open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): authorize reconciliation reviews

Browse Source
This commit is contained in:
whyour
2026-08-21 19:34:29 +08:00
parent 827ba5294f
commit 22f58b1eff
19 changed files with 4293 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/back/ql3ClusterDependencyAudit.test.cjs
+67
View File
@@ -2083,6 +2083,73 @@ test('confines fresh setup authority to the reviewed owner CLI subpath', (t) =>
);
});
test('confines reconciliation review authentication to exact read-only owners', (t) => {
const root = fs.mkdtempSync(
path.join(os.tmpdir(), 'ql3-reconciliation-review-boundary-'),
);
const reviewDirectory = path.join(
root,
'packages/ql3-local-owner-cli/src/deployment/reconciliation/review',
);
fs.mkdirSync(reviewDirectory, { recursive: true });
fs.writeFileSync(
path.join(reviewDirectory, 'authorization.ts'),
[
"import type { Key } from '@qinglong/runtime-core/local-secret';",
"import type { Principal } from '@qinglong/runtime-core/security';",
].join('\n'),
);
fs.writeFileSync(
path.join(reviewDirectory, 'completion.ts'),
[
"import { authenticate } from '@qinglong/local-owner-console/authenticated-command';",
"import { database } from '@qinglong/local-sqlite/authentication-read';",
].join('\n'),
);
fs.writeFileSync(
path.join(reviewDirectory, 'issuerKeyring.ts'),
"import type { Key } from '@qinglong/runtime-core/local-secret';",
);
fs.writeFileSync(
path.join(reviewDirectory, 'neighbor.ts'),
[
"import { authenticate } from '@qinglong/local-owner-console/authenticated-command';",
"import { database } from '@qinglong/local-sqlite/authentication-read';",
"import type { Key } from '@qinglong/runtime-core/local-secret';",
"import type { Principal } from '@qinglong/runtime-core/security';",
].join('\n'),
);
t.after(() => fs.rmSync(root, { recursive: true, force: true }));
const findings = [];
auditSourceImports(root, 'packages/ql3-local-owner-cli', findings);
assert.deepEqual(
findings.map(({ code, file, specifier }) => ({ code, file, specifier })),
[
{
code: 'FORBIDDEN_LOCAL_ADOPTION_CLI_AUTHORITY_IMPORT',
file: 'packages/ql3-local-owner-cli/src/deployment/reconciliation/review/neighbor.ts',
specifier: '@qinglong/local-owner-console/authenticated-command',
},
{
code: 'FORBIDDEN_LOCAL_ADOPTION_CLI_AUTHORITY_IMPORT',
file: 'packages/ql3-local-owner-cli/src/deployment/reconciliation/review/neighbor.ts',
specifier: '@qinglong/local-sqlite/authentication-read',
},
{
code: 'FORBIDDEN_PACKAGE_SOURCE_IMPORT',
file: 'packages/ql3-local-owner-cli/src/deployment/reconciliation/review/neighbor.ts',
specifier: '@qinglong/runtime-core/local-secret',
},
{
code: 'FORBIDDEN_PACKAGE_SOURCE_IMPORT',
file: 'packages/ql3-local-owner-cli/src/deployment/reconciliation/review/neighbor.ts',
specifier: '@qinglong/runtime-core/security',
},
],
);
});
test('deleted Owner ceremony package names remain dependency tombstones', (t) => {
const root = fixture(
t,
test/back/ql3PackageBoundaryAudit.test.cjs
+4 -4
View File
@@ -207,10 +207,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
rootSourceFileRoles: localOwnerCli.rootSourceFileRoles,
},
{
sourceFiles: 149,
sourceFiles: 155,
rootSourceFiles: 1,
rootSourceLines: 50,
nestedSourceFiles: 148,
nestedSourceFiles: 154,
rootSourceFileRoles: { 'cli.ts': 'binary_entry' },
},
);
@@ -540,10 +540,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
rootSourceFileRoles: localSqlite.rootSourceFileRoles,
},
{
sourceFiles: 202,
sourceFiles: 203,
rootSourceFiles: 1,
rootSourceLines: 31,
nestedSourceFiles: 201,
nestedSourceFiles: 202,
rootSourceFileRoles: { 'index.ts': 'public_export' },
},
);