unoverse 0.1.138 → 0.1.140

package/operator/infra/aws/main.tf

@@ -400,8 +400,18 @@ data "archive_file" "pretoken" {
   output_path = "${path.module}/pretoken/pretoken.zip"
 }
 
+# THE ROLE IS OURS TO CREATE ONLY WHERE IAM WRITE IS DELEGATED. Where it is not, the
+# account's own pipeline creates it and hands us the ARN, and we must reference it rather
+# than manage it: two states owning one role fight, and our destroy would take theirs with
+# it. See variables.tf, `pretoken_role_arn`.
+locals {
+  pretoken_role_arn  = var.pretoken_role_arn != "" ? var.pretoken_role_arn : one(aws_iam_role.pretoken[*].arn)
+  pretoken_role_ours = var.pretoken_role_arn == ""
+}
+
 resource "aws_iam_role" "pretoken" {
-  name = "${var.name}-pretoken"
+  count = local.pretoken_role_ours ? 1 : 0
+  name  = "${var.name}-pretoken"
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
@@ -413,7 +423,8 @@ resource "aws_iam_role" "pretoken" {
 }
 
 resource "aws_iam_role_policy_attachment" "pretoken_logs" {
-  role       = aws_iam_role.pretoken.name
+  count      = local.pretoken_role_ours ? 1 : 0
+  role       = aws_iam_role.pretoken[0].name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
@@ -422,8 +433,11 @@ resource "aws_iam_role_policy_attachment" "pretoken_logs" {
 # assumed by Lambda" — the role is correct and simply not visible yet. Terraform's
 # dependency graph is satisfied because the role exists; AWS's own propagation is not.
 #
-# Ten seconds is the usual advice and it costs ten seconds on a first apply only.
+# Ten seconds is the usual advice and it costs ten seconds on a first apply only. A role we
+# were handed was created by another pipeline long before this apply, so there is nothing to
+# outrun and the wait is skipped with the role.
 resource "time_sleep" "iam_propagation" {
+  count           = local.pretoken_role_ours ? 1 : 0
   depends_on      = [aws_iam_role.pretoken, aws_iam_role_policy_attachment.pretoken_logs]
   create_duration = "10s"
 }
@@ -435,7 +449,7 @@ resource "aws_lambda_function" "pretoken" {
     variables = { ROLE_PERMISSIONS = jsonencode(local.all_roles) }
   }
   function_name    = "${var.name}-pretoken"
-  role             = aws_iam_role.pretoken.arn
+  role             = local.pretoken_role_arn
   runtime          = "nodejs20.x"
   handler          = "index.handler"
   filename         = data.archive_file.pretoken.output_path

package/operator/infra/aws/terraform.tfvars.example

@@ -57,3 +57,11 @@ roles = [
 # Marketplace catalogue. Defaults to the official one — set this only to point somewhere
 # else, or to "" for local items only.
 # marketplace_url = "https://your-own-marketplace.example.com"
+
+# An account that will not let you create IAM roles. Leave both of these alone unless your
+# deploy fails with AccessDenied on iam:CreateRole or iam:CreateUser, which is what a
+# customer-owned account governed by a permission set (AWS's PowerUserAccess excludes IAM
+# by design) looks like. Then: their team creates the Lambda execution role, you paste the
+# ARN here, and you skip the Bedrock user and paste its keys into a credential by hand.
+# pretoken_role_arn   = "arn:aws:iam::000000000000:role/unoverse-pretoken-role"
+# bedrock_credentials = false

package/operator/infra/aws/variables.tf

@@ -130,3 +130,21 @@ variable "bedrock_credentials" {
   default     = true
   description = "Create an IAM user and access key for the Bedrock nodes. Set false where IAM write is not delegated."
 }
+
+# The pre-token Lambda's execution role (main.tf, "pretoken"), when the account will not let
+# us create it.
+#
+# EMPTY IS EVERY DEPLOYMENT WE HAVE. The module creates the role, attaches
+# AWSLambdaBasicExecutionRole, and nothing changes. Set this only where `iam:CreateRole` is
+# not delegated, which is the normal shape of a customer-owned account governed by a
+# permission set: their pipeline creates the role, we reference the ARN it produces.
+#
+# Creating the Lambda still needs `iam:PassRole` on that role, conditioned on
+# lambda.amazonaws.com, because AWS asks that of whoever attaches the role, not whoever made
+# it. Handing us an ARN does not remove it. The role needs only lambda.amazonaws.com in its
+# trust policy and AWSLambdaBasicExecutionRole attached, which is log writes and nothing else.
+variable "pretoken_role_arn" {
+  type        = string
+  default     = ""
+  description = "ARN of an existing Lambda execution role for the pre-token trigger. Empty = the module creates it."
+}

package/operator/infra/digitalocean/main.tf

@@ -146,9 +146,9 @@ resource "digitalocean_firewall" "app" {
 # NOTE (INFRASTRUCTURE.md § Ingress): DO caps http idle timeout at 600s — set to
 # the cap; long-quiet SSE/WS sessions must survive a reconnect (smoke-test item).
 resource "digitalocean_certificate" "api" {
-  count   = local.has_domain ? 1 : 0
-  name    = "${var.name}-api"
-  type    = "lets_encrypt"
+  count = local.has_domain ? 1 : 0
+  name  = "${var.name}-api"
+  type  = "lets_encrypt"
   # canvas.<domain> rides the SAME certificate as a SAN (and the same LB): the
   # clean hostname costs nothing — only the PORT cannot be dropped, because DO
   # LBs cannot host-route (DECIDED 2026-07-29: one LB, port in the URL).
@@ -156,11 +156,11 @@ resource "digitalocean_certificate" "api" {
 }
 
 resource "digitalocean_loadbalancer" "public" {
-  name                     = "${var.name}-lb"
-  region                   = var.region
-  droplet_ids              = [digitalocean_droplet.app.id]
-  redirect_http_to_https   = local.has_domain # domainless serves HTTP itself, nothing to redirect to
-  http_idle_timeout_seconds = 600 # DO's maximum
+  name                      = "${var.name}-lb"
+  region                    = var.region
+  droplet_ids               = [digitalocean_droplet.app.id]
+  redirect_http_to_https    = local.has_domain # domainless serves HTTP itself, nothing to redirect to
+  http_idle_timeout_seconds = 600              # DO's maximum
 
   # With a domain: HTTPS 443 with the managed cert. Without: plain HTTP 80 on
   # the LB IP. Same port meanings for the developer either way (API on the root).
@@ -367,6 +367,13 @@ resource "random_password" "credential_key" {
   special = false
 }
 
+# The key that actually ships: the operator's when they brought one (a database that
+# already holds credentials keeps the key that encrypted them), otherwise the generated
+# one above. See variables.tf § credential master key.
+locals {
+  credential_encryption_key = var.credential_encryption_key != "" ? var.credential_encryption_key : random_password.credential_key.result
+}
+
 # ── One project, so a universe looks like one thing ───────────────────────────
 #
 # Without this, a universe's parts scatter through the DigitalOcean default project among

package/operator/infra/digitalocean/outputs.tf

@@ -23,7 +23,7 @@ locals {
   # spends it on one GRANT, and it goes no further.
   pg_admin_user = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].user : (local.provision_pg ? digitalocean_database_cluster.pg[0].user : "")
   pg_admin_pass = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].password : (local.provision_pg ? digitalocean_database_cluster.pg[0].password : "")
-  pg_admin_url = local.pg_managed ? "postgresql://${local.pg_admin_user}:${local.pg_admin_pass}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : ""
+  pg_admin_url  = local.pg_managed ? "postgresql://${local.pg_admin_user}:${local.pg_admin_pass}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : ""
 
   # Redis is always ours — provisioned above, no BYO branch.
   redis_host     = digitalocean_database_cluster.redis.private_host
@@ -100,7 +100,7 @@ output "env_production" {
 
     # Credential encryption at rest — per-deployment, generated by Terraform.
     # Back this up with the database (a DB backup is unreadable without it).
-    CREDENTIAL_ENCRYPTION_KEY=${random_password.credential_key.result}
+    CREDENTIAL_ENCRYPTION_KEY=${local.credential_encryption_key}
 
     # Redis (managed, TLS)
     REDIS_HOST=${local.redis_host}

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -43,6 +43,14 @@ openai_api_key       = "sk-..."       # memory server + OpenAI nodes
 #   Or a fully external database, used verbatim:
 # byo_postgres_url = "postgresql://user:pass@host:5432/db?sslmode=require"
 
+# BRINGING A DATABASE MEANS BRINGING ITS KEY. Credentials are encrypted at rest, and the
+# key belongs to the data: reuse a database that already holds credentials without it and
+# every one of them fails to decrypt. Leave this empty for a FRESH database (Terraform
+# generates one, the common case); set it to the existing key when the database is not
+# new. The same applies to a local .env pointed at this universe's database — one key,
+# everywhere that reads those rows.
+# credential_encryption_key = "the key that already encrypted those rows"
+
 # Redis: always provisioned by Terraform (Managed Redis, TLS). Not configurable.
 
 # The rendered output (terraform output -raw env_production > ../../.env.production)

package/operator/infra/digitalocean/variables.tf

@@ -141,3 +141,31 @@ variable "marketplace_url" {
   type        = string
   default     = "https://unoverse-marketplace-4hlb9.ondigitalocean.app"
 }
+
+# ── The credential master key: BRING YOUR OWN when you bring your own database ──
+#
+# THE KEY BELONGS TO THE DATA, NOT TO THE DEPLOYMENT. It decrypts the credential rows in
+# the database it is paired with, so any two environments sharing a database must share
+# this key. Terraform generating a fresh one per deployment is right for a fresh database
+# and WRONG for byo_postgres_url / existing_pg_cluster_name pointing at a database that
+# already holds credentials: the deploy renders a new key and every stored credential
+# fails with OpenSSL "bad decrypt". The same trap catches a local .env pointed at this
+# universe's database (SECURITY.md § Credential encryption at rest).
+#
+# DIGITALOCEAN ONLY, deliberately. AWS always provisions its own RDS instance, so its
+# database is always new and a generated key is always right; a variable there would be
+# a way to get it wrong with no case that needs it.
+#
+# Leave it empty for a fresh database and Terraform generates one, which is the common
+# case. Set it to the key that already encrypted those rows when the database is not new,
+# and keep the two in step from then on.
+variable "credential_encryption_key" {
+  description = "Master key for credentials at rest. Empty = generate one (fresh database). Set it to the EXISTING key when reusing a database that already holds credentials."
+  type        = string
+  sensitive   = true
+  default     = ""
+  validation {
+    condition     = var.credential_encryption_key == "" || length(var.credential_encryption_key) >= 32
+    error_message = "credential_encryption_key must be at least 32 characters (openssl rand -base64 32)."
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.138",
+  "version": "0.1.140",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",