open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 03:18:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add opaque cluster environment bundle delivery

Browse Source
This commit is contained in:
whyour
2026-08-24 19:31:03 +08:00
parent cf2c0ec7b3
commit 4abf125ce9
36 changed files with 1682 additions and 382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-runtime-core/test/remoteSecretDelivery.test.cjs
+104 -36
View File
@@ -14,6 +14,11 @@ const { createSecretRef } = require('../dist/secret/secretReference');
const SESSION_ID = '018f0000-0000-7000-8000-000000000001';
const DIGEST = 'a'.repeat(64);
const SECRET_REF = createSecretRef({ projectId: 'project-1', name: 'token' });
const BUNDLE_REF = createSecretRef({
projectId: 'project-1',
name: 'legacy-env-bundle',
version: 7,
});
function command(overrides = {}) {
return {
@@ -31,13 +36,14 @@ function command(overrides = {}) {
leaseToken: 'worker_generated_lease_capability_0000000000000001',
expectedLeaseVersion: 4,
secretRefs: [SECRET_REF],
environmentBundleRefs: [],
...overrides,
};
}
test('creates a versioned request without duplicating path-bound identity', () => {
const body = createRemoteWorkerSecretDeliveryRequestBody(command());
assert.equal(body.schema, 'qinglong/remote-secret-delivery@v1');
assert.equal(body.schema, 'qinglong/remote-secret-delivery@v2');
assert.equal('workerId' in body, false);
assert.equal('workerSessionId' in body, false);
assert.deepEqual(body.secretRefs, [SECRET_REF]);
@@ -45,67 +51,129 @@ test('creates a versioned request without duplicating path-bound identity', () =
});
test('parses only an exact authority and ordered Secret set', () => {
const response = createRemoteWorkerSecretDeliveryResponseBody({
runId: 'run-1',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
values: [{ secretRef: SECRET_REF, value: 'private-value' }],
}, [SECRET_REF]);
const response = createRemoteWorkerSecretDeliveryResponseBody(
{
runId: 'run-1',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
values: [{ secretRef: SECRET_REF, value: 'private-value' }],
environmentBundles: [],
},
{ secretRefs: [SECRET_REF], environmentBundleRefs: [] },
);
const parsed = parseRemoteWorkerSecretDeliveryResponse(
JSON.stringify(response),
{
runId: 'run-1', attemptId: 'attempt-1', offerId: 'offer-1',
executionDigest: DIGEST, secretRefs: [SECRET_REF],
runId: 'run-1',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
secretRefs: [SECRET_REF],
environmentBundleRefs: [],
},
);
assert.deepEqual(parsed.values, [
{ secretRef: SECRET_REF, value: 'private-value' },
]);
assert.throws(
() => parseRemoteWorkerSecretDeliveryResponse(JSON.stringify(response), {
runId: 'run-other', attemptId: 'attempt-1', offerId: 'offer-1',
executionDigest: DIGEST, secretRefs: [SECRET_REF],
}),
() =>
parseRemoteWorkerSecretDeliveryResponse(JSON.stringify(response), {
runId: 'run-other',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
secretRefs: [SECRET_REF],
environmentBundleRefs: [],
}),
/authority does not match/,
);
});
test('rejects duplicate, cross-project and oversized delivery input', () => {
assert.throws(
() => normalizeRemoteWorkerSecretDeliveryCommand(command({
secretRefs: [SECRET_REF, SECRET_REF],
})),
() =>
normalizeRemoteWorkerSecretDeliveryCommand(
command({
secretRefs: [SECRET_REF, SECRET_REF],
}),
),
/secretRefs are invalid/,
);
const foreign = createSecretRef({ projectId: 'project-2', name: 'token' });
assert.throws(
() => normalizeRemoteWorkerSecretDeliveryCommand(command({
secretRefs: [foreign],
})),
() =>
normalizeRemoteWorkerSecretDeliveryCommand(
command({
secretRefs: [foreign],
}),
),
/project is invalid/,
);
assert.throws(
() => parseRemoteWorkerSecretDeliveryResponse(
Buffer.alloc(MAX_REMOTE_SECRET_DELIVERY_RESPONSE_BYTES + 1),
{
runId: 'run-1', attemptId: 'attempt-1', offerId: 'offer-1',
executionDigest: DIGEST, secretRefs: [SECRET_REF],
},
),
() =>
parseRemoteWorkerSecretDeliveryResponse(
Buffer.alloc(MAX_REMOTE_SECRET_DELIVERY_RESPONSE_BYTES + 1),
{
runId: 'run-1',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
secretRefs: [SECRET_REF],
environmentBundleRefs: [],
},
),
/byte size/,
);
const refs = Array.from({ length: 5 }, (_, index) =>
createSecretRef({ projectId: 'project-1', name: `item-${index}` }));
createSecretRef({ projectId: 'project-1', name: `item-${index}` }),
);
assert.throws(
() => createRemoteWorkerSecretDeliveryResponseBody({
runId: 'run-1', attemptId: 'attempt-1', offerId: 'offer-1',
executionDigest: DIGEST,
values: refs.map((secretRef) => ({
secretRef,
value: 'x'.repeat(16 * 1024),
})),
}, refs),
() =>
createRemoteWorkerSecretDeliveryResponseBody(
{
runId: 'run-1',
attemptId: 'attempt-1',
offerId: 'offer-1',
executionDigest: DIGEST,
values: refs.map((secretRef) => ({
secretRef,
value: 'x'.repeat(16 * 1024),
})),
environmentBundles: [],
},
{ secretRefs: refs, environmentBundleRefs: [] },
),
/byte budget/,
);
});
test('keeps one environment bundle in a distinct bounded authority role', () => {
const normalized = normalizeRemoteWorkerSecretDeliveryCommand(
command({
secretRefs: [],
environmentBundleRefs: [BUNDLE_REF],
}),
);
assert.deepEqual(normalized.environmentBundleRefs, [BUNDLE_REF]);
assert.throws(
() =>
normalizeRemoteWorkerSecretDeliveryCommand(
command({
secretRefs: [BUNDLE_REF],
environmentBundleRefs: [BUNDLE_REF],
}),
),
/roles overlap/,
);
assert.throws(
() =>
normalizeRemoteWorkerSecretDeliveryCommand(
command({
secretRefs: [],
environmentBundleRefs: [],
}),
),
/set is empty/,
);
});