minio: full nox module — client, tools, provisioner and events (ADR 0044/0045/0046)

Object store, an s3-bucket provider. Client ported with no npm deps: S3 data plane over fetch + SigV4 (node:crypto), scoped access keys via the mc CLI (the admin API needs an Argon2 payload node built-ins can't make — the honest port hal also used). Tools: list buckets/objects, bucket info, presigned url. The provisioner makes a bucket + scoped key per grant and emits module.minio.bucket.created/removed (the secret stays off the bus). Typechecks; manifest parses. (Trimmed the generated self-consuming ledger: a provider need not subscribe to its own emits.)
2026-09-04 02:35:51 +02:00
parent fb42fb956b
commit f689b7dfa6
6 changed files with 537 additions and 5 deletions
@@ -0,0 +1,66 @@
+// minio's provisioner — the adapter that makes minio a provider of the mesh `s3-bucket` interface
+// (the name in module.json's `provides`). The reconcile loop, sealing and grant-file handling are the
+// sdk harness's; this writes only the per-service half: how minio creates and removes a consumer's
+// bucket and its scoped access key (novox/hq ADR 0044/0045).
+//
+// The `s3-bucket` interface: a consumer receives `{ endpoint, bucket, accessKey, secretKey, region }`
+// — an S3 endpoint and a credential confined to its own bucket. It depends on `s3-bucket`, not on
+// minio, so any S3-compatible provider could serve it.
+//
+// The bucket and access-key id are derived deterministically from the consumer's identity, because
+// the harness hands `remove` only that identity (no stored values) — so teardown recomputes exactly
+// what creation minted, with nothing to persist. The emits fire here, at the real provisioning
+// points (novox/hq ADR 0046/0047); the module's events entrypoint (../index.ts) consumes them.
+
+import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
+import { emit } from "@novox/mesh-sdk/events";
+import { MinioClient, accessKeyFor, bucketFor } from "../client.js";
+
+const minio = MinioClient.fromEnv();
+
+runProvisioner("s3-bucket", {
+  async create(grant: Grant): Promise<Credential> {
+    const bucket = bucketFor(grant.consumer);
+    const accessKeyId = accessKeyFor(grant.consumer);
+
+    if (!(await minio.bucketExists(bucket))) await minio.createBucket(bucket);
+    // Re-mint the scoped key idempotently: drop any prior one under this id, then add fresh.
+    try { await minio.removeAccessKey(accessKeyId); } catch { /* none yet — first provision */ }
+    const key = await minio.createAccessKey(bucket, accessKeyId);
+
+    await emit("module.minio.bucket.created", {
+      bucket,
+      consumer: grant.consumer,
+      node: grant.node,
+      accessKey: key.accessKey, // the secret is never put on the bus — only the credential file carries it
+      endpoint: minio.baseUrl,
+    });
+
+    return {
+      fields: {
+        endpoint: minio.baseUrl,
+        bucket,
+        accessKey: key.accessKey,
+        secretKey: key.secretKey,
+        region: minio.region,
+      },
+    };
+  },
+
+  async remove(grant: Grant): Promise<void> {
+    const bucket = bucketFor(grant.consumer);
+    const accessKeyId = accessKeyFor(grant.consumer);
+
+    // Revoking the key is what cuts the consumer's access. The bucket is emptied-then-dropped only if
+    // empty; a bucket that still holds objects is left for an operator rather than erroring on every
+    // reconcile tick — access is already gone, and silently deleting a consumer's data would be worse.
+    try { await minio.removeAccessKey(accessKeyId); } catch { /* already gone */ }
+    try {
+      await minio.removeBucket(bucket);
+    } catch (err) {
+      console.error(`[minio] bucket ${bucket} not removed (likely non-empty), access revoked: ${err}`);
+    }
+
+    await emit("module.minio.bucket.removed", { bucket, consumer: grant.consumer, node: grant.node });
+  },
+});