@wildo-ai/platform-infra-providers 1.1.2

package/dist/esm/redis-self/redis-self.infra.module.js

@@ -0,0 +1,331 @@
+/**
+ * `RedisSelfInfraProviderModule` — second concrete `InfraProviderModule`
+ * (Slice 4.B.1 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 `RabbitmqSelfInfraProviderModule` pattern).
+ *
+ * Implements the `REDIS_SELF` `InfraProvider` over the
+ * `IRedisAclClient` transport (Valkey/Redis ACL commands, exposed by
+ * `RedisConnectionManagerService` after the Slice 4.B.1 5C policy/
+ * transport split). Owns ALL per-app ACL policy — the per-app
+ * keyPattern, the channel-pattern fan-out family, the per-app
+ * username convention.
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `appSlug` — used as the **key-pattern** prefix
+ *   (`<appSlug>:*`). This MUST match the backend's effective
+ *   `dataServices.redis.keyPrefix`, which is the slug-derived key
+ *   namespace every backend write is rooted under (see
+ *   `engine/saas-backend-lib/src/databases/services/redis.service.ts`
+ *   `appPrefix` field — every `org:`/`global:` scope is composed with
+ *   that prefix). Slot owner: the SaaS app's authored config.
+ *   ACL invariant: `keyPrefix` MUST start with `<appSlug>:` so the
+ *   `~<appSlug>:*` grant covers every key the backend writes.
+ * - `applicationNamespace` — used as the Redis ACL **username** AND
+ *   as the channel-pattern prefix (`<ns>#*`, `<ns>-request#*`,
+ *   `<ns>-response#*`). Mirrors the legacy username convention from
+ *   `wildo-application-lifecycle.service.ts:441` (`redisUsername =
+ *   ns`). Channels stay namespace-scoped because the Socket.IO Redis
+ *   adapter (`engine/saas-backend-lib/src/requests/service/websocket
+ *   .service.ts:1501`) uses the Redis username as its `key:` — the
+ *   ACL channel pattern MUST match that.
+ * - `secretInputs['database.redis.password']` — orchestrator-supplied
+ *   password (module is upsert-only, never generator).
+ * - `adminClient` — narrowed to `IRedisAclClient`.
+ *
+ * **Key vs channel pattern split** (2026-05-26 framework-correct fix):
+ * Pre-fix, this module derived BOTH key and channel patterns from
+ * `applicationNamespace` (`<ns>:*` for keys, `<ns>#*` for channels).
+ * That was correct pre-Slice-3.6, when the backend used the username
+ * to namespace keys too. Slice 3.6 moved key namespacing to
+ * `dataServices.redis.keyPrefix` (default + recommended value
+ * `<appSlug>:`) but the ACL provisioner was not updated — every per-app
+ * Redis read/write returned `NOPERM No permissions to access a key`
+ * because the ACL only granted `<ns>:*` while the backend wrote
+ * `<appSlug>:*`. Fix: key pattern now derives from `appSlug`, channel
+ * patterns continue to derive from the username/namespace (Socket.IO
+ * adapter still uses the username as its channel key, so channels
+ * stay correct unchanged).
+ *
+ * **What this module IGNORES from the context** (Slice 4.A.2 / M4
+ * forward-compat documentation):
+ * - `wildoApplicationId` — the keyPattern uses appSlug + the channel
+ *   patterns use namespace; the application id is redundant for both
+ *   (no globally-shared key namespace risk because slug/namespace
+ *   already disambiguate by tenant and environment).
+ * - `applicationConfigInputs` — Redis_Self has no per-app authored
+ *   topology (no equivalent of RabbitMQ's vhost). Future modules may
+ *   read it for per-app db-index overrides etc.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:
+ *    cluster-wide ACL admin creds (`REDIS_HOST`, `REDIS_PORT`,
+ *    `REDIS_DATABASE` env + `REDIS_ADMIN_PASSWORD` secret env).
+ *    Consumers: `apps-manager` (mints per-app ACL users via
+ *    `mintAppCredentials`), `companion` (mirrors apps-manager admin
+ *    role for local dev).
+ *
+ * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +
+ *    `mintAppCredentials`)**: per-customer-app Redis ACL user.
+ *    Username = `applicationNamespace`; keyPattern disambiguates by
+ *    the same namespace. Result threaded into
+ *    `Wildo_Application_Secrets.database.redis.{username, password}`
+ *    via `_merge_WildoApplicationSecrets`.
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: Redis is currently NOT
+ *   used for inter-platform-service messaging (RabbitMQ is the bus).
+ *   `mintPlatformServiceCredentials` is therefore not implemented.
+ *   When/if a platform service surfaces a Redis-scoped per-service
+ *   credential need, this module gains the method.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+import { InfraCapability, InfraPlatformAdminConsumer, InfraProvider, ApplicationRuntimePrincipalKind, buildMinionRedisKeyPrefix, } from '@wildo-ai/platform-config-lib';
+/**
+ * Default Valkey port (matches `INFRA_DEFAULT_PORTS.VALKEY` in the
+ * shared platform constants — duplicated here as a literal because
+ * the planner output is consumed by the CLI which materializes it
+ * into `Wildo_Application_Config` blob paths; the value is stable
+ * and small).
+ */
+const DEFAULT_VALKEY_PORT = 6379;
+/**
+ * Default DB index for app workloads. Wildo applications use db `0`
+ * across the board; per-app DB-index isolation is intentionally NOT
+ * modeled — keyPattern + ACL is the isolation seam.
+ */
+const DEFAULT_DB_INDEX = 0;
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes
+ * through `mintAppCredentials`. Declared once and reused as
+ * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of
+ * `secretBlobValues` in the result, so a refactor that renames a
+ * path fails loudly at one place instead of drifting silently.
+ */
+const REDIS_USERNAME_PATH = 'database.redis.username';
+const REDIS_PASSWORD_PATH = 'database.redis.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS = [REDIS_USERNAME_PATH, REDIS_PASSWORD_PATH];
+/**
+ * Compute the per-app Redis ACL username. Mirrors the existing
+ * convention at `wildo-application-lifecycle.service.ts:441`
+ * (`redisUsername = ns`) — username is the application namespace
+ * (`<appSlug>-<environmentId>`), NOT the raw slug. Centralized here
+ * so future changes touch one site.
+ */
+function buildRedisUsername(applicationNamespace) {
+    return applicationNamespace;
+}
+/**
+ * Per-principal ACL username (Step 2 / D17).
+ *
+ * The application backend keeps `applicationNamespace` VERBATIM — its username
+ * must not move, or an existing deployment's ACL user is orphaned and a running
+ * backend loses Redis on the next sync.
+ *
+ * A named principal appends its kind and name. The separator is `-`: an ACL
+ * username is whitespace-delimited in `ACL SETUSER`, and the principal key's own
+ * `:` is already meaningful in Redis KEY space, so reusing it in a username
+ * blurs the two namespaces at a glance. Non-alphanumeric characters in a bucket
+ * key are collapsed — the key is a TypeScript object key and may legally contain
+ * `$` or `_`, while a username reaching the wire should stay conservative.
+ *
+ * Used by BOTH `mintAppCredentials` and `revokeAppCredentials`. That is the
+ * point of it being a function: a revoke that derived the username differently
+ * would delete the APPLICATION BACKEND's ACL user while believing it was
+ * removing a minion's.
+ */
+function buildRedisPrincipalUsername(applicationNamespace, principal) {
+    if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {
+        return buildRedisUsername(applicationNamespace);
+    }
+    const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return `${applicationNamespace}-${principal.kind}-${sanitizedName}`;
+}
+/**
+ * Compute the per-app Redis ACL key pattern.
+ *
+ * The pattern derives from `appSlug` (NOT `applicationNamespace`)
+ * because the backend's effective key namespace is sourced from
+ * `dataServices.redis.keyPrefix` (Slice 3.6 — see
+ * `engine/saas-backend-lib/src/databases/services/redis.service.ts`
+ * `appPrefix` field JSDoc) whose default + recommended value is
+ * `<appSlug>:`. The ACL `~<appSlug>:*` rule must match the key shape
+ * the backend writes; ANY namespace-derived ACL (the pre-2026-05-26
+ * shape) would only grant `<ns>:*` and `NOPERM` every backend access.
+ *
+ * The channel patterns are computed separately from the username
+ * (== applicationNamespace) inside `IRedisAclClient.upsertUser`,
+ * because the Socket.IO Redis adapter uses the username as its
+ * channel key (`engine/saas-backend-lib/src/requests/service/
+ * websocket.service.ts:1501`). The two namespaces are split:
+ * - key namespace      = `<appSlug>:`  (app-authored
+ *                                       `dataServices.redis.keyPrefix`)
+ * - channel namespace  = `<applicationNamespace>#`  (Socket.IO adapter
+ *                                                    key, == redisUsername)
+ *
+ * App-author contract (validated by `validateKeyPrefixContract`
+ * downstream — see `databases.backend.schemas.ts`): if the SaaS app
+ * overrides the default `keyPrefix`, the override MUST still start
+ * with `<appSlug>:` so the `~<appSlug>:*` grant remains a superset
+ * of the keys the backend writes.
+ */
+function buildRedisKeyPattern(appSlug) {
+    return `${appSlug}:*`;
+}
+export const RedisSelfInfraProviderModule = {
+    provider: InfraProvider.REDIS_SELF,
+    supportedCapabilities: [InfraCapability.CACHE_MANAGER],
+    perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+    plan() {
+        return {
+            dockerComposeServices: ['valkey'],
+            k8sResources: ['templates/infra/k8s/internal/valkey/deployment.yaml.hbs'],
+            platformAdmin: {
+                envVars: {
+                    REDIS_HOST: 'valkey',
+                    REDIS_PORT: String(DEFAULT_VALKEY_PORT),
+                    REDIS_DATABASE: String(DEFAULT_DB_INDEX),
+                },
+                // ACL admin password is the only secret env. The legacy
+                // `RedisConnectionManagerService.initializeAclAdmin` reads it
+                // from `REDIS_ADMIN_PASSWORD`; the planner emits the key, the
+                // CLI's `env-vars-builder` writes the value at sync time.
+                secretEnvVars: ['REDIS_ADMIN_PASSWORD'],
+                // Audience-1 only (ACL-admin access). No audience-2
+                // platform-service-scoped Redis use case today (D-4).
+                consumers: [
+                    InfraPlatformAdminConsumer.APPS_MANAGER,
+                    InfraPlatformAdminConsumer.COMPANION,
+                ],
+            },
+            appRuntime: {
+                // Static topology — same for every app in this env.
+                // Per-app values (username/password) flow through
+                // `perAppSecretBlobPaths` below.
+                perAppConfigBlobPaths: {
+                    'database.redis.host': 'valkey',
+                    'database.redis.port': DEFAULT_VALKEY_PORT,
+                    'database.redis.db': DEFAULT_DB_INDEX,
+                },
+                perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+            },
+        };
+    },
+    async mintAppCredentials(context) {
+        const adminClient = context.adminClient;
+        const password = context.secretInputs[REDIS_PASSWORD_PATH];
+        if (!password) {
+            throw new Error(`RedisSelfInfraProviderModule.mintAppCredentials: ` +
+                `secretInputs is missing '${REDIS_PASSWORD_PATH}'. ` +
+                `The orchestrator MUST supply the Redis password — modules are upsert-only.`);
+        }
+        if (!context.applicationNamespace) {
+            throw new Error(`RedisSelfInfraProviderModule.mintAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        if (!context.appSlug) {
+            throw new Error(`RedisSelfInfraProviderModule.mintAppCredentials: ` +
+                `appSlug is empty. ` +
+                `The orchestrator MUST supply a non-empty appSlug — the ACL key ` +
+                `pattern derives from it (must match the backend's effective ` +
+                `\`dataServices.redis.keyPrefix\`, default \`<appSlug>:\`).`);
+        }
+        const username = buildRedisPrincipalUsername(context.applicationNamespace, context.principal);
+        // Key pattern derives from appSlug (matches backend `keyPrefix`),
+        // channel patterns derive from username/namespace inside upsertUser
+        // (matches Socket.IO adapter's `key:` config). See module JSDoc for
+        // the full key-vs-channel-namespace split rationale.
+        // A MINION is confined to its own namespace (D20); the application backend
+        // keeps the app-wide pattern.
+        //
+        // This and the minion's `REDIS_KEY_PREFIX` are ONE COUPLED PAIR — a
+        // mismatch DENIES every operation the minion performs, and the error names
+        // an ACL rather than the mismatch. Both sides derive from
+        // `buildMinionRedisKeyPrefix`, so they cannot drift.
+        const keyPattern = context.principal?.kind === ApplicationRuntimePrincipalKind.MINION && context.principal.name
+            ? `${buildMinionRedisKeyPrefix(context.appSlug, context.principal.name)}*`
+            : buildRedisKeyPattern(context.appSlug);
+        // ACL SETUSER — idempotent upsert. Replaces password + key
+        // patterns + channel patterns + category allow/deny on conflict.
+        //
+        // **Atomicity guard** (Slice 6 audit / F-2, 2026-05-10): the
+        // sequential `await upsertUser(); await persistAcl();` shape
+        // intentionally relies on JavaScript exception propagation —
+        // when `upsertUser` throws, the thrown error bubbles up the
+        // async stack BEFORE `persistAcl` is reached, leaving the ACL
+        // list on disk unchanged. The
+        // `redis-self.infra.module.test.ts` "atomicity guard" case pins
+        // this behavior. **DO NOT wrap this pair in a try/catch that
+        // swallows the upsert error** — that would silently persist a
+        // partially-applied state. Any future refactor that introduces
+        // a try-block here MUST re-throw on the upsert error AND must
+        // gate `persistAcl` on the upsert's success.
+        await adminClient.upsertUser({
+            username,
+            password,
+            keyPattern,
+        });
+        // Persist ACL list to disk so Valkey restarts don't lose tenant
+        // users. Mirrors the legacy
+        // `wildo-application-lifecycle.service.ts:540` pairing.
+        await adminClient.persistAcl();
+        return {
+            secretBlobValues: {
+                [REDIS_USERNAME_PATH]: username,
+                // Echo the orchestrator-supplied password — proves the module
+                // is upsert-only, not generator. The orchestrator persists
+                // this exact value into `Wildo_Application_Secrets`.
+                [REDIS_PASSWORD_PATH]: password,
+            },
+        };
+    },
+    /**
+     * Tear down the per-app Redis ACL user. Valkey ACL users are
+     * global (no vhost equivalent), so `deleteUser` removes the user
+     * (and its key/channel access) atomically.
+     *
+     * **Caller status** (F6 of 2026-05-06 plan review): no caller
+     * wires this in Slices 1–4.B.1.
+     * `wildo-application-lifecycle.service.ts` has no app-deletion
+     * ceremony to invoke it from. Method ships as a forward-compat
+     * seam for whichever future slice designs the app-deletion
+     * lifecycle.
+     *
+     * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty
+     * `applicationNamespace` would call `ACL DELUSER` with an empty
+     * username (Valkey would either error or silently no-op,
+     * depending on version); we fail-loud instead so a bad caller
+     * surfaces immediately.
+     */
+    async revokeAppCredentials(context) {
+        if (!context.applicationNamespace) {
+            throw new Error(`RedisSelfInfraProviderModule.revokeAppCredentials: ` +
+                `applicationNamespace is empty. ` +
+                `The orchestrator MUST supply a non-empty namespace.`);
+        }
+        const adminClient = context.adminClient;
+        const username = buildRedisPrincipalUsername(context.applicationNamespace, context.principal);
+        await adminClient.deleteUser(username);
+        // Persist after deletion so the ACL list on disk stays in sync
+        // with the in-memory state. Mirrors mintAppCredentials' pairing.
+        await adminClient.persistAcl();
+    },
+    // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —
+    // audience-2 not applicable to Redis_Self today). When a real
+    // need surfaces, add the method here following the
+    // `RabbitmqSelfInfraProviderModule` shape.
+};
+//# sourceMappingURL=redis-self.infra.module.js.map

package/dist/esm/redis-self/redis-self.infra.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-self.infra.module.js","sourceRoot":"","sources":["../../../../src/redis-self/redis-self.infra.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EAIL,eAAe,EACf,0BAA0B,EAC1B,aAAa,EAGb,+BAA+B,EAC/B,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AACtD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AACtD;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAA0B,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;AAG1G;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,oBAA4B;IACtD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,2BAA2B,CAClC,oBAA4B,EAC5B,SAAkD;IAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,+BAA+B,CAAC,mBAAmB,EAAE,CAAC;QACzF,OAAO,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,oBAAoB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,GAAG,OAAO,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,QAAQ,EAAE,aAAa,CAAC,UAAU;IAClC,qBAAqB,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC;IACtD,2BAA2B,EAAE,+BAA+B;IAE5D,IAAI;QACF,OAAO;YACL,qBAAqB,EAAE,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,CAAC,yDAAyD,CAAC;YACzE,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,MAAM,CAAC,mBAAmB,CAAC;oBACvC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;iBACzC;gBACD,wDAAwD;gBACxD,8DAA8D;gBAC9D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,aAAa,EAAE,CAAC,sBAAsB,CAAC;gBACvC,oDAAoD;gBACpD,sDAAsD;gBACtD,SAAS,EAAE;oBACT,0BAA0B,CAAC,YAAY;oBACvC,0BAA0B,CAAC,SAAS;iBACrC;aACF;YACD,UAAU,EAAE;gBACV,oDAAoD;gBACpD,kDAAkD;gBAClD,iCAAiC;gBACjC,qBAAqB,EAAE;oBACrB,qBAAqB,EAAE,QAAQ;oBAC/B,qBAAqB,EAAE,mBAAmB;oBAC1C,mBAAmB,EAAE,gBAAgB;iBACtC;gBACD,qBAAqB,EAAE,CAAC,GAAG,+BAA+B,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAoC;QAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAA8B,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,mDAAmD;gBACnD,4BAA4B,mBAAmB,KAAK;gBACpD,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,mDAAmD;gBACnD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,mDAAmD;gBACnD,oBAAoB;gBACpB,iEAAiE;gBACjE,8DAA8D;gBAC9D,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9F,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,qDAAqD;QACrD,2EAA2E;QAC3E,8BAA8B;QAC9B,EAAE;QACF,oEAAoE;QACpE,2EAA2E;QAC3E,0DAA0D;QAC1D,qDAAqD;QACrD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,+BAA+B,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI;YAC7G,CAAC,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YAC1E,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE1C,2DAA2D;QAC3D,iEAAiE;QACjE,EAAE;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,8BAA8B;QAC9B,gEAAgE;QAChE,6DAA6D;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,6CAA6C;QAC7C,MAAM,WAAW,CAAC,UAAU,CAAC;YAC3B,QAAQ;YACR,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QAEH,gEAAgE;QAChE,4BAA4B;QAC5B,wDAAwD;QACxD,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAE/B,OAAO;YACL,gBAAgB,EAAE;gBAChB,CAAC,mBAAmB,CAAC,EAAE,QAAQ;gBAC/B,8DAA8D;gBAC9D,2DAA2D;gBAC3D,qDAAqD;gBACrD,CAAC,mBAAmB,CAAC,EAAE,QAAQ;aAChC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC;QAC7D,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,qDAAqD;gBACrD,iCAAiC;gBACjC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAA8B,CAAC;QAC3D,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9F,MAAM,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,0DAA0D;IAC1D,8DAA8D;IAC9D,mDAAmD;IACnD,2CAA2C;CAC5C,CAAC","sourcesContent":["/**\n * `RedisSelfInfraProviderModule` — second concrete `InfraProviderModule`\n * (Slice 4.B.1 of `infra-provider-planner.md`, generalizing the\n * Slice 2 `RabbitmqSelfInfraProviderModule` pattern).\n *\n * Implements the `REDIS_SELF` `InfraProvider` over the\n * `IRedisAclClient` transport (Valkey/Redis ACL commands, exposed by\n * `RedisConnectionManagerService` after the Slice 4.B.1 5C policy/\n * transport split). Owns ALL per-app ACL policy — the per-app\n * keyPattern, the channel-pattern fan-out family, the per-app\n * username convention.\n *\n * **What this module reads from `AppCredentialMintingContext`**:\n * - `appSlug` — used as the **key-pattern** prefix\n *   (`<appSlug>:*`). This MUST match the backend's effective\n *   `dataServices.redis.keyPrefix`, which is the slug-derived key\n *   namespace every backend write is rooted under (see\n *   `engine/saas-backend-lib/src/databases/services/redis.service.ts`\n *   `appPrefix` field — every `org:`/`global:` scope is composed with\n *   that prefix). Slot owner: the SaaS app's authored config.\n *   ACL invariant: `keyPrefix` MUST start with `<appSlug>:` so the\n *   `~<appSlug>:*` grant covers every key the backend writes.\n * - `applicationNamespace` — used as the Redis ACL **username** AND\n *   as the channel-pattern prefix (`<ns>#*`, `<ns>-request#*`,\n *   `<ns>-response#*`). Mirrors the legacy username convention from\n *   `wildo-application-lifecycle.service.ts:441` (`redisUsername =\n *   ns`). Channels stay namespace-scoped because the Socket.IO Redis\n *   adapter (`engine/saas-backend-lib/src/requests/service/websocket\n *   .service.ts:1501`) uses the Redis username as its `key:` — the\n *   ACL channel pattern MUST match that.\n * - `secretInputs['database.redis.password']` — orchestrator-supplied\n *   password (module is upsert-only, never generator).\n * - `adminClient` — narrowed to `IRedisAclClient`.\n *\n * **Key vs channel pattern split** (2026-05-26 framework-correct fix):\n * Pre-fix, this module derived BOTH key and channel patterns from\n * `applicationNamespace` (`<ns>:*` for keys, `<ns>#*` for channels).\n * That was correct pre-Slice-3.6, when the backend used the username\n * to namespace keys too. Slice 3.6 moved key namespacing to\n * `dataServices.redis.keyPrefix` (default + recommended value\n * `<appSlug>:`) but the ACL provisioner was not updated — every per-app\n * Redis read/write returned `NOPERM No permissions to access a key`\n * because the ACL only granted `<ns>:*` while the backend wrote\n * `<appSlug>:*`. Fix: key pattern now derives from `appSlug`, channel\n * patterns continue to derive from the username/namespace (Socket.IO\n * adapter still uses the username as its channel key, so channels\n * stay correct unchanged).\n *\n * **What this module IGNORES from the context** (Slice 4.A.2 / M4\n * forward-compat documentation):\n * - `wildoApplicationId` — the keyPattern uses appSlug + the channel\n *   patterns use namespace; the application id is redundant for both\n *   (no globally-shared key namespace risk because slug/namespace\n *   already disambiguate by tenant and environment).\n * - `applicationConfigInputs` — Redis_Self has no per-app authored\n *   topology (no equivalent of RabbitMQ's vhost). Future modules may\n *   read it for per-app db-index overrides etc.\n *\n * **Two audiences this module serves:**\n *\n * 1. **Audience-1 (platform-admin, declared via `plan().platformAdmin`)**:\n *    cluster-wide ACL admin creds (`REDIS_HOST`, `REDIS_PORT`,\n *    `REDIS_DATABASE` env + `REDIS_ADMIN_PASSWORD` secret env).\n *    Consumers: `apps-manager` (mints per-app ACL users via\n *    `mintAppCredentials`), `companion` (mirrors apps-manager admin\n *    role for local dev).\n *\n * 2. **Audience-3 (app-scoped, via `plan().appRuntime` +\n *    `mintAppCredentials`)**: per-customer-app Redis ACL user.\n *    Username = `applicationNamespace`; keyPattern disambiguates by\n *    the same namespace. Result threaded into\n *    `Wildo_Application_Secrets.database.redis.{username, password}`\n *    via `_merge_WildoApplicationSecrets`.\n *\n * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:\n * - **Audience-2 (platform-service-scoped)**: Redis is currently NOT\n *   used for inter-platform-service messaging (RabbitMQ is the bus).\n *   `mintPlatformServiceCredentials` is therefore not implemented.\n *   When/if a platform service surfaces a Redis-scoped per-service\n *   credential need, this module gains the method.\n *\n * **`revokeAppCredentials`**: declared and tested, but the integration\n * call site does NOT exist in `wildo-application-lifecycle.service.ts`\n * (no app-deletion ceremony today — F6 of plan review 2026-05-06).\n * Method ships as a forward-compat seam.\n */\n\nimport {\n  AppCredentialMintingContext,\n  AppCredentialMintingResult,\n  IRedisAclClient,\n  InfraCapability,\n  InfraPlatformAdminConsumer,\n  InfraProvider,\n  InfraProviderModule,\n  InfraProviderPlanContribution,\n  ApplicationRuntimePrincipalKind,\n  buildMinionRedisKeyPrefix,\n  type ApplicationRuntimePrincipal,\n} from '@wildo-ai/platform-config-lib';\n\n/**\n * Default Valkey port (matches `INFRA_DEFAULT_PORTS.VALKEY` in the\n * shared platform constants — duplicated here as a literal because\n * the planner output is consumed by the CLI which materializes it\n * into `Wildo_Application_Config` blob paths; the value is stable\n * and small).\n */\nconst DEFAULT_VALKEY_PORT = 6379;\n\n/**\n * Default DB index for app workloads. Wildo applications use db `0`\n * across the board; per-app DB-index isolation is intentionally NOT\n * modeled — keyPattern + ACL is the isolation seam.\n */\nconst DEFAULT_DB_INDEX = 0;\n\n/**\n * The `Wildo_Application_Secrets` JSON paths this module writes\n * through `mintAppCredentials`. Declared once and reused as\n * `appRuntime.perAppSecretBlobPaths` in `plan()` AND as the keys of\n * `secretBlobValues` in the result, so a refactor that renames a\n * path fails loudly at one place instead of drifting silently.\n */\nconst REDIS_USERNAME_PATH = 'database.redis.username';\nconst REDIS_PASSWORD_PATH = 'database.redis.password';\n/**\n * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.\n *\n * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip\n * these from the application blob before delivering a principal's own material) AND spread into\n * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery\n * path would silently stop covering a path this module still mints.\n */\nconst PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [REDIS_USERNAME_PATH, REDIS_PASSWORD_PATH];\n\n\n/**\n * Compute the per-app Redis ACL username. Mirrors the existing\n * convention at `wildo-application-lifecycle.service.ts:441`\n * (`redisUsername = ns`) — username is the application namespace\n * (`<appSlug>-<environmentId>`), NOT the raw slug. Centralized here\n * so future changes touch one site.\n */\nfunction buildRedisUsername(applicationNamespace: string): string {\n  return applicationNamespace;\n}\n\n/**\n * Per-principal ACL username (Step 2 / D17).\n *\n * The application backend keeps `applicationNamespace` VERBATIM — its username\n * must not move, or an existing deployment's ACL user is orphaned and a running\n * backend loses Redis on the next sync.\n *\n * A named principal appends its kind and name. The separator is `-`: an ACL\n * username is whitespace-delimited in `ACL SETUSER`, and the principal key's own\n * `:` is already meaningful in Redis KEY space, so reusing it in a username\n * blurs the two namespaces at a glance. Non-alphanumeric characters in a bucket\n * key are collapsed — the key is a TypeScript object key and may legally contain\n * `$` or `_`, while a username reaching the wire should stay conservative.\n *\n * Used by BOTH `mintAppCredentials` and `revokeAppCredentials`. That is the\n * point of it being a function: a revoke that derived the username differently\n * would delete the APPLICATION BACKEND's ACL user while believing it was\n * removing a minion's.\n */\nfunction buildRedisPrincipalUsername(\n  applicationNamespace: string,\n  principal: ApplicationRuntimePrincipal | undefined,\n): string {\n  if (!principal || principal.kind === ApplicationRuntimePrincipalKind.APPLICATION_BACKEND) {\n    return buildRedisUsername(applicationNamespace);\n  }\n  const sanitizedName = (principal.name ?? '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');\n  return `${applicationNamespace}-${principal.kind}-${sanitizedName}`;\n}\n\n/**\n * Compute the per-app Redis ACL key pattern.\n *\n * The pattern derives from `appSlug` (NOT `applicationNamespace`)\n * because the backend's effective key namespace is sourced from\n * `dataServices.redis.keyPrefix` (Slice 3.6 — see\n * `engine/saas-backend-lib/src/databases/services/redis.service.ts`\n * `appPrefix` field JSDoc) whose default + recommended value is\n * `<appSlug>:`. The ACL `~<appSlug>:*` rule must match the key shape\n * the backend writes; ANY namespace-derived ACL (the pre-2026-05-26\n * shape) would only grant `<ns>:*` and `NOPERM` every backend access.\n *\n * The channel patterns are computed separately from the username\n * (== applicationNamespace) inside `IRedisAclClient.upsertUser`,\n * because the Socket.IO Redis adapter uses the username as its\n * channel key (`engine/saas-backend-lib/src/requests/service/\n * websocket.service.ts:1501`). The two namespaces are split:\n * - key namespace      = `<appSlug>:`  (app-authored\n *                                       `dataServices.redis.keyPrefix`)\n * - channel namespace  = `<applicationNamespace>#`  (Socket.IO adapter\n *                                                    key, == redisUsername)\n *\n * App-author contract (validated by `validateKeyPrefixContract`\n * downstream — see `databases.backend.schemas.ts`): if the SaaS app\n * overrides the default `keyPrefix`, the override MUST still start\n * with `<appSlug>:` so the `~<appSlug>:*` grant remains a superset\n * of the keys the backend writes.\n */\nfunction buildRedisKeyPattern(appSlug: string): string {\n  return `${appSlug}:*`;\n}\n\nexport const RedisSelfInfraProviderModule: InfraProviderModule = {\n  provider: InfraProvider.REDIS_SELF,\n  supportedCapabilities: [InfraCapability.CACHE_MANAGER],\n  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,\n\n  plan(): InfraProviderPlanContribution {\n    return {\n      dockerComposeServices: ['valkey'],\n      k8sResources: ['templates/infra/k8s/internal/valkey/deployment.yaml.hbs'],\n      platformAdmin: {\n        envVars: {\n          REDIS_HOST: 'valkey',\n          REDIS_PORT: String(DEFAULT_VALKEY_PORT),\n          REDIS_DATABASE: String(DEFAULT_DB_INDEX),\n        },\n        // ACL admin password is the only secret env. The legacy\n        // `RedisConnectionManagerService.initializeAclAdmin` reads it\n        // from `REDIS_ADMIN_PASSWORD`; the planner emits the key, the\n        // CLI's `env-vars-builder` writes the value at sync time.\n        secretEnvVars: ['REDIS_ADMIN_PASSWORD'],\n        // Audience-1 only (ACL-admin access). No audience-2\n        // platform-service-scoped Redis use case today (D-4).\n        consumers: [\n          InfraPlatformAdminConsumer.APPS_MANAGER,\n          InfraPlatformAdminConsumer.COMPANION,\n        ],\n      },\n      appRuntime: {\n        // Static topology — same for every app in this env.\n        // Per-app values (username/password) flow through\n        // `perAppSecretBlobPaths` below.\n        perAppConfigBlobPaths: {\n          'database.redis.host': 'valkey',\n          'database.redis.port': DEFAULT_VALKEY_PORT,\n          'database.redis.db': DEFAULT_DB_INDEX,\n        },\n        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],\n      },\n    };\n  },\n\n  async mintAppCredentials(\n    context: AppCredentialMintingContext,\n  ): Promise<AppCredentialMintingResult> {\n    const adminClient = context.adminClient as IRedisAclClient;\n    const password = context.secretInputs[REDIS_PASSWORD_PATH];\n    if (!password) {\n      throw new Error(\n        `RedisSelfInfraProviderModule.mintAppCredentials: ` +\n        `secretInputs is missing '${REDIS_PASSWORD_PATH}'. ` +\n        `The orchestrator MUST supply the Redis password — modules are upsert-only.`,\n      );\n    }\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `RedisSelfInfraProviderModule.mintAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    if (!context.appSlug) {\n      throw new Error(\n        `RedisSelfInfraProviderModule.mintAppCredentials: ` +\n        `appSlug is empty. ` +\n        `The orchestrator MUST supply a non-empty appSlug — the ACL key ` +\n        `pattern derives from it (must match the backend's effective ` +\n        `\\`dataServices.redis.keyPrefix\\`, default \\`<appSlug>:\\`).`,\n      );\n    }\n\n    const username = buildRedisPrincipalUsername(context.applicationNamespace, context.principal);\n    // Key pattern derives from appSlug (matches backend `keyPrefix`),\n    // channel patterns derive from username/namespace inside upsertUser\n    // (matches Socket.IO adapter's `key:` config). See module JSDoc for\n    // the full key-vs-channel-namespace split rationale.\n    // A MINION is confined to its own namespace (D20); the application backend\n    // keeps the app-wide pattern.\n    //\n    // This and the minion's `REDIS_KEY_PREFIX` are ONE COUPLED PAIR — a\n    // mismatch DENIES every operation the minion performs, and the error names\n    // an ACL rather than the mismatch. Both sides derive from\n    // `buildMinionRedisKeyPrefix`, so they cannot drift.\n    const keyPattern = context.principal?.kind === ApplicationRuntimePrincipalKind.MINION && context.principal.name\n      ? `${buildMinionRedisKeyPrefix(context.appSlug, context.principal.name)}*`\n      : buildRedisKeyPattern(context.appSlug);\n\n    // ACL SETUSER — idempotent upsert. Replaces password + key\n    // patterns + channel patterns + category allow/deny on conflict.\n    //\n    // **Atomicity guard** (Slice 6 audit / F-2, 2026-05-10): the\n    // sequential `await upsertUser(); await persistAcl();` shape\n    // intentionally relies on JavaScript exception propagation —\n    // when `upsertUser` throws, the thrown error bubbles up the\n    // async stack BEFORE `persistAcl` is reached, leaving the ACL\n    // list on disk unchanged. The\n    // `redis-self.infra.module.test.ts` \"atomicity guard\" case pins\n    // this behavior. **DO NOT wrap this pair in a try/catch that\n    // swallows the upsert error** — that would silently persist a\n    // partially-applied state. Any future refactor that introduces\n    // a try-block here MUST re-throw on the upsert error AND must\n    // gate `persistAcl` on the upsert's success.\n    await adminClient.upsertUser({\n      username,\n      password,\n      keyPattern,\n    });\n\n    // Persist ACL list to disk so Valkey restarts don't lose tenant\n    // users. Mirrors the legacy\n    // `wildo-application-lifecycle.service.ts:540` pairing.\n    await adminClient.persistAcl();\n\n    return {\n      secretBlobValues: {\n        [REDIS_USERNAME_PATH]: username,\n        // Echo the orchestrator-supplied password — proves the module\n        // is upsert-only, not generator. The orchestrator persists\n        // this exact value into `Wildo_Application_Secrets`.\n        [REDIS_PASSWORD_PATH]: password,\n      },\n    };\n  },\n\n  /**\n   * Tear down the per-app Redis ACL user. Valkey ACL users are\n   * global (no vhost equivalent), so `deleteUser` removes the user\n   * (and its key/channel access) atomically.\n   *\n   * **Caller status** (F6 of 2026-05-06 plan review): no caller\n   * wires this in Slices 1–4.B.1.\n   * `wildo-application-lifecycle.service.ts` has no app-deletion\n   * ceremony to invoke it from. Method ships as a forward-compat\n   * seam for whichever future slice designs the app-deletion\n   * lifecycle.\n   *\n   * **Defensive validation** (Slice 4.A.2 / L4 pattern): empty\n   * `applicationNamespace` would call `ACL DELUSER` with an empty\n   * username (Valkey would either error or silently no-op,\n   * depending on version); we fail-loud instead so a bad caller\n   * surfaces immediately.\n   */\n  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {\n    if (!context.applicationNamespace) {\n      throw new Error(\n        `RedisSelfInfraProviderModule.revokeAppCredentials: ` +\n        `applicationNamespace is empty. ` +\n        `The orchestrator MUST supply a non-empty namespace.`,\n      );\n    }\n    const adminClient = context.adminClient as IRedisAclClient;\n    const username = buildRedisPrincipalUsername(context.applicationNamespace, context.principal);\n    await adminClient.deleteUser(username);\n    // Persist after deletion so the ACL list on disk stays in sync\n    // with the in-memory state. Mirrors mintAppCredentials' pairing.\n    await adminClient.persistAcl();\n  },\n\n  // No `mintPlatformServiceCredentials` (D-4 of Slice 4.B —\n  // audience-2 not applicable to Redis_Self today). When a real\n  // need surfaces, add the method here following the\n  // `RabbitmqSelfInfraProviderModule` shape.\n};\n"]}