open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 02:27:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): bind package secrets to generations

Browse Source
This commit is contained in:
whyour
2026-08-13 04:49:19 +08:00
parent 4c2a0b6adf
commit 55ef085a6e
39 changed files with 2182 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/test/postgresqlSchemaReadiness.test.cjs
+16 -11
View File
@@ -74,6 +74,7 @@ function validPrivileges() {
plugin_package_install_heads: [false, false, false, false],
plugin_package_install_mutations: [false, false, false, false],
plugin_package_materialized_revisions: [false, false, false, false],
plugin_package_secret_bindings: [false, false, false, false],
project_tool_definition_snapshots: [false, false, false, false],
project_tool_definition_snapshot_sources: [false, false, false, false],
plugin_package_quarantine_events: [false, false, false, false],
@@ -192,6 +193,7 @@ function validAdminPrivileges() {
plugin_package_install_heads: [false, false, false, false],
plugin_package_install_mutations: [false, false, false, false],
plugin_package_materialized_revisions: [false, false, false, false],
plugin_package_secret_bindings: [false, false, false, false],
project_tool_definition_snapshots: [false, false, false, false],
project_tool_definition_snapshot_sources: [false, false, false, false],
plugin_package_quarantine_events: [false, false, false, false],
@@ -302,6 +304,7 @@ function packagePrivileges(kind) {
'plugin_package_install_heads',
'plugin_package_install_mutations',
'plugin_package_materialized_revisions',
'plugin_package_secret_bindings',
'project_tool_definition_snapshots',
'project_tool_definition_snapshot_sources',
'plugin_package_admission_receipts',
@@ -344,6 +347,7 @@ function packagePrivileges(kind) {
'plugin_package_install_heads',
'plugin_package_install_mutations',
'plugin_package_materialized_revisions',
'plugin_package_secret_bindings',
'plugin_package_automation_publications',
'plugin_package_automation_publication_heads',
'project_tool_definition_snapshots',
@@ -750,7 +754,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
serverMajor: 16,
currentUser: 'ql3_runtime',
contractName: 'control-core',
contractVersion: 57,
contractVersion: 58,
migrationIds: [
'pg-0001-schema-capability',
'pg-0002-run-core',
@@ -810,6 +814,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
],
});
});
@@ -840,10 +845,10 @@ test('accepts the exact schema and isolated least-privilege admin role', async (
}),
);
assert.equal(report.currentUser, 'ql3_admin');
assert.equal(report.contractVersion, 57);
assert.equal(report.contractVersion, 58);
assert.equal(
report.migrationIds.at(-1),
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
);
});
@@ -856,10 +861,10 @@ test('accepts the isolated least-privilege automation manager role', async () =>
}),
);
assert.equal(report.currentUser, 'ql3_automation_manager');
assert.equal(report.contractVersion, 57);
assert.equal(report.contractVersion, 58);
assert.equal(
report.migrationIds.at(-1),
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
);
const widened = automationManagerPrivileges();
@@ -888,10 +893,10 @@ test('accepts the isolated least-privilege human Approval manager role', async (
}),
);
assert.equal(report.currentUser, 'ql3_approval_manager');
assert.equal(report.contractVersion, 57);
assert.equal(report.contractVersion, 58);
assert.equal(
report.migrationIds.at(-1),
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
);
const widened = approvalManagerPrivileges();
@@ -922,10 +927,10 @@ test('accepts the isolated least-privilege Run manager role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_run_manager');
assert.equal(report.contractVersion, 57);
assert.equal(report.contractVersion, 58);
assert.equal(
report.migrationIds.at(-1),
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
);
const widened = runManagerPrivileges();
@@ -1057,10 +1062,10 @@ test('accepts the exact schema and isolated Worker ingress role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_worker_ingress');
assert.equal(report.contractVersion, 57);
assert.equal(report.contractVersion, 58);
assert.equal(
report.migrationIds.at(-1),
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
);
});