novox/mesh-catalog
3
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

Providers create the credential the mesh minted, sealing nothing (ADR 0053)

Browse Source 
redis, postgres and minio adapters drop generatePassword + the returned credential:
each creates the resource under the login the mesh derived (`as`) with the password
the mesh minted (`p.password`). minio's client gains a secret-key argument so it sets
the mesh's secret rather than generating one. umami (analytics) is re-pointed at the
new contract too; its siteId return is a data-provision concern ADR 0053 scopes out.

Proven: mesh-lab provider-uses-mesh-credential green — redis creates the consumer's
login with the mesh's password, the consumer authenticates (PONG), no seal key set.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
This commit is contained in:
jschoubben
2026-09-05 00:27:37 +02:00
parent 550393b847
commit 3b03fcd8f7
5 changed files with 107 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/postgres/provisioner/index.ts
+25 -41
View File
@@ -1,33 +1,25 @@
// postgres's provisioner — the adapter that makes postgres a provider of the mesh
// `postgres-database` interface. The watching, sealing and grant-file handling are the sdk
// harness's; this writes only the per-service half: how postgres creates and removes a consumer's
// database + owning role (novox/hq ADR 0044/0045).
// `postgres-database` interface. The reconcile loop, the contributions file, and reading the mesh's
// minted password are the sdk harness's; this writes only the per-service half: how postgres creates
// and removes a consumer's database + owning role (novox/hq ADR 0044/0045/0053).
//
// The `postgres-database` interface: a consumer receives `{ host, port, database, user, password }`
// and connects to a database only it owns.
// The `postgres-database` interface: a consumer connects to a database it alone owns, as `as` with
// the password the mesh minted.
//
// Identity (the database and role names) is derived from `grant.consumer` alone — never from
// `grant.values` — because on removal the harness hands the adapter a grant carrying only the
// consumer. Deriving from the consumer keeps create and remove naming the same resource.
// **The role name and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives
// the login and hands it to both ends, and mints the password. postgres creates a role and a
// same-named database under exactly that login — a name the consumer cannot learn is a database it
// cannot reach.
//
// The credential is composed here and returned; the DDL runs through PostgresClient.query(), which
// is the module's one pending boundary (see client.ts). Until that boundary is backed, create()
// surfaces the TODO honestly rather than sealing a credential for a database that was never made.
// The DDL runs through PostgresClient.query(), which is the module's one pending boundary (see
// client.ts).
import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
import { emit } from "@novox/mesh-sdk/events";
import { PostgresClient, generatePassword } from "../client.js";
import { PostgresClient } from "../client.js";
const postgres = PostgresClient.fromEnv();
/** A stable postgres identifier for a consumer: lowercase [a-z0-9_], never starting with a digit. */
function identity(consumer: string): string {
let safe = consumer.toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/^_+|_+$/g, "");
if (safe === "" ) safe = "consumer";
if (/^[0-9]/.test(safe)) safe = "_" + safe;
return safe.slice(0, 63); // postgres identifier limit
}
/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
async function announce(type: string, body: Record<string, string>): Promise<void> {
try {
@@ -38,27 +30,19 @@ async function announce(type: string, body: Record<string, string>): Promise<voi
}
runProvisioner("postgres-database", {
async create(grant: Grant): Promise<Credential> {
const database = identity(grant.consumer);
const user = database;
const password = generatePassword();
await postgres.createDatabaseAndRole(database, user, password);
await announce("module.postgres.database.provisioned", { consumer: grant.consumer, database, user });
return {
fields: {
host: postgres.host,
port: String(postgres.port),
database,
user,
password,
},
};
async create(p: Provision): Promise<void> {
// Database and owning role share the consumer's login, so the consumer owns exactly its own.
const database = p.as;
await postgres.createDatabaseAndRole(database, p.as, p.password);
await announce("module.postgres.database.provisioned", {
consumer: p.consumer ?? "",
database,
user: p.as,
});
},
async remove(grant: Grant): Promise<void> {
const database = identity(grant.consumer);
const user = database;
await postgres.dropDatabaseAndRole(database, user);
await announce("module.postgres.database.deprovisioned", { consumer: grant.consumer, database });
async remove(p: { as: string }): Promise<void> {
await postgres.dropDatabaseAndRole(p.as, p.as);
await announce("module.postgres.database.deprovisioned", { database: p.as });
},
});