iec-builder 0.1.0

package/src/services/db-provisioner.test.ts

@@ -0,0 +1,602 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// Use vi.hoisted so the mock fn is available when vi.mock factory runs
+const {
+  mockExecSync,
+  mockEnsureMongoUser,
+  mockEnsureRedisUser,
+  mockEnsureNeo4jUser,
+  mockBuildMongoUsername,
+  mockBuildSharedMongoUsername,
+  mockBuildRedisUsername,
+  mockBuildNeo4jUsername,
+  mockGeneratePassword,
+  mockEncrypt,
+  mockDecrypt,
+} = vi.hoisted(() => ({
+  mockExecSync: vi.fn(),
+  mockEnsureMongoUser: vi.fn(),
+  mockEnsureRedisUser: vi.fn(),
+  mockEnsureNeo4jUser: vi.fn(),
+  mockBuildMongoUsername: vi.fn(),
+  mockBuildSharedMongoUsername: vi.fn(),
+  mockBuildRedisUsername: vi.fn(),
+  mockBuildNeo4jUsername: vi.fn(),
+  mockGeneratePassword: vi.fn(),
+  mockEncrypt: vi.fn(),
+  mockDecrypt: vi.fn(),
+}))
+
+vi.mock('child_process', () => ({
+  execSync: mockExecSync,
+}))
+
+vi.mock('../utils/logger.js', () => ({
+  logger: {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  },
+}))
+
+vi.mock('../config/env.js', () => ({
+  env: {
+    MONGODB_URI: 'mongodb://64.23.181.20:27017/builder',
+    REDIS_URL: 'redis://64.23.181.20:6379',
+    DB_MONGODB_HOST: '64.23.181.20',
+    DB_MONGODB_PORT: 27017,
+    DB_MONGODB_ADMIN_URI: '',
+    DB_REDIS_HOST: '64.23.181.20',
+    DB_REDIS_PORT: 6379,
+    DB_REDIS_ADMIN_URL: '',
+    DB_NEO4J_HOST: '64.23.181.20',
+    DB_NEO4J_PORT: 7687,
+    DB_NEO4J_ADMIN_URI: '',
+    DB_NEO4J_ADMIN_USER: '',
+    DB_NEO4J_ADMIN_PASSWORD: '',
+  },
+}))
+
+vi.mock('./crypto.js', () => ({
+  encrypt: mockEncrypt,
+  decrypt: mockDecrypt,
+}))
+
+vi.mock('./db-credential-manager.js', () => ({
+  ensureMongoUser: mockEnsureMongoUser,
+  ensureRedisUser: mockEnsureRedisUser,
+  ensureNeo4jUser: mockEnsureNeo4jUser,
+  buildMongoUsername: mockBuildMongoUsername,
+  buildSharedMongoUsername: mockBuildSharedMongoUsername,
+  buildRedisUsername: mockBuildRedisUsername,
+  buildNeo4jUsername: mockBuildNeo4jUsername,
+  generatePassword: mockGeneratePassword,
+}))
+
+import { provisionDatabases, provisionConsumedDatabases, buildConnectionString, buildAuthenticatedConnectionString, buildAuthenticatedRedisUrl, type DatabaseSpec, type ConsumesDatabaseSpec } from './db-provisioner.js'
+import { env } from '../config/env.js'
+
+describe('db-provisioner', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockExecSync.mockReturnValue('')
+    mockBuildMongoUsername.mockReturnValue('svc_myapp_prod')
+    mockBuildSharedMongoUsername.mockReturnValue('svc_portal_on_bio_prod')
+    mockBuildRedisUsername.mockReturnValue('svc_myapp_prod')
+    mockBuildNeo4jUsername.mockReturnValue('svc_myapp_prod')
+    mockGeneratePassword.mockReturnValue('test-password-123')
+    mockEncrypt.mockReturnValue('encrypted-password')
+    mockDecrypt.mockReturnValue('decrypted-password')
+    mockEnsureMongoUser.mockResolvedValue(true)
+    mockEnsureRedisUser.mockResolvedValue(true)
+    mockEnsureNeo4jUser.mockResolvedValue(true)
+    // Reset admin URIs to empty (default)
+    ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = ''
+    ;(env as Record<string, unknown>).DB_REDIS_ADMIN_URL = ''
+    ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = ''
+  })
+
+  describe('buildConnectionString', () => {
+    it('should build mongodb connection string with service name and environment', () => {
+      const result = buildConnectionString('mongodb', 'myapp', 'prod')
+      expect(result).toBe('mongodb://64.23.181.20:27017/myapp-prod')
+    })
+
+    it('should build mongodb connection string with custom db name', () => {
+      const result = buildConnectionString('mongodb', 'myapp', 'sandbox', 'custom-db')
+      expect(result).toBe('mongodb://64.23.181.20:27017/custom-db')
+    })
+
+    it('should build redis connection string', () => {
+      const result = buildConnectionString('redis', 'myapp', 'prod')
+      expect(result).toBe('redis://64.23.181.20:6379/0')
+    })
+
+    it('should return empty string for unknown database type', () => {
+      const result = buildConnectionString('postgres' as 'mongodb', 'myapp', 'prod')
+      expect(result).toBe('')
+    })
+
+    it('should build neo4j connection string', () => {
+      const result = buildConnectionString('neo4j', 'myapp', 'prod')
+      expect(result).toBe('bolt://64.23.181.20:7687')
+    })
+  })
+
+  describe('buildAuthenticatedConnectionString', () => {
+    it('should include user and password in the URI', () => {
+      const result = buildAuthenticatedConnectionString('svc_myapp_prod', 'mypass', 'myapp-prod')
+      expect(result).toBe('mongodb://svc_myapp_prod:mypass@64.23.181.20:27017/myapp-prod?authSource=myapp-prod')
+    })
+
+    it('should encode special characters in username and password', () => {
+      const result = buildAuthenticatedConnectionString('user@host', 'p@ss:w/rd', 'db-name')
+      expect(result).toContain(encodeURIComponent('user@host'))
+      expect(result).toContain(encodeURIComponent('p@ss:w/rd'))
+    })
+
+    it('should include authSource parameter matching the database name', () => {
+      const result = buildAuthenticatedConnectionString('user', 'pass', 'mydb')
+      expect(result).toContain('?authSource=mydb')
+    })
+  })
+
+  describe('provisionDatabases', () => {
+    it('should return empty result when no databases specified', async () => {
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', [])
+      expect(result).toEqual({ envVars: {}, credentials: [] })
+      expect(mockExecSync).not.toHaveBeenCalled()
+    })
+
+    it('should provision mongodb without credentials when admin URI is empty', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({
+        MONGODB_URI: 'mongodb://64.23.181.20:27017/myapp-prod',
+      })
+      expect(result.credentials).toEqual([])
+      expect(mockEnsureMongoUser).not.toHaveBeenCalled()
+    })
+
+    it('should provision mongodb with credentials when admin URI is configured', async () => {
+      ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = 'mongodb://admin:pass@64.23.181.20:27017/admin'
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.MONGODB_URI).toContain('svc_myapp_prod')
+      expect(result.envVars.MONGODB_URI).toContain('test-password-123')
+      expect(result.envVars.MONGODB_URI).toContain('authSource=myapp-prod')
+      expect(result.credentials).toHaveLength(1)
+      expect(result.credentials[0]).toMatchObject({
+        type: 'mongodb',
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'encrypted-password',
+        databaseName: 'myapp-prod',
+        environment: 'prod',
+      })
+      expect(mockEnsureMongoUser).toHaveBeenCalledWith('myapp-prod', 'svc_myapp_prod', 'test-password-123', 'readWrite')
+    })
+
+    it('should reuse existing credentials on redeploy', async () => {
+      ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = 'mongodb://admin:pass@64.23.181.20:27017/admin'
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+      const existingCredentials = [{
+        type: 'mongodb' as const,
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'existing-encrypted',
+        databaseName: 'myapp-prod',
+        environment: 'prod' as const,
+        provisionedAt: '2026-01-01T00:00:00.000Z',
+      }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases, existingCredentials)
+
+      expect(mockDecrypt).toHaveBeenCalledWith('existing-encrypted')
+      expect(mockGeneratePassword).not.toHaveBeenCalled()
+      expect(result.credentials[0].username).toBe('svc_myapp_prod')
+      expect(result.credentials[0].provisionedAt).toBe('2026-01-01T00:00:00.000Z')
+    })
+
+    it('should provision a redis database and return REDIS_URL env var', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'redis' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({
+        REDIS_URL: 'redis://64.23.181.20:6379/0',
+      })
+      expect(result.credentials).toEqual([])
+    })
+
+    it('should provision a neo4j database and return NEO4J_URI env var', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({
+        NEO4J_URI: 'bolt://64.23.181.20:7687',
+      })
+    })
+
+    it('should provision multiple databases and return all env vars', async () => {
+      const databases: DatabaseSpec[] = [
+        { type: 'mongodb' },
+        { type: 'redis', name: 'myapp-cache' },
+      ]
+
+      const result = await provisionDatabases('myapp', 'sandbox', 'myapp-sandbox', databases)
+
+      expect(result.envVars.MONGODB_URI).toBe('mongodb://64.23.181.20:27017/myapp-sandbox')
+      expect(result.envVars.REDIS_URL).toBe('redis://64.23.181.20:6379/0')
+      expect(mockExecSync).toHaveBeenCalledTimes(2)
+    })
+
+    it('should use custom name for mongodb when provided', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'mongodb', name: 'custom-db' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({
+        MONGODB_URI: 'mongodb://64.23.181.20:27017/custom-db',
+      })
+    })
+
+    it('should skip unknown database types with warning', async () => {
+      const databases: DatabaseSpec[] = [
+        { type: 'postgres' as 'mongodb' },
+        { type: 'mongodb' },
+      ]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.MONGODB_URI).toBe('mongodb://64.23.181.20:27017/myapp-prod')
+      expect(mockExecSync).toHaveBeenCalledTimes(1)
+    })
+
+    it('should be idempotent using kubectl apply with dry-run pipe', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      const kubectlCommand = mockExecSync.mock.calls[0][0] as string
+      expect(kubectlCommand).toContain('--dry-run=client -o yaml | kubectl apply -f -')
+    })
+
+    it('should create secret in the correct namespace', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      const kubectlCommand = mockExecSync.mock.calls[0][0] as string
+      expect(kubectlCommand).toContain('--namespace myapp-prod')
+    })
+
+    it('should name the secret with service name and db type', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      const kubectlCommand = mockExecSync.mock.calls[0][0] as string
+      expect(kubectlCommand).toContain('myapp-db-mongodb')
+    })
+
+    it('should handle kubectl failure gracefully', async () => {
+      mockExecSync.mockImplementation(() => {
+        throw new Error('kubectl: command not found')
+      })
+
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      await expect(
+        provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+      ).rejects.toThrow('Failed to provision mongodb database')
+    })
+
+    it('should fall back to unauthenticated when ensureMongoUser returns false', async () => {
+      ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = 'mongodb://admin:pass@64.23.181.20:27017/admin'
+      mockEnsureMongoUser.mockResolvedValue(false)
+      const databases: DatabaseSpec[] = [{ type: 'mongodb' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.MONGODB_URI).toBe('mongodb://64.23.181.20:27017/myapp-prod')
+      expect(result.credentials).toEqual([])
+    })
+  })
+
+  describe('provisionConsumedDatabases', () => {
+    const mockLookupOwner = vi.fn()
+
+    beforeEach(() => {
+      mockLookupOwner.mockReset()
+      ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = 'mongodb://admin:pass@64.23.181.20:27017/admin'
+    })
+
+    it('should return empty result when no consumed databases', async () => {
+      const result = await provisionConsumedDatabases('portal', 'prod', 'portal-prod', [], [], mockLookupOwner)
+      expect(result).toEqual({ envVars: {}, credentials: [] })
+      expect(mockLookupOwner).not.toHaveBeenCalled()
+    })
+
+    it('should throw when owner service is not found', async () => {
+      mockLookupOwner.mockResolvedValue(null)
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      await expect(
+        provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+      ).rejects.toThrow('service not found')
+    })
+
+    it('should throw when owner has no shared databases of requested type', async () => {
+      mockLookupOwner.mockResolvedValue({ name: 'bio', databaseSharing: [] })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      await expect(
+        provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+      ).rejects.toThrow('no shared databases of type "mongodb"')
+    })
+
+    it('should throw when consumer is not authorized in sharedWith', async () => {
+      mockLookupOwner.mockResolvedValue({
+        name: 'bio',
+        databaseSharing: [{
+          type: 'mongodb',
+          databaseName: 'bio',
+          sharedWith: [{ service: 'other-svc', access: 'readWrite' }],
+        }],
+      })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      await expect(
+        provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+      ).rejects.toThrow('not authorized')
+    })
+
+    it('should provision consumed database with readWrite access', async () => {
+      mockLookupOwner.mockResolvedValue({
+        name: 'bio',
+        databaseSharing: [{
+          type: 'mongodb',
+          databaseName: 'bio',
+          sharedWith: [{ service: 'portal', access: 'readWrite' }],
+        }],
+      })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      const result = await provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+
+      expect(mockEnsureMongoUser).toHaveBeenCalledWith('bio', 'svc_portal_on_bio_prod', 'test-password-123', 'readWrite')
+      expect(result.envVars).toHaveProperty('BIO_MONGODB_URI')
+      expect(result.envVars.BIO_MONGODB_URI).toContain('svc_portal_on_bio_prod')
+      expect(result.credentials).toHaveLength(1)
+    })
+
+    it('should provision consumed database with readOnly access', async () => {
+      mockLookupOwner.mockResolvedValue({
+        name: 'bio',
+        databaseSharing: [{
+          type: 'mongodb',
+          databaseName: 'bio',
+          sharedWith: [{ service: 'portal', access: 'readOnly' }],
+        }],
+      })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      await provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+
+      expect(mockEnsureMongoUser).toHaveBeenCalledWith('bio', 'svc_portal_on_bio_prod', 'test-password-123', 'read')
+    })
+
+    it('should use custom envVar when specified', async () => {
+      mockLookupOwner.mockResolvedValue({
+        name: 'bio',
+        databaseSharing: [{
+          type: 'mongodb',
+          databaseName: 'bio',
+          sharedWith: [{ service: 'portal', access: 'readWrite' }],
+        }],
+      })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb', envVar: 'MONGODB_URI' }]
+
+      const result = await provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+
+      expect(result.envVars).toHaveProperty('MONGODB_URI')
+      expect(result.envVars).not.toHaveProperty('BIO_MONGODB_URI')
+    })
+
+    it('should create K8s secret with correct naming convention', async () => {
+      mockLookupOwner.mockResolvedValue({
+        name: 'bio',
+        databaseSharing: [{
+          type: 'mongodb',
+          databaseName: 'bio',
+          sharedWith: [{ service: 'portal', access: 'readWrite' }],
+        }],
+      })
+      const consumed: ConsumesDatabaseSpec[] = [{ service: 'bio', type: 'mongodb' }]
+
+      await provisionConsumedDatabases('portal', 'prod', 'portal-prod', consumed, [], mockLookupOwner)
+
+      const kubectlCommand = mockExecSync.mock.calls[0][0] as string
+      expect(kubectlCommand).toContain('portal-shared-bio-db-mongodb')
+      expect(kubectlCommand).toContain('--namespace portal-prod')
+    })
+  })
+
+  describe('buildAuthenticatedRedisUrl', () => {
+    it('should include user and password in the URL', () => {
+      const result = buildAuthenticatedRedisUrl('svc_myapp_prod', 'mypass')
+      expect(result).toBe('redis://svc_myapp_prod:mypass@64.23.181.20:6379/0')
+    })
+
+    it('should encode special characters in username and password', () => {
+      const result = buildAuthenticatedRedisUrl('user@host', 'p@ss:w/rd')
+      expect(result).toContain(encodeURIComponent('user@host'))
+      expect(result).toContain(encodeURIComponent('p@ss:w/rd'))
+    })
+  })
+
+  describe('Redis provisioning', () => {
+    it('should provision redis without credentials when admin URL is empty', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'redis' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({ REDIS_URL: 'redis://64.23.181.20:6379/0' })
+      expect(result.credentials).toEqual([])
+      expect(mockEnsureRedisUser).not.toHaveBeenCalled()
+    })
+
+    it('should provision redis with credentials when admin URL is configured', async () => {
+      ;(env as Record<string, unknown>).DB_REDIS_ADMIN_URL = 'redis://redis-admin:pass@64.23.181.20:6379/0'
+      const databases: DatabaseSpec[] = [{ type: 'redis' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.REDIS_URL).toContain('svc_myapp_prod')
+      expect(result.envVars.REDIS_URL).toContain('test-password-123')
+      expect(result.envVars.REDIS_URL).toContain('64.23.181.20:6379/0')
+      expect(result.credentials).toHaveLength(1)
+      expect(result.credentials[0]).toMatchObject({
+        type: 'redis',
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'encrypted-password',
+        databaseName: 'redis-myapp-prod',
+        environment: 'prod',
+      })
+      expect(mockEnsureRedisUser).toHaveBeenCalledWith('svc_myapp_prod', 'test-password-123')
+    })
+
+    it('should reuse existing redis credentials on redeploy', async () => {
+      ;(env as Record<string, unknown>).DB_REDIS_ADMIN_URL = 'redis://redis-admin:pass@64.23.181.20:6379/0'
+      const databases: DatabaseSpec[] = [{ type: 'redis' }]
+      const existingCredentials = [{
+        type: 'redis' as const,
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'existing-encrypted',
+        databaseName: 'redis-myapp-prod',
+        environment: 'prod' as const,
+        provisionedAt: '2026-01-01T00:00:00.000Z',
+      }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases, existingCredentials)
+
+      expect(mockDecrypt).toHaveBeenCalledWith('existing-encrypted')
+      expect(mockGeneratePassword).not.toHaveBeenCalled()
+      expect(result.credentials[0].username).toBe('svc_myapp_prod')
+      expect(result.credentials[0].provisionedAt).toBe('2026-01-01T00:00:00.000Z')
+    })
+
+    it('should fall back to unauthenticated when ensureRedisUser returns false', async () => {
+      ;(env as Record<string, unknown>).DB_REDIS_ADMIN_URL = 'redis://redis-admin:pass@64.23.181.20:6379/0'
+      mockEnsureRedisUser.mockResolvedValue(false)
+      const databases: DatabaseSpec[] = [{ type: 'redis' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.REDIS_URL).toBe('redis://64.23.181.20:6379/0')
+      expect(result.credentials).toEqual([])
+    })
+  })
+
+  describe('Neo4j provisioning', () => {
+    it('should provision neo4j without credentials when admin URI is empty', async () => {
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars).toEqual({ NEO4J_URI: 'bolt://64.23.181.20:7687' })
+      expect(result.credentials).toEqual([])
+      expect(mockEnsureNeo4jUser).not.toHaveBeenCalled()
+    })
+
+    it('should provision neo4j with credentials when admin URI is configured', async () => {
+      ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = 'bolt://64.23.181.20:7687'
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.NEO4J_URI).toBe('bolt://64.23.181.20:7687')
+      expect(result.envVars.NEO4J_USERNAME).toBe('svc_myapp_prod')
+      expect(result.envVars.NEO4J_PASSWORD).toBe('test-password-123')
+      expect(result.credentials).toHaveLength(1)
+      expect(result.credentials[0]).toMatchObject({
+        type: 'neo4j',
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'encrypted-password',
+        databaseName: 'myapp-prod',
+        environment: 'prod',
+      })
+      expect(mockEnsureNeo4jUser).toHaveBeenCalledWith('myapp-prod', 'svc_myapp_prod', 'test-password-123')
+    })
+
+    it('should create K8s secret with 3 keys for neo4j', async () => {
+      ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = 'bolt://64.23.181.20:7687'
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+
+      await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      const kubectlCommand = mockExecSync.mock.calls[0][0] as string
+      expect(kubectlCommand).toContain('--from-literal=NEO4J_URI=')
+      expect(kubectlCommand).toContain('--from-literal=NEO4J_USERNAME=')
+      expect(kubectlCommand).toContain('--from-literal=NEO4J_PASSWORD=')
+    })
+
+    it('should reuse existing neo4j credentials on redeploy', async () => {
+      ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = 'bolt://64.23.181.20:7687'
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+      const existingCredentials = [{
+        type: 'neo4j' as const,
+        username: 'svc_myapp_prod',
+        passwordEncrypted: 'existing-encrypted',
+        databaseName: 'myapp-prod',
+        environment: 'prod' as const,
+        provisionedAt: '2026-01-01T00:00:00.000Z',
+      }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases, existingCredentials)
+
+      expect(mockDecrypt).toHaveBeenCalledWith('existing-encrypted')
+      expect(mockGeneratePassword).not.toHaveBeenCalled()
+      expect(result.credentials[0].username).toBe('svc_myapp_prod')
+      expect(result.credentials[0].provisionedAt).toBe('2026-01-01T00:00:00.000Z')
+    })
+
+    it('should fall back to unauthenticated when ensureNeo4jUser returns false', async () => {
+      ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = 'bolt://64.23.181.20:7687'
+      mockEnsureNeo4jUser.mockResolvedValue(false)
+      const databases: DatabaseSpec[] = [{ type: 'neo4j' }]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.NEO4J_URI).toBe('bolt://64.23.181.20:7687')
+      expect(result.credentials).toEqual([])
+    })
+  })
+
+  describe('Multi-type provisioning', () => {
+    it('should provision all three database types together', async () => {
+      ;(env as Record<string, unknown>).DB_MONGODB_ADMIN_URI = 'mongodb://admin:pass@64.23.181.20:27017/admin'
+      ;(env as Record<string, unknown>).DB_REDIS_ADMIN_URL = 'redis://redis-admin:pass@64.23.181.20:6379/0'
+      ;(env as Record<string, unknown>).DB_NEO4J_ADMIN_URI = 'bolt://64.23.181.20:7687'
+      const databases: DatabaseSpec[] = [
+        { type: 'mongodb' },
+        { type: 'redis' },
+        { type: 'neo4j' },
+      ]
+
+      const result = await provisionDatabases('myapp', 'prod', 'myapp-prod', databases)
+
+      expect(result.envVars.MONGODB_URI).toContain('authSource=myapp-prod')
+      expect(result.envVars.REDIS_URL).toContain('svc_myapp_prod')
+      expect(result.envVars.NEO4J_URI).toBe('bolt://64.23.181.20:7687')
+      expect(result.envVars.NEO4J_USERNAME).toBe('svc_myapp_prod')
+      expect(result.envVars.NEO4J_PASSWORD).toBe('test-password-123')
+      expect(result.credentials).toHaveLength(3)
+      expect(mockExecSync).toHaveBeenCalledTimes(3)
+    })
+  })
+})