feat(ql3): bind package secrets to generations

packages/ql3-cluster-postgres/src/schema/schema.ts

@@ -326,6 +326,66 @@ export const pluginPackageMaterializedRevisions = ql3Schema.table(
   ],
 );
 
+export const pluginPackageSecretBindings = ql3Schema.table(
+  'plugin_package_secret_bindings',
+  {
+    generationDigest: char('generation_digest', { length: 64 }).primaryKey(),
+    projectId: varchar('project_id', { length: 128 }).notNull(),
+    packageName: varchar('package_name', { length: 63 }).notNull(),
+    installationId: varchar('installation_id', { length: 128 }).notNull(),
+    lockDigest: char('lock_digest', { length: 64 }).notNull(),
+    generation: integer('generation').notNull(),
+    manifestDigest: char('manifest_digest', { length: 64 }).notNull(),
+    authorityKind: varchar('authority_kind', { length: 32 }).notNull(),
+    evidenceDigest: char('evidence_digest', { length: 64 }).notNull(),
+    boundAtMs: bigint('bound_at_ms', { mode: 'number' }).notNull(),
+    bindingDigest: char('binding_digest', { length: 64 }).notNull(),
+    bindingJson: jsonb('binding_json')
+      .$type<Record<string, unknown>>()
+      .notNull(),
+  },
+  (table) => [
+    foreignKey({
+      name: 'ql3_plugin_package_secret_binding_project_fk',
+      columns: [table.projectId],
+      foreignColumns: [projects.id],
+    })
+      .onDelete('restrict')
+      .onUpdate('restrict'),
+    foreignKey({
+      name: 'ql3_plugin_package_secret_binding_install_fk',
+      columns: [table.installationId],
+      foreignColumns: [pluginPackageInstalls.installationId],
+    })
+      .onDelete('restrict')
+      .onUpdate('restrict'),
+    check(
+      'ql3_plugin_package_secret_binding_identity_check',
+      sql`${table.projectId} ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' and ${table.packageName} ~ '^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$' and ${table.installationId} ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' and ${table.generation} between 1 and 2147483647 and ${table.authorityKind} in ('approved-action-execution','local-owner-confirmation') and ${table.boundAtMs} >= 0`,
+    ),
+    check(
+      'ql3_plugin_package_secret_binding_digest_check',
+      sql`${table.generationDigest} ~ '^[0-9a-f]{64}$' and ${table.lockDigest} ~ '^[0-9a-f]{64}$' and ${table.manifestDigest} ~ '^[0-9a-f]{64}$' and ${table.evidenceDigest} ~ '^[0-9a-f]{64}$' and ${table.bindingDigest} ~ '^[0-9a-f]{64}$'`,
+    ),
+    check(
+      'ql3_plugin_package_secret_binding_json_check',
+      sql`jsonb_typeof(${table.bindingJson}) = 'object' and octet_length(${table.bindingJson}::text) between 2 and 65536 and ${table.bindingJson} @> jsonb_build_object('schema', 'qinglong/plugin-package-secret-binding@v1', 'target', jsonb_build_object('generationDigest', ${table.generationDigest}, 'projectId', ${table.projectId}, 'packageName', ${table.packageName}, 'installationId', ${table.installationId}, 'lockDigest', ${table.lockDigest}, 'generation', ${table.generation}, 'manifestDigest', ${table.manifestDigest}), 'authority', jsonb_build_object('kind', ${table.authorityKind}, 'evidenceDigest', ${table.evidenceDigest}), 'boundAtMs', ${table.boundAtMs}, 'bindingDigest', ${table.bindingDigest}) and jsonb_typeof(${table.bindingJson} -> 'entries') = 'array' and jsonb_array_length(${table.bindingJson} -> 'entries') between 1 and 64`,
+    ),
+    uniqueIndex('ql3_plugin_package_secret_binding_generation_uidx').on(
+      table.projectId,
+      table.packageName,
+      table.generation,
+    ),
+    uniqueIndex('ql3_plugin_package_secret_binding_digest_uidx').on(
+      table.bindingDigest,
+    ),
+    index('ql3_plugin_package_secret_binding_install_idx').on(
+      table.installationId,
+      table.generationDigest,
+    ),
+  ],
+);
+
 export const projectToolDefinitionSnapshots = ql3Schema.table(
   'project_tool_definition_snapshots',
   {
@@ -5812,6 +5872,7 @@ export const ql3PostgresTables = [
   pluginPackageInstallHeads,
   pluginPackageInstallMutations,
   pluginPackageMaterializedRevisions,
+  pluginPackageSecretBindings,
   projectToolDefinitionSnapshots,
   projectToolDefinitionSnapshotSources,
   pluginPackageQuarantineEvents,

packages/ql3-cluster-postgres/src/schema/schemaContract.ts

@@ -15,8 +15,8 @@ export interface PostgresSchemaContractFunction {
 export interface PostgresSchemaContract {
   readonly schema: 'ql3';
   readonly contractName: 'control-core';
-  readonly contractVersion: 57;
-  readonly migrationId: 'pg-0058-plugin-package-automation-disposition-events';
+  readonly contractVersion: 58;
+  readonly migrationId: 'pg-0059-plugin-package-secret-bindings';
   readonly minimumServerMajor: 16;
   readonly maximumServerMajor: 18;
   readonly capabilities: Readonly<{
@@ -55,6 +55,7 @@ export interface PostgresSchemaContract {
     plugin_package_lifecycle_plan: 1;
     plugin_package_management_quota: 1;
     plugin_package_materialized_revision: 1;
+    plugin_package_secret_binding: 1;
     plugin_package_proposal: 1;
     plugin_package_publisher_provenance: 1;
     plugin_package_publisher_trust_authority: 1;
@@ -104,8 +105,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
   Object.freeze({
     schema: 'ql3',
     contractName: 'control-core',
-    contractVersion: 57,
-    migrationId: 'pg-0058-plugin-package-automation-disposition-events',
+    contractVersion: 58,
+    migrationId: 'pg-0059-plugin-package-secret-bindings',
     minimumServerMajor: 16,
     maximumServerMajor: 18,
     capabilities: Object.freeze({
@@ -137,6 +138,7 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       plugin_package_lifecycle_plan: 1,
       plugin_package_management_quota: 1,
       plugin_package_materialized_revision: 1,
+      plugin_package_secret_binding: 1,
       plugin_package_proposal: 1,
       plugin_package_publisher_provenance: 1,
       plugin_package_publisher_trust_authority: 1,
@@ -242,6 +244,20 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
         'revision_json',
         'created_at_ms',
       ]),
+      table('plugin_package_secret_bindings', [
+        'generation_digest',
+        'project_id',
+        'package_name',
+        'installation_id',
+        'lock_digest',
+        'generation',
+        'manifest_digest',
+        'authority_kind',
+        'evidence_digest',
+        'bound_at_ms',
+        'binding_digest',
+        'binding_json',
+      ]),
       table('project_tool_definition_snapshots', [
         'project_id',
         'active_vector_digest',
@@ -1417,6 +1433,10 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_materialized_revision_generation_uidx',
       'ql3_plugin_package_materialized_revision_lock_idx',
       'ql3_plugin_package_materialized_revision_snapshot_source_uidx',
+      'plugin_package_secret_bindings_pkey',
+      'ql3_plugin_package_secret_binding_generation_uidx',
+      'ql3_plugin_package_secret_binding_digest_uidx',
+      'ql3_plugin_package_secret_binding_install_idx',
       'project_tool_definition_snapshots_pkey',
       'ql3_project_tool_snapshot_withdrawal_key',
       'ql3_project_tool_definition_snapshot_digest_uidx',
@@ -1708,6 +1728,9 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_installs_version_check',
       'ql3_plugin_package_installs_digest_check',
       'ql3_plugin_package_installs_record_check',
+      'ql3_plugin_package_secret_binding_identity_check',
+      'ql3_plugin_package_secret_binding_digest_check',
+      'ql3_plugin_package_secret_binding_json_check',
       'ql3_plugin_package_quarantine_identity_check',
       'ql3_plugin_package_quarantine_state_check',
       'ql3_plugin_package_quarantine_subject_check',
@@ -2161,6 +2184,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
       'ql3_plugin_package_install_heads_install_fk',
       'ql3_plugin_package_install_mutations_install_fk',
       'ql3_plugin_package_materialized_revision_project_fk',
+      'ql3_plugin_package_secret_binding_project_fk',
+      'ql3_plugin_package_secret_binding_install_fk',
       'ql3_project_tool_definition_snapshot_project_fk',
       'ql3_project_tool_definition_snapshot_source_snapshot_fk',
       'ql3_project_tool_definition_snapshot_source_install_fk',

packages/ql3-cluster-postgres/src/schema/schemaReadiness.ts

@@ -167,6 +167,12 @@ const REQUIRED_RUNTIME_PRIVILEGES = Object.freeze({
     update: false,
     delete: false,
   }),
+  plugin_package_secret_bindings: Object.freeze({
+    select: false,
+    insert: false,
+    update: false,
+    delete: false,
+  }),
   project_tool_definition_snapshots: Object.freeze({
     select: false,
     insert: false,
@@ -680,6 +686,12 @@ const REQUIRED_ADMIN_PRIVILEGES = Object.freeze({
     update: false,
     delete: false,
   }),
+  plugin_package_secret_bindings: Object.freeze({
+    select: false,
+    insert: false,
+    update: false,
+    delete: false,
+  }),
   project_tool_definition_snapshots: Object.freeze({
     select: false,
     insert: false,
@@ -1230,6 +1242,7 @@ const REQUIRED_PACKAGE_EXECUTOR_PRIVILEGES: RequiredPrivileges = Object.freeze(
             name === 'approved_action_dispatches' ||
             name === 'plugin_package_install_mutations' ||
             name === 'plugin_package_materialized_revisions' ||
+            name === 'plugin_package_secret_bindings' ||
             name === 'project_tool_definition_snapshots' ||
             name === 'project_tool_definition_snapshot_sources' ||
             name === 'plugin_package_lifecycle_plans' ||