variant) and
+ * the per-app SRV URL derivation by swapping admin credentials
+ * with per-app credentials in the authored
+ * `BASE_MONGO_SERVER_URL`-derived admin connect URL.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required.
+ * - `applicationConfigInputs['adminConnectUrl']` — required, the
+ *   admin-scoped MongoDB connect URL the orchestrator reads from
+ *   `MONGO_CONNECT_URL` env at app-init time.
+ * - `adminClient` — narrowed to `IMongoSelfAdminClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin
+ *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`
+ *    (mints per-app users via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Mongo database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the per-app connect URL
+ *    returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations.
+ *
+ * **NOT served (D-4)**: audience-2 not applicable.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, resolveGrantStorageNames, } from '@wildo-ai/platform-config-lib';
+const MONGODB_USERNAME_PATH = 'database.mongodb.username';
+const MONGODB_PASSWORD_PATH = 'database.mongodb.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];
+const MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';
+const DATABASE_NAME_INPUT_KEY = 'databaseName';
+const ADMIN_CONNECT_URL_INPUT_KEY = 'adminConnectUrl';
+const CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';
+/**
+ * Compute the per-app username. Mirrors the Atlas module's
+ * convention (`${ns}_user`) so the persistence shape is identical
+ * regardless of provider.
+ */
+function buildMongodbUsername(applicationNamespace) {
+    return `${applicationNamespace}_user`;
+}
+/**
+ * MongoDB privilege ACTIONS, per grant axis.
+ *
+ * Named here rather than inlined because these ARE the security semantics: what
+ * "read" and "write" mean once they reach the database. Mongo's action
+ * vocabulary is an external one, so it lives at this adapter — the module that
+ * speaks Mongo — and never leaks into the platform's grant model.
+ *
+ * `find` alone for read: no `listCollections`, no `collStats`, nothing that
+ * enumerates. A minion granted read on one resource should not be able to
+ * discover what else exists.
+ *
+ * `insert`/`update`/`remove` for write, and deliberately NOT `find`. The
+ * platform-level derivation refuses to widen write into read, and re-adding it
+ * here would defeat that decision at the last hop — see
+ * `deriveMinionResourceGrants`.
+ */
+const MONGODB_READ_ACTIONS = ['find'];
+const MONGODB_WRITE_ACTIONS = ['insert', 'update', 'remove'];
+/**
+ * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).
+ *
+ * ## What this deliberately never produces
+ *
+ * No `dbAdmin` and no `readWrite` — the two roles the application backend
+ * currently holds on the whole database. `dbAdmin` is banned outright by D14;
+ * `readWrite` is database-WIDE, so granting it to a minion would make every
+ * collection reachable regardless of what `resourceAccess` declared, which is
+ * the containment this exists to create.
+ *
+ * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which
+ * is Mongo's way of saying "every collection in this database". Every entry
+ * names one collection explicitly.
+ *
+ * ## Read and write are separate entries on purpose
+ *
+ * A collection granted both axes yields TWO privilege entries rather than one
+ * merged action list. Mongo unions them identically, but the emitted role then
+ * reads back as the declaration that produced it — which is what makes an
+ * operator inspecting `db.getRole()` able to check the grant against the config
+ * without re-deriving it.
+ */
+export function buildMinionMongodbPrivileges(input) {
+    const privileges = [];
+    for (const collection of input.readCollections) {
+        privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_READ_ACTIONS] });
+    }
+    for (const collection of input.writeCollections) {
+        privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });
+    }
+    return privileges;
+}
+/**
+ * Derive the per-app connect URL by swapping admin credentials and
+ * the database path in the authored `adminConnectUrl`. Mirrors the
+ * legacy logic at
+ * `wildo-application-lifecycle.service.ts:469-479`:
+ *
+ *   const parsed = new URL(adminConnectUrl);
+ *   parsed.username = perAppUsername;
+ *   parsed.password = perAppPassword;
+ *   parsed.pathname = '/' + databaseName;
+ *
+ * URL-encoding handled automatically by the WHATWG URL class.
+ */
+function buildPerAppConnectUrl(adminConnectUrl, databaseName, username, password) {
+    const parsed = new URL(adminConnectUrl);
+    parsed.username = encodeURIComponent(username);
+    parsed.password = encodeURIComponent(password);
+    parsed.pathname = '/' + databaseName;
+    return parsed.toString();
+}
+/**
+ * Per-principal Mongo username — the SAME derivation the revoke path must use.
+ *
+ * The application backend keeps `<namespace>_user` VERBATIM so an existing
+ * deployment's user is never orphaned. Third time this shape appears (Redis,
+ * RabbitMQ, now Mongo): a revoke deriving it differently deletes the BACKEND's
+ * database user while believing it is removing a minion's.
+ */
+function buildMongodbPrincipalUsername(applicationNamespace, principal) {
+    if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+        return buildMongodbUsername(applicationNamespace);
+    }
+    const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+    return `${applicationNamespace}_${principal.kind}_${sanitizedName}_user`;
+}
+export const MongodbSelfInfraProviderModule = {
+    provider: InfraProvider.MONGODB_SELF,
+    supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],
+    perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+    plan() {
+        return {
+            dockerComposeServices: ['mongodb'],
+            k8sResources: ['templates/infra/k8s/internal/mongodb/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {},
+                // The single MONGO_CONNECT_URL secret carries the admin
+                // credentials embedded; legacy field name preserved.
+                secretEnvVars: ['MONGO_CONNECT_URL'],
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            appRuntime: {
+                // Same persistence shape as Atlas — per-app username +
+                // password go into secrets; the host/protocol/options come
+                // from `_merge_WildoApplicationConfig` which derives them
+                // from env-config (BASE_MONGO_SERVER_URL).
+                perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+            },
+        };
+    },
+    async mintAppCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];
+        if (!password) {
+            throw new Error(`MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+                `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the Mongo password — modules are upsert-only.`);
+        }
+        if (!context.applicationNamespace) {
+            throw new Error(`MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+        if (!databaseName) {
+            throw new Error(`MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+                `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the per-app database name.`);
+        }
+        const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];
+        if (!adminConnectUrl) {
+            throw new Error(`MongodbSelfInfraProviderModule.mintAppCredentials: ` +
+                `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the admin Mongo connect URL.`);
+        }
+        const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);
+        if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+            // A named principal gets a COLLECTION-SCOPED user (Step 3 / R1 / D14):
+            // one custom role carrying exactly the privileges its `resourceAccess`
+            // derived, and nothing inherited.
+            //
+            // `resourceGrants` is REQUIRED here and its absence is an error rather
+            // than a default. Falling back to the app-wide upsert would hand a minion
+            // `readWrite` + `dbAdmin` on the whole database — the exact over-grant
+            // this path exists to replace, arriving silently through a code path that
+            // looks like it is doing the narrow thing.
+            const grants = context.resourceGrants;
+            if (!grants) {
+                throw new Error(`MongodbSelfInfraProviderModule.mintAppCredentials: `
+                    + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `
+                    + `Refusing to fall back to the database-wide application user — a minion with no declared `
+                    + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`);
+            }
+            await adminClient.upsertCollectionScopedDatabaseUser({
+                adminConnectUrl,
+                databaseName,
+                username,
+                password,
+                roleName: `${username}_role`,
+                // Resource types → collection names HERE, at the adapter that speaks
+                // Mongo. The grant contract itself stays in the platform vocabulary.
+                privileges: buildMinionMongodbPrivileges({
+                    databaseName,
+                    readCollections: resolveGrantStorageNames(grants.read),
+                    writeCollections: resolveGrantStorageNames(grants.write),
+                }),
+            });
+        }
+        else {
+            // createUser-or-updateUser over an admin-scoped mongoose
+            // connection — idempotent upsert.
+            await adminClient.upsertApplicationDatabaseUser({
+                adminConnectUrl,
+                databaseName,
+                username,
+                password,
+            });
+        }
+        // Derive the per-app SRV URL by swapping credentials + db path
+        // in the authored admin URL. The orchestrator uses this for
+        // transient app-init seeding; not persisted.
+        const connectionString = buildPerAppConnectUrl(adminConnectUrl, databaseName, username, password);
+        return {
+            secretBlobValues: {
+                [MONGODB_USERNAME_PATH]: username,
+                [MONGODB_PASSWORD_PATH]: password,
+            },
+            runtimeArtifacts: {
+                [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,
+            },
+        };
+    },
+    /**
+     * Tear down the per-app Mongo database user.
+     *
+     * **Caller status**: no caller wires this in Slices 1–4.B.3.
+     * Forward-compat seam.
+     */
+    async revokeAppCredentials(context) {
+        if (!context.applicationNamespace) {
+            throw new Error(`MongodbSelfInfraProviderModule.revokeAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];
+        if (!adminConnectUrl) {
+            throw new Error(`MongodbSelfInfraProviderModule.revokeAppCredentials: ` +
+                `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +
+                `The orchestrator MUST supply the admin Mongo connect URL.`);
+        }
+        const adminClient = context.adminClient;
+        // Derived through the SAME function the mint uses. Deriving it independently
+        // here — which is what this line did before named principals existed — meant
+        // revoking a minion left its credential live AND dropped the APPLICATION
+        // BACKEND's database user, because the backend's name is what
+        // `buildMongodbUsername` returns for every input.
+        const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);
+        if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+            // A scoped principal owns a user AND a custom role. Routing it through the
+            // user-only door would leave a privileged role behind that the next mint
+            // adopts without anybody declaring it.
+            const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+            if (!databaseName) {
+                throw new Error(`MongodbSelfInfraProviderModule.revokeAppCredentials: `
+                    + `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}' for principal `
+                    + `'${context.principal.kind}:${context.principal.name}'. The role to drop lives IN that `
+                    + `database — revoking without it would drop the user and silently orphan its privileges.`);
+            }
+            await adminClient.dropCollectionScopedDatabaseUser({
+                adminConnectUrl,
+                databaseName,
+                username,
+                roleName: `${username}_role`,
+            });
+            return;
+        }
+        await adminClient.deleteApplicationDatabaseUser({ adminConnectUrl, username });
+    },
+    // No `mintPlatformServiceCredentials` (D-4).
+};
+//# sourceMappingURL=mongodb-self.infra.module.js.map

package/dist/esm/mongodb-self/mongodb-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb-self.infra.module.js","sourceRoot":"","sources":["../../../../src/mongodb-self/mongodb-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAGb,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;AAG9G,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAC/C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,oBAA4B;IACxD,OAAO,GAAG,oBAAoB,OAAO,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAsB,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAQhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,eAAuB,EACvB,YAAoB,EACpB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,GAAG,GAAG,YAAY,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CACpC,oBAA4B,EAC5B,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,oBAAoB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,QAAQ,EAAE,aAAa,CAAC,YAAY;IACpC,qBAAqB,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC;IAC1D,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,YAAY,EAAE,CAAC,0DAA0D,CAAC;YAC1E,aAAa,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,wDAAwD;gBACxD,qDAAqD;gBACrD,aAAa,EAAE,CAAC,mBAAmB,CAAC;gBACpC,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,uDAAuD;gBACvD,2DAA2D;gBAC3D,0DAA0D;gBAC1D,2CAA2C;gBAC3C,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,4BAA4B,0BAA0B,KAAK;gBAC3D,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,uBAAuB,KAAK;gBACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,uEAAuE;YACvE,uEAAuE;YACvE,kCAAkC;YAClC,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,2CAA2C;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qDAAqD;sBACnD,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,2BAA2B;sBACzF,0FAA0F;sBAC1F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,kCAAkC,CAAC;gBACnD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;gBAC5B,qEAAqE;gBACrE,qEAAqE;gBACrE,UAAU,EAAE,4BAA4B,CAAC;oBACvC,YAAY;oBACZ,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,gBAAgB,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC;iBACzD,CAAC;aACH,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,kCAAkC;YAClC,MAAM,WAAW,CAAC,6BAA6B,CAAC;gBAC9C,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,4DAA4D;QAC5D,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,qBAAqB,CAAC,EAAE,QAAQ;gBACjC,CAAC,qBAAqB,CAAC,EAAE,QAAQ;aAClC;YACD,gBAAgB,EAAE;gBAChB,CAAC,8BAA8B,CAAC,EAAE,gBAAgB;aACnD;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,2BAA2B,CAAC,CAAC;QACvF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACvD,uCAAuC,2BAA2B,KAAK;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAoC,CAAC;QACjE,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhG,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;YACxG,2EAA2E;YAC3E,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,CAAC;YAChF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,uDAAuD;sBACrD,uCAAuC,uBAAuB,kBAAkB;sBAChF,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,oCAAoC;sBACxF,wFAAwF,CAC3F,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,gCAAgC,CAAC;gBACjD,eAAe;gBACf,YAAY;gBACZ,QAAQ;gBACR,QAAQ,EAAE,GAAG,QAAQ,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,6BAA6B,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,6CAA6C;CAC9C,CAAC","sourcesContent":["/**\n * `MongodbSelfInfraProviderModule` — fifth concrete `InfraProviderModule`\n * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the\n * pattern to self-managed MongoDB).\n *\n * Implements the `MONGODB_SELF` `InfraProvider` over the\n * `IMongoSelfAdminClient` transport (admin-side mongoose connection,\n * exposed by `MongoSelfManagerService` after the Slice 4.B.3 5C\n * policy/transport split). Owns ALL per-app naming policy +\n * URL-derivation policy — the per-app username convention\n * (`<applicationNamespace>_user`, mirroring the Atlas variant) and\n * the per-app SRV URL derivation by swapping admin credentials\n * with per-app credentials in the authored\n * `BASE_MONGO_SERVER_URL`-derived admin connect URL.\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `applicationNamespace` — used as the source for the per-app\n *   username (legacy convention `${ns}_user`).\n * - `secretInputs['database.mongodb.password']` — orchestrator-\n *   supplied password (module is upsert-only, never generator).\n * - `applicationConfigInputs['databaseName']` — required.\n * - `applicationConfigInputs['adminConnectUrl']` — required, the\n *   admin-scoped MongoDB connect URL the orchestrator reads from\n *   `MONGO_CONNECT_URL` env at app-init time.\n * - `adminClient` — narrowed to `IMongoSelfAdminClient`.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin)**: cluster-wide Mongo admin\n *    connect URL (`MONGO_CONNECT_URL`). Consumers: `apps-manager`\n *    (mints per-app users via `mintAppCredentials`), `companion`\n *    (mirrors apps-manager admin role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:\n *    per-customer-app Mongo database user. Result threaded into\n *    `Wildo_Application_Secrets.database.mongodb.{username,password}`\n *    via `_merge_WildoApplicationSecrets`; the per-app connect URL\n *    returned via `runtimeArtifacts.connectionString` for\n *    transient app-init operations.\n *\n * **NOT served (D-4)**: audience-2 not applicable.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IMongoSelfAdminClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipalKind,\n  resolveGrantStorageNames,\n  type ApplicationRuntimePrincipal,\n} from '@wildo-ai/platform-config-lib';\n\nconst MONGODB_USERNAME_PATH = 'database.mongodb.username';\nconst MONGODB_PASSWORD_PATH = 'database.mongodb.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];\n\n\nconst MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';\n\nconst DATABASE_NAME_INPUT_KEY = 'databaseName';\nconst ADMIN_CONNECT_URL_INPUT_KEY = 'adminConnectUrl';\n\nconst CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';\n\n/**\n * Compute the per-app username. Mirrors the Atlas module's\n * convention (`${ns}_user`) so the persistence shape is identical\n * regardless of provider.\n */\nfunction buildMongodbUsername(applicationNamespace: string): string {\n  return `${applicationNamespace}_user`;\n}\n\n/**\n * MongoDB privilege ACTIONS, per grant axis.\n *\n * Named here rather than inlined because these ARE the security semantics: what\n * \"read\" and \"write\" mean once they reach the database. Mongo's action\n * vocabulary is an external one, so it lives at this adapter — the module that\n * speaks Mongo — and never leaks into the platform's grant model.\n *\n * `find` alone for read: no `listCollections`, no `collStats`, nothing that\n * enumerates. A minion granted read on one resource should not be able to\n * discover what else exists.\n *\n * `insert`/`update`/`remove` for write, and deliberately NOT `find`. The\n * platform-level derivation refuses to widen write into read, and re-adding it\n * here would defeat that decision at the last hop — see\n * `deriveMinionResourceGrants`.\n */\nconst MONGODB_READ_ACTIONS: readonly string[] = ['find'];\nconst MONGODB_WRITE_ACTIONS: readonly string[] = ['insert', 'update', 'remove'];\n\n/** One `createRole`/`updateRole` privilege entry. */\nexport interface MongodbCollectionPrivilege {\n  readonly resource: { readonly db: string; readonly collection: string };\n  readonly actions: readonly string[];\n}\n\n/**\n * Turn a minion's grants into collection-scoped MongoDB privileges (D14, R1).\n *\n * ## What this deliberately never produces\n *\n * No `dbAdmin` and no `readWrite` — the two roles the application backend\n * currently holds on the whole database. `dbAdmin` is banned outright by D14;\n * `readWrite` is database-WIDE, so granting it to a minion would make every\n * collection reachable regardless of what `resourceAccess` declared, which is\n * the containment this exists to create.\n *\n * No privilege on the database RESOURCE either (`{ db, collection: '' }`), which\n * is Mongo's way of saying \"every collection in this database\". Every entry\n * names one collection explicitly.\n *\n * ## Read and write are separate entries on purpose\n *\n * A collection granted both axes yields TWO privilege entries rather than one\n * merged action list. Mongo unions them identically, but the emitted role then\n * reads back as the declaration that produced it — which is what makes an\n * operator inspecting `db.getRole()` able to check the grant against the config\n * without re-deriving it.\n */\nexport function buildMinionMongodbPrivileges(input: {\n  databaseName: string;\n  readCollections: readonly string[];\n  writeCollections: readonly string[];\n}): MongodbCollectionPrivilege[] {\n  const privileges: MongodbCollectionPrivilege[] = [];\n  for (const collection of input.readCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_READ_ACTIONS] });\n  }\n  for (const collection of input.writeCollections) {\n    privileges.push({ resource: { db: input.databaseName, collection }, actions: [...MONGODB_WRITE_ACTIONS] });\n  }\n  return privileges;\n}\n\n/**\n * Derive the per-app connect URL by swapping admin credentials and\n * the database path in the authored `adminConnectUrl`. Mirrors the\n * legacy logic at\n * `wildo-application-lifecycle.service.ts:469-479`:\n *\n *   const parsed = new URL(adminConnectUrl);\n *   parsed.username = perAppUsername;\n *   parsed.password = perAppPassword;\n *   parsed.pathname = '/' + databaseName;\n *\n * URL-encoding handled automatically by the WHATWG URL class.\n */\nfunction buildPerAppConnectUrl(\n  adminConnectUrl: string,\n  databaseName: string,\n  username: string,\n  password: string,\n): string {\n  const parsed = new URL(adminConnectUrl);\n  parsed.username = encodeURIComponent(username);\n  parsed.password = encodeURIComponent(password);\n  parsed.pathname = '/' + databaseName;\n  return parsed.toString();\n}\n\n/**\n * Per-principal Mongo username — the SAME derivation the revoke path must use.\n *\n * The application backend keeps `<namespace>_user` VERBATIM so an existing\n * deployment's user is never orphaned. Third time this shape appears (Redis,\n * RabbitMQ, now Mongo): a revoke deriving it differently deletes the BACKEND's\n * database user while believing it is removing a minion's.\n */\nfunction buildMongodbPrincipalUsername(\n  applicationNamespace: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildMongodbUsername(applicationNamespace);\n  }\n  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');\n  return `${applicationNamespace}_${principal.kind}_${sanitizedName}_user`;\n}\n\nexport const MongodbSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.MONGODB_SELF,\n  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['mongodb'],\n      k8sResources: ['templates/infra/k8s/internal/mongodb/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {},\n        // The single MONGO_CONNECT_URL secret carries the admin\n        // credentials embedded; legacy field name preserved.\n        secretEnvVars: ['MONGO_CONNECT_URL'],\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Same persistence shape as Atlas — per-app username +\n        // password go into secrets; the host/protocol/options come\n        // from `_merge_WildoApplicationConfig` which derives them\n        // from env-config (BASE_MONGO_SERVER_URL).\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];\n    if (!password) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,\n      );\n    }\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n    if (!databaseName) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the per-app database name.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A named principal gets a COLLECTION-SCOPED user (Step 3 / R1 / D14):\n      // one custom role carrying exactly the privileges its `resourceAccess`\n      // derived, and nothing inherited.\n      //\n      // `resourceGrants` is REQUIRED here and its absence is an error rather\n      // than a default. Falling back to the app-wide upsert would hand a minion\n      // `readWrite` + `dbAdmin` on the whole database — the exact over-grant\n      // this path exists to replace, arriving silently through a code path that\n      // looks like it is doing the narrow thing.\n      const grants = context.resourceGrants;\n      if (!grants) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.mintAppCredentials: `\n          + `principal '${context.principal.kind}:${context.principal.name}' has no resourceGrants. `\n          + `Refusing to fall back to the database-wide application user — a minion with no declared `\n          + `access must get NO database user at all (D11/R3), which is the orchestrator's decision to make.`,\n        );\n      }\n      await adminClient.upsertCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n        roleName: `${username}_role`,\n        // Resource types → collection names HERE, at the adapter that speaks\n        // Mongo. The grant contract itself stays in the platform vocabulary.\n        privileges: buildMinionMongodbPrivileges({\n          databaseName,\n          readCollections: resolveGrantStorageNames(grants.read),\n          writeCollections: resolveGrantStorageNames(grants.write),\n        }),\n      });\n    } else {\n      // createUser-or-updateUser over an admin-scoped mongoose\n      // connection — idempotent upsert.\n      await adminClient.upsertApplicationDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        password,\n      });\n    }\n\n    // Derive the per-app SRV URL by swapping credentials + db path\n    // in the authored admin URL. The orchestrator uses this for\n    // transient app-init seeding; not persisted.\n    const connectionString = buildPerAppConnectUrl(\n      adminConnectUrl,\n      databaseName,\n      username,\n      password,\n    );\n\n    return {\n      secretBlobValues: {\n        [MONGODB_USERNAME_PATH]: username,\n        [MONGODB_PASSWORD_PATH]: password,\n      },\n      runtimeArtifacts: {\n        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Mongo database user.\n   *\n   * **Caller status**: no caller wires this in Slices 1–4.B.3.\n   * Forward-compat seam.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminConnectUrl = context.applicationConfigInputs?.[ADMIN_CONNECT_URL_INPUT_KEY];\n    if (!adminConnectUrl) {\n      throw new Error(\n        `MongodbSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationConfigInputs is missing '${ADMIN_CONNECT_URL_INPUT_KEY}'. ` +\n        `The orchestrator MUST supply the admin Mongo connect URL.`,\n      );\n    }\n    const adminClient = context.adminClient as IMongoSelfAdminClient;\n    // Derived through the SAME function the mint uses. Deriving it independently\n    // here — which is what this line did before named principals existed — meant\n    // revoking a minion left its credential live AND dropped the APPLICATION\n    // BACKEND's database user, because the backend's name is what\n    // `buildMongodbUsername` returns for every input.\n    const username = buildMongodbPrincipalUsername(context.applicationNamespace, context.principal);\n\n    if (context.principal && context.principal.kind !== ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n      // A scoped principal owns a user AND a custom role. Routing it through the\n      // user-only door would leave a privileged role behind that the next mint\n      // adopts without anybody declaring it.\n      const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];\n      if (!databaseName) {\n        throw new Error(\n          `MongodbSelfInfraProviderModule.revokeAppCredentials: `\n          + `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}' for principal `\n          + `'${context.principal.kind}:${context.principal.name}'. The role to drop lives IN that `\n          + `database — revoking without it would drop the user and silently orphan its privileges.`,\n        );\n      }\n      await adminClient.dropCollectionScopedDatabaseUser({\n        adminConnectUrl,\n        databaseName,\n        username,\n        roleName: `${username}_role`,\n      });\n      return;\n    }\n\n    await adminClient.deleteApplicationDatabaseUser({ adminConnectUrl, username });\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4).\n};\n"]}

package/dist/esm/postgres-self/postgres-self.infra.module.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `PostgresSelfInfraProviderModule` — third concrete `InfraProviderModule`
+ * (Slice 4.B.2 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B.1 pattern).
+ *
+ * Implements the `POSTGRES_SELF` `InfraProvider` over the
+ * `IPostgresAdminClient` transport (raw `pg` Pool against the
+ * Postgres admin connection, exposed by
+ * `PostgreSQLConnectionManagerService` after the Slice 4.B.2 5C
+ * policy/transport split). Owns ALL per-app naming policy — the
+ * per-app database-name + role-name conventions (`wildo_<sanitized>_user`,
+ * `wildo_<sanitized>` mirroring the legacy
+ * `PlatformInfrastructureManagerService.provisionPostgreSQLDatabase`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `appSlug` — used as the source for the sanitized database +
+ *   user name. Mirrors the legacy convention at
+ *   `platform-infrastructure-manager.service.ts:300-302`
+ *   (`sanitizedName = sanitizeForPostgreSQL(applicationName)`,
+ *   `databaseName = wildo_${sanitizedName}`,
+ *   `username = wildo_${sanitizedName}_user`).
+ * - `secretInputs['database.postgresql.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs?.['databaseName']` — optional override
+ *   for the derived database name. Mirrors the legacy
+ *   `provisionPostgreSQLDatabase(appSlug, { databaseName? })` arg.
+ * - `adminClient` — narrowed to `IPostgresAdminClient`.
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4
+ * forward-compat documentation):
+ * - `applicationNamespace` — Postgres per-app DB names use the
+ *   slug-derived sanitized form (env-suffix isolation comes from
+ *   the surrounding env-scoped admin connection). Future modules
+ *   may switch to namespace-scoped naming if cross-env collision
+ *   risk surfaces.
+ * - `wildoApplicationId` — Postgres role names embed the
+ *   sanitized slug, NOT the application id. This is the legacy
+ *   convention; preserved for back-compat with apps already
+ *   provisioned.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide Postgres admin creds. Consumers: `apps-manager`
+ *    (mints per-app DB+role via `mintAppCredentials`), `companion`
+ *    (mirrors apps-manager admin role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app Postgres database +
+ *    role. Result threaded into
+ *    `Wildo_Application_Secrets.database.postgresql.{
+ *    databaseName, username, connectUrl}` via
+ *    `_merge_WildoApplicationSecrets`. Note: the password is
+ *    embedded in `connectUrl` — there is no separate
+ *    `database.postgresql.password` blob path today (matches the
+ *    legacy persistence shape at
+ *    `wildo-application-lifecycle.service.ts:2191-2200`).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Postgres for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraProviderModule } from '@wildo-ai/platform-config-lib';
+export declare const PostgresSelfInfraProviderModule: InfraProviderModule;
+//# sourceMappingURL=postgres-self.infra.module.d.ts.map

package/dist/esm/postgres-self/postgres-self.infra.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-self.infra.module.d.ts","sourceRoot":"","sources":["../../../../src/postgres-self/postgres-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAOL,mBAAmB,EAKpB,MAAM,+BAA+B,CAAC;AA6HvC,eAAO,MAAM,+BAA+B,EAAE,mBA2K7C,CAAC"}