do

Overview ¶

Package do is the org-scoped private-network surface — /v1/vpcs and /v1/balancers — carved out of Hanzo's OWN house DigitalOcean account.

It is the house-account facade over digitalocean/godo's VPCs + LoadBalancers. An org's OWN cloud accounts (DigitalOcean, AWS, GCP, Azure) are a different plane: apps/venue links those and folds their clusters into the fleet.

GET    /v1/vpcs                 list the caller's VPCs            -> {vpcs:[...]}
POST   /v1/vpcs                 create {name,region,ip_range}     -> Vpc
GET    /v1/vpcs/:id             one VPC (owned)                   -> Vpc
DELETE /v1/vpcs/:id             delete one VPC (owned)
GET    /v1/balancers       list the caller's LBs             -> {loadBalancers:[...]}
POST   /v1/balancers       create {name,region,...}          -> LoadBalancer
GET    /v1/balancers/:id   one LB (owned)                    -> LoadBalancer
DELETE /v1/balancers/:id   delete one LB (owned)

TENANT ISOLATION — DigitalOcean is a SINGLE account, so the org boundary is enforced by this subsystem, not by DO. A resource's PHYSICAL DO name is derived from the caller's validated org as "o"<orgHash>-<friendly> — the SAME org-hash, DNS-safe convention apps/storage + apps/provisioning use for shared backends (provisioning.BucketName). The client speaks FRIENDLY names ("web"); the server maps friendly↔physical and never trusts a client-supplied physical name. LIST filters DO's account-wide inventory to the caller's "o"<orgHash>- prefix and strips it; GET/DELETE re-derive nothing from the request beyond the resource id, fetch the resource, and confirm its physical name carries the CALLER's prefix before returning or deleting it — a resource in another org's namespace is reported 404 (an existence-oracle guard, never 403), so one tenant can neither see, read, nor delete another's. The boundary is by construction. VPCs carry no DO tags, so the name prefix (not a tag) is the ONE convention that isolates both resource kinds uniformly.

FAIL-CLOSED — absent DO_API_TOKEN the subsystem mounts its full route space but every op returns an honest 503; it NEVER fabricates a VPC or load balancer. The token is the SAME single personal-access token the finance client reads (DO_API_TOKEN, sourced from a KMSSecret on the cloud env) — never hard-coded.