do

Overview ¶

Package do mounts the Hanzo Cloud DigitalOcean-native infra surface — /v1/vpcs and /v1/load-balancers — on the unified cloud binary (HIP-0106). DigitalOcean is Hanzo's EXCLUSIVE cloud venue; VPCs and Load Balancers are first-class DO resources, so this subsystem is a thin, org-scoped facade over the digitalocean/godo SDK's native VPCs + LoadBalancers services. It backs the console's "VPC" and "Load Balancers" pages, which render "not connected" today because nothing serves them.

GET    /v1/vpcs                 list the caller's VPCs            -> {vpcs:[...]}
POST   /v1/vpcs                 create {name,region,ip_range}     -> Vpc
GET    /v1/vpcs/:id             one VPC (owned)                   -> Vpc
DELETE /v1/vpcs/:id             delete one VPC (owned)
GET    /v1/load-balancers       list the caller's LBs             -> {loadBalancers:[...]}
POST   /v1/load-balancers       create {name,region,...}          -> LoadBalancer
GET    /v1/load-balancers/:id   one LB (owned)                    -> LoadBalancer
DELETE /v1/load-balancers/:id   delete one LB (owned)

TENANT ISOLATION — DigitalOcean is a SINGLE account, so the org boundary is enforced by this subsystem, not by DO. A resource's PHYSICAL DO name is derived from the caller's validated org as "o"<orgHash>-<friendly> — the SAME org-hash, DNS-safe convention clients/s3 + clients/provisioning use for shared backends (provisioning.BucketName). The client speaks FRIENDLY names ("web"); the server maps friendly↔physical and never trusts a client-supplied physical name. LIST filters DO's account-wide inventory to the caller's "o"<orgHash>- prefix and strips it; GET/DELETE re-derive nothing from the request beyond the resource id, fetch the resource, and confirm its physical name carries the CALLER's prefix before returning or deleting it — a resource in another org's namespace is reported 404 (an existence-oracle guard, never 403), so one tenant can neither see, read, nor delete another's. The boundary is by construction. VPCs carry no DO tags, so the name prefix (not a tag) is the ONE convention that isolates both resource kinds uniformly.

FAIL-CLOSED — absent DO_API_TOKEN the subsystem mounts its full route space but every op returns an honest 503; it NEVER fabricates a VPC or load balancer. The token is the SAME single personal-access token the finance client reads (DO_API_TOKEN, sourced from a KMSSecret on the cloud env) — never hard-coded.