jschoubben
4d04585831
redis provides redis-cache: a real admin client speaking RESP over a raw socket (node:net, no deps); provisioner makes a keyspace-scoped ACL user per grant. postgres provides postgres-database: admin client executing through psql (the consistent shell-out port, like minio's mc), full DDL for create/drop database+ role, a CSV row parser, read-only query tool. Both emit module.<x>.<thing>.provisioned/.deprovisioned from the provisioner. Both typecheck; manifests parse.
58 lines
2.4 KiB
TypeScript
58 lines
2.4 KiB
TypeScript
// redis's provisioner — the adapter that makes redis a provider of the mesh `redis-cache`
|
|
// interface. The watching, sealing and grant-file handling are the sdk harness's; this writes only
|
|
// the per-service half: how redis creates and removes a per-consumer cache (novox/hq ADR 0044/0045).
|
|
//
|
|
// The `redis-cache` interface: a consumer receives `{ host, port, username, password,
|
|
// keyspacePrefix }` and stores its keys under `<keyspacePrefix>:*`, isolated from every other
|
|
// consumer by an ACL user scoped to exactly that prefix.
|
|
//
|
|
// Identity (the ACL username and keyspace) is derived from `grant.consumer` alone — never from
|
|
// `grant.values` — because on removal the harness hands the adapter a grant carrying only the
|
|
// consumer. Deriving from the consumer keeps create and remove naming the same resource.
|
|
|
|
import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
|
|
import { emit } from "@novox/mesh-sdk/events";
|
|
import { RedisClient, generatePassword } from "../client.js";
|
|
|
|
const redis = RedisClient.fromEnv();
|
|
|
|
/** A stable, ACL-safe identity for a consumer: only [A-Za-z0-9_.-], never empty. */
|
|
function identity(consumer: string): string {
|
|
const safe = consumer.replace(/[^A-Za-z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
|
|
return safe || "consumer";
|
|
}
|
|
|
|
/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
|
|
async function announce(type: string, body: Record<string, string>): Promise<void> {
|
|
try {
|
|
await emit(type, body);
|
|
} catch (err) {
|
|
console.error(`[provisioner:redis-cache] emit ${type} failed: ${err}`);
|
|
}
|
|
}
|
|
|
|
runProvisioner("redis-cache", {
|
|
async create(grant: Grant): Promise<Credential> {
|
|
const username = identity(grant.consumer);
|
|
const keyspacePrefix = username;
|
|
const password = generatePassword();
|
|
await redis.createAclUser(username, password, keyspacePrefix);
|
|
await announce("module.redis.cache.provisioned", { consumer: grant.consumer, username, keyspacePrefix });
|
|
return {
|
|
fields: {
|
|
host: redis.host,
|
|
port: String(redis.port),
|
|
username,
|
|
password,
|
|
keyspacePrefix,
|
|
},
|
|
};
|
|
},
|
|
|
|
async remove(grant: Grant): Promise<void> {
|
|
const username = identity(grant.consumer);
|
|
await redis.deleteAclUser(username);
|
|
await announce("module.redis.cache.deprovisioned", { consumer: grant.consumer, username });
|
|
},
|
|
});
|