open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 19:02:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): persist cluster secret transition receipts

Browse Source
This commit is contained in:
whyour
2026-08-13 21:48:57 +08:00
parent c877147d0f
commit 5f93e0b5d2
26 changed files with 1127 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/src/schema/schemaContract.ts
+46 -4
View File
@@ -21,8 +21,8 @@ export interface PostgresSchemaContractTrigger {
export interface PostgresSchemaContract {
readonly schema: 'ql3';
readonly contractName: 'control-core';
readonly contractVersion: 61;
readonly migrationId: 'pg-0062-plugin-package-secret-binding-target-guard';
readonly contractVersion: 62;
readonly migrationId: 'pg-0063-plugin-package-secret-binding-transition-receipts';
readonly minimumServerMajor: 16;
readonly maximumServerMajor: 18;
readonly capabilities: Readonly<{
@@ -64,6 +64,7 @@ export interface PostgresSchemaContract {
plugin_package_secret_binding: 1;
plugin_package_secret_binding_approval_plan: 1;
plugin_package_secret_binding_transition: 1;
plugin_package_secret_binding_transition_receipt: 1;
plugin_package_secret_materialization: 1;
plugin_package_proposal: 1;
plugin_package_publisher_provenance: 1;
@@ -115,8 +116,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
Object.freeze({
schema: 'ql3',
contractName: 'control-core',
contractVersion: 61,
migrationId: 'pg-0062-plugin-package-secret-binding-target-guard',
contractVersion: 62,
migrationId: 'pg-0063-plugin-package-secret-binding-transition-receipts',
minimumServerMajor: 16,
maximumServerMajor: 18,
capabilities: Object.freeze({
@@ -151,6 +152,7 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
plugin_package_secret_binding: 1,
plugin_package_secret_binding_approval_plan: 1,
plugin_package_secret_binding_transition: 1,
plugin_package_secret_binding_transition_receipt: 1,
plugin_package_secret_materialization: 1,
plugin_package_proposal: 1,
plugin_package_publisher_provenance: 1,
@@ -288,6 +290,23 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
'expires_at_ms',
'plan_json',
]),
table('plugin_package_secret_binding_transition_receipts', [
'generation_digest',
'transition_digest',
'project_id',
'package_name',
'installation_id',
'lock_digest',
'generation',
'manifest_digest',
'previous_active_lock_digest',
'authority_kind',
'evidence_digest',
'binding_digest',
'committed_at_ms',
'receipt_digest',
'receipt_json',
]),
table('project_tool_definition_snapshots', [
'project_id',
'active_vector_digest',
@@ -1471,6 +1490,10 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
'ql3_plugin_package_secret_binding_approval_plan_digest_uidx',
'ql3_plugin_package_secret_binding_approval_plan_target_idx',
'ql3_plugin_package_secret_binding_approval_plan_expiry_idx',
'plugin_package_secret_binding_transition_receipts_pkey',
'ql3_package_secret_transition_receipt_transition_uidx',
'ql3_package_secret_transition_receipt_digest_uidx',
'ql3_package_secret_transition_receipt_install_idx',
'project_tool_definition_snapshots_pkey',
'ql3_project_tool_snapshot_withdrawal_key',
'ql3_project_tool_definition_snapshot_digest_uidx',
@@ -1769,6 +1792,9 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
'ql3_plugin_package_secret_binding_approval_plan_digest_check',
'ql3_plugin_package_secret_binding_approval_plan_time_check',
'ql3_plugin_package_secret_binding_approval_plan_json_check',
'ql3_package_secret_transition_receipt_identity_check',
'ql3_package_secret_transition_receipt_digest_check',
'ql3_package_secret_transition_receipt_json_check',
'ql3_plugin_package_quarantine_identity_check',
'ql3_plugin_package_quarantine_state_check',
'ql3_plugin_package_quarantine_subject_check',
@@ -2226,6 +2252,8 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
'ql3_plugin_package_secret_binding_install_fk',
'ql3_plugin_package_secret_binding_approval_plan_project_fk',
'ql3_plugin_package_secret_binding_approval_plan_install_fk',
'ql3_plugin_package_secret_binding_transition_receipt_project_fk',
'ql3_plugin_package_secret_binding_transition_receipt_install_fk',
'ql3_project_tool_definition_snapshot_project_fk',
'ql3_project_tool_definition_snapshot_source_snapshot_fk',
'ql3_project_tool_definition_snapshot_source_install_fk',
@@ -2401,6 +2429,14 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
volatility: 'volatile',
configuration: Object.freeze(['search_path=pg_catalog, ql3']),
}),
Object.freeze({
name: 'enforce_plugin_package_secret_binding_transition_receipt_target',
identityArguments: '',
owner: 'ql3_migration',
securityDefiner: false,
volatility: 'volatile',
configuration: Object.freeze(['search_path=pg_catalog, ql3']),
}),
Object.freeze({
name: 'enforce_plugin_package_secret_materialization',
identityArguments: '',
@@ -2539,6 +2575,12 @@ export const postgresqlControlSchemaContract: PostgresSchemaContract =
tableName: 'plugin_package_secret_bindings',
functionName: 'enforce_plugin_package_secret_binding_target',
}),
Object.freeze({
name: 'ql3_package_secret_transition_receipt_target_guard',
tableName: 'plugin_package_secret_binding_transition_receipts',
functionName:
'enforce_plugin_package_secret_binding_transition_receipt_target',
}),
Object.freeze({
name: 'ql3_plugin_package_secret_materialization_guard',
tableName: 'plugin_package_materialized_revisions',