open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 18:08:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): cut alpha.1 candidate milestone

Browse Source
This commit is contained in:
whyour
2026-08-26 01:41:20 +08:00
parent c2df0c7215
commit 07cdc76bae
94 changed files with 1469 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-control/test/apiCredentialAuthenticator.test.cjs
+48
View File
@@ -13,6 +13,7 @@ const {
const NOW = 10_000;
const PEPPER = Buffer.alloc(32, 1).toString('base64url');
const NEXT_PEPPER = Buffer.alloc(32, 3).toString('base64url');
const SECRET = Buffer.alloc(32, 2).toString('base64url');
const CREDENTIAL_ID = 'app_primary';
@@ -86,6 +87,53 @@ test('derives a domain-separated HMAC digest and user assurance', async () => {
assert.equal(principal.assurance, 'single_factor');
});
test('authenticates overlap generations by exact stored key id without fallback', async () => {
const keyring = {
schemaVersion: 1,
activePepperKeyId: 'rotation-2026-08',
keys: [
{ pepperKeyId: 'legacy-v1', pepper: PEPPER },
{ pepperKeyId: 'rotation-2026-08', pepper: NEXT_PEPPER },
],
};
const records = new Map([
[
'legacy',
credential({
credentialId: 'legacy',
secretDigest: apiCredentialSecretDigest(PEPPER, 'legacy', SECRET),
}),
],
[
'next',
credential({
credentialId: 'next',
pepperKeyId: 'rotation-2026-08',
secretDigest: apiCredentialSecretDigest(
NEXT_PEPPER,
'next',
SECRET,
),
}),
],
['unknown', credential({ credentialId: 'unknown', pepperKeyId: 'missing' })],
]);
const verifier = createClusterControlApiCredentialAuthenticator(
{ async resolve(credentialId) { return records.get(credentialId) ?? null; } },
keyring,
{ now: () => NOW },
);
const request = (credentialId) =>
metadata(`Bearer ql3c_${credentialId}_${SECRET}`);
assert.equal((await verifier.authenticate(request('legacy'))).subject.id, 'app_primary');
assert.equal((await verifier.authenticate(request('next'))).subject.id, 'app_primary');
await assert.rejects(
verifier.authenticate(request('unknown')),
ClusterControlApiCredentialUnavailableError,
);
});
test('rejects missing, malformed, wrong, inactive and disabled credentials', async () => {
let repositoryCalls = 0;
const strict = createClusterControlApiCredentialAuthenticator(