@wildo-ai/platform-infra-providers 1.1.2

package/src/minio-self/minio-self.infra.module.ts

@@ -0,0 +1,116 @@
+/**
+ * `MinioSelfInfraProviderModule` — sixth concrete `InfraProviderModule`
+ * (Slice 5.1 of `infra-provider-planner.md`, generalizing the
+ * Slice 2 / 4.B pattern to object storage).
+ *
+ * Implements the `MINIO_SELF` `InfraProvider`. One shared MinIO bucket
+ * serves every application; the object-key tree is namespaced
+ * `${prefix}/applications/${applicationId}/files/${fileId}`.
+ *
+ * `mintAppCredentials` / `revokeAppCredentials` are absent from THIS
+ * module, and that remains accurate — but it no longer means what it
+ * used to. Per-application credential isolation exists; it is simply
+ * not implemented here. See below.
+ *
+ * ## ⚠️ Corrected 2026-08-10 — this block described a posture the
+ * system no longer has
+ *
+ * It previously stated that every app shares "one access-key/secret-key
+ * pair", that per-app isolation "comes from `STORAGE_BUCKET_PREFIX`",
+ * and that app-scoped credentials were "NONE — apps consume the shared
+ * `STORAGE_*` env". All three were true when written and are now false:
+ *
+ * - Applications no longer receive any long-lived storage credential.
+ *   `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are no longer emitted
+ *   into application-tier env at all — they were the object store's
+ *   ROOT pair, and handing them to every app, minion and worker is the
+ *   exposure this was corrected to remove.
+ * - Isolation is enforced by a **credential**, not by a prefix
+ *   convention. `apps-manager`'s `ObjectStorageStsBrokerService` issues
+ *   short-lived STS sessions whose inline policy confines each
+ *   application to `applications/<applicationId>/`, keyed on the
+ *   platform-minted id — never on `STORAGE_BUCKET_PREFIX`, which an
+ *   application authors for itself and therefore cannot be a security
+ *   boundary. The prefix is now cosmetic namespacing.
+ *
+ * The three prerequisites this block listed for per-app credentials
+ * were addressed rather than deferred: the adapter threads per-principal
+ * credentials through a credential provider (1); the session policy
+ * replaces per-app bucket-policy authoring (2); and rotation safety (3)
+ * dissolved — STS credentials expire by construction, so there is no
+ * long-lived key whose rotation must be coordinated across pods.
+ *
+ * **Why the mint methods still do not live here.** MinIO's JS client
+ * ships no user-management API, so minting would need the `mc` binary or
+ * hand-written admin-API crypto. STS needs neither, and belongs with the
+ * service that holds the admin credential — apps-manager — rather than
+ * with this planning module, which contributes deployment topology.
+ *
+ * **Audience-1 (platform-admin)**: cluster-wide MinIO admin creds
+ * delivered via env. Consumers: `apps-manager` (which brokers STS from
+ * them) and `companion`. Whether these consumers should hold *root*
+ * specifically, rather than a narrower admin credential, is OQ-2 in the
+ * plan below.
+ *
+ * **Audience-3 (app-scoped)**: no per-app MinIO STATE is minted here —
+ * but applications DO receive a per-application storage credential at
+ * runtime, from apps-manager. "No app-scoped audience in this module" is
+ * not "no app-scoped credential in the system".
+ *
+ * See `.claude/plans/object-storage-root-credential-distribution.md`.
+ */
+
+import {
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+} from '@wildo-ai/platform-config-lib';
+
+const DEFAULT_MINIO_PORT = 9000;
+
+export const MinioSelfInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.MINIO_SELF,
+  supportedCapabilities: [InfraCapability.OBJECT_STORAGE],
+
+  /**
+   * Shared bucket, shared root key — same as AWS S3: object-storage confinement is an STS session
+   * policy minted per request, never a per-principal secret in the application blob.
+   */
+  perPrincipalSecretBlobPaths: [],
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      dockerComposeServices: ['minio'],
+      k8sResources: ['templates/infra/k8s/internal/minio/deployment.yaml.hbs'],
+      platformAdmin: {
+        envVars: {
+          STORAGE_PROVIDER: 'minio',
+          STORAGE_ENDPOINT: 'minio',
+          STORAGE_PORT: String(DEFAULT_MINIO_PORT),
+          STORAGE_USE_SSL: 'false',
+        },
+        // Cluster-wide bucket access creds. Every app uses the same
+        // pair. Per-app isolation is via `STORAGE_BUCKET_PREFIX`
+        // (see module JSDoc).
+        secretEnvVars: ['STORAGE_ACCESS_KEY', 'STORAGE_SECRET_KEY'],
+        consumers: [
+          InfraPlatformAdminConsumer.APPS_MANAGER,
+          InfraPlatformAdminConsumer.COMPANION,
+        ],
+      },
+      // Apps receive `STORAGE_*` via the bootstrap env contract
+      // (engine-side `application-backend-env.contracts.ts`). No
+      // per-app blob-path additions because the values are static
+      // across all apps in the same env. `appRuntime` intentionally
+      // empty so the contribution stays an honest "shared bucket,
+      // no per-app state".
+    };
+  },
+
+  // No `mintAppCredentials` / `revokeAppCredentials` —
+  // shared-bucket model (see module JSDoc).
+  // No `mintPlatformServiceCredentials` — platform services use the
+  // same shared bucket as customer apps.
+};

package/src/mongodb-atlas/__tests__/mongodb-atlas.infra.module.test.ts

@@ -0,0 +1,198 @@
+/**
+ * Tests for `MongodbAtlasInfraProviderModule` (Slice 4.B.3 of
+ * `infra-provider-planner.md`).
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  AppCredentialMintingContext,
+  IMongoAtlasClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { MongodbAtlasInfraProviderModule } from '../mongodb-atlas.infra.module';
+
+function makeAdminClientStub(
+  connectionString: string = 'mongodb+srv://wonder-todos-local_user:secret@cluster0.mongodb.net/wonder_todos?retryWrites=true',
+): IMongoAtlasClient & {
+  upsertApplicationDatabaseSpy: ReturnType<typeof vi.fn>;
+  deleteDatabaseUserSpy: ReturnType<typeof vi.fn>;
+} {
+  const upsertApplicationDatabaseSpy = vi.fn().mockResolvedValue({ connectionString });
+  const deleteDatabaseUserSpy = vi.fn().mockResolvedValue(undefined);
+  return {
+    upsertApplicationDatabase: upsertApplicationDatabaseSpy,
+    deleteDatabaseUser: deleteDatabaseUserSpy,
+    upsertApplicationDatabaseSpy,
+    deleteDatabaseUserSpy,
+  };
+}
+
+function makeMintContext(
+  adminClient: IMongoAtlasClient,
+  overrides: Partial<AppCredentialMintingContext> = {},
+): AppCredentialMintingContext {
+  return {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '60d21bdf1c4ae5cda1b2c3d4',
+    adminClient,
+    secretInputs: {
+      'database.mongodb.password': 'orchestrator-supplied-password',
+    },
+    applicationConfigInputs: {
+      databaseName: 'wonder_todos',
+      clusterName: 'Cluster0',
+    },
+    ...overrides,
+  };
+}
+
+describe('MongodbAtlasInfraProviderModule.plan()', () => {
+  const contribution = MongodbAtlasInfraProviderModule.plan({
+    environment: 'staging',
+    runtime: 'kubernetes',
+    backingServiceKey: 'mongodb',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(MongodbAtlasInfraProviderModule.provider).toBe(InfraProvider.MONGODB_ATLAS);
+    expect(MongodbAtlasInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.DOCUMENT_DATABASE,
+    ]);
+  });
+
+  it('does NOT contribute compose / K8s resources (Atlas is remote)', () => {
+    expect(contribution.dockerComposeServices).toBeUndefined();
+    expect(contribution.k8sResources).toBeUndefined();
+  });
+
+  it('declares platformAdmin (audience-1) for apps-manager only', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      ATLAS_API_BASE_URL: 'https://cloud.mongodb.com/api/atlas/v1.0',
+      ATLAS_PROJECT_ID: '',
+      ATLAS_CLUSTER_NAME: 'Cluster0',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual([
+      'ATLAS_PUBLIC_KEY',
+      'ATLAS_PRIVATE_KEY',
+    ]);
+    // Atlas is admin-API only for apps-manager. Companion runs against
+    // self-managed Mongo locally — it is NOT a consumer here.
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+    ]);
+  });
+
+  it('declares appRuntime per-app secret blob paths (username + password only)', () => {
+    expect(contribution.appRuntime?.perAppSecretBlobPaths).toEqual([
+      'database.mongodb.username',
+      'database.mongodb.password',
+    ]);
+    // Host/protocol/options are derived from env-config at runtime,
+    // NOT from this contribution.
+    expect(contribution.appRuntime?.perAppConfigBlobPaths).toBeUndefined();
+  });
+});
+
+describe('MongodbAtlasInfraProviderModule.mintAppCredentials', () => {
+  it('upserts an Atlas DB user keyed by namespace and returns the SRV connection in runtimeArtifacts', async () => {
+    const adminClient = makeAdminClientStub();
+    const result = await MongodbAtlasInfraProviderModule.mintAppCredentials!(
+      makeMintContext(adminClient),
+    );
+
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.upsertApplicationDatabaseSpy).toHaveBeenCalledWith({
+      clusterName: 'Cluster0',
+      databaseName: 'wonder_todos',
+      username: 'wonder-todos-local_user',
+      password: 'orchestrator-supplied-password',
+    });
+
+    expect(result.secretBlobValues).toEqual({
+      'database.mongodb.username': 'wonder-todos-local_user',
+      'database.mongodb.password': 'orchestrator-supplied-password',
+    });
+    // SRV URL with credentials is in runtimeArtifacts (NOT secretBlobValues),
+    // because the persistence shape is split (config: host/protocol/options;
+    // secrets: username/password).
+    expect(result.runtimeArtifacts).toEqual({
+      connectionString: 'mongodb+srv://wonder-todos-local_user:secret@cluster0.mongodb.net/wonder_todos?retryWrites=true',
+    });
+  });
+
+  it('fails loud when secretInputs is missing the password', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbAtlasInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { secretInputs: {} }),
+      ),
+    ).rejects.toThrow(/missing 'database\.mongodb\.password'/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when applicationNamespace is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbAtlasInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when applicationConfigInputs.databaseName is missing', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbAtlasInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, {
+          applicationConfigInputs: { clusterName: 'Cluster0' },
+        }),
+      ),
+    ).rejects.toThrow(/missing 'databaseName'/);
+    expect(adminClient.upsertApplicationDatabaseSpy).not.toHaveBeenCalled();
+  });
+
+  it('fails loud when applicationConfigInputs.clusterName is missing', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbAtlasInfraProviderModule.mintAppCredentials!(
+        makeMintContext(adminClient, {
+          applicationConfigInputs: { databaseName: 'wonder_todos' },
+        }),
+      ),
+    ).rejects.toThrow(/missing 'clusterName'/);
+  });
+});
+
+describe('MongodbAtlasInfraProviderModule.revokeAppCredentials', () => {
+  it('deletes the per-app Atlas DB user', async () => {
+    const adminClient = makeAdminClientStub();
+    await MongodbAtlasInfraProviderModule.revokeAppCredentials!(
+      makeMintContext(adminClient),
+    );
+    expect(adminClient.deleteDatabaseUserSpy).toHaveBeenCalledTimes(1);
+    expect(adminClient.deleteDatabaseUserSpy).toHaveBeenCalledWith(
+      'wonder-todos-local_user',
+    );
+  });
+
+  it('fails loud when applicationNamespace is empty', async () => {
+    const adminClient = makeAdminClientStub();
+    await expect(
+      MongodbAtlasInfraProviderModule.revokeAppCredentials!(
+        makeMintContext(adminClient, { applicationNamespace: '' }),
+      ),
+    ).rejects.toThrow(/applicationNamespace is empty/);
+    expect(adminClient.deleteDatabaseUserSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('MongodbAtlasInfraProviderModule audience-2 absence (D-4)', () => {
+  it('does NOT declare mintPlatformServiceCredentials', () => {
+    expect(MongodbAtlasInfraProviderModule.mintPlatformServiceCredentials).toBeUndefined();
+  });
+});

package/src/mongodb-atlas/mongodb-atlas.infra.module.ts

@@ -0,0 +1,236 @@
+/**
+ * `MongodbAtlasInfraProviderModule` — fourth concrete `InfraProviderModule`
+ * (Slice 4.B.3 of `infra-provider-planner.md`, generalizing the Slice
+ * 2 / 4.B.1 / 4.B.2 pattern to MongoDB Atlas).
+ *
+ * Implements the `MONGODB_ATLAS` `InfraProvider` over the
+ * `IMongoAtlasClient` transport (Atlas REST API + digest auth, exposed
+ * by `MongoAtlasManagerService` after the Slice 4.B.3 5C policy/
+ * transport split). Owns ALL per-app naming policy — the per-app
+ * username convention (`<applicationNamespace>_user`, mirroring the
+ * legacy `getOrGenerateCredentials.generateNewCredentials`).
+ *
+ * **What this module reads from `AppCredentialMintingContext`**:
+ * - `applicationNamespace` — used as the source for the per-app
+ *   username (legacy convention `${ns}_user`).
+ * - `secretInputs['database.mongodb.password']` — orchestrator-
+ *   supplied password (module is upsert-only, never generator).
+ * - `applicationConfigInputs['databaseName']` — required, the
+ *   per-app database name (orchestrator derives via
+ *   `deriveDefaultMongoDatabaseName`).
+ * - `applicationConfigInputs['clusterName']` — required, the
+ *   Atlas cluster name (orchestrator passes `appInfo.clusterName ||
+ *   'Cluster0'`).
+ * - `adminClient` — narrowed to `IMongoAtlasClient`.
+ *
+ * **Two audiences this module serves:**
+ *
+ * 1. **Audience-1 (platform-admin)**: Atlas API public/private key
+ *    pair + project id + base URL. Consumers: `apps-manager` only
+ *    (companion uses self-managed locally; Atlas is remote-only).
+ *
+ * 2. **Audience-3 (app-scoped, via `mintAppCredentials`)**:
+ *    per-customer-app Atlas database user. Result threaded into
+ *    `Wildo_Application_Secrets.database.mongodb.{username,password}`
+ *    via `_merge_WildoApplicationSecrets`; the SRV connection
+ *    string returned via `runtimeArtifacts.connectionString` for
+ *    transient app-init operations (NOT persisted — the persistence
+ *    shape is split between config (host/protocol/options/database)
+ *    and secrets (username/password)).
+ *
+ * **NOT served (D-4 of Slice 4.B locked decisions, 2026-05-10)**:
+ * - **Audience-2 (platform-service-scoped)**: no platform service
+ *   uses Atlas for inter-service messaging today. Method omitted.
+ *
+ * **`revokeAppCredentials`**: declared and tested, but the integration
+ * call site does NOT exist in `wildo-application-lifecycle.service.ts`
+ * (no app-deletion ceremony today — F6 of plan review 2026-05-06).
+ * Method ships as a forward-compat seam.
+ */
+
+import {
+  AppCredentialMintingContext,
+  AppCredentialMintingResult,
+  IMongoAtlasClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+  InfraProviderModule,
+  InfraProviderPlanContribution,
+} from '@wildo-ai/platform-config-lib';
+
+/**
+ * The `Wildo_Application_Secrets` JSON paths this module writes
+ * through `mintAppCredentials.secretBlobValues`. Declared once and
+ * reused as `appRuntime.perAppSecretBlobPaths` in `plan()` AND as
+ * the keys of the result, so a refactor that renames a path fails
+ * loudly at one place.
+ */
+const MONGODB_USERNAME_PATH = 'database.mongodb.username';
+const MONGODB_PASSWORD_PATH = 'database.mongodb.password';
+/**
+ * The paths this module mints PER RUNTIME PRINCIPAL — the single source for both consumers.
+ *
+ * Read by `InfraProviderModule.perPrincipalSecretBlobPaths` (statically, so apps-manager can strip
+ * these from the application blob before delivering a principal's own material) AND spread into
+ * `appRuntime.perAppSecretBlobPaths` inside `plan()`. Declaring the list twice is how the delivery
+ * path would silently stop covering a path this module still mints.
+ */
+const PER_PRINCIPAL_SECRET_BLOB_PATHS: ReadonlyArray<string> = [MONGODB_USERNAME_PATH, MONGODB_PASSWORD_PATH];
+
+
+/**
+ * Key the module looks for in `secretInputs` for the orchestrator-
+ * supplied password.
+ */
+const MONGODB_PASSWORD_INPUT_KEY = 'database.mongodb.password';
+
+/**
+ * Required keys in `applicationConfigInputs`. The orchestrator
+ * derives both before calling `mintAppCredentials`.
+ */
+const DATABASE_NAME_INPUT_KEY = 'databaseName';
+const CLUSTER_NAME_INPUT_KEY = 'clusterName';
+
+/**
+ * Key in `runtimeArtifacts` carrying the SRV connection string with
+ * credentials embedded. Exposed for orchestrator transient use
+ * (app-init seeding); deliberately NOT persisted.
+ */
+const CONNECTION_STRING_ARTIFACT_KEY = 'connectionString';
+
+/**
+ * Compute the per-app Atlas database username. Mirrors the legacy
+ * convention at
+ * `wildo-application-lifecycle.service.ts:2607` /
+ * `generateNewCredentials` — `mongoUsername = ${ns}_user`.
+ * Centralized here so future changes touch one site.
+ */
+function buildMongodbUsername(applicationNamespace: string): string {
+  return `${applicationNamespace}_user`;
+}
+
+export const MongodbAtlasInfraProviderModule: InfraProviderModule = {
+  provider: InfraProvider.MONGODB_ATLAS,
+  supportedCapabilities: [InfraCapability.DOCUMENT_DATABASE],
+  perPrincipalSecretBlobPaths: PER_PRINCIPAL_SECRET_BLOB_PATHS,
+
+  plan(): InfraProviderPlanContribution {
+    return {
+      // Atlas is remote-only — no compose service / no K8s manifest.
+      // The plan's `externalEndpoints` (in the wider envelope) carry
+      // the Atlas host topology; this module's `plan()` covers only
+      // admin-API access + per-app secret paths.
+      platformAdmin: {
+        envVars: {
+          // ATLAS_API_BASE_URL is non-secret because it identifies
+          // the Atlas API surface (default https://cloud.mongodb.com/api/atlas/v1.0).
+          // ATLAS_PROJECT_ID + ATLAS_CLUSTER_NAME are non-secret
+          // identifiers — public information about the customer's
+          // Atlas project.
+          ATLAS_API_BASE_URL: 'https://cloud.mongodb.com/api/atlas/v1.0',
+          // PROJECT_ID + CLUSTER_NAME default to authored values; the
+          // CLI's env-vars-builder writes them per-env from the
+          // operator's `wildo.infra.<env>.config.ts > backingServices.mongodb`.
+          ATLAS_PROJECT_ID: '',
+          ATLAS_CLUSTER_NAME: 'Cluster0',
+        },
+        secretEnvVars: ['ATLAS_PUBLIC_KEY', 'ATLAS_PRIVATE_KEY'],
+        // Atlas is admin-API only for apps-manager. Companion runs
+        // locally against self-managed Mongo, NOT Atlas (no
+        // companion consumer for the Atlas variant).
+        consumers: [InfraPlatformAdminConsumer.APPS_MANAGER],
+      },
+      appRuntime: {
+        // Static topology for the app pod. The actual host /
+        // protocol / options for Atlas connections are derived
+        // server-side at runtime from cluster info; the persistence
+        // shape mirrors the legacy `_merge_WildoApplicationConfig`
+        // mongodb section.
+        perAppSecretBlobPaths: [...PER_PRINCIPAL_SECRET_BLOB_PATHS],
+      },
+    };
+  },
+
+  async mintAppCredentials(
+    context: AppCredentialMintingContext,
+  ): Promise<AppCredentialMintingResult> {
+    const adminClient = context.adminClient as IMongoAtlasClient;
+    const password = context.secretInputs[MONGODB_PASSWORD_INPUT_KEY];
+    if (!password) {
+      throw new Error(
+        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+        `secretInputs is missing '${MONGODB_PASSWORD_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the Mongo password — modules are upsert-only.`,
+      );
+    }
+    if (!context.applicationNamespace) {
+      throw new Error(
+        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+        `applicationNamespace is empty. ` +
+        `The orchestrator MUST supply a non-empty namespace.`,
+      );
+    }
+    const databaseName = context.applicationConfigInputs?.[DATABASE_NAME_INPUT_KEY];
+    if (!databaseName) {
+      throw new Error(
+        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+        `applicationConfigInputs is missing '${DATABASE_NAME_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the per-app database name.`,
+      );
+    }
+    const clusterName = context.applicationConfigInputs?.[CLUSTER_NAME_INPUT_KEY];
+    if (!clusterName) {
+      throw new Error(
+        `MongodbAtlasInfraProviderModule.mintAppCredentials: ` +
+        `applicationConfigInputs is missing '${CLUSTER_NAME_INPUT_KEY}'. ` +
+        `The orchestrator MUST supply the Atlas cluster name.`,
+      );
+    }
+
+    const username = buildMongodbUsername(context.applicationNamespace);
+
+    // POST /databaseUsers (with PATCH-fallback) — idempotent upsert.
+    // Returns the SRV connection string with credentials embedded.
+    const { connectionString } = await adminClient.upsertApplicationDatabase({
+      clusterName,
+      databaseName,
+      username,
+      password,
+    });
+
+    return {
+      secretBlobValues: {
+        [MONGODB_USERNAME_PATH]: username,
+        // Echo of input password — proves upsert-only.
+        [MONGODB_PASSWORD_PATH]: password,
+      },
+      runtimeArtifacts: {
+        // Transient only — orchestrator uses for app-init seeding,
+        // does NOT persist.
+        [CONNECTION_STRING_ARTIFACT_KEY]: connectionString,
+      },
+    };
+  },
+
+  /**
+   * Tear down the per-app Atlas database user. Idempotent.
+   *
+   * **Caller status**: no caller wires this in Slices 1–4.B.3.
+   * Forward-compat seam.
+   */
+  async revokeAppCredentials(context: AppCredentialMintingContext): Promise<void> {
+    if (!context.applicationNamespace) {
+      throw new Error(
+        `MongodbAtlasInfraProviderModule.revokeAppCredentials: ` +
+        `applicationNamespace is empty. ` +
+        `The orchestrator MUST supply a non-empty namespace.`,
+      );
+    }
+    const adminClient = context.adminClient as IMongoAtlasClient;
+    const username = buildMongodbUsername(context.applicationNamespace);
+    await adminClient.deleteDatabaseUser(username);
+  },
+
+  // No `mintPlatformServiceCredentials` (D-4).
+};